#include "fs_tools_i.h"
#include "ntfs.h"
#include <ctype.h>
Defines | |
#define | NSEC_BTWN_1601_1970 (uint64_t)(116444736000000000ULL) |
#define | NTFS_PRINT_WIDTH 8 |
Functions | |
uint32_t | nt2unixtime (uint64_t ntdate) |
uint8_t | ntfs_data_walk (NTFS_INFO *ntfs, INUM_T inum, TSK_FS_DATA *fs_data, int flags, TSK_FS_FILE_WALK_CB action, void *ptr) |
uint8_t | ntfs_dinode_load (NTFS_INFO *ntfs, INUM_T mftnum) |
uint8_t | ntfs_attrname_lookup (TSK_FS_INFO *fs, uint16_t type, char *name, int len) |
uint8_t | ntfs_load_sxx_buffer (TSK_FS_INFO *fs, DADDR_T addr, char *buf, size_t size, TSK_FS_BLOCK_FLAG_ENUM flags, void *ptr) |
uint8_t | ntfs_file_walk (TSK_FS_INFO *fs, TSK_FS_INODE *fs_inode, uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB action, void *ptr) |
Walk the contents of a file and use the callback for each cluster. | |
uint8_t | ntfs_block_walk (TSK_FS_INFO *fs, DADDR_T start_blk, DADDR_T end_blk, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB action, void *ptr) |
uint8_t | ntfs_inode_walk (TSK_FS_INFO *fs, INUM_T start_inum, INUM_T end_inum, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB action, void *ptr) |
char * | ntfs_get_sid_as_string (TSK_FS_INFO *fs, uint32_t security_id) |
uint8_t | ntfs_jopen (TSK_FS_INFO *fs, INUM_T inum) |
uint8_t | ntfs_jentry_walk (TSK_FS_INFO *fs, int flags, TSK_FS_JENTRY_WALK_CB action, void *ptr) |
uint8_t | ntfs_jblk_walk (TSK_FS_INFO *fs, DADDR_T start, DADDR_T end, int flags, TSK_FS_JBLK_WALK_CB action, void *ptr) |
TSK_FS_INFO * | ntfs_open (TSK_IMG_INFO *img_info, SSIZE_T offset, TSK_FS_INFO_TYPE_ENUM ftype, uint8_t test) |
|
Walk the contents of a file and use the callback for each cluster. This actually just finds the specific attribute and then calls data_walk. If TSK_FS_FILE_FLAG_RECOVER is set, then error codes are set to _RECOVER so that errors can be more easily suppressed. No special recovery logic exists in this code. action uses: TSK_FS_BLOCK_FLAG_CONT No notion of meta with NTFS
|