ext2fs.c File Reference


Detailed Description

General ext2/ext3 file system functions.

#include "fs_tools_i.h"
#include "ext2fs.h"

Data Structures

struct  EXT2FS_PRINT_ADDR

Defines

#define INODE_TABLE_SIZE(ext2fs)
#define EXT2FS_INDIR_SIZ   64

Functions

uint8_t ext2fs_inode_walk (TSK_FS_INFO *fs, INUM_T start_inum, INUM_T end_inum, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB action, void *ptr)
uint8_t ext2fs_block_walk (TSK_FS_INFO *fs, DADDR_T start_blk, DADDR_T end_blk, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB action, void *ptr)
uint8_t ext2fs_file_walk (TSK_FS_INFO *fs, TSK_FS_INODE *inode, uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB action, void *ptr)
 Calls a callback function with the contents of each block in a file.
TSK_FS_INFOext2fs_open (TSK_IMG_INFO *img_info, SSIZE_T offset, TSK_FS_INFO_TYPE_ENUM ftype, uint8_t test)
 Open part of a disk image as a Ext2/3 file system.


Define Documentation

#define INODE_TABLE_SIZE ( ext2fs   ) 

Value:

((tsk_getu32(fs->endian, ext2fs->fs->s_inodes_per_group) * ext2fs->inode_size - 1) \
           / fs->block_size + 1)


Function Documentation

uint8_t ext2fs_file_walk ( TSK_FS_INFO fs,
TSK_FS_INODE inode,
uint32_t  type,
uint16_t  id,
TSK_FS_FILE_FLAG_ENUM  flags,
TSK_FS_FILE_WALK_CB  action,
void *  ptr 
)

Calls a callback function with the contents of each block in a file.

flag values: TSK_FS_FILE_FLAG_NOSPARSE, TSK_FS_FILE_FLAG_AONLY, TSK_FS_FILE_FLAG_SLACK TSK_FS_FILE_FLAG_META

If TSK_FS_FILE_FLAG_RECOVER is set, then most error codes are set to _RECOVER. No special recovery logic exists in this code.

The action will use the flags: TSK_FS_BLOCK_FLAG_CONT, TSK_FS_BLOCK_FLAG_META -- @@ Currently do not do _ALLOC and _UNALLOC

Parameters:
fs File system file is located in
inode File to read and analyze
type Attribute type to read and analyze (does not apply to Ext2)
id Attribute id to read and analyze (does not apply to Ext2)
flags Flags to use while reading
action Callback function that is called for each block
ptr Pointer to data that is passed to the callback
Returns:
1 on error and 0 on success

TSK_FS_INFO* ext2fs_open ( TSK_IMG_INFO img_info,
SSIZE_T  offset,
TSK_FS_INFO_TYPE_ENUM  ftype,
uint8_t  test 
)

Open part of a disk image as a Ext2/3 file system.

Parameters:
img_info Disk image to analyze
offset Byte offset where file system starts
ftype Specific type of file system
test NOT USED
Returns:
NULL on error or if data is not an Ext2/3 file system


Generated on Wed Nov 28 16:11:15 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1