Main Page | Data Structures | Directories | File List | Data Fields | Globals

fs_tools.h File Reference


Detailed Description

Contains the library functions and data structures for the FS support in TSK.

#include "img_tools.h"
#include <sys/types.h>

Go to the source code of this file.

Defines

#define TSK_FS_DENT_TYPE_MAX_STR   15
 Number of types that have a short string name.
#define TSK_FS_INODE_NAME_LIST_NSIZE   512
 Size of name array in TSK_FS_INODE_NAME_LIST structure.
#define TSK_FS_ORPHAN_STR   "-ORPHAN_FILE-"
 String that is prepended to orphan FAT & NTFS files when the file name is known, but the parent is not.
#define TSK_FS_INODE_MODE_TYPE_SHIFT   12
 Number of bits to shift mode to isolate file type.
#define TSK_FS_INODE_MODE_TYPE_STR_MAX   15
 Number of file types in shortname array.
#define TSK_FS_ISDOT(str)
#define tsk_fs_read_random(fsi, buf, len, offs)   (fsi)->img_info->read_random((fsi)->img_info, (fsi)->offset, (buf), (len), (offs))
#define TSK_FS_DCALC_DD   0x1
#define TSK_FS_DCALC_DLS   0x2
#define TSK_FS_DCALC_SLACK   0x4
#define TSK_FS_DCAT_HEX   0x1
#define TSK_FS_DCAT_ASCII   0x2
#define TSK_FS_DCAT_HTML   0x4
#define TSK_FS_DCAT_STAT   0x8
#define TSK_FS_DLS_CAT   0x01
#define TSK_FS_DLS_LIST   0x02
#define TSK_FS_DLS_SLACK   0x04
#define TSK_FS_FFIND_ALL   0x1
#define TSK_FS_FLS_DOT   0x001
#define TSK_FS_FLS_LONG   0x002
#define TSK_FS_FLS_FILE   0x004
#define TSK_FS_FLS_DIR   0x008
#define TSK_FS_FLS_FULL   0x010
#define TSK_FS_FLS_MAC   0x020
#define TSK_FS_IFIND_ALL   0x01
#define TSK_FS_IFIND_PATH   0x04
#define TSK_FS_IFIND_DATA   0x08
#define TSK_FS_IFIND_PAR   0x10
#define TSK_FS_IFIND_PAR_LONG   0x20
#define TSK_FS_ILS_OPEN   (1<<0)
#define TSK_FS_ILS_MAC   (1<<1)
#define TSK_FS_ILS_LINK   (1<<2)
#define TSK_FS_ILS_UNLINK   (1<<3)

Typedefs

typedef enum TSK_FS_INFO_TYPE_ENUM TSK_FS_INFO_TYPE_ENUM
typedef TSK_FS_INFO TSK_FS_INFO
typedef TSK_FS_DATA TSK_FS_DATA
typedef TSK_FS_DATA_RUN TSK_FS_DATA_RUN
typedef TSK_FS_INODE_NAME_LIST TSK_FS_INODE_NAME_LIST
typedef TSK_FS_JENTRY TSK_FS_JENTRY
typedef enum TSK_FS_DENT_FLAG_ENUM TSK_FS_DENT_FLAG_ENUM
typedef enum TSK_FS_DENT_TYPE_ENUM TSK_FS_DENT_TYPE_ENUM
typedef TSK_FS_DENT TSK_FS_DENT
typedef enum TSK_FS_INODE_FLAG_ENUM TSK_FS_INODE_FLAG_ENUM
typedef TSK_FS_INODE TSK_FS_INODE
typedef enum TSK_FS_INODE_MODE_ENUM TSK_FS_INODE_MODE_ENUM
typedef enum TSK_FS_BLOCK_FLAG_ENUM TSK_FS_BLOCK_FLAG_ENUM
typedef enum TSK_FS_FILE_FLAG_ENUM TSK_FS_FILE_FLAG_ENUM
typedef uint8_t(* TSK_FS_INODE_WALK_CB )(TSK_FS_INFO *, TSK_FS_INODE *, void *)
typedef uint8_t(* TSK_FS_BLOCK_WALK_CB )(TSK_FS_INFO *, DADDR_T, char *, TSK_FS_BLOCK_FLAG_ENUM, void *)
typedef uint8_t(* TSK_FS_DENT_TYPE_WALK_CB )(TSK_FS_INFO *, TSK_FS_DENT *, void *)
typedef uint8_t(* TSK_FS_FILE_WALK_CB )(TSK_FS_INFO *, DADDR_T, char *, size_t, TSK_FS_BLOCK_FLAG_ENUM, void *)
typedef uint8_t(* TSK_FS_JBLK_WALK_CB )(TSK_FS_INFO *, char *, int, void *)
typedef uint8_t(* TSK_FS_JENTRY_WALK_CB )(TSK_FS_INFO *, TSK_FS_JENTRY *, int, void *)
typedef enum TSK_FS_INFO_FLAG_ENUM TSK_FS_INFO_FLAG_ENUM
typedef enum TSK_FS_DATA_RUN_FLAG_ENUM TSK_FS_DATA_RUN_FLAG_ENUM
typedef enum TSK_FS_DATA_FLAG_ENUM TSK_FS_DATA_FLAG_ENUM

Enumerations

enum  TSK_FS_INFO_TYPE_ENUM {
  TSK_FS_INFO_TYPE_FS_MASK = 0xf0, TSK_FS_INFO_TYPE_SUB_MASK = 0x0f, TSK_FS_INFO_TYPE_UNSUPP = 0x00, TSK_FS_INFO_TYPE_FFS_TYPE = 0x10,
  TSK_FS_INFO_TYPE_FFS_1 = 0x11, TSK_FS_INFO_TYPE_FFS_1B = 0x12, TSK_FS_INFO_TYPE_FFS_2 = 0x13, TSK_FS_INFO_TYPE_FFS_AUTO = 0x14,
  TSK_FS_INFO_TYPE_EXT_TYPE = 0x20, TSK_FS_INFO_TYPE_EXT_2 = 0x21, TSK_FS_INFO_TYPE_EXT_3 = 0x22, TSK_FS_INFO_TYPE_EXT_AUTO = 0x23,
  TSK_FS_INFO_TYPE_FAT_TYPE = 0x30, TSK_FS_INFO_TYPE_FAT_12 = 0x31, TSK_FS_INFO_TYPE_FAT_16 = 0x32, TSK_FS_INFO_TYPE_FAT_32 = 0x33,
  TSK_FS_INFO_TYPE_FAT_AUTO = 0x34, TSK_FS_INFO_TYPE_NTFS_TYPE = 0x40, TSK_FS_INFO_TYPE_NTFS = 0x40, TSK_FS_INFO_TYPE_NTFS_AUTO = 0x40,
  TSK_FS_INFO_TYPE_SWAP_TYPE = 0x50, TSK_FS_INFO_TYPE_SWAP = 0x50, TSK_FS_INFO_TYPE_RAW_TYPE = 0x60, TSK_FS_INFO_TYPE_RAW = 0x60,
  TSK_FS_INFO_TYPE_ISO9660_TYPE = 0x70, TSK_FS_INFO_TYPE_ISO9660 = 0x70, TSK_FS_INFO_TYPE_HFS_TYPE = 0x80, TSK_FS_INFO_TYPE_HFS = 0x80
}
 Values for the file system type. More...
enum  TSK_FS_DENT_FLAG_ENUM { TSK_FS_DENT_FLAG_ALLOC = (1 << 0), TSK_FS_DENT_FLAG_UNALLOC = (1 << 1), TSK_FS_DENT_FLAG_RECURSE = (1 << 2) }
 File name flags that are used when walking directories and when specifying the status of a name in the TSK_FS_DENT structure. More...
enum  TSK_FS_DENT_TYPE_ENUM {
  TSK_FS_DENT_TYPE_UNDEF = 0, TSK_FS_DENT_TYPE_FIFO = 1, TSK_FS_DENT_TYPE_CHR = 2, TSK_FS_DENT_TYPE_DIR = 4,
  TSK_FS_DENT_TYPE_BLK = 6, TSK_FS_DENT_TYPE_REG = 8, TSK_FS_DENT_TYPE_LNK = 10, TSK_FS_DENT_TYPE_SOCK = 12,
  TSK_FS_DENT_TYPE_SHAD = 13, TSK_FS_DENT_TYPE_WHT = 14
}
 File type values -- as specified in the directory entry structure. More...
enum  TSK_FS_INODE_FLAG_ENUM {
  TSK_FS_INODE_FLAG_ALLOC = (1 << 0), TSK_FS_INODE_FLAG_UNALLOC = (1 << 1), TSK_FS_INODE_FLAG_USED = (1 << 2), TSK_FS_INODE_FLAG_UNUSED = (1 << 3),
  TSK_FS_INODE_FLAG_ORPHAN = (1 << 4), TSK_FS_INODE_FLAG_COMP = (1 << 5)
}
 Metadata flags used in TSK_FS_INODE.flags and in request to inode_walk. More...
enum  TSK_FS_INODE_MODE_ENUM {
  TSK_FS_INODE_MODE_FMT = 0170000, TSK_FS_INODE_MODE_FIFO = 0010000, TSK_FS_INODE_MODE_CHR = 0020000, TSK_FS_INODE_MODE_DIR = 0040000,
  TSK_FS_INODE_MODE_BLK = 0060000, TSK_FS_INODE_MODE_REG = 0100000, TSK_FS_INODE_MODE_LNK = 0120000, TSK_FS_INODE_MODE_SHAD = 0130000,
  TSK_FS_INODE_MODE_SOCK = 0140000, TSK_FS_INODE_MODE_WHT = 0160000, TSK_FS_INODE_MODE_ISUID = 0004000, TSK_FS_INODE_MODE_ISGID = 0002000,
  TSK_FS_INODE_MODE_ISVTX = 0001000, TSK_FS_INODE_MODE_IRUSR = 0000400, TSK_FS_INODE_MODE_IWUSR = 0000200, TSK_FS_INODE_MODE_IXUSR = 0000100,
  TSK_FS_INODE_MODE_IRGRP = 0000040, TSK_FS_INODE_MODE_IWGRP = 0000020, TSK_FS_INODE_MODE_IXGRP = 0000010, TSK_FS_INODE_MODE_IROTH = 0000004,
  TSK_FS_INODE_MODE_IWOTH = 0000002, TSK_FS_INODE_MODE_IXOTH = 0000001
}
 Values for the mode field -- which identifies the file type and permissions. More...
enum  TSK_FS_BLOCK_FLAG_ENUM {
  TSK_FS_BLOCK_FLAG_ALLOC = (1 << 0), TSK_FS_BLOCK_FLAG_UNALLOC = (1 << 1), TSK_FS_BLOCK_FLAG_CONT = (1 << 2), TSK_FS_BLOCK_FLAG_META = (1 << 3),
  TSK_FS_BLOCK_FLAG_BAD = (1 << 4), TSK_FS_BLOCK_FLAG_ALIGN = (1 << 5), TSK_FS_BLOCK_FLAG_RES = (1 << 6), TSK_FS_BLOCK_FLAG_SPARSE = (1 << 7),
  TSK_FS_BLOCK_FLAG_COMP = (1 << 8)
}
 Flags that are used when calling block_walk, in callback of of block_walk, and in callback of file_walk. More...
enum  TSK_FS_FILE_FLAG_ENUM {
  TSK_FS_FILE_FLAG_AONLY = (1 << 0), TSK_FS_FILE_FLAG_SLACK = (1 << 1), TSK_FS_FILE_FLAG_RECOVER = (1 << 2), TSK_FS_FILE_FLAG_META = (1 << 3),
  TSK_FS_FILE_FLAG_NOSPARSE = (1 << 4), TSK_FS_FILE_FLAG_NOID = (1 << 5)
}
 Flags used when calling file_walk, the action of file_walk uses the TSK_FS_BLOCK_FLAG flags. More...
enum  TSK_FS_INFO_FLAG_ENUM { TSK_FS_INFO_FLAG_HAVE_SEQ = (1 << 0) }
 Flags for the FS_INFO structure. More...
enum  TSK_FS_DATA_RUN_FLAG_ENUM { TSK_FS_DATA_RUN_FLAG_FILLER = 0x1, TSK_FS_DATA_RUN_FLAG_SPARSE = 0x2 }
 Flags used for data runs in attributes (FS_DATA). More...
enum  TSK_FS_DATA_FLAG_ENUM {
  TSK_FS_DATA_INUSE = 0x1, TSK_FS_DATA_NONRES = 0x2, TSK_FS_DATA_RES = 0x4, TSK_FS_DATA_ENC = 0x10,
  TSK_FS_DATA_COMP = 0x20, TSK_FS_DATA_SPARSE = 0x40
}
 Flags used for the TSK_FS_DATA structure, which is used to store attribute data. More...

Functions

TSK_FS_INFO_TYPE_ENUM tsk_fs_parse_type (const TSK_TCHAR *)
void tsk_fs_print_types (FILE *)
char * tsk_fs_get_type (TSK_FS_INFO_TYPE_ENUM)
TSK_FS_INODEtsk_fs_inode_alloc (int, int)
 Allocates a generic inode / metadata structure.
TSK_FS_INODEtsk_fs_inode_realloc (TSK_FS_INODE *, int, int)
 Resize an existing FS_INODE structure -- changes the number of block pointers.
void tsk_fs_inode_free (TSK_FS_INODE *)
 Free the memory allocated to the FS_INODE structure.
TSK_FS_DATAtsk_fs_data_alloc (TSK_FS_DATA_FLAG_ENUM)
 Allocates and initializes a new structure.
TSK_FS_DATA_RUNtsk_fs_data_run_alloc ()
 Allocate a run list entry.
TSK_FS_DATAtsk_fs_data_getnew_attr (TSK_FS_DATA *, TSK_FS_DATA_FLAG_ENUM)
 Given the begining of the list, return either an empty element in the list or a new one at the end.
void tsk_fs_data_clear_list (TSK_FS_DATA *)
 Clear the fields and run_lists in the FS_DATA list.
TSK_FS_DATAtsk_fs_data_put_str (TSK_FS_DATA *, char *, uint32_t, uint16_t, void *, unsigned int)
 Copy resident data to an attribute in the list.
TSK_FS_DATAtsk_fs_data_put_run (TSK_FS_DATA *, DADDR_T, OFF_T, TSK_FS_DATA_RUN *, char *, uint32_t, uint16_t, OFF_T, TSK_FS_DATA_FLAG_ENUM, uint32_t)
 Add a set of consecutive runs of an attribute of a specified type and id.
TSK_FS_DATAtsk_fs_data_lookup (TSK_FS_DATA *, uint32_t, uint16_t)
 Search the list of TSK_FS_DATA structures for an entry with a given type and id.
TSK_FS_DATAtsk_fs_data_lookup_noid (TSK_FS_DATA *, uint32_t)
 Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id).
void tsk_fs_data_run_free (TSK_FS_DATA_RUN *)
 Free a list of data_runs.
void tsk_fs_data_free (TSK_FS_DATA *)
 Free the list of TSK_FS_DATA structures and the runs that they allocated.
TSK_FS_DENTtsk_fs_dent_alloc (ULONG, ULONG)
TSK_FS_DENTtsk_fs_dent_realloc (TSK_FS_DENT *, ULONG)
void tsk_fs_dent_free (TSK_FS_DENT *)
void tsk_fs_dent_print (FILE *, TSK_FS_DENT *, TSK_FS_INFO *, TSK_FS_DATA *)
void tsk_fs_dent_print_long (FILE *, TSK_FS_DENT *, TSK_FS_INFO *, TSK_FS_DATA *)
void tsk_fs_dent_print_mac (FILE *, TSK_FS_DENT *, TSK_FS_INFO *, TSK_FS_DATA *fs_data, char *)
void tsk_fs_make_ls (mode_t, char *)
void tsk_fs_print_day (FILE *, time_t)
void tsk_fs_print_time (FILE *, time_t)
TSK_FS_INFOtsk_fs_open (TSK_IMG_INFO *, SSIZE_T, const TSK_TCHAR *)
 Read data and process it as a file system.
SSIZE_T tsk_fs_read_block (TSK_FS_INFO *, TSK_DATA_BUF *, OFF_T, DADDR_T)
 Read a file system block into a TSK_DATA_BUF structure.
SSIZE_T tsk_fs_read_block_nobuf (TSK_FS_INFO *, char *, OFF_T, DADDR_T)
 Read a file system block into a char* buffer.
char * tsk_fs_load_file (TSK_FS_INFO *, TSK_FS_INODE *, uint32_t, uint16_t, int)
 Load the contents of a file into a buffer.
SSIZE_T tsk_fs_read_file (TSK_FS_INFO *, TSK_FS_INODE *, uint32_t, uint16_t, SSIZE_T, SSIZE_T, char *)
 Read the contents of a specific attribute of a file using a typical read() type interface.
SSIZE_T tsk_fs_read_file_noid (TSK_FS_INFO *, TSK_FS_INODE *, SSIZE_T, SSIZE_T, char *)
 Read the contents of a file using a typical read() type interface.
int8_t tsk_fs_dcalc (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T cnt)
uint8_t tsk_fs_dcat (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T addr, DADDR_T read_num_units)
 Read a specific number of blocks and print the contents to STDOUT.
uint8_t tsk_fs_dls (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T bstart, DADDR_T bend, TSK_FS_BLOCK_FLAG_ENUM flags)
uint8_t tsk_fs_dstat (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T addr, TSK_FS_BLOCK_FLAG_ENUM flags)
uint8_t tsk_fs_ffind (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T inode, uint32_t type, uint16_t id, int flags)
uint8_t tsk_fs_fls (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T inode, int flags, TSK_TCHAR *pre, int32_t skew)
uint8_t tsk_fs_icat (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T inum, uint32_t type, uint16_t id, int flags)
int8_t tsk_fs_ifind_path (TSK_FS_INFO *fs, uint8_t lclflags, TSK_TCHAR *path, INUM_T *result)
uint8_t tsk_fs_ifind_data (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T blk)
uint8_t tsk_fs_ifind_par (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T par)
uint8_t tsk_fs_ils (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T istart, INUM_T ilast, int flags, int32_t skew, TSK_TCHAR *img)

Variables

char tsk_fs_dent_str [TSK_FS_DENT_TYPE_MAX_STR][2]
char tsk_fs_inode_mode_str [TSK_FS_INODE_MODE_TYPE_STR_MAX][2]
 Contains the short (1 character) name of the file type.


Define Documentation

#define TSK_FS_ISDOT str   ) 
 

Value:

( ((str[0] == '.') && \
 ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 )


Enumeration Type Documentation

enum TSK_FS_BLOCK_FLAG_ENUM
 

Flags that are used when calling block_walk, in callback of of block_walk, and in callback of file_walk.

Enumeration values:
TSK_FS_BLOCK_FLAG_ALLOC  Block is allocated.
TSK_FS_BLOCK_FLAG_UNALLOC  Block is unallocated.
TSK_FS_BLOCK_FLAG_CONT  Block contains file content.
TSK_FS_BLOCK_FLAG_META  Block contains file system metadata.
TSK_FS_BLOCK_FLAG_BAD  Block has been marked as bad by the file system.
TSK_FS_BLOCK_FLAG_ALIGN  Return entire block when walking -- applies to FS with fragments.
TSK_FS_BLOCK_FLAG_RES  The data passed in the file_walk callback is from an NTFS resident file.
TSK_FS_BLOCK_FLAG_SPARSE  The data passed in the file_walk calback was stored as sparse (all zeros).
TSK_FS_BLOCK_FLAG_COMP  The data passed in the file_walk callback was stored in a compressed form.

enum TSK_FS_DATA_FLAG_ENUM
 

Flags used for the TSK_FS_DATA structure, which is used to store attribute data.

Enumeration values:
TSK_FS_DATA_INUSE  Attribute structure is in use.
TSK_FS_DATA_NONRES  Attribute is for non-resident data.
TSK_FS_DATA_RES  Attribute is for resident data.
TSK_FS_DATA_ENC  Attribute data is encrypted.
TSK_FS_DATA_COMP  Attribute data is compressed.
TSK_FS_DATA_SPARSE  Attribute data is sparse.

enum TSK_FS_DATA_RUN_FLAG_ENUM
 

Flags used for data runs in attributes (FS_DATA).

Enumeration values:
TSK_FS_DATA_RUN_FLAG_FILLER  Run entry is a filler because we haven't seen the actual run for this location yet.
TSK_FS_DATA_RUN_FLAG_SPARSE  Run is sparse -- blocks in this run should contain all zeros.

enum TSK_FS_DENT_FLAG_ENUM
 

File name flags that are used when walking directories and when specifying the status of a name in the TSK_FS_DENT structure.

Enumeration values:
TSK_FS_DENT_FLAG_ALLOC  Name is in an allocated state.
TSK_FS_DENT_FLAG_UNALLOC  Name is in an unallocated state.
TSK_FS_DENT_FLAG_RECURSE  Recurse into directories (dent_walk only).

enum TSK_FS_DENT_TYPE_ENUM
 

File type values -- as specified in the directory entry structure.

Enumeration values:
TSK_FS_DENT_TYPE_UNDEF  Unknown type.
TSK_FS_DENT_TYPE_FIFO  Named pipe.
TSK_FS_DENT_TYPE_CHR  Character device.
TSK_FS_DENT_TYPE_DIR  Directory.
TSK_FS_DENT_TYPE_BLK  Block device.
TSK_FS_DENT_TYPE_REG  Regular file.
TSK_FS_DENT_TYPE_LNK  Symbolic link.
TSK_FS_DENT_TYPE_SOCK  Socket.
TSK_FS_DENT_TYPE_SHAD  Shadow inode (solaris).
TSK_FS_DENT_TYPE_WHT  Whiteout (openbsd).

enum TSK_FS_FILE_FLAG_ENUM
 

Flags used when calling file_walk, the action of file_walk uses the TSK_FS_BLOCK_FLAG flags.

Enumeration values:
TSK_FS_FILE_FLAG_AONLY  Do not include file content in callback -- supply adddress only.
TSK_FS_FILE_FLAG_SLACK  Include the file slack space in the callback.
TSK_FS_FILE_FLAG_RECOVER  Use special data recovery techniques for deleted files.
TSK_FS_FILE_FLAG_META  Return blocks that contain metadata (such as indirect UFS/ExtX blocks).
TSK_FS_FILE_FLAG_NOSPARSE  Do not use callback for sparse blocks.
TSK_FS_FILE_FLAG_NOID  Ignore the Id argument given in the call to file_walk -- use only the type.

enum TSK_FS_INFO_FLAG_ENUM
 

Flags for the FS_INFO structure.

Enumeration values:
TSK_FS_INFO_FLAG_HAVE_SEQ  File system has sequence numbers in the inode addresses.

enum TSK_FS_INFO_TYPE_ENUM
 

Values for the file system type.

The most-significant nibble is the high-level type. The least-sigificant nibble is the specific sub-type of implementation.

enum TSK_FS_INODE_FLAG_ENUM
 

Metadata flags used in TSK_FS_INODE.flags and in request to inode_walk.

Enumeration values:
TSK_FS_INODE_FLAG_ALLOC  Metadata structure is currently in an allocated state.
TSK_FS_INODE_FLAG_UNALLOC  Metadata structure is currently in an unallocated state.
TSK_FS_INODE_FLAG_USED  Metadata structure has been allocated at least once.
TSK_FS_INODE_FLAG_UNUSED  Metadata structure has never been allocated.
TSK_FS_INODE_FLAG_ORPHAN  Metadata structure is unallocated and has no file name pointing to it.
TSK_FS_INODE_FLAG_COMP  The file contents are compressed.

enum TSK_FS_INODE_MODE_ENUM
 

Values for the mode field -- which identifies the file type and permissions.

Enumeration values:
TSK_FS_INODE_MODE_FMT  Mask to apply to mode to isolate file type.
TSK_FS_INODE_MODE_FIFO  Named pipe (fifo).
TSK_FS_INODE_MODE_CHR  Character device.
TSK_FS_INODE_MODE_DIR  Directory file.
TSK_FS_INODE_MODE_BLK  Block device.
TSK_FS_INODE_MODE_REG  Regular file.
TSK_FS_INODE_MODE_LNK  Symbolic link.
TSK_FS_INODE_MODE_SHAD  SOLARIS ONLY.
TSK_FS_INODE_MODE_SOCK  UNIX domain socket.
TSK_FS_INODE_MODE_WHT  Whiteout.
TSK_FS_INODE_MODE_ISUID  set user id on execution
TSK_FS_INODE_MODE_ISGID  set group id on execution
TSK_FS_INODE_MODE_ISVTX  sticky bit
TSK_FS_INODE_MODE_IRUSR  R for owner.
TSK_FS_INODE_MODE_IWUSR  W for owner.
TSK_FS_INODE_MODE_IXUSR  X for owner.
TSK_FS_INODE_MODE_IRGRP  R for group.
TSK_FS_INODE_MODE_IWGRP  W for group.
TSK_FS_INODE_MODE_IXGRP  X for group.
TSK_FS_INODE_MODE_IROTH  R for other.
TSK_FS_INODE_MODE_IWOTH  W for other.
TSK_FS_INODE_MODE_IXOTH  X for other.


Function Documentation

TSK_FS_DATA* tsk_fs_data_alloc TSK_FS_DATA_FLAG_ENUM  type  ) 
 

Allocates and initializes a new structure.

Parameters:
type The type of attribute to create (Resident or Non-resident)
Returns:
NULL on error

void tsk_fs_data_clear_list TSK_FS_DATA fs_data_head  ) 
 

Clear the fields and run_lists in the FS_DATA list.

Parameters:
fs_data_head List of attributes to clear

void tsk_fs_data_free TSK_FS_DATA fs_data_head  ) 
 

Free the list of TSK_FS_DATA structures and the runs that they allocated.

Parameters:
fs_data_head List of structures to free.

TSK_FS_DATA* tsk_fs_data_getnew_attr TSK_FS_DATA fs_data_head,
TSK_FS_DATA_FLAG_ENUM  type
 

Given the begining of the list, return either an empty element in the list or a new one at the end.

Preference is given to finding one of the same type to prevent excessive malloc's, but if one is not found then a different type is used: type = [TSK_FS_DATA_NONRES | TSK_FS_DATA_RES]

Parameters:
fs_data_head Head of attribute list to search
type Preference for attribute type to reuse
Returns:
NULL on error or attribute in list to use

TSK_FS_DATA* tsk_fs_data_lookup TSK_FS_DATA fs_data_head,
uint32_t  type,
uint16_t  id
 

Search the list of TSK_FS_DATA structures for an entry with a given type and id.

Parameters:
fs_data_head Head of fs_data list to search
type Type of attribute to find
id Id of attribute to find. If 0, then the lowest id of the given type is returned.
Returns:
NULL is returned on error and if an entry could not be found. tsk_errno will be set to 0 if entry could not be found and it will be non-zero if an error occured.

TSK_FS_DATA* tsk_fs_data_lookup_noid TSK_FS_DATA fs_data_head,
uint32_t  type
 

Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id).

The attribute with the lowest id (or the named $Data attribute if that type is specified) is returned.

Parameters:
fs_data_head Head of fs_data list to search
type Type of attribute to find
Returns:
NULL is returned on error and if an entry could not be found. tsk_errno will be set to 0 if entry could not be found and it will be non-zero if an error occured.

TSK_FS_DATA* tsk_fs_data_put_run TSK_FS_DATA fs_data_head,
DADDR_T  start_vcn,
OFF_T  runlen,
TSK_FS_DATA_RUN run,
char *  name,
uint32_t  type,
uint16_t  id,
OFF_T  size,
TSK_FS_DATA_FLAG_ENUM  flags,
uint32_t  compsize
 

Add a set of consecutive runs of an attribute of a specified type and id.

This function first determines if the attribute exists and then either creates the attribute or adds to it. This is complicated because we could get the runs out of order so we use "filler" TSK_FS_DATA_RUN structures during the process

Parameters:
fs_data_head The head of the list of attributes (or NULL if list is empty)
start_vcn The virtual cluster number of the start of this run in the attribute.
runlen The total number of clusters in this set of runs.
run The set of runs to add
name Name of the attribute (in case it needs to be created)
type Type of attribute to add run to
id Id of attribute to add run to
size Total size of the attribute (in case it needs to be created)
flags Flags about compression, sparse etc. of data
compsize Compression unit size (in case it needs to be created)
Returns:
The head of the list or NULL on error

TSK_FS_DATA* tsk_fs_data_put_str TSK_FS_DATA fs_data_head,
char *  name,
uint32_t  type,
uint16_t  id,
void *  res_data,
unsigned int  len
 

Copy resident data to an attribute in the list.

If no attributes exist yet, one will be created and the head of the resulting list will be returned.

Parameters:
fs_data_head Head of the attribute list (or NULL if empty)
name Name of the attribute to add
type Type of the attribute to add
id Id of the attribute to add
res_data Pointer to where resident data is located (data will be copied from here into FS_DATA)
len Length of resident data
Returns:
NULL on error or head of attribute list

TSK_FS_DATA_RUN* tsk_fs_data_run_alloc  ) 
 

Allocate a run list entry.

Returns:
NULL on error

void tsk_fs_data_run_free TSK_FS_DATA_RUN fs_data_run  ) 
 

Free a list of data_runs.

Parameters:
fs_data_run Head of list to free

uint8_t tsk_fs_dcat TSK_FS_INFO fs,
uint8_t  lclflags,
DADDR_T  addr,
DADDR_T  read_num_units
 

Read a specific number of blocks and print the contents to STDOUT.

Parameters:
fs File system to analyze
lclflags flags
addr Starting block address to read from
read_num_units Number of blocks to read
Returns:
1 on error and 0 on success

TSK_FS_INODE* tsk_fs_inode_alloc int  direct_count,
int  indir_count
 

Allocates a generic inode / metadata structure.

Parameters:
direct_count Number of direct block address pointers to include in structure
indir_count Number of indirect block address pointers to include in structure
Returns:
NULL on error

void tsk_fs_inode_free TSK_FS_INODE fs_inode  ) 
 

Free the memory allocated to the FS_INODE structure.

Parameters:
fs_inode Structure to free

TSK_FS_INODE* tsk_fs_inode_realloc TSK_FS_INODE fs_inode,
int  direct_count,
int  indir_count
 

Resize an existing FS_INODE structure -- changes the number of block pointers.

Parameters:
fs_inode Structure to resize
direct_count Number of direct block address pointers to include in structure
indir_count Number of indirect block address pointers to include in structure
Returns:
NULL on error

char* tsk_fs_load_file TSK_FS_INFO fs,
TSK_FS_INODE fsi,
uint32_t  type,
uint16_t  id,
int  flags
 

Load the contents of a file into a buffer.

Parameters:
fs The file system structure.
fsi The inode structure of the file to read.
type The type of attribute to load (ignored if TSK_FS_FILE_FLAG_NOID is given)
id The id of attribute to load (ignored if TSK_FS_FILE_FLAG_NOID is given)
flags Flag values of type TSK_FS_FILE_FLAG_*
Returns:
The buffer with the file content (must be freed by caller)

TSK_FS_INFO* tsk_fs_open TSK_IMG_INFO img_info,
SSIZE_T  offset,
const TSK_TCHAR *  type
 

Read data and process it as a file system.

Parameters:
img_info Disk image to analyze
offset Byte offset to start analyzing from
type String type of file system type (autodetects if NULL)
Returns:
NULL on error

SSIZE_T tsk_fs_read_block TSK_FS_INFO fs,
TSK_DATA_BUF *  buf,
OFF_T  len,
DADDR_T  addr
 

Read a file system block into a TSK_DATA_BUF structure.

This is actually a wrapper around the fs_read_random function, but it allows the starting location to be specified as a block address.

Parameters:
fs The file system structure.
buf The buffer to store the block in.
len The number of bytes to read (must be a multiple of the device block size)
addr The starting block file system address.
Returns:
The number of bytes read or -1 on error.

SSIZE_T tsk_fs_read_block_nobuf TSK_FS_INFO fs,
char *  buf,
OFF_T  len,
DADDR_T  addr
 

Read a file system block into a char* buffer.

This is actually a wrapper around the fs_read_random function, but it allows the starting location to be specified as a block address.

Parameters:
fs The file system structure.
buf The char * buffer to store the block in.
len The number of bytes to read (must be a multiple of the device block size)
addr The starting block file system address.
Returns:
The number of bytes read or -1 on error.

SSIZE_T tsk_fs_read_file TSK_FS_INFO fs,
TSK_FS_INODE fsi,
uint32_t  type,
uint16_t  id,
SSIZE_T  offset,
SSIZE_T  size,
char *  buf
 

Read the contents of a specific attribute of a file using a typical read() type interface.

Parameters:
fs The file system structure.
fsi The inode structure of the file to read.
type The type of attribute to load
id The id of attribute to load
offset The byte offset to start reading from.
size The number of bytes to read from the file.
buf The buffer to read the data into.
Returns:
The number of bytes read or -1 on error.

SSIZE_T tsk_fs_read_file_noid TSK_FS_INFO fs,
TSK_FS_INODE fsi,
SSIZE_T  offset,
SSIZE_T  size,
char *  buf
 

Read the contents of a file using a typical read() type interface.

Parameters:
fs The file system structure.
fsi The inode structure of the file to read.
offset The byte offset to start reading from.
size The number of bytes to read from the file.
buf The buffer to read the data into.
Returns:
The number of bytes read or -1 on error.


Generated on Thu Apr 19 14:58:53 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.4.2