00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00027 #ifndef _TSK_FS_TOOLS_H
00028 #define _TSK_FS_TOOLS_H
00029
00030 #include "img_tools.h"
00031 #include <sys/types.h>
00032
00033
00034
00035 #ifdef __cplusplus
00036 extern "C" {
00037 #endif
00038
00039
00040
00046 enum TSK_FS_INFO_TYPE_ENUM {
00047 TSK_FS_INFO_TYPE_FS_MASK = 0xf0,
00048 TSK_FS_INFO_TYPE_SUB_MASK = 0x0f,
00049
00050 TSK_FS_INFO_TYPE_UNSUPP = 0x00,
00051
00052 TSK_FS_INFO_TYPE_FFS_TYPE = 0x10,
00053 TSK_FS_INFO_TYPE_FFS_1 = 0x11,
00054 TSK_FS_INFO_TYPE_FFS_1B = 0x12,
00055 TSK_FS_INFO_TYPE_FFS_2 = 0x13,
00056 TSK_FS_INFO_TYPE_FFS_AUTO = 0x14,
00057
00058 TSK_FS_INFO_TYPE_EXT_TYPE = 0x20,
00059 TSK_FS_INFO_TYPE_EXT_2 = 0x21,
00060 TSK_FS_INFO_TYPE_EXT_3 = 0x22,
00061 TSK_FS_INFO_TYPE_EXT_AUTO = 0x23,
00062
00063 TSK_FS_INFO_TYPE_FAT_TYPE = 0x30,
00064 TSK_FS_INFO_TYPE_FAT_12 = 0x31,
00065 TSK_FS_INFO_TYPE_FAT_16 = 0x32,
00066 TSK_FS_INFO_TYPE_FAT_32 = 0x33,
00067 TSK_FS_INFO_TYPE_FAT_AUTO = 0x34,
00068
00069 TSK_FS_INFO_TYPE_NTFS_TYPE = 0x40,
00070 TSK_FS_INFO_TYPE_NTFS = 0x40,
00071 TSK_FS_INFO_TYPE_NTFS_AUTO = 0x40,
00072
00073 TSK_FS_INFO_TYPE_SWAP_TYPE = 0x50,
00074 TSK_FS_INFO_TYPE_SWAP = 0x50,
00075
00076 TSK_FS_INFO_TYPE_RAW_TYPE = 0x60,
00077 TSK_FS_INFO_TYPE_RAW = 0x60,
00078
00079 TSK_FS_INFO_TYPE_ISO9660_TYPE = 0x70,
00080 TSK_FS_INFO_TYPE_ISO9660 = 0x70,
00081
00082 TSK_FS_INFO_TYPE_HFS_TYPE = 0x80,
00083 TSK_FS_INFO_TYPE_HFS = 0x80,
00084 };
00085 typedef enum TSK_FS_INFO_TYPE_ENUM TSK_FS_INFO_TYPE_ENUM;
00086
00087 extern TSK_FS_INFO_TYPE_ENUM tsk_fs_parse_type(const TSK_TCHAR *);
00088 extern void tsk_fs_print_types(FILE *);
00089 extern char *tsk_fs_get_type(TSK_FS_INFO_TYPE_ENUM);
00090
00091 typedef struct TSK_FS_INFO TSK_FS_INFO;
00092 typedef struct TSK_FS_DATA TSK_FS_DATA;
00093 typedef struct TSK_FS_DATA_RUN TSK_FS_DATA_RUN;
00094 typedef struct TSK_FS_INODE_NAME_LIST TSK_FS_INODE_NAME_LIST;
00095 typedef struct TSK_FS_JENTRY TSK_FS_JENTRY;
00096
00097
00098
00099
00100
00101
00102
00103
00108 enum TSK_FS_DENT_FLAG_ENUM {
00109 TSK_FS_DENT_FLAG_ALLOC = (1 << 0),
00110 TSK_FS_DENT_FLAG_UNALLOC = (1 << 1),
00111 TSK_FS_DENT_FLAG_RECURSE = (1 << 2),
00112 };
00113 typedef enum TSK_FS_DENT_FLAG_ENUM TSK_FS_DENT_FLAG_ENUM;
00114
00115
00119 enum TSK_FS_DENT_TYPE_ENUM {
00120 TSK_FS_DENT_TYPE_UNDEF = 0,
00121 TSK_FS_DENT_TYPE_FIFO = 1,
00122 TSK_FS_DENT_TYPE_CHR = 2,
00123 TSK_FS_DENT_TYPE_DIR = 4,
00124 TSK_FS_DENT_TYPE_BLK = 6,
00125 TSK_FS_DENT_TYPE_REG = 8,
00126 TSK_FS_DENT_TYPE_LNK = 10,
00127 TSK_FS_DENT_TYPE_SOCK = 12,
00128 TSK_FS_DENT_TYPE_SHAD = 13,
00129 TSK_FS_DENT_TYPE_WHT = 14,
00130 };
00131 typedef enum TSK_FS_DENT_TYPE_ENUM TSK_FS_DENT_TYPE_ENUM;
00132
00133 #define TSK_FS_DENT_TYPE_MAX_STR 15
00134
00135
00136 extern char tsk_fs_dent_str[TSK_FS_DENT_TYPE_MAX_STR][2];
00137
00144 struct TSK_FS_DENT {
00145 char *name;
00146 ULONG name_max;
00147
00148 char *shrt_name;
00149 ULONG shrt_name_max;
00150
00151 char *path;
00152 unsigned int pathdepth;
00153
00154 INUM_T inode;
00155 struct TSK_FS_INODE *fsi;
00156
00157 TSK_FS_DENT_TYPE_ENUM ent_type;
00158 TSK_FS_DENT_FLAG_ENUM flags;
00159 };
00160
00161 typedef struct TSK_FS_DENT TSK_FS_DENT;
00162
00163
00164
00165
00166
00170 enum TSK_FS_INODE_FLAG_ENUM {
00171 TSK_FS_INODE_FLAG_ALLOC = (1 << 0),
00172 TSK_FS_INODE_FLAG_UNALLOC = (1 << 1),
00173 TSK_FS_INODE_FLAG_USED = (1 << 2),
00174 TSK_FS_INODE_FLAG_UNUSED = (1 << 3),
00175 TSK_FS_INODE_FLAG_ORPHAN = (1 << 4),
00176 TSK_FS_INODE_FLAG_COMP = (1 << 5)
00177 };
00178 typedef enum TSK_FS_INODE_FLAG_ENUM TSK_FS_INODE_FLAG_ENUM;
00179
00180
00181
00185 #define TSK_FS_INODE_NAME_LIST_NSIZE 512
00186
00194 struct TSK_FS_INODE_NAME_LIST {
00195 TSK_FS_INODE_NAME_LIST *next;
00196 char name[TSK_FS_INODE_NAME_LIST_NSIZE];
00197 INUM_T par_inode;
00198 uint32_t par_seq;
00199 };
00200
00204 struct TSK_FS_INODE {
00205 INUM_T addr;
00206 mode_t mode;
00207 int nlink;
00208 OFF_T size;
00209 uid_t uid;
00210 gid_t gid;
00211
00212
00213 time_t mtime;
00214 time_t atime;
00215 time_t ctime;
00216
00217
00218 union {
00219 struct {
00220 time_t crtime;
00221 };
00222 struct {
00223 time_t dtime;
00224 };
00225 struct {
00226 time_t bkup_time;
00227 time_t attr_mtime;
00228 };
00229 };
00230
00231 DADDR_T *direct_addr;
00232 int direct_count;
00233 DADDR_T *indir_addr;
00234 int indir_count;
00235
00236 uint32_t seq;
00237 TSK_FS_DATA *attr;
00238 TSK_FS_INODE_NAME_LIST *name;
00239 char *link;
00240
00241 TSK_FS_INODE_FLAG_ENUM flags;
00242 };
00243
00244 typedef struct TSK_FS_INODE TSK_FS_INODE;
00245
00246 extern TSK_FS_INODE *tsk_fs_inode_alloc(int, int);
00247 extern TSK_FS_INODE *tsk_fs_inode_realloc(TSK_FS_INODE *, int, int);
00248 extern void tsk_fs_inode_free(TSK_FS_INODE *);
00249
00250
00253 #define TSK_FS_ORPHAN_STR "-ORPHAN_FILE-"
00254
00255
00256
00257
00262 enum TSK_FS_INODE_MODE_ENUM {
00263
00264
00265 TSK_FS_INODE_MODE_FMT = 0170000,
00266 TSK_FS_INODE_MODE_FIFO = 0010000,
00267 TSK_FS_INODE_MODE_CHR = 0020000,
00268 TSK_FS_INODE_MODE_DIR = 0040000,
00269 TSK_FS_INODE_MODE_BLK = 0060000,
00270 TSK_FS_INODE_MODE_REG = 0100000,
00271 TSK_FS_INODE_MODE_LNK = 0120000,
00272 TSK_FS_INODE_MODE_SHAD = 0130000,
00273 TSK_FS_INODE_MODE_SOCK = 0140000,
00274 TSK_FS_INODE_MODE_WHT = 0160000,
00275
00276
00277 TSK_FS_INODE_MODE_ISUID = 0004000,
00278 TSK_FS_INODE_MODE_ISGID = 0002000,
00279 TSK_FS_INODE_MODE_ISVTX = 0001000,
00280
00281 TSK_FS_INODE_MODE_IRUSR = 0000400,
00282 TSK_FS_INODE_MODE_IWUSR = 0000200,
00283 TSK_FS_INODE_MODE_IXUSR = 0000100,
00284
00285 TSK_FS_INODE_MODE_IRGRP = 0000040,
00286 TSK_FS_INODE_MODE_IWGRP = 0000020,
00287 TSK_FS_INODE_MODE_IXGRP = 0000010,
00288
00289 TSK_FS_INODE_MODE_IROTH = 0000004,
00290 TSK_FS_INODE_MODE_IWOTH = 0000002,
00291 TSK_FS_INODE_MODE_IXOTH = 0000001
00292 };
00293 typedef enum TSK_FS_INODE_MODE_ENUM TSK_FS_INODE_MODE_ENUM;
00294
00295
00296 #define TSK_FS_INODE_MODE_TYPE_SHIFT 12
00297 #define TSK_FS_INODE_MODE_TYPE_STR_MAX 15
00298
00299 extern char tsk_fs_inode_mode_str[TSK_FS_INODE_MODE_TYPE_STR_MAX][2];
00300
00301
00304 enum TSK_FS_BLOCK_FLAG_ENUM {
00305 TSK_FS_BLOCK_FLAG_ALLOC = (1 << 0),
00306 TSK_FS_BLOCK_FLAG_UNALLOC = (1 << 1),
00307 TSK_FS_BLOCK_FLAG_CONT = (1 << 2),
00308 TSK_FS_BLOCK_FLAG_META = (1 << 3),
00309 TSK_FS_BLOCK_FLAG_BAD = (1 << 4),
00310 TSK_FS_BLOCK_FLAG_ALIGN = (1 << 5),
00311 TSK_FS_BLOCK_FLAG_RES = (1 << 6),
00312 TSK_FS_BLOCK_FLAG_SPARSE = (1 << 7),
00313 TSK_FS_BLOCK_FLAG_COMP = (1 << 8)
00314 };
00315 typedef enum TSK_FS_BLOCK_FLAG_ENUM TSK_FS_BLOCK_FLAG_ENUM;
00316
00317
00318
00322 enum TSK_FS_FILE_FLAG_ENUM {
00323 TSK_FS_FILE_FLAG_AONLY = (1 << 0),
00324 TSK_FS_FILE_FLAG_SLACK = (1 << 1),
00325 TSK_FS_FILE_FLAG_RECOVER = (1 << 2),
00326 TSK_FS_FILE_FLAG_META = (1 << 3),
00327 TSK_FS_FILE_FLAG_NOSPARSE = (1 << 4),
00328 TSK_FS_FILE_FLAG_NOID = (1 << 5)
00329 };
00330 typedef enum TSK_FS_FILE_FLAG_ENUM TSK_FS_FILE_FLAG_ENUM;
00331
00332
00333 typedef uint8_t(*TSK_FS_INODE_WALK_CB) (TSK_FS_INFO *, TSK_FS_INODE *,
00334 void *);
00335 typedef uint8_t(*TSK_FS_BLOCK_WALK_CB) (TSK_FS_INFO *, DADDR_T, char *,
00336 TSK_FS_BLOCK_FLAG_ENUM, void *);
00337 typedef uint8_t(*TSK_FS_DENT_TYPE_WALK_CB) (TSK_FS_INFO *,
00338 TSK_FS_DENT *, void *);
00339 typedef uint8_t(*TSK_FS_FILE_WALK_CB) (TSK_FS_INFO *, DADDR_T, char *,
00340 size_t, TSK_FS_BLOCK_FLAG_ENUM, void *);
00341 typedef uint8_t(*TSK_FS_JBLK_WALK_CB) (TSK_FS_INFO *, char *, int,
00342 void *);
00343 typedef uint8_t(*TSK_FS_JENTRY_WALK_CB) (TSK_FS_INFO *,
00344 TSK_FS_JENTRY *, int, void *);
00345
00346
00347
00348
00352 enum TSK_FS_INFO_FLAG_ENUM {
00353 TSK_FS_INFO_FLAG_HAVE_SEQ = (1 << 0)
00354 };
00355 typedef enum TSK_FS_INFO_FLAG_ENUM TSK_FS_INFO_FLAG_ENUM;
00356
00357
00364 struct TSK_FS_INFO {
00365 TSK_IMG_INFO *img_info;
00366 SSIZE_T offset;
00367
00368
00369 INUM_T inum_count;
00370 INUM_T root_inum;
00371 INUM_T first_inum;
00372 INUM_T last_inum;
00373
00374
00375 DADDR_T block_count;
00376 DADDR_T first_block;
00377 DADDR_T last_block;
00378 unsigned int block_size;
00379 unsigned int dev_bsize;
00380
00381
00382 INUM_T journ_inum;
00383
00384 TSK_FS_INFO_TYPE_ENUM ftype;
00385 char *duname;
00386 TSK_FS_INFO_FLAG_ENUM flags;
00387
00388 uint8_t endian;
00389
00390 TSK_LIST *list_inum_named;
00396 uint8_t(*block_walk) (TSK_FS_INFO *, DADDR_T, DADDR_T,
00397 TSK_FS_BLOCK_FLAG_ENUM, TSK_FS_BLOCK_WALK_CB, void *);
00398
00400 uint8_t(*inode_walk) (TSK_FS_INFO *, INUM_T, INUM_T,
00401 TSK_FS_INODE_FLAG_ENUM, TSK_FS_INODE_WALK_CB, void *);
00402
00404 TSK_FS_INODE *(*inode_lookup) (TSK_FS_INFO *, INUM_T);
00405
00407 uint8_t(*istat) (TSK_FS_INFO *, FILE *, INUM_T, DADDR_T, int32_t);
00408
00410 uint8_t(*file_walk) (TSK_FS_INFO *, TSK_FS_INODE *, uint32_t,
00411 uint16_t, TSK_FS_FILE_FLAG_ENUM, TSK_FS_FILE_WALK_CB, void *);
00412
00414 uint8_t(*dent_walk) (TSK_FS_INFO *, INUM_T, TSK_FS_DENT_FLAG_ENUM,
00415 TSK_FS_DENT_TYPE_WALK_CB, void *);
00416
00418 uint8_t(*jopen) (TSK_FS_INFO *, INUM_T);
00419
00421 uint8_t(*jblk_walk) (TSK_FS_INFO *, DADDR_T, DADDR_T, int,
00422 TSK_FS_JBLK_WALK_CB, void *);
00423
00425 uint8_t(*jentry_walk) (TSK_FS_INFO *, int, TSK_FS_JENTRY_WALK_CB,
00426 void *);
00427
00428
00430 uint8_t(*fsstat) (TSK_FS_INFO *, FILE *);
00431
00433 uint8_t(*fscheck) (TSK_FS_INFO *, FILE *);
00434
00436 void (*close) (TSK_FS_INFO *);
00437 };
00438
00439
00440
00441
00442
00443
00444
00445
00446
00447
00448
00449
00450
00451
00452
00453
00454
00455
00456
00460 enum TSK_FS_DATA_RUN_FLAG_ENUM {
00461 TSK_FS_DATA_RUN_FLAG_FILLER = 0x1,
00462 TSK_FS_DATA_RUN_FLAG_SPARSE = 0x2
00463 };
00464 typedef enum TSK_FS_DATA_RUN_FLAG_ENUM TSK_FS_DATA_RUN_FLAG_ENUM;
00465
00466
00471 struct TSK_FS_DATA_RUN {
00472 TSK_FS_DATA_RUN *next;
00473 DADDR_T addr;
00474 DADDR_T len;
00475 TSK_FS_DATA_RUN_FLAG_ENUM flags;
00476 };
00477
00478
00482 enum TSK_FS_DATA_FLAG_ENUM {
00483 TSK_FS_DATA_INUSE = 0x1,
00484 TSK_FS_DATA_NONRES = 0x2,
00485 TSK_FS_DATA_RES = 0x4,
00486 TSK_FS_DATA_ENC = 0x10,
00487 TSK_FS_DATA_COMP = 0x20,
00488 TSK_FS_DATA_SPARSE = 0x40,
00489 };
00490 typedef enum TSK_FS_DATA_FLAG_ENUM TSK_FS_DATA_FLAG_ENUM;
00491
00500 struct TSK_FS_DATA {
00501 TSK_FS_DATA *next;
00502 TSK_FS_DATA_FLAG_ENUM flags;
00503 char *name;
00504 size_t nsize;
00505 uint32_t type;
00506 uint16_t id;
00507
00508 OFF_T size;
00509
00510
00511 TSK_FS_DATA_RUN *run;
00512 OFF_T allocsize;
00513 uint32_t compsize;
00514
00515
00516 size_t buflen;
00517 uint8_t *buf;
00518 };
00519
00520
00521
00522 extern TSK_FS_DATA *tsk_fs_data_alloc(TSK_FS_DATA_FLAG_ENUM);
00523 extern TSK_FS_DATA_RUN *tsk_fs_data_run_alloc();
00524 extern TSK_FS_DATA *tsk_fs_data_getnew_attr(TSK_FS_DATA *,
00525 TSK_FS_DATA_FLAG_ENUM);
00526 extern void tsk_fs_data_clear_list(TSK_FS_DATA *);
00527
00528 extern TSK_FS_DATA *tsk_fs_data_put_str(TSK_FS_DATA *, char *,
00529 uint32_t, uint16_t, void *, unsigned int);
00530
00531 extern TSK_FS_DATA *tsk_fs_data_put_run(TSK_FS_DATA *, DADDR_T, OFF_T,
00532 TSK_FS_DATA_RUN *, char *, uint32_t, uint16_t, OFF_T,
00533 TSK_FS_DATA_FLAG_ENUM, uint32_t);
00534
00535 extern TSK_FS_DATA *tsk_fs_data_lookup(TSK_FS_DATA *, uint32_t,
00536 uint16_t);
00537 extern TSK_FS_DATA *tsk_fs_data_lookup_noid(TSK_FS_DATA *, uint32_t);
00538
00539 extern void tsk_fs_data_run_free(TSK_FS_DATA_RUN *);
00540 extern void tsk_fs_data_free(TSK_FS_DATA *);
00541
00542
00543
00544
00545 struct TSK_FS_JENTRY {
00546 DADDR_T jblk;
00547 DADDR_T fsblk;
00548 };
00549
00550
00551
00552
00553 extern TSK_FS_DENT *tsk_fs_dent_alloc(ULONG, ULONG);
00554 extern TSK_FS_DENT *tsk_fs_dent_realloc(TSK_FS_DENT *, ULONG);
00555 extern void tsk_fs_dent_free(TSK_FS_DENT *);
00556 extern void tsk_fs_dent_print(FILE *, TSK_FS_DENT *,
00557 TSK_FS_INFO *, TSK_FS_DATA *);
00558 extern void tsk_fs_dent_print_long(FILE *, TSK_FS_DENT *,
00559 TSK_FS_INFO *, TSK_FS_DATA *);
00560 extern void tsk_fs_dent_print_mac(FILE *, TSK_FS_DENT *,
00561 TSK_FS_INFO *, TSK_FS_DATA * fs_data, char *);
00562
00563 extern void tsk_fs_make_ls(mode_t, char *);
00564 extern void tsk_fs_print_day(FILE *, time_t);
00565 extern void tsk_fs_print_time(FILE *, time_t);
00566
00567
00568
00569
00570 #define TSK_FS_ISDOT(str) ( ((str[0] == '.') && \
00571 ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 )
00572
00573
00574
00575
00576
00577
00578 extern TSK_FS_INFO *tsk_fs_open(TSK_IMG_INFO *, SSIZE_T,
00579 const TSK_TCHAR *);
00580
00581
00582 extern SSIZE_T tsk_fs_read_block(TSK_FS_INFO *, TSK_DATA_BUF *, OFF_T,
00583 DADDR_T);
00584 extern SSIZE_T tsk_fs_read_block_nobuf(TSK_FS_INFO *, char *, OFF_T,
00585 DADDR_T);
00586 #define tsk_fs_read_random(fsi, buf, len, offs) \
00587 (fsi)->img_info->read_random((fsi)->img_info, (fsi)->offset, (buf), (len), (offs))
00588
00589 extern char *tsk_fs_load_file(TSK_FS_INFO *, TSK_FS_INODE *, uint32_t,
00590 uint16_t, int);
00591
00592 extern SSIZE_T
00593 tsk_fs_read_file(TSK_FS_INFO *, TSK_FS_INODE *, uint32_t, uint16_t,
00594 SSIZE_T, SSIZE_T, char *);
00595
00596 extern SSIZE_T
00597 tsk_fs_read_file_noid(TSK_FS_INFO *, TSK_FS_INODE *, SSIZE_T,
00598 SSIZE_T, char *);
00599
00600
00601
00602
00603 #define TSK_FS_DCALC_DD 0x1
00604 #define TSK_FS_DCALC_DLS 0x2
00605 #define TSK_FS_DCALC_SLACK 0x4
00606 extern int8_t tsk_fs_dcalc(TSK_FS_INFO * fs, uint8_t lclflags,
00607 DADDR_T cnt);
00608
00609
00610 #define TSK_FS_DCAT_HEX 0x1
00611 #define TSK_FS_DCAT_ASCII 0x2
00612 #define TSK_FS_DCAT_HTML 0x4
00613 #define TSK_FS_DCAT_STAT 0x8
00614 extern uint8_t tsk_fs_dcat(TSK_FS_INFO * fs, uint8_t lclflags,
00615 DADDR_T addr, DADDR_T read_num_units);
00616
00617
00618 #define TSK_FS_DLS_CAT 0x01
00619 #define TSK_FS_DLS_LIST 0x02
00620 #define TSK_FS_DLS_SLACK 0x04
00621 extern uint8_t tsk_fs_dls(TSK_FS_INFO * fs, uint8_t lclflags,
00622 DADDR_T bstart, DADDR_T bend, TSK_FS_BLOCK_FLAG_ENUM flags);
00623
00624 extern uint8_t tsk_fs_dstat(TSK_FS_INFO * fs, uint8_t lclflags,
00625 DADDR_T addr, TSK_FS_BLOCK_FLAG_ENUM flags);
00626
00627 #define TSK_FS_FFIND_ALL 0x1
00628 extern uint8_t tsk_fs_ffind(TSK_FS_INFO * fs, uint8_t lclflags,
00629 INUM_T inode, uint32_t type, uint16_t id, int flags);
00630
00631
00632
00633 #define TSK_FS_FLS_DOT 0x001
00634 #define TSK_FS_FLS_LONG 0x002
00635 #define TSK_FS_FLS_FILE 0x004
00636 #define TSK_FS_FLS_DIR 0x008
00637 #define TSK_FS_FLS_FULL 0x010
00638 #define TSK_FS_FLS_MAC 0x020
00639 extern uint8_t tsk_fs_fls(TSK_FS_INFO * fs, uint8_t lclflags,
00640 INUM_T inode, int flags, TSK_TCHAR * pre, int32_t skew);
00641
00642
00643 extern uint8_t tsk_fs_icat(TSK_FS_INFO * fs, uint8_t lclflags,
00644 INUM_T inum, uint32_t type, uint16_t id, int flags);
00645
00646
00647 #define TSK_FS_IFIND_ALL 0x01
00648 #define TSK_FS_IFIND_PATH 0x04
00649 #define TSK_FS_IFIND_DATA 0x08
00650 #define TSK_FS_IFIND_PAR 0x10
00651 #define TSK_FS_IFIND_PAR_LONG 0x20
00652 extern int8_t tsk_fs_ifind_path(TSK_FS_INFO * fs, uint8_t lclflags,
00653 TSK_TCHAR * path, INUM_T * result);
00654 extern uint8_t tsk_fs_ifind_data(TSK_FS_INFO * fs, uint8_t lclflags,
00655 DADDR_T blk);
00656 extern uint8_t tsk_fs_ifind_par(TSK_FS_INFO * fs, uint8_t lclflags,
00657 INUM_T par);
00658
00659
00660 #define TSK_FS_ILS_OPEN (1<<0)
00661 #define TSK_FS_ILS_MAC (1<<1)
00662 #define TSK_FS_ILS_LINK (1<<2)
00663 #define TSK_FS_ILS_UNLINK (1<<3)
00664
00665 extern uint8_t tsk_fs_ils(TSK_FS_INFO * fs, uint8_t lclflags,
00666 INUM_T istart, INUM_T ilast, int flags, int32_t skew,
00667 TSK_TCHAR * img);
00668
00669
00670
00671 #ifdef __cplusplus
00672 }
00673 #endif
00674 #endif
00675
00676
00677
00678
00679
00680
00681
00682
00683
00684