Main Page | Data Structures | Directories | File List | Data Fields | Globals

TSK_FS_INFO Struct Reference

#include <fs_tools.h>


Detailed Description

Stores state information for an open file system.

One of these are generated for each open files system and it contains file system-type specific data. These values are all filled in by the file system code and not the caller functions.


Data Fields

TSK_IMG_INFOimg_info
 Pointer to the image layer state.
SSIZE_T offset
 Byte offset into img_info that fs starts.
INUM_T inum_count
 Number of inodes.
INUM_T root_inum
 Address of root inode.
INUM_T first_inum
 Address of first valid inode.
INUM_T last_inum
 Address of last valid inode.
DADDR_T block_count
 Number of blocks in fs.
DADDR_T first_block
 Address of first block.
DADDR_T last_block
 Address of last block.
unsigned int block_size
 Size of each block (in bytes).
unsigned int dev_bsize
 Size of device block (typically always 512).
INUM_T journ_inum
 Address of journal inode.
TSK_FS_INFO_TYPE_ENUM ftype
 type of file system
char * duname
 string "name" of data unit type
TSK_FS_INFO_FLAG_ENUM flags
 flags for image
uint8_t endian
 Endian order (see auxtools/tsk_endian.h).
TSK_LIST * list_inum_named
 List of unallocated inodes that are pointed to by a file name -- Used to find orphans.
uint8_t(* block_walk )(TSK_FS_INFO *, DADDR_T, DADDR_T, TSK_FS_BLOCK_FLAG_ENUM, TSK_FS_BLOCK_WALK_CB, void *)
 Walk a set of blocks and pass each to the callback.
uint8_t(* inode_walk )(TSK_FS_INFO *, INUM_T, INUM_T, TSK_FS_INODE_FLAG_ENUM, TSK_FS_INODE_WALK_CB, void *)
 Walk a set of inodes and pass each to the callback.
TSK_FS_INODE *(* inode_lookup )(TSK_FS_INFO *, INUM_T)
 Lookup an inode and return it.
uint8_t(* istat )(TSK_FS_INFO *, FILE *, INUM_T, DADDR_T, int32_t)
 Print file details to a handle.
uint8_t(* file_walk )(TSK_FS_INFO *, TSK_FS_INODE *, uint32_t, uint16_t, TSK_FS_FILE_FLAG_ENUM, TSK_FS_FILE_WALK_CB, void *)
 Walk the contents of a file and pass each block to the callback.
uint8_t(* dent_walk )(TSK_FS_INFO *, INUM_T, TSK_FS_DENT_FLAG_ENUM, TSK_FS_DENT_TYPE_WALK_CB, void *)
 Walk the files in a directory and pass each file name to the callback.
uint8_t(* jopen )(TSK_FS_INFO *, INUM_T)
 Open the journal.
uint8_t(* jblk_walk )(TSK_FS_INFO *, DADDR_T, DADDR_T, int, TSK_FS_JBLK_WALK_CB, void *)
 Walk the blocks in a journal.
uint8_t(* jentry_walk )(TSK_FS_INFO *, int, TSK_FS_JENTRY_WALK_CB, void *)
 Walk the entries in a journal.
uint8_t(* fsstat )(TSK_FS_INFO *, FILE *)
 Print the file system details to FILE handle.
uint8_t(* fscheck )(TSK_FS_INFO *, FILE *)
 Check the integrity / sanity of the file system (not implemented).
void(* close )(TSK_FS_INFO *)
 Close the file system and free the allocated memory.


The documentation for this struct was generated from the following file:
Generated on Thu Apr 19 14:58:53 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.4.2