Main Page | Data Structures | Directories | File List | Data Fields | Globals

fs_tools.h

Go to the documentation of this file.
00001 /*
00002 ** fs_tools
00003 ** The Sleuth Kit 
00004 **
00005 ** This header file is to be included if file system routines
00006 ** are used from the library.  
00007 **
00008 ** $Date: 2007/04/19 19:01:32 $
00009 **
00010 ** Brian Carrier [carrier@sleuthkit.org]
00011 ** Copyright (c) 2003-2007 Brian Carrier.  All rights reserved
00012 **
00013 ** TASK
00014 ** Copyright (c) 2002 @stake Inc.  All rights reserved
00015 ** 
00016 ** Copyright (c) 1997,1998,1999, International Business Machines          
00017 ** Corporation and others. All Rights Reserved.
00018 */
00019 
00027 #ifndef _TSK_FS_TOOLS_H
00028 #define _TSK_FS_TOOLS_H
00029 
00030 #include "img_tools.h"
00031 #include <sys/types.h>
00032 
00033 
00034 
00035 #ifdef __cplusplus
00036 extern "C" {
00037 #endif
00038 
00039 /****************  FILE SYSTEM TYPES SECTION ********************/
00040 
00046     enum TSK_FS_INFO_TYPE_ENUM {
00047         TSK_FS_INFO_TYPE_FS_MASK = 0xf0,
00048         TSK_FS_INFO_TYPE_SUB_MASK = 0x0f,
00049 
00050         TSK_FS_INFO_TYPE_UNSUPP = 0x00,
00051 
00052         TSK_FS_INFO_TYPE_FFS_TYPE = 0x10,
00053         TSK_FS_INFO_TYPE_FFS_1 = 0x11,  /* UFS1 - FreeBSD, OpenBSD, BSDI ... */
00054         TSK_FS_INFO_TYPE_FFS_1B = 0x12, /* Solaris (no type) */
00055         TSK_FS_INFO_TYPE_FFS_2 = 0x13,  /* UFS2 - FreeBSD, NetBSD */
00056         TSK_FS_INFO_TYPE_FFS_AUTO = 0x14,
00057 
00058         TSK_FS_INFO_TYPE_EXT_TYPE = 0x20,
00059         TSK_FS_INFO_TYPE_EXT_2 = 0x21,
00060         TSK_FS_INFO_TYPE_EXT_3 = 0x22,
00061         TSK_FS_INFO_TYPE_EXT_AUTO = 0x23,
00062 
00063         TSK_FS_INFO_TYPE_FAT_TYPE = 0x30,
00064         TSK_FS_INFO_TYPE_FAT_12 = 0x31,
00065         TSK_FS_INFO_TYPE_FAT_16 = 0x32,
00066         TSK_FS_INFO_TYPE_FAT_32 = 0x33,
00067         TSK_FS_INFO_TYPE_FAT_AUTO = 0x34,
00068 
00069         TSK_FS_INFO_TYPE_NTFS_TYPE = 0x40,
00070         TSK_FS_INFO_TYPE_NTFS = 0x40,
00071         TSK_FS_INFO_TYPE_NTFS_AUTO = 0x40,
00072 
00073         TSK_FS_INFO_TYPE_SWAP_TYPE = 0x50,
00074         TSK_FS_INFO_TYPE_SWAP = 0x50,
00075 
00076         TSK_FS_INFO_TYPE_RAW_TYPE = 0x60,
00077         TSK_FS_INFO_TYPE_RAW = 0x60,
00078 
00079         TSK_FS_INFO_TYPE_ISO9660_TYPE = 0x70,
00080         TSK_FS_INFO_TYPE_ISO9660 = 0x70,
00081 
00082         TSK_FS_INFO_TYPE_HFS_TYPE = 0x80,
00083         TSK_FS_INFO_TYPE_HFS = 0x80,
00084     };
00085     typedef enum TSK_FS_INFO_TYPE_ENUM TSK_FS_INFO_TYPE_ENUM;
00086 
00087     extern TSK_FS_INFO_TYPE_ENUM tsk_fs_parse_type(const TSK_TCHAR *);
00088     extern void tsk_fs_print_types(FILE *);
00089     extern char *tsk_fs_get_type(TSK_FS_INFO_TYPE_ENUM);
00090 
00091     typedef struct TSK_FS_INFO TSK_FS_INFO;
00092     typedef struct TSK_FS_DATA TSK_FS_DATA;
00093     typedef struct TSK_FS_DATA_RUN TSK_FS_DATA_RUN;
00094     typedef struct TSK_FS_INODE_NAME_LIST TSK_FS_INODE_NAME_LIST;
00095     typedef struct TSK_FS_JENTRY TSK_FS_JENTRY;
00096 
00097 
00098 
00099 
00100 /************************************************************************* 
00101  * Directory entries 
00102  */
00103 
00108     enum TSK_FS_DENT_FLAG_ENUM {
00109         TSK_FS_DENT_FLAG_ALLOC = (1 << 0),      
00110         TSK_FS_DENT_FLAG_UNALLOC = (1 << 1),    
00111         TSK_FS_DENT_FLAG_RECURSE = (1 << 2),    
00112     };
00113     typedef enum TSK_FS_DENT_FLAG_ENUM TSK_FS_DENT_FLAG_ENUM;
00114 
00115 
00119     enum TSK_FS_DENT_TYPE_ENUM {
00120         TSK_FS_DENT_TYPE_UNDEF = 0,     
00121         TSK_FS_DENT_TYPE_FIFO = 1,      
00122         TSK_FS_DENT_TYPE_CHR = 2,       
00123         TSK_FS_DENT_TYPE_DIR = 4,       
00124         TSK_FS_DENT_TYPE_BLK = 6,       
00125         TSK_FS_DENT_TYPE_REG = 8,       
00126         TSK_FS_DENT_TYPE_LNK = 10,      
00127         TSK_FS_DENT_TYPE_SOCK = 12,     
00128         TSK_FS_DENT_TYPE_SHAD = 13,     
00129         TSK_FS_DENT_TYPE_WHT = 14,      
00130     };
00131     typedef enum TSK_FS_DENT_TYPE_ENUM TSK_FS_DENT_TYPE_ENUM;
00132 
00133 #define TSK_FS_DENT_TYPE_MAX_STR 15     
00134 
00135 /* ascii representation of above types */
00136     extern char tsk_fs_dent_str[TSK_FS_DENT_TYPE_MAX_STR][2];
00137 
00144     struct TSK_FS_DENT {
00145         char *name;             
00146         ULONG name_max;         
00147 
00148         char *shrt_name;        
00149         ULONG shrt_name_max;    
00150 
00151         char *path;             
00152         unsigned int pathdepth; 
00153 
00154         INUM_T inode;           
00155         struct TSK_FS_INODE *fsi;       
00156 
00157         TSK_FS_DENT_TYPE_ENUM ent_type; 
00158         TSK_FS_DENT_FLAG_ENUM flags;    
00159     };
00160 
00161     typedef struct TSK_FS_DENT TSK_FS_DENT;
00162 
00163 
00164 /******************* INODE / META DATA **************/
00165 
00166 
00170     enum TSK_FS_INODE_FLAG_ENUM {
00171         TSK_FS_INODE_FLAG_ALLOC = (1 << 0),     
00172         TSK_FS_INODE_FLAG_UNALLOC = (1 << 1),   
00173         TSK_FS_INODE_FLAG_USED = (1 << 2),      
00174         TSK_FS_INODE_FLAG_UNUSED = (1 << 3),    
00175         TSK_FS_INODE_FLAG_ORPHAN = (1 << 4),    
00176         TSK_FS_INODE_FLAG_COMP = (1 << 5)       
00177     };
00178     typedef enum TSK_FS_INODE_FLAG_ENUM TSK_FS_INODE_FLAG_ENUM;
00179 
00180 
00181 
00185 #define TSK_FS_INODE_NAME_LIST_NSIZE    512
00186 
00194     struct TSK_FS_INODE_NAME_LIST {
00195         TSK_FS_INODE_NAME_LIST *next;   
00196         char name[TSK_FS_INODE_NAME_LIST_NSIZE];        
00197         INUM_T par_inode;       
00198         uint32_t par_seq;       
00199     };
00200 
00204     struct TSK_FS_INODE {
00205         INUM_T addr;            
00206         mode_t mode;            
00207         int nlink;              
00208         OFF_T size;             
00209         uid_t uid;              
00210         gid_t gid;              
00211 
00212         /* @@@ Need to make these 64-bits ... ? */
00213         time_t mtime;           
00214         time_t atime;           
00215         time_t ctime;           
00216 
00217         /* filesystem specific times */
00218         union {
00219             struct {
00220                 time_t crtime;  
00221             };
00222             struct {
00223                 time_t dtime;   
00224             };
00225             struct {
00226                 time_t bkup_time;       
00227                 time_t attr_mtime;      
00228             };
00229         };
00230 
00231         DADDR_T *direct_addr;   
00232         int direct_count;       
00233         DADDR_T *indir_addr;    
00234         int indir_count;        
00235 
00236         uint32_t seq;           
00237         TSK_FS_DATA *attr;      
00238         TSK_FS_INODE_NAME_LIST *name;   
00239         char *link;             
00240 
00241         TSK_FS_INODE_FLAG_ENUM flags;   
00242     };
00243 
00244     typedef struct TSK_FS_INODE TSK_FS_INODE;
00245 
00246     extern TSK_FS_INODE *tsk_fs_inode_alloc(int, int);
00247     extern TSK_FS_INODE *tsk_fs_inode_realloc(TSK_FS_INODE *, int, int);
00248     extern void tsk_fs_inode_free(TSK_FS_INODE *);
00249 
00250 
00253 #define TSK_FS_ORPHAN_STR "-ORPHAN_FILE-"
00254 
00255 /* Type of file in the mode field of Inodes.  FAT and NTFS are converted
00256  * to this mode value */
00257 
00262     enum TSK_FS_INODE_MODE_ENUM {
00263 
00264         /* the following are file types */
00265         TSK_FS_INODE_MODE_FMT = 0170000,        
00266         TSK_FS_INODE_MODE_FIFO = 0010000,       
00267         TSK_FS_INODE_MODE_CHR = 0020000,        
00268         TSK_FS_INODE_MODE_DIR = 0040000,        
00269         TSK_FS_INODE_MODE_BLK = 0060000,        
00270         TSK_FS_INODE_MODE_REG = 0100000,        
00271         TSK_FS_INODE_MODE_LNK = 0120000,        
00272         TSK_FS_INODE_MODE_SHAD = 0130000,       
00273         TSK_FS_INODE_MODE_SOCK = 0140000,       
00274         TSK_FS_INODE_MODE_WHT = 0160000,        
00275 
00276         /* The following describe the file permissions */
00277         TSK_FS_INODE_MODE_ISUID = 0004000,      
00278         TSK_FS_INODE_MODE_ISGID = 0002000,      
00279         TSK_FS_INODE_MODE_ISVTX = 0001000,      
00280 
00281         TSK_FS_INODE_MODE_IRUSR = 0000400,      
00282         TSK_FS_INODE_MODE_IWUSR = 0000200,      
00283         TSK_FS_INODE_MODE_IXUSR = 0000100,      
00284 
00285         TSK_FS_INODE_MODE_IRGRP = 0000040,      
00286         TSK_FS_INODE_MODE_IWGRP = 0000020,      
00287         TSK_FS_INODE_MODE_IXGRP = 0000010,      
00288 
00289         TSK_FS_INODE_MODE_IROTH = 0000004,      
00290         TSK_FS_INODE_MODE_IWOTH = 0000002,      
00291         TSK_FS_INODE_MODE_IXOTH = 0000001       
00292     };
00293     typedef enum TSK_FS_INODE_MODE_ENUM TSK_FS_INODE_MODE_ENUM;
00294 
00295 
00296 #define TSK_FS_INODE_MODE_TYPE_SHIFT    12      
00297 #define TSK_FS_INODE_MODE_TYPE_STR_MAX 15       
00298 
00299     extern char tsk_fs_inode_mode_str[TSK_FS_INODE_MODE_TYPE_STR_MAX][2];
00300 
00301 
00304     enum TSK_FS_BLOCK_FLAG_ENUM {
00305         TSK_FS_BLOCK_FLAG_ALLOC = (1 << 0),     
00306         TSK_FS_BLOCK_FLAG_UNALLOC = (1 << 1),   
00307         TSK_FS_BLOCK_FLAG_CONT = (1 << 2),      
00308         TSK_FS_BLOCK_FLAG_META = (1 << 3),      
00309         TSK_FS_BLOCK_FLAG_BAD = (1 << 4),       
00310         TSK_FS_BLOCK_FLAG_ALIGN = (1 << 5),     
00311         TSK_FS_BLOCK_FLAG_RES = (1 << 6),       
00312         TSK_FS_BLOCK_FLAG_SPARSE = (1 << 7),    
00313         TSK_FS_BLOCK_FLAG_COMP = (1 << 8)       
00314     };
00315     typedef enum TSK_FS_BLOCK_FLAG_ENUM TSK_FS_BLOCK_FLAG_ENUM;
00316 
00317 
00318 
00322     enum TSK_FS_FILE_FLAG_ENUM {
00323         TSK_FS_FILE_FLAG_AONLY = (1 << 0),      
00324         TSK_FS_FILE_FLAG_SLACK = (1 << 1),      
00325         TSK_FS_FILE_FLAG_RECOVER = (1 << 2),    
00326         TSK_FS_FILE_FLAG_META = (1 << 3),       
00327         TSK_FS_FILE_FLAG_NOSPARSE = (1 << 4),   
00328         TSK_FS_FILE_FLAG_NOID = (1 << 5)        
00329     };
00330     typedef enum TSK_FS_FILE_FLAG_ENUM TSK_FS_FILE_FLAG_ENUM;
00331 
00332 /* walk callback functions */
00333     typedef uint8_t(*TSK_FS_INODE_WALK_CB) (TSK_FS_INFO *, TSK_FS_INODE *,
00334         void *);
00335     typedef uint8_t(*TSK_FS_BLOCK_WALK_CB) (TSK_FS_INFO *, DADDR_T, char *,
00336         TSK_FS_BLOCK_FLAG_ENUM, void *);
00337     typedef uint8_t(*TSK_FS_DENT_TYPE_WALK_CB) (TSK_FS_INFO *,
00338         TSK_FS_DENT *, void *);
00339     typedef uint8_t(*TSK_FS_FILE_WALK_CB) (TSK_FS_INFO *, DADDR_T, char *,
00340         size_t, TSK_FS_BLOCK_FLAG_ENUM, void *);
00341     typedef uint8_t(*TSK_FS_JBLK_WALK_CB) (TSK_FS_INFO *, char *, int,
00342         void *);
00343     typedef uint8_t(*TSK_FS_JENTRY_WALK_CB) (TSK_FS_INFO *,
00344         TSK_FS_JENTRY *, int, void *);
00345 
00346 
00347 /******************************* TSK_FS_INFO ******************/
00348 
00352     enum TSK_FS_INFO_FLAG_ENUM {
00353         TSK_FS_INFO_FLAG_HAVE_SEQ = (1 << 0)    
00354     };
00355     typedef enum TSK_FS_INFO_FLAG_ENUM TSK_FS_INFO_FLAG_ENUM;
00356 
00357 
00364     struct TSK_FS_INFO {
00365         TSK_IMG_INFO *img_info; 
00366         SSIZE_T offset;         
00367 
00368         /* meta data */
00369         INUM_T inum_count;      
00370         INUM_T root_inum;       
00371         INUM_T first_inum;      
00372         INUM_T last_inum;       
00373 
00374         /* content */
00375         DADDR_T block_count;    
00376         DADDR_T first_block;    
00377         DADDR_T last_block;     
00378         unsigned int block_size;        
00379         unsigned int dev_bsize; 
00380 
00381         /* Journal */
00382         INUM_T journ_inum;      
00383 
00384         TSK_FS_INFO_TYPE_ENUM ftype;    
00385         char *duname;           
00386         TSK_FS_INFO_FLAG_ENUM flags;    
00387 
00388         uint8_t endian;         
00389 
00390         TSK_LIST *list_inum_named;      
00396          uint8_t(*block_walk) (TSK_FS_INFO *, DADDR_T, DADDR_T,
00397             TSK_FS_BLOCK_FLAG_ENUM, TSK_FS_BLOCK_WALK_CB, void *);
00398 
00400          uint8_t(*inode_walk) (TSK_FS_INFO *, INUM_T, INUM_T,
00401             TSK_FS_INODE_FLAG_ENUM, TSK_FS_INODE_WALK_CB, void *);
00402 
00404         TSK_FS_INODE *(*inode_lookup) (TSK_FS_INFO *, INUM_T);
00405 
00407          uint8_t(*istat) (TSK_FS_INFO *, FILE *, INUM_T, DADDR_T, int32_t);
00408 
00410          uint8_t(*file_walk) (TSK_FS_INFO *, TSK_FS_INODE *, uint32_t,
00411             uint16_t, TSK_FS_FILE_FLAG_ENUM, TSK_FS_FILE_WALK_CB, void *);
00412 
00414          uint8_t(*dent_walk) (TSK_FS_INFO *, INUM_T, TSK_FS_DENT_FLAG_ENUM,
00415             TSK_FS_DENT_TYPE_WALK_CB, void *);
00416 
00418          uint8_t(*jopen) (TSK_FS_INFO *, INUM_T);
00419 
00421          uint8_t(*jblk_walk) (TSK_FS_INFO *, DADDR_T, DADDR_T, int,
00422             TSK_FS_JBLK_WALK_CB, void *);
00423 
00425          uint8_t(*jentry_walk) (TSK_FS_INFO *, int, TSK_FS_JENTRY_WALK_CB,
00426             void *);
00427 
00428 
00430          uint8_t(*fsstat) (TSK_FS_INFO *, FILE *);
00431 
00433          uint8_t(*fscheck) (TSK_FS_INFO *, FILE *);
00434 
00436         void (*close) (TSK_FS_INFO *);
00437     };
00438 
00439 
00440 
00441 /***************************************************************
00442  * Generic inode structure for filesystem-independent operations.
00443  */
00444 
00445 
00446 /* 
00447  * All non-resident addresses will be stored here so that the search
00448  * programs (find_inode) can account for the addresses. 
00449  *
00450  * All resident non-standard attributes will be stored here so they
00451  * can be displayed.  By default, the $Data attribute will be saved
00452  * in the TSK_FS_INODE structure. If the $Data attribute is resident,
00453  * then the dir/indir stuff will be 0 and the $Data will be the
00454  * first element in this linked list 
00455  */
00456 
00460     enum TSK_FS_DATA_RUN_FLAG_ENUM {
00461         TSK_FS_DATA_RUN_FLAG_FILLER = 0x1,      
00462         TSK_FS_DATA_RUN_FLAG_SPARSE = 0x2       
00463     };
00464     typedef enum TSK_FS_DATA_RUN_FLAG_ENUM TSK_FS_DATA_RUN_FLAG_ENUM;
00465 
00466 /* len = 0 when not being used */
00471     struct TSK_FS_DATA_RUN {
00472         TSK_FS_DATA_RUN *next;  
00473         DADDR_T addr;           
00474         DADDR_T len;            
00475         TSK_FS_DATA_RUN_FLAG_ENUM flags;        
00476     };
00477 
00478 
00482     enum TSK_FS_DATA_FLAG_ENUM {
00483         TSK_FS_DATA_INUSE = 0x1,        
00484         TSK_FS_DATA_NONRES = 0x2,       
00485         TSK_FS_DATA_RES = 0x4,  
00486         TSK_FS_DATA_ENC = 0x10, 
00487         TSK_FS_DATA_COMP = 0x20,        
00488         TSK_FS_DATA_SPARSE = 0x40,      
00489     };
00490     typedef enum TSK_FS_DATA_FLAG_ENUM TSK_FS_DATA_FLAG_ENUM;
00491 
00500     struct TSK_FS_DATA {
00501         TSK_FS_DATA *next;      
00502         TSK_FS_DATA_FLAG_ENUM flags;    
00503         char *name;             
00504         size_t nsize;           
00505         uint32_t type;          
00506         uint16_t id;            
00507 
00508         OFF_T size;             
00509 
00510         /* Run-List data (non-resident) */
00511         TSK_FS_DATA_RUN *run;   
00512         OFF_T allocsize;        
00513         uint32_t compsize;      
00514 
00515         /* stream data (resident) */
00516         size_t buflen;          
00517         uint8_t *buf;           
00518     };
00519 
00520 
00521 
00522     extern TSK_FS_DATA *tsk_fs_data_alloc(TSK_FS_DATA_FLAG_ENUM);
00523     extern TSK_FS_DATA_RUN *tsk_fs_data_run_alloc();
00524     extern TSK_FS_DATA *tsk_fs_data_getnew_attr(TSK_FS_DATA *,
00525         TSK_FS_DATA_FLAG_ENUM);
00526     extern void tsk_fs_data_clear_list(TSK_FS_DATA *);
00527 
00528     extern TSK_FS_DATA *tsk_fs_data_put_str(TSK_FS_DATA *, char *,
00529         uint32_t, uint16_t, void *, unsigned int);
00530 
00531     extern TSK_FS_DATA *tsk_fs_data_put_run(TSK_FS_DATA *, DADDR_T, OFF_T,
00532         TSK_FS_DATA_RUN *, char *, uint32_t, uint16_t, OFF_T,
00533         TSK_FS_DATA_FLAG_ENUM, uint32_t);
00534 
00535     extern TSK_FS_DATA *tsk_fs_data_lookup(TSK_FS_DATA *, uint32_t,
00536         uint16_t);
00537     extern TSK_FS_DATA *tsk_fs_data_lookup_noid(TSK_FS_DATA *, uint32_t);
00538 
00539     extern void tsk_fs_data_run_free(TSK_FS_DATA_RUN *);
00540     extern void tsk_fs_data_free(TSK_FS_DATA *);
00541 
00542 
00543 
00544 /**************** Journal Stuff **********************/
00545     struct TSK_FS_JENTRY {
00546         DADDR_T jblk;           /* journal block address */
00547         DADDR_T fsblk;          /* fs block that journal entry is about */
00548     };
00549 
00550 
00551 
00552 /* function decs */
00553     extern TSK_FS_DENT *tsk_fs_dent_alloc(ULONG, ULONG);
00554     extern TSK_FS_DENT *tsk_fs_dent_realloc(TSK_FS_DENT *, ULONG);
00555     extern void tsk_fs_dent_free(TSK_FS_DENT *);
00556     extern void tsk_fs_dent_print(FILE *, TSK_FS_DENT *,
00557         TSK_FS_INFO *, TSK_FS_DATA *);
00558     extern void tsk_fs_dent_print_long(FILE *, TSK_FS_DENT *,
00559         TSK_FS_INFO *, TSK_FS_DATA *);
00560     extern void tsk_fs_dent_print_mac(FILE *, TSK_FS_DENT *,
00561         TSK_FS_INFO *, TSK_FS_DATA * fs_data, char *);
00562 
00563     extern void tsk_fs_make_ls(mode_t, char *);
00564     extern void tsk_fs_print_day(FILE *, time_t);
00565     extern void tsk_fs_print_time(FILE *, time_t);
00566 
00567 /*
00568 ** Is this string a "." or ".."
00569 */
00570 #define TSK_FS_ISDOT(str) ( ((str[0] == '.') && \
00571  ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 )
00572 
00573 
00574 
00575 /**************************************************************8
00576  * Generic routines.
00577  */
00578     extern TSK_FS_INFO *tsk_fs_open(TSK_IMG_INFO *, SSIZE_T,
00579         const TSK_TCHAR *);
00580 
00581 /* fs_io routines */
00582     extern SSIZE_T tsk_fs_read_block(TSK_FS_INFO *, TSK_DATA_BUF *, OFF_T,
00583         DADDR_T);
00584     extern SSIZE_T tsk_fs_read_block_nobuf(TSK_FS_INFO *, char *, OFF_T,
00585         DADDR_T);
00586 #define tsk_fs_read_random(fsi, buf, len, offs) \
00587         (fsi)->img_info->read_random((fsi)->img_info, (fsi)->offset, (buf), (len), (offs))
00588 
00589     extern char *tsk_fs_load_file(TSK_FS_INFO *, TSK_FS_INODE *, uint32_t,
00590         uint16_t, int);
00591 
00592     extern SSIZE_T
00593         tsk_fs_read_file(TSK_FS_INFO *, TSK_FS_INODE *, uint32_t, uint16_t,
00594         SSIZE_T, SSIZE_T, char *);
00595 
00596     extern SSIZE_T
00597         tsk_fs_read_file_noid(TSK_FS_INFO *, TSK_FS_INODE *, SSIZE_T,
00598         SSIZE_T, char *);
00599 
00600 
00601 
00602 /***** LIBRARY ROUTINES FOR COMMAND LINE FUNCTIONS */
00603 #define TSK_FS_DCALC_DD        0x1
00604 #define TSK_FS_DCALC_DLS       0x2
00605 #define TSK_FS_DCALC_SLACK     0x4
00606     extern int8_t tsk_fs_dcalc(TSK_FS_INFO * fs, uint8_t lclflags,
00607         DADDR_T cnt);
00608 
00609 
00610 #define TSK_FS_DCAT_HEX                0x1
00611 #define TSK_FS_DCAT_ASCII   0x2
00612 #define TSK_FS_DCAT_HTML       0x4
00613 #define TSK_FS_DCAT_STAT       0x8
00614     extern uint8_t tsk_fs_dcat(TSK_FS_INFO * fs, uint8_t lclflags,
00615         DADDR_T addr, DADDR_T read_num_units);
00616 
00617 
00618 #define TSK_FS_DLS_CAT     0x01
00619 #define TSK_FS_DLS_LIST    0x02
00620 #define TSK_FS_DLS_SLACK   0x04
00621     extern uint8_t tsk_fs_dls(TSK_FS_INFO * fs, uint8_t lclflags,
00622         DADDR_T bstart, DADDR_T bend, TSK_FS_BLOCK_FLAG_ENUM flags);
00623 
00624     extern uint8_t tsk_fs_dstat(TSK_FS_INFO * fs, uint8_t lclflags,
00625         DADDR_T addr, TSK_FS_BLOCK_FLAG_ENUM flags);
00626 
00627 #define TSK_FS_FFIND_ALL 0x1
00628     extern uint8_t tsk_fs_ffind(TSK_FS_INFO * fs, uint8_t lclflags,
00629         INUM_T inode, uint32_t type, uint16_t id, int flags);
00630 
00631 
00632 
00633 #define TSK_FS_FLS_DOT         0x001
00634 #define TSK_FS_FLS_LONG        0x002
00635 #define TSK_FS_FLS_FILE        0x004
00636 #define TSK_FS_FLS_DIR         0x008
00637 #define TSK_FS_FLS_FULL        0x010
00638 #define TSK_FS_FLS_MAC         0x020
00639     extern uint8_t tsk_fs_fls(TSK_FS_INFO * fs, uint8_t lclflags,
00640         INUM_T inode, int flags, TSK_TCHAR * pre, int32_t skew);
00641 
00642 
00643     extern uint8_t tsk_fs_icat(TSK_FS_INFO * fs, uint8_t lclflags,
00644         INUM_T inum, uint32_t type, uint16_t id, int flags);
00645 
00646 
00647 #define TSK_FS_IFIND_ALL       0x01
00648 #define TSK_FS_IFIND_PATH      0x04
00649 #define TSK_FS_IFIND_DATA      0x08
00650 #define TSK_FS_IFIND_PAR       0x10
00651 #define TSK_FS_IFIND_PAR_LONG  0x20
00652     extern int8_t tsk_fs_ifind_path(TSK_FS_INFO * fs, uint8_t lclflags,
00653         TSK_TCHAR * path, INUM_T * result);
00654     extern uint8_t tsk_fs_ifind_data(TSK_FS_INFO * fs, uint8_t lclflags,
00655         DADDR_T blk);
00656     extern uint8_t tsk_fs_ifind_par(TSK_FS_INFO * fs, uint8_t lclflags,
00657         INUM_T par);
00658 
00659 
00660 #define TSK_FS_ILS_OPEN        (1<<0)
00661 #define TSK_FS_ILS_MAC          (1<<1)
00662 #define TSK_FS_ILS_LINK (1<<2)
00663 #define TSK_FS_ILS_UNLINK       (1<<3)
00664 
00665     extern uint8_t tsk_fs_ils(TSK_FS_INFO * fs, uint8_t lclflags,
00666         INUM_T istart, INUM_T ilast, int flags, int32_t skew,
00667         TSK_TCHAR * img);
00668 
00669 
00670 
00671 #ifdef __cplusplus
00672 }
00673 #endif
00674 #endif
00675 /* LICENSE
00676  * .ad
00677  * .fi
00678  *      This software is distributed under the IBM Public License.
00679  * AUTHOR(S)
00680  *      Wietse Venema
00681  *      IBM T.J. Watson Research
00682  *      P.O. Box 704
00683  *      Yorktown Heights, NY 10598, USA
00684  --*/

Generated on Thu Apr 19 14:58:53 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.4.2