Currently used only for NTFS, but could be expanded to other file systems in the future.
#include "fs_tools_i.h"
#include "ntfs.h"
Functions | |
TSK_FS_DATA * | tsk_fs_data_alloc (TSK_FS_DATA_FLAG_ENUM type) |
Allocates and initializes a new structure. | |
TSK_FS_DATA_RUN * | tsk_fs_data_run_alloc () |
Allocate a run list entry. | |
void | tsk_fs_data_run_free (TSK_FS_DATA_RUN *fs_data_run) |
Free a list of data_runs. | |
void | tsk_fs_data_free (TSK_FS_DATA *fs_data_head) |
Free the list of TSK_FS_DATA structures and the runs that they allocated. | |
void | tsk_fs_data_clear_list (TSK_FS_DATA *fs_data_head) |
Clear the fields and run_lists in the FS_DATA list. | |
TSK_FS_DATA * | tsk_fs_data_getnew_attr (TSK_FS_DATA *fs_data_head, TSK_FS_DATA_FLAG_ENUM type) |
Given the begining of the list, return either an empty element in the list or a new one at the end. | |
TSK_FS_DATA * | tsk_fs_data_lookup (TSK_FS_DATA *fs_data_head, uint32_t type, uint16_t id) |
Search the list of TSK_FS_DATA structures for an entry with a given type and id. | |
TSK_FS_DATA * | tsk_fs_data_lookup_noid (TSK_FS_DATA *fs_data_head, uint32_t type) |
Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id). | |
TSK_FS_DATA * | tsk_fs_data_put_str (TSK_FS_DATA *fs_data_head, char *name, uint32_t type, uint16_t id, void *res_data, unsigned int len) |
Copy resident data to an attribute in the list. | |
TSK_FS_DATA * | tsk_fs_data_put_run (TSK_FS_DATA *fs_data_head, DADDR_T start_vcn, OFF_T runlen, TSK_FS_DATA_RUN *run, char *name, uint32_t type, uint16_t id, OFF_T size, TSK_FS_DATA_FLAG_ENUM flags, uint32_t compsize) |
Add a set of consecutive runs of an attribute of a specified type and id. |
|
Allocates and initializes a new structure.
|
|
Clear the fields and run_lists in the FS_DATA list.
|
|
Free the list of TSK_FS_DATA structures and the runs that they allocated.
|
|
Given the begining of the list, return either an empty element in the list or a new one at the end. Preference is given to finding one of the same type to prevent excessive malloc's, but if one is not found then a different type is used: type = [TSK_FS_DATA_NONRES | TSK_FS_DATA_RES]
|
|
Search the list of TSK_FS_DATA structures for an entry with a given type and id.
|
|
Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id). The attribute with the lowest id (or the named $Data attribute if that type is specified) is returned.
|
|
Add a set of consecutive runs of an attribute of a specified type and id. This function first determines if the attribute exists and then either creates the attribute or adds to it. This is complicated because we could get the runs out of order so we use "filler" TSK_FS_DATA_RUN structures during the process
|
|
Copy resident data to an attribute in the list. If no attributes exist yet, one will be created and the head of the resulting list will be returned.
|
|
Allocate a run list entry.
|
|
Free a list of data_runs.
|