00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00027 #ifndef _TSK_FS_TOOLS_H
00028 #define _TSK_FS_TOOLS_H
00029
00030 #include "img_tools.h"
00031 #include <sys/types.h>
00032
00033
00034
00035 #ifdef __cplusplus
00036 extern "C" {
00037 #endif
00038
00039
00040
00046 enum TSK_FS_INFO_TYPE_ENUM {
00047 TSK_FS_INFO_TYPE_FS_MASK = 0xf0,
00048 TSK_FS_INFO_TYPE_SUB_MASK = 0x0f,
00049
00050 TSK_FS_INFO_TYPE_UNSUPP = 0x00,
00051
00052 TSK_FS_INFO_TYPE_FFS_TYPE = 0x10,
00053 TSK_FS_INFO_TYPE_FFS_1 = 0x11,
00054 TSK_FS_INFO_TYPE_FFS_1B = 0x12,
00055 TSK_FS_INFO_TYPE_FFS_2 = 0x13,
00056 TSK_FS_INFO_TYPE_FFS_AUTO = 0x14,
00057
00058 TSK_FS_INFO_TYPE_EXT_TYPE = 0x20,
00059 TSK_FS_INFO_TYPE_EXT_2 = 0x21,
00060 TSK_FS_INFO_TYPE_EXT_3 = 0x22,
00061 TSK_FS_INFO_TYPE_EXT_AUTO = 0x23,
00062
00063 TSK_FS_INFO_TYPE_FAT_TYPE = 0x30,
00064 TSK_FS_INFO_TYPE_FAT_12 = 0x31,
00065 TSK_FS_INFO_TYPE_FAT_16 = 0x32,
00066 TSK_FS_INFO_TYPE_FAT_32 = 0x33,
00067 TSK_FS_INFO_TYPE_FAT_AUTO = 0x34,
00068
00069 TSK_FS_INFO_TYPE_NTFS_TYPE = 0x40,
00070 TSK_FS_INFO_TYPE_NTFS = 0x40,
00071 TSK_FS_INFO_TYPE_NTFS_AUTO = 0x40,
00072
00073 TSK_FS_INFO_TYPE_SWAP_TYPE = 0x50,
00074 TSK_FS_INFO_TYPE_SWAP = 0x50,
00075
00076 TSK_FS_INFO_TYPE_RAW_TYPE = 0x60,
00077 TSK_FS_INFO_TYPE_RAW = 0x60,
00078
00079 TSK_FS_INFO_TYPE_ISO9660_TYPE = 0x70,
00080 TSK_FS_INFO_TYPE_ISO9660 = 0x70,
00081
00082 TSK_FS_INFO_TYPE_HFS_TYPE = 0x80,
00083 TSK_FS_INFO_TYPE_HFS = 0x80,
00084 };
00085 typedef enum TSK_FS_INFO_TYPE_ENUM TSK_FS_INFO_TYPE_ENUM;
00086
00087 extern TSK_FS_INFO_TYPE_ENUM tsk_fs_parse_type(const TSK_TCHAR *);
00088 extern void tsk_fs_print_types(FILE *);
00089 extern char *tsk_fs_get_type(TSK_FS_INFO_TYPE_ENUM);
00090
00091 typedef struct TSK_FS_INFO TSK_FS_INFO;
00092 typedef struct TSK_FS_DATA TSK_FS_DATA;
00093 typedef struct TSK_FS_DATA_RUN TSK_FS_DATA_RUN;
00094 typedef struct TSK_FS_INODE_NAME_LIST TSK_FS_INODE_NAME_LIST;
00095 typedef struct TSK_FS_JENTRY TSK_FS_JENTRY;
00096
00097
00098
00099
00100
00101
00102
00103
00108 enum TSK_FS_DENT_FLAG_ENUM {
00109 TSK_FS_DENT_FLAG_ALLOC = (1 << 0),
00110 TSK_FS_DENT_FLAG_UNALLOC = (1 << 1),
00111 TSK_FS_DENT_FLAG_RECURSE = (1 << 2),
00112 };
00113 typedef enum TSK_FS_DENT_FLAG_ENUM TSK_FS_DENT_FLAG_ENUM;
00114
00115
00119 enum TSK_FS_DENT_TYPE_ENUM {
00120 TSK_FS_DENT_TYPE_UNDEF = 0,
00121 TSK_FS_DENT_TYPE_FIFO = 1,
00122 TSK_FS_DENT_TYPE_CHR = 2,
00123 TSK_FS_DENT_TYPE_DIR = 4,
00124 TSK_FS_DENT_TYPE_BLK = 6,
00125 TSK_FS_DENT_TYPE_REG = 8,
00126 TSK_FS_DENT_TYPE_LNK = 10,
00127 TSK_FS_DENT_TYPE_SOCK = 12,
00128 TSK_FS_DENT_TYPE_SHAD = 13,
00129 TSK_FS_DENT_TYPE_WHT = 14,
00130 };
00131 typedef enum TSK_FS_DENT_TYPE_ENUM TSK_FS_DENT_TYPE_ENUM;
00132
00133 #define TSK_FS_DENT_TYPE_MAX_STR 15
00134
00135
00136 extern char tsk_fs_dent_str[TSK_FS_DENT_TYPE_MAX_STR][2];
00137
00144 struct TSK_FS_DENT {
00145 char *name;
00146 ULONG name_max;
00147
00148 char *shrt_name;
00149 ULONG shrt_name_max;
00150
00151 char *path;
00152 unsigned int pathdepth;
00153
00154 INUM_T inode;
00155 struct TSK_FS_INODE *fsi;
00156
00157 TSK_FS_DENT_TYPE_ENUM ent_type;
00158 TSK_FS_DENT_FLAG_ENUM flags;
00159 };
00160
00161 typedef struct TSK_FS_DENT TSK_FS_DENT;
00162
00163
00164
00165
00166
00170 enum TSK_FS_INODE_FLAG_ENUM {
00171 TSK_FS_INODE_FLAG_ALLOC = (1 << 0),
00172 TSK_FS_INODE_FLAG_UNALLOC = (1 << 1),
00173 TSK_FS_INODE_FLAG_USED = (1 << 2),
00174 TSK_FS_INODE_FLAG_UNUSED = (1 << 3),
00175 TSK_FS_INODE_FLAG_ORPHAN = (1 << 4),
00176 TSK_FS_INODE_FLAG_COMP = (1 << 5)
00177 };
00178 typedef enum TSK_FS_INODE_FLAG_ENUM TSK_FS_INODE_FLAG_ENUM;
00179
00180 enum TSK_FS_INODE_ATTR_FLAG_ENUM {
00181 TSK_FS_INODE_ATTR_EMPTY,
00182 TSK_FS_INODE_ATTR_STUDIED,
00183 TSK_FS_INODE_ATTR_ERROR
00184 };
00185 typedef enum TSK_FS_INODE_ATTR_FLAG_ENUM TSK_FS_INODE_ATTR_FLAG_ENUM;
00186
00187
00191 #define TSK_FS_INODE_NAME_LIST_NSIZE 512
00192
00200 struct TSK_FS_INODE_NAME_LIST {
00201 TSK_FS_INODE_NAME_LIST *next;
00202 char name[TSK_FS_INODE_NAME_LIST_NSIZE];
00203 INUM_T par_inode;
00204 uint32_t par_seq;
00205 };
00206
00210 struct TSK_FS_INODE {
00211 INUM_T addr;
00212 mode_t mode;
00213 int nlink;
00214 OFF_T size;
00215 uid_t uid;
00216 gid_t gid;
00217
00218
00219 time_t mtime;
00220 time_t atime;
00221 time_t ctime;
00222
00223
00224 union {
00225 struct {
00226 time_t crtime;
00227 };
00228 struct {
00229 time_t dtime;
00230 };
00231 struct {
00232 time_t bkup_time;
00233 time_t attr_mtime;
00234 };
00235 };
00236
00237 DADDR_T *direct_addr;
00238 int direct_count;
00239 DADDR_T *indir_addr;
00240 int indir_count;
00241
00242 uint32_t seq;
00243
00244 TSK_FS_DATA *attr;
00245 TSK_FS_INODE_ATTR_FLAG_ENUM attr_state;
00246 uint8_t attr_flags;
00247
00248 TSK_FS_INODE_NAME_LIST *name;
00249 char *link;
00250
00251 TSK_FS_INODE_FLAG_ENUM flags;
00252 };
00253
00254 typedef struct TSK_FS_INODE TSK_FS_INODE;
00255
00256 extern TSK_FS_INODE *tsk_fs_inode_alloc(int, int);
00257 extern TSK_FS_INODE *tsk_fs_inode_realloc(TSK_FS_INODE *, int, int);
00258 extern void tsk_fs_inode_free(TSK_FS_INODE *);
00259
00260
00263 #define TSK_FS_ORPHAN_STR "-ORPHAN_FILE-"
00264
00265
00266
00267
00272 enum TSK_FS_INODE_MODE_ENUM {
00273
00274
00275 TSK_FS_INODE_MODE_FMT = 0170000,
00276 TSK_FS_INODE_MODE_FIFO = 0010000,
00277 TSK_FS_INODE_MODE_CHR = 0020000,
00278 TSK_FS_INODE_MODE_DIR = 0040000,
00279 TSK_FS_INODE_MODE_BLK = 0060000,
00280 TSK_FS_INODE_MODE_REG = 0100000,
00281 TSK_FS_INODE_MODE_LNK = 0120000,
00282 TSK_FS_INODE_MODE_SHAD = 0130000,
00283 TSK_FS_INODE_MODE_SOCK = 0140000,
00284 TSK_FS_INODE_MODE_WHT = 0160000,
00285
00286
00287 TSK_FS_INODE_MODE_ISUID = 0004000,
00288 TSK_FS_INODE_MODE_ISGID = 0002000,
00289 TSK_FS_INODE_MODE_ISVTX = 0001000,
00290
00291 TSK_FS_INODE_MODE_IRUSR = 0000400,
00292 TSK_FS_INODE_MODE_IWUSR = 0000200,
00293 TSK_FS_INODE_MODE_IXUSR = 0000100,
00294
00295 TSK_FS_INODE_MODE_IRGRP = 0000040,
00296 TSK_FS_INODE_MODE_IWGRP = 0000020,
00297 TSK_FS_INODE_MODE_IXGRP = 0000010,
00298
00299 TSK_FS_INODE_MODE_IROTH = 0000004,
00300 TSK_FS_INODE_MODE_IWOTH = 0000002,
00301 TSK_FS_INODE_MODE_IXOTH = 0000001
00302 };
00303 typedef enum TSK_FS_INODE_MODE_ENUM TSK_FS_INODE_MODE_ENUM;
00304
00305
00306 #define TSK_FS_INODE_MODE_TYPE_SHIFT 12
00307 #define TSK_FS_INODE_MODE_TYPE_STR_MAX 15
00308
00309 extern char tsk_fs_inode_mode_str[TSK_FS_INODE_MODE_TYPE_STR_MAX][2];
00310
00311
00314 enum TSK_FS_BLOCK_FLAG_ENUM {
00315 TSK_FS_BLOCK_FLAG_ALLOC = (1 << 0),
00316 TSK_FS_BLOCK_FLAG_UNALLOC = (1 << 1),
00317 TSK_FS_BLOCK_FLAG_CONT = (1 << 2),
00318 TSK_FS_BLOCK_FLAG_META = (1 << 3),
00319 TSK_FS_BLOCK_FLAG_BAD = (1 << 4),
00320 TSK_FS_BLOCK_FLAG_ALIGN = (1 << 5),
00321 TSK_FS_BLOCK_FLAG_RES = (1 << 6),
00322 TSK_FS_BLOCK_FLAG_SPARSE = (1 << 7),
00323 TSK_FS_BLOCK_FLAG_COMP = (1 << 8)
00324 };
00325 typedef enum TSK_FS_BLOCK_FLAG_ENUM TSK_FS_BLOCK_FLAG_ENUM;
00326
00327
00328
00332 enum TSK_FS_FILE_FLAG_ENUM {
00333 TSK_FS_FILE_FLAG_AONLY = (1 << 0),
00334 TSK_FS_FILE_FLAG_SLACK = (1 << 1),
00335 TSK_FS_FILE_FLAG_RECOVER = (1 << 2),
00336 TSK_FS_FILE_FLAG_META = (1 << 3),
00337 TSK_FS_FILE_FLAG_NOSPARSE = (1 << 4),
00338 TSK_FS_FILE_FLAG_NOID = (1 << 5)
00339 };
00340 typedef enum TSK_FS_FILE_FLAG_ENUM TSK_FS_FILE_FLAG_ENUM;
00341
00342
00343 typedef uint8_t(*TSK_FS_INODE_WALK_CB) (TSK_FS_INFO *, TSK_FS_INODE *,
00344 void *);
00345 typedef uint8_t(*TSK_FS_BLOCK_WALK_CB) (TSK_FS_INFO *, DADDR_T, char *,
00346 TSK_FS_BLOCK_FLAG_ENUM, void *);
00347 typedef uint8_t(*TSK_FS_DENT_TYPE_WALK_CB) (TSK_FS_INFO *,
00348 TSK_FS_DENT *, void *);
00349 typedef uint8_t(*TSK_FS_FILE_WALK_CB) (TSK_FS_INFO *, DADDR_T, char *,
00350 size_t, TSK_FS_BLOCK_FLAG_ENUM, void *);
00351 typedef uint8_t(*TSK_FS_JBLK_WALK_CB) (TSK_FS_INFO *, char *, int,
00352 void *);
00353 typedef uint8_t(*TSK_FS_JENTRY_WALK_CB) (TSK_FS_INFO *,
00354 TSK_FS_JENTRY *, int, void *);
00355
00356
00357
00358
00362 enum TSK_FS_INFO_FLAG_ENUM {
00363 TSK_FS_INFO_FLAG_HAVE_SEQ = (1 << 0)
00364 };
00365 typedef enum TSK_FS_INFO_FLAG_ENUM TSK_FS_INFO_FLAG_ENUM;
00366
00367
00374 struct TSK_FS_INFO {
00375 TSK_IMG_INFO *img_info;
00376 SSIZE_T offset;
00377
00378
00379 INUM_T inum_count;
00380 INUM_T root_inum;
00381 INUM_T first_inum;
00382 INUM_T last_inum;
00383
00384
00385 DADDR_T block_count;
00386 DADDR_T first_block;
00387 DADDR_T last_block;
00388 DADDR_T last_block_act;
00389 unsigned int block_size;
00390 unsigned int dev_bsize;
00391
00392
00393 INUM_T journ_inum;
00394
00395 TSK_FS_INFO_TYPE_ENUM ftype;
00396 char *duname;
00397 TSK_FS_INFO_FLAG_ENUM flags;
00398
00399 uint8_t endian;
00400
00401 TSK_LIST *list_inum_named;
00415 uint8_t(*block_walk) (TSK_FS_INFO * fs, DADDR_T start,
00416 DADDR_T end, TSK_FS_BLOCK_FLAG_ENUM flags,
00417 TSK_FS_BLOCK_WALK_CB cb, void *ptr);
00418
00428 uint8_t(*inode_walk) (TSK_FS_INFO * fs, INUM_T start, INUM_T end,
00429 TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB cb,
00430 void *ptr);
00431
00437 TSK_FS_INODE *(*inode_lookup) (TSK_FS_INFO * fs, INUM_T addr);
00438
00450 uint8_t(*istat) (TSK_FS_INFO * fs, FILE * hFile, INUM_T inum,
00451 DADDR_T numblock, int32_t sec_skew);
00452
00465 uint8_t(*file_walk) (TSK_FS_INFO * fs, TSK_FS_INODE * fs_inode,
00466 uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags,
00467 TSK_FS_FILE_WALK_CB cb, void *ptr);
00468
00469
00480 uint8_t(*dent_walk) (TSK_FS_INFO * fs, INUM_T inode,
00481 TSK_FS_DENT_FLAG_ENUM flags, TSK_FS_DENT_TYPE_WALK_CB action,
00482 void *ptr);
00483
00485 uint8_t(*jopen) (TSK_FS_INFO *, INUM_T);
00486
00488 uint8_t(*jblk_walk) (TSK_FS_INFO *, DADDR_T, DADDR_T, int,
00489 TSK_FS_JBLK_WALK_CB, void *);
00490
00492 uint8_t(*jentry_walk) (TSK_FS_INFO *, int, TSK_FS_JENTRY_WALK_CB,
00493 void *);
00494
00503 uint8_t(*fsstat) (TSK_FS_INFO * fs, FILE * hFile);
00504
00506 uint8_t(*fscheck) (TSK_FS_INFO *, FILE *);
00507
00512 void (*close) (TSK_FS_INFO * fs);
00513 };
00514
00515
00516
00517
00518
00519
00520
00521
00522
00523
00524
00525
00526
00527
00528
00529
00530
00531
00532
00536 enum TSK_FS_DATA_RUN_FLAG_ENUM {
00537 TSK_FS_DATA_RUN_FLAG_FILLER = 0x1,
00538 TSK_FS_DATA_RUN_FLAG_SPARSE = 0x2
00539 };
00540 typedef enum TSK_FS_DATA_RUN_FLAG_ENUM TSK_FS_DATA_RUN_FLAG_ENUM;
00541
00542
00547 struct TSK_FS_DATA_RUN {
00548 TSK_FS_DATA_RUN *next;
00549 DADDR_T offset;
00550 DADDR_T addr;
00551 DADDR_T len;
00552 TSK_FS_DATA_RUN_FLAG_ENUM flags;
00553 };
00554
00555
00559 enum TSK_FS_DATA_FLAG_ENUM {
00560 TSK_FS_DATA_INUSE = 0x1,
00561 TSK_FS_DATA_NONRES = 0x2,
00562 TSK_FS_DATA_RES = 0x4,
00563 TSK_FS_DATA_ENC = 0x10,
00564 TSK_FS_DATA_COMP = 0x20,
00565 TSK_FS_DATA_SPARSE = 0x40,
00566 TSK_FS_DATA_RECOVERY = 0x80,
00567 };
00568 typedef enum TSK_FS_DATA_FLAG_ENUM TSK_FS_DATA_FLAG_ENUM;
00569
00578 struct TSK_FS_DATA {
00579 TSK_FS_DATA *next;
00580 TSK_FS_DATA_FLAG_ENUM flags;
00581 char *name;
00582 size_t nsize;
00583 uint32_t type;
00584 uint16_t id;
00585
00586 OFF_T size;
00587
00588
00589 TSK_FS_DATA_RUN *run;
00590 TSK_FS_DATA_RUN *run_end;
00591 OFF_T allocsize;
00592 uint32_t compsize;
00593
00594
00595 size_t buflen;
00596 uint8_t *buf;
00597 };
00598
00599
00600
00601 extern TSK_FS_DATA *tsk_fs_data_alloc(TSK_FS_DATA_FLAG_ENUM);
00602 extern TSK_FS_DATA_RUN *tsk_fs_data_run_alloc();
00603 extern TSK_FS_DATA *tsk_fs_data_getnew_attr(TSK_FS_DATA *,
00604 TSK_FS_DATA_FLAG_ENUM);
00605 extern void tsk_fs_data_clear_list(TSK_FS_DATA *);
00606
00607 extern TSK_FS_DATA *tsk_fs_data_put_str(TSK_FS_DATA *, char *,
00608 uint32_t, uint16_t, void *, unsigned int);
00609
00610 extern TSK_FS_DATA *tsk_fs_data_put_run(TSK_FS_DATA *, OFF_T,
00611 TSK_FS_DATA_RUN *, char *, uint32_t, uint16_t, OFF_T,
00612 TSK_FS_DATA_FLAG_ENUM, uint32_t);
00613
00614 extern TSK_FS_DATA *tsk_fs_data_lookup(TSK_FS_DATA *, uint32_t,
00615 uint16_t);
00616 extern TSK_FS_DATA *tsk_fs_data_lookup_noid(TSK_FS_DATA *, uint32_t);
00617
00618 extern void tsk_fs_data_run_free(TSK_FS_DATA_RUN *);
00619 extern void tsk_fs_data_free(TSK_FS_DATA *);
00620
00621
00622
00623
00624 struct TSK_FS_JENTRY {
00625 DADDR_T jblk;
00626 DADDR_T fsblk;
00627 };
00628
00629
00630
00631
00632 extern TSK_FS_DENT *tsk_fs_dent_alloc(ULONG, ULONG);
00633 extern TSK_FS_DENT *tsk_fs_dent_realloc(TSK_FS_DENT *, ULONG);
00634 extern void tsk_fs_dent_free(TSK_FS_DENT *);
00635 extern void tsk_fs_dent_print(FILE *, TSK_FS_DENT *,
00636 TSK_FS_INFO *, TSK_FS_DATA *);
00637 extern void tsk_fs_dent_print_long(FILE *, TSK_FS_DENT *,
00638 TSK_FS_INFO *, TSK_FS_DATA *);
00639 extern void tsk_fs_dent_print_mac(FILE *, TSK_FS_DENT *,
00640 TSK_FS_INFO *, TSK_FS_DATA * fs_data, char *);
00641
00642 extern void tsk_fs_make_ls(mode_t, char *);
00643 extern void tsk_fs_print_day(FILE *, time_t);
00644 extern void tsk_fs_print_time(FILE *, time_t);
00645
00646
00647
00648
00649 #define TSK_FS_ISDOT(str) ( ((str[0] == '.') && \
00650 ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 )
00651
00652
00653
00654
00655
00656
00657 extern TSK_FS_INFO *tsk_fs_open(TSK_IMG_INFO *, SSIZE_T,
00658 const TSK_TCHAR *);
00659
00660
00661 extern SSIZE_T tsk_fs_read_block(TSK_FS_INFO *, TSK_DATA_BUF *, OFF_T,
00662 DADDR_T);
00663 extern SSIZE_T tsk_fs_read_block_nobuf(TSK_FS_INFO *, char *, OFF_T,
00664 DADDR_T);
00665 #define tsk_fs_read_random(fsi, buf, len, offs) \
00666 (fsi)->img_info->read_random((fsi)->img_info, (fsi)->offset, (buf), (len), (offs))
00667
00668 extern char *tsk_fs_load_file(TSK_FS_INFO *, TSK_FS_INODE *, uint32_t,
00669 uint16_t, int);
00670
00671 extern SSIZE_T
00672 tsk_fs_read_file(TSK_FS_INFO *, TSK_FS_INODE *, uint32_t, uint16_t,
00673 SSIZE_T, SSIZE_T, char *);
00674
00675 extern SSIZE_T
00676 tsk_fs_read_file_noid(TSK_FS_INFO *, TSK_FS_INODE *, SSIZE_T,
00677 SSIZE_T, char *);
00678
00679
00680
00681
00682 #define TSK_FS_DCALC_DD 0x1
00683 #define TSK_FS_DCALC_DLS 0x2
00684 #define TSK_FS_DCALC_SLACK 0x4
00685 extern int8_t tsk_fs_dcalc(TSK_FS_INFO * fs, uint8_t lclflags,
00686 DADDR_T cnt);
00687
00688
00689 #define TSK_FS_DCAT_HEX 0x1
00690 #define TSK_FS_DCAT_ASCII 0x2
00691 #define TSK_FS_DCAT_HTML 0x4
00692 #define TSK_FS_DCAT_STAT 0x8
00693 extern uint8_t tsk_fs_dcat(TSK_FS_INFO * fs, uint8_t lclflags,
00694 DADDR_T addr, DADDR_T read_num_units);
00695
00696
00697 #define TSK_FS_DLS_CAT 0x01
00698 #define TSK_FS_DLS_LIST 0x02
00699 #define TSK_FS_DLS_SLACK 0x04
00700 extern uint8_t tsk_fs_dls(TSK_FS_INFO * fs, uint8_t lclflags,
00701 DADDR_T bstart, DADDR_T bend, TSK_FS_BLOCK_FLAG_ENUM flags);
00702
00703 extern uint8_t tsk_fs_dstat(TSK_FS_INFO * fs, uint8_t lclflags,
00704 DADDR_T addr, TSK_FS_BLOCK_FLAG_ENUM flags);
00705
00706 #define TSK_FS_FFIND_ALL 0x1
00707 extern uint8_t tsk_fs_ffind(TSK_FS_INFO * fs, uint8_t lclflags,
00708 INUM_T inode, uint32_t type, uint16_t id, int flags);
00709
00710
00711
00712 #define TSK_FS_FLS_DOT 0x001
00713 #define TSK_FS_FLS_LONG 0x002
00714 #define TSK_FS_FLS_FILE 0x004
00715 #define TSK_FS_FLS_DIR 0x008
00716 #define TSK_FS_FLS_FULL 0x010
00717 #define TSK_FS_FLS_MAC 0x020
00718 extern uint8_t tsk_fs_fls(TSK_FS_INFO * fs, uint8_t lclflags,
00719 INUM_T inode, int flags, TSK_TCHAR * pre, int32_t skew);
00720
00721
00722 extern uint8_t tsk_fs_icat(TSK_FS_INFO * fs, uint8_t lclflags,
00723 INUM_T inum, uint32_t type, uint16_t id, int flags);
00724
00725
00726 #define TSK_FS_IFIND_ALL 0x01
00727 #define TSK_FS_IFIND_PATH 0x04
00728 #define TSK_FS_IFIND_DATA 0x08
00729 #define TSK_FS_IFIND_PAR 0x10
00730 #define TSK_FS_IFIND_PAR_LONG 0x20
00731 extern int8_t tsk_fs_ifind_path(TSK_FS_INFO * fs, uint8_t lclflags,
00732 TSK_TCHAR * path, INUM_T * result);
00733 extern uint8_t tsk_fs_ifind_data(TSK_FS_INFO * fs, uint8_t lclflags,
00734 DADDR_T blk);
00735 extern uint8_t tsk_fs_ifind_par(TSK_FS_INFO * fs, uint8_t lclflags,
00736 INUM_T par);
00737
00738
00739 #define TSK_FS_ILS_OPEN (1<<0)
00740 #define TSK_FS_ILS_MAC (1<<1)
00741 #define TSK_FS_ILS_LINK (1<<2)
00742 #define TSK_FS_ILS_UNLINK (1<<3)
00743
00744 extern uint8_t tsk_fs_ils(TSK_FS_INFO * fs, uint8_t lclflags,
00745 INUM_T istart, INUM_T ilast, int flags, int32_t skew,
00746 TSK_TCHAR * img);
00747
00748
00749
00750 extern uint8_t
00751 fatfs_file_walk_off(TSK_FS_INFO * fs, TSK_FS_INODE * fs_inode,
00752 uint32_t type, uint16_t id, OFF_T a_st_off,
00753 TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB action,
00754 void *ptr);
00755
00756
00757 #ifdef __cplusplus
00758 }
00759 #endif
00760 #endif
00761
00762
00763
00764
00765
00766
00767
00768
00769
00770