Main Page | Data Structures | Directories | File List | Data Fields | Globals

ext2fs.h

00001 /*
00002 ** The Sleuth Kit 
00003 **
00004 ** $Date: 2007/04/19 19:01:32 $
00005 **
00006 ** Brian Carrier [carrier@sleuthkit.org]
00007 ** Copyright (c) 2003-2005 Brian Carrier.  All rights reserved
00008 **
00009 ** TASK
00010 ** Copyright (c) 2002 Brian Carrier, @stake Inc.  All rights reserved
00011 ** 
00012 */
00013 #ifndef _EXT2FS_H
00014 #define _EXT2FS_H
00015 
00016 #ifdef __cplusplus
00017 extern "C" {
00018 #endif
00019 
00020     typedef uint32_t EXT2_GRPNUM_T;
00021 #define PRI_EXT2GRP     PRIu32
00022 
00023 /*
00024 ** Constants
00025 */
00026 #define EXT2FS_FIRSTINO    1    /* inode 1 contains the bad blocks */
00027 #define EXT2FS_ROOTINO     2    /* location of root directory inode */
00028 #define EXT2FS_NDADDR      12
00029 #define EXT2FS_NIADDR      3
00030 #define EXT2FS_SBOFF       1024
00031 #define EXT2FS_FS_MAGIC    0xef53
00032 #define EXT2FS_MAXNAMLEN        255
00033 #define EXT2FS_MAXPATHLEN       4096
00034 #define EXT2FS_MIN_BLOCK_SIZE   1024
00035 #define EXT2FS_MAX_BLOCK_SIZE   4096
00036 #define EXT2FS_DEV_BSIZE        512
00037 
00038 /*
00039 ** Super Block
00040 */
00041     typedef struct {
00042         uint8_t s_inodes_count[4];      /* u32 */
00043         uint8_t s_blocks_count[4];      /* u32 */
00044         uint8_t s_r_blocks_count[4];
00045         uint8_t s_free_blocks_count[4]; /* u32 */
00046         uint8_t s_free_inode_count[4];  /* u32 */
00047         uint8_t s_first_data_block[4];  /* u32 */
00048         uint8_t s_log_block_size[4];    /* u32 */
00049         uint8_t s_log_frag_size[4];     /* s32 */
00050         uint8_t s_blocks_per_group[4];  /* u32 */
00051         uint8_t s_frags_per_group[4];   /* u32 */
00052         uint8_t s_inodes_per_group[4];  /* u32 */
00053         uint8_t s_mtime[4];     /* u32 *//* mount time */
00054         uint8_t s_wtime[4];     /* u32 *//* write time */
00055         uint8_t s_mnt_count[2]; /* u16 *//* mount count */
00056         uint8_t s_max_mnt_count[2];     /* s16 */
00057         uint8_t s_magic[2];     /* u16 */
00058         uint8_t s_state[2];     /* u16 *//* fs state */
00059         uint8_t s_errors[2];    /* u16 */
00060         uint8_t s_minor_rev_level[2];   /* u16 */
00061         uint8_t s_lastcheck[4]; /* u32 */
00062         uint8_t s_checkinterval[4];     /* u32 */
00063         uint8_t s_creator_os[4];        /* u32 */
00064         uint8_t s_rev_level[4]; /* u32 */
00065         uint8_t s_def_resuid[2];        /* u16 */
00066         uint8_t s_def_resgid[2];        /* u16 */
00067         uint8_t s_first_ino[4]; /* u32 */
00068         uint8_t s_inode_size[2];        /* u16 */
00069         uint8_t s_block_group_nr[2];    /* u16 */
00070         uint8_t s_feature_compat[4];    /* u32 */
00071         uint8_t s_feature_incompat[4];  /* u32 */
00072         uint8_t s_feature_ro_compat[4]; /* u32 */
00073         uint8_t s_uuid[16];     /* u8[16] */
00074         char s_volume_name[16];
00075         char s_last_mounted[64];
00076         uint8_t s_algorithm_usage_bitmap[4];    /* u32 */
00077         uint8_t s_prealloc_blocks;      /* u8 */
00078         uint8_t s_prealloc_dir_blocks;  /* u8 */
00079         uint8_t s_padding1[2];  /* u16 */
00080         uint8_t s_journal_uuid[16];     /* u8[16] */
00081         uint8_t s_journal_inum[4];      /* u32 */
00082         uint8_t s_journal_dev[4];       /* u32 */
00083         uint8_t s_last_orphan[4];       /* u32 */
00084         uint8_t s_padding[788];
00085     } ext2fs_sb;
00086 
00087 /* File system State Values */
00088 #define EXT2FS_STATE_VALID      0x0001  /* unmounted correctly */
00089 #define EXT2FS_STATE_ERROR      0x0002  /* errors detected */
00090 
00091 /* Operating System Codes */
00092 #define EXT2FS_OS_LINUX         0
00093 #define EXT2FS_OS_HURD          1
00094 #define EXT2FS_OS_MASIX         2
00095 #define EXT2FS_OS_FREEBSD       3
00096 #define EXT2FS_OS_LITES         4
00097 
00098 /* Revision Levels */
00099 #define EXT2FS_REV_ORIG         0
00100 #define EXT2FS_REV_DYN          1
00101 
00102 /* feature flags */
00103 #define EXT2FS_FEATURE_COMPAT_DIR_PREALLOC      0x0001
00104 #define EXT2FS_FEATURE_COMPAT_IMAGIC_INODES     0x0002
00105 #define EXT2FS_FEATURE_COMPAT_HAS_JOURNAL       0x0004
00106 #define EXT2FS_FEATURE_COMPAT_EXT_ATTR          0x0008
00107 #define EXT2FS_FEATURE_COMPAT_RESIZE_INO        0x0010
00108 #define EXT2FS_FEATURE_COMPAT_DIR_INDEX         0x0020
00109 
00110 #define EXT2FS_FEATURE_INCOMPAT_COMPRESSION     0x0001
00111 #define EXT2FS_FEATURE_INCOMPAT_FILETYPE        0x0002
00112 #define EXT2FS_FEATURE_INCOMPAT_RECOVER         0x0004
00113 #define EXT2FS_FEATURE_INCOMPAT_JOURNAL_DEV     0x0008
00114 
00115 #define EXT2FS_FEATURE_RO_COMPAT_SPARSE_SUPER   0x0001
00116 #define EXT2FS_FEATURE_RO_COMPAT_LARGE_FILE             0x0002
00117 #define EXT2FS_FEATURE_RO_COMPAT_BTREE_DIR              0x0004
00118 
00119 
00120 
00121 /*
00122  * Group Descriptor
00123  */
00124     typedef struct {
00125         uint8_t bg_block_bitmap[4];     /* u32: block of blocks bitmap */
00126         uint8_t bg_inode_bitmap[4];     /* u32: block of inodes bitmap */
00127         uint8_t bg_inode_table[4];      /* u32: block of inodes table */
00128         uint8_t bg_free_blocks_count[2];        /* u16: num of free blocks */
00129         uint8_t bg_free_inodes_count[2];        /* u16: num of free inodes */
00130         uint8_t bg_used_dirs_count[2];  /* u16: num of use directories  */
00131         uint8_t f1[14];
00132     } ext2fs_gd;
00133 
00134 
00135 /* data address to group number */
00136 #define ext2_dtog_lcl(fsi, fs, d)       \
00137         (EXT2_GRPNUM_T)(((d) - tsk_getu32(fsi->endian, fs->s_first_data_block)) / \
00138         tsk_getu32(fsi->endian, fs->s_blocks_per_group))
00139 
00140 
00141 /* first fragment of group */
00142 #define ext2_cgbase_lcl(fsi, fs, c)     \
00143         ((DADDR_T)((tsk_getu32(fsi->endian, fs->s_blocks_per_group) * (c)) + \
00144         tsk_getu32(fsi->endian, fs->s_first_data_block)))
00145 
00146 
00147 /*
00148  * Inode
00149  */
00150     typedef struct {
00151         uint8_t i_mode[2];      /* u16 */
00152         uint8_t i_uid[2];       /* u16 */
00153         uint8_t i_size[4];      /* u32 */
00154         uint8_t i_atime[4];     /* u32 */
00155         uint8_t i_ctime[4];     /* u32 */
00156         uint8_t i_mtime[4];     /* u32 */
00157         uint8_t i_dtime[4];     /* u32 */
00158         uint8_t i_gid[2];       /* u16 */
00159         uint8_t i_nlink[2];     /* u16 */
00160         uint8_t i_nblk[4];
00161         uint8_t i_flags[4];
00162         uint8_t i_f5[4];
00163         uint8_t i_block[15][4]; /*s32 */
00164         uint8_t i_generation[4];
00165         uint8_t i_file_acl[4];
00166         uint8_t i_size_high[4]; /* u32 - also i_dir_acl for non-regular  */
00167         uint8_t i_faddr[4];
00168         uint8_t i_frag;
00169         uint8_t i_fsize;
00170         uint8_t f1[2];
00171         uint8_t i_uid_high[2];
00172         uint8_t i_gid_high[2];
00173         uint8_t f7[4];
00174     } ext2fs_inode;
00175 
00176 /* MODE */
00177 #define EXT2_IN_FMT  0017000
00178 #define EXT2_IN_SOCK 0140000
00179 #define EXT2_IN_LNK  0120000
00180 #define EXT2_IN_REG  0100000
00181 #define EXT2_IN_BLK  0060000
00182 #define EXT2_IN_DIR  0040000
00183 #define EXT2_IN_CHR  0020000
00184 #define EXT2_IN_FIFO  0010000
00185 
00186 #define EXT2_IN_SECDEL          0x00000001      /* Secure deletion */
00187 #define EXT2_IN_UNRM            0x00000002      /* Undelete */
00188 #define EXT2_IN_COMP            0x00000004      /* Compress file */
00189 #define EXT2_IN_SYNC            0x00000008      /* Synchronous updates */
00190 #define EXT2_IN_IMM                     0x00000010      /* Immutable file */
00191 #define EXT2_IN_APPEND          0x00000020      /* writes to file may only append */
00192 #define EXT2_IN_NODUMP          0x00000040      /* do not dump file */
00193 #define EXT2_IN_NOA                     0x00000080      /* do not update atime */
00194 
00195 
00196 
00197 /*
00198  * directory entries
00199  */
00200     typedef struct {
00201         uint8_t inode[4];       /* u32 */
00202         uint8_t rec_len[2];     /* u16 */
00203         uint8_t name_len[2];    /* u16 */
00204         char name[EXT2FS_MAXNAMLEN];
00205     } ext2fs_dentry1;
00206 
00207 /* new structure starting at 2.2 */
00208     typedef struct {
00209         uint8_t inode[4];       /* u32 */
00210         uint8_t rec_len[2];     /* u16 */
00211         uint8_t name_len;
00212         uint8_t type;
00213         char name[EXT2FS_MAXNAMLEN];
00214     } ext2fs_dentry2;
00215 
00216 #define EXT2FS_DIRSIZ_lcl(len) \
00217     ((len + 8 + 3) & ~(3))
00218 
00219 
00220 /* Ext2 directory file types (not the same as FFS. Sigh. */
00221 #define EXT2_DE_UNKNOWN         0
00222 #define EXT2_DE_REG_FILE        1
00223 #define EXT2_DE_DIR             2
00224 #define EXT2_DE_CHRDEV          3
00225 #define EXT2_DE_BLKDEV          4
00226 #define EXT2_DE_FIFO            5
00227 #define EXT2_DE_SOCK            6
00228 #define EXT2_DE_SYMLINK         7
00229 #define EXT2_DE_MAX             8
00230 
00231 
00232 #define EXT2_DE_V1      1
00233 #define EXT2_DE_V2      2
00234 
00235 
00236 
00237 
00238 /* Extended Attributes
00239  */
00240 
00241 #define EXT2_EA_MAGIC   0xEA020000
00242 
00243     typedef struct {
00244         uint8_t magic[4];
00245         uint8_t refcount[4];
00246         uint8_t blocks[4];
00247         uint8_t hash[4];
00248         uint8_t f1[16];
00249         uint8_t entry;
00250     } ext2fs_ea_header;
00251 
00252 
00253 #define EXT2_EA_IDX_USER                   1
00254 #define EXT2_EA_IDX_POSIX_ACL_ACCESS       2
00255 #define EXT2_EA_IDX_POSIX_ACL_DEFAULT      3
00256 #define EXT2_EA_IDX_TRUSTED                4
00257 #define EXT2_EA_IDX_LUSTRE                 5
00258 #define EXT2_EA_IDX_SECURITY               6
00259 
00260 /* Entries follow the header and are aligned to 4-byte boundaries 
00261  * the value of the attribute is stored at the bottom of the block 
00262  */
00263     typedef struct {
00264         uint8_t nlen;
00265         uint8_t nidx;
00266         uint8_t val_off[2];
00267         uint8_t val_blk[4];
00268         uint8_t val_size[4];
00269         uint8_t hash[4];
00270         uint8_t name;
00271     } ext2fs_ea_entry;
00272 
00273 #define EXT2_EA_LEN(nlen) \
00274         ((((nlen) + 19 ) / 4) * 4)
00275 
00276 
00277     typedef struct {
00278         uint8_t ver[4];
00279     } ext2fs_pos_acl_head;
00280 
00281 
00282 #define EXT2_PACL_TAG_USERO     0x01
00283 #define EXT2_PACL_TAG_USER      0x02
00284 #define EXT2_PACL_TAG_GRPO      0x04
00285 #define EXT2_PACL_TAG_GRP       0x08
00286 #define EXT2_PACL_TAG_MASK      0x10
00287 #define EXT2_PACL_TAG_OTHER     0x20
00288 
00289 
00290 #define EXT2_PACL_PERM_EXEC     0x01
00291 #define EXT2_PACL_PERM_WRITE    0x02
00292 #define EXT2_PACL_PERM_READ     0x04
00293 
00294 
00295     typedef struct {
00296         uint8_t tag[2];
00297         uint8_t perm[2];
00298     } ext2fs_pos_acl_entry_sh;
00299 
00300     typedef struct {
00301         uint8_t tag[2];
00302         uint8_t perm[2];
00303         uint8_t id[4];
00304     } ext2fs_pos_acl_entry_lo;
00305 
00306 
00307 
00308 
00309 /************** JOURNAL ******************/
00310 
00311 /* These values are always in big endian */
00312 
00313 #define EXT2_JMAGIC     0xC03b3998
00314 
00315     typedef struct {
00316         uint8_t magic[4];
00317         uint8_t entrytype[4];
00318         uint8_t entryseq[4];    /* sequence of this entry */
00319         uint8_t bsize[4];       /* size of block */
00320 
00321         uint8_t num_blk[4];     /* num of blks in journal */
00322         uint8_t first_blk[4];   /* bl where log starts */
00323         uint8_t start_seq[4];   /* first commit ID in log */
00324         uint8_t start_blk[4];   /* journ blk for 1st valid entry */
00325 
00326         uint8_t j_errno[4];     /* signed error number */
00327 
00328 /* the rest are not valid for v1 sb */
00329         uint8_t feature_compat[4];
00330         uint8_t feature_incompat[4];
00331         uint8_t feature_ro_incompat[4];
00332         uint8_t uuid[16];
00333         uint8_t num_fs[4];      /* num of fs sharing log */
00334         uint8_t dynsuper[4];    /* fs block of sb copy */
00335         uint8_t max_trans[4];   /* limit of blk per trans */
00336         uint8_t max_trans_data[4];      /* limit of data blocks per */
00337         uint8_t reserved[176];
00338         uint8_t id_fs[16][48];  /* Ids of fs sharing log */
00339     } ext2fs_journ_sb;
00340 
00341 
00342 #define EXT2_J_ETYPE_DESC       1       /* descriptor block */
00343 #define EXT2_J_ETYPE_COM        2       /* commit */
00344 #define EXT2_J_ETYPE_SB1        3       /* super block v1 */
00345 #define EXT2_J_ETYPE_SB2        4       /* sb v2 */
00346 #define EXT2_J_ETYPE_REV        5       /* revoke */
00347 
00348 
00349 /* Header that is used for all structures */
00350     typedef struct {
00351         uint8_t magic[4];
00352         uint8_t entry_type[4];
00353         uint8_t entry_seq[4];
00354     } ext2fs_journ_head;
00355 
00356 
00357 /* dentry flags */
00358 #define EXT2_J_DENTRY_ESC       1       /* The orig block starts with magic */
00359 #define EXT2_J_DENTRY_SAMEID    2       /* Entry is for same id, so do not skip 16 ahead */
00360 #define EXT2_J_DENTRY_DEL       4       /* not currently used in src */
00361 #define EXT2_J_DENTRY_LAST      8       /* Last tag */
00362 
00363 /* Entry in the descriptor table */
00364     typedef struct {
00365         uint8_t fs_blk[4];
00366         uint8_t flag[4];
00367     } ext2fs_journ_dentry;
00368 
00369 
00370 /* Journal Info */
00371     typedef struct {
00372 
00373         TSK_FS_INODE *fs_inode;
00374         INUM_T j_inum;
00375 
00376         uint32_t bsize;
00377         DADDR_T first_block;
00378         DADDR_T last_block;
00379 
00380         uint32_t start_seq;
00381         DADDR_T start_blk;
00382 
00383     } EXT2FS_JINFO;
00384 
00385 
00386 
00387     /*
00388      * Structure of an ext2fs file system handle.
00389      */
00390     typedef struct {
00391         TSK_FS_INFO fs_info;    /* super class */
00392         ext2fs_sb *fs;          /* super block */
00393 
00394         ext2fs_gd *grp_buf;     /* cached group descriptor */
00395         EXT2_GRPNUM_T grp_num;  /* cached group number */
00396 
00397         UCHAR *bmap_buf;        /* cached block allocation bitmap */
00398         EXT2_GRPNUM_T bmap_grp_num;     /* cached block bitmap nr */
00399 
00400         UCHAR *imap_buf;        /* cached inode allocation bitmap */
00401         EXT2_GRPNUM_T imap_grp_num;     /* cached inode bitmap nr */
00402 
00403         ext2fs_inode *dino_buf; /* cached disk inode */
00404         INUM_T dino_inum;       /* cached inode number */
00405 
00406         OFF_T groups_offset;    /* offset to first group desc */
00407         EXT2_GRPNUM_T groups_count;     /* nr of descriptor group blocks */
00408         uint8_t deentry_type;   /* v1 or v2 of dentry */
00409         uint16_t inode_size;    /* size of each inode */
00410         DADDR_T first_data_block;
00411 
00412         EXT2FS_JINFO *jinfo;
00413     } EXT2FS_INFO;
00414 
00415     extern uint8_t ext2fs_dent_walk(TSK_FS_INFO *, INUM_T,
00416         TSK_FS_DENT_FLAG_ENUM, TSK_FS_DENT_TYPE_WALK_CB, void *);
00417     extern uint8_t ext2fs_jentry_walk(TSK_FS_INFO *, int,
00418         TSK_FS_JENTRY_WALK_CB, void *);
00419     extern uint8_t ext2fs_jblk_walk(TSK_FS_INFO *, DADDR_T, DADDR_T, int,
00420         TSK_FS_JBLK_WALK_CB, void *);
00421     extern uint8_t ext2fs_jopen(TSK_FS_INFO *, INUM_T);
00422 
00423 #ifdef __cplusplus
00424 }
00425 #endif
00426 #endif

Generated on Thu Apr 19 14:58:53 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.4.2