Main Page | Data Structures | Directories | File List | Data Fields | Globals

fs_data.c File Reference


Detailed Description

Functions to allocate and add structures to maintain generic file system attributes and run lists.

Currently used only for NTFS, but could be expanded to other file systems in the future.

#include "fs_tools_i.h"
#include "ntfs.h"

Functions

TSK_FS_DATAtsk_fs_data_alloc (TSK_FS_DATA_FLAG_ENUM type)
 Allocates and initializes a new structure.
TSK_FS_DATA_RUNtsk_fs_data_run_alloc ()
 Allocate a run list entry.
void tsk_fs_data_run_free (TSK_FS_DATA_RUN *fs_data_run)
 Free a list of data_runs.
void tsk_fs_data_free (TSK_FS_DATA *fs_data_head)
 Free the list of TSK_FS_DATA structures and the runs that they allocated.
void tsk_fs_data_clear_list (TSK_FS_DATA *fs_data_head)
 Clear the fields and run_lists in the FS_DATA list.
TSK_FS_DATAtsk_fs_data_getnew_attr (TSK_FS_DATA *fs_data_head, TSK_FS_DATA_FLAG_ENUM type)
 Given the begining of the list, return either an empty element in the list or a new one at the end.
TSK_FS_DATAtsk_fs_data_lookup (TSK_FS_DATA *fs_data_head, uint32_t type, uint16_t id)
 Search the list of TSK_FS_DATA structures for an entry with a given type and id.
TSK_FS_DATAtsk_fs_data_lookup_noid (TSK_FS_DATA *fs_data_head, uint32_t type)
 Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id).
TSK_FS_DATAtsk_fs_data_put_str (TSK_FS_DATA *fs_data_head, char *name, uint32_t type, uint16_t id, void *res_data, unsigned int len)
 Copy resident data to an attribute in the list.
TSK_FS_DATAtsk_fs_data_put_run (TSK_FS_DATA *fs_data_head, DADDR_T start_vcn, OFF_T runlen, TSK_FS_DATA_RUN *run, char *name, uint32_t type, uint16_t id, OFF_T size, TSK_FS_DATA_FLAG_ENUM flags, uint32_t compsize)
 Add a set of consecutive runs of an attribute of a specified type and id.


Function Documentation

TSK_FS_DATA* tsk_fs_data_alloc TSK_FS_DATA_FLAG_ENUM  type  ) 
 

Allocates and initializes a new structure.

Parameters:
type The type of attribute to create (Resident or Non-resident)
Returns:
NULL on error

void tsk_fs_data_clear_list TSK_FS_DATA fs_data_head  ) 
 

Clear the fields and run_lists in the FS_DATA list.

Parameters:
fs_data_head List of attributes to clear

void tsk_fs_data_free TSK_FS_DATA fs_data_head  ) 
 

Free the list of TSK_FS_DATA structures and the runs that they allocated.

Parameters:
fs_data_head List of structures to free.

TSK_FS_DATA* tsk_fs_data_getnew_attr TSK_FS_DATA fs_data_head,
TSK_FS_DATA_FLAG_ENUM  type
 

Given the begining of the list, return either an empty element in the list or a new one at the end.

Preference is given to finding one of the same type to prevent excessive malloc's, but if one is not found then a different type is used: type = [TSK_FS_DATA_NONRES | TSK_FS_DATA_RES]

Parameters:
fs_data_head Head of attribute list to search
type Preference for attribute type to reuse
Returns:
NULL on error or attribute in list to use

TSK_FS_DATA* tsk_fs_data_lookup TSK_FS_DATA fs_data_head,
uint32_t  type,
uint16_t  id
 

Search the list of TSK_FS_DATA structures for an entry with a given type and id.

Parameters:
fs_data_head Head of fs_data list to search
type Type of attribute to find
id Id of attribute to find. If 0, then the lowest id of the given type is returned.
Returns:
NULL is returned on error and if an entry could not be found. tsk_errno will be set to 0 if entry could not be found and it will be non-zero if an error occured.

TSK_FS_DATA* tsk_fs_data_lookup_noid TSK_FS_DATA fs_data_head,
uint32_t  type
 

Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id).

The attribute with the lowest id (or the named $Data attribute if that type is specified) is returned.

Parameters:
fs_data_head Head of fs_data list to search
type Type of attribute to find
Returns:
NULL is returned on error and if an entry could not be found. tsk_errno will be set to 0 if entry could not be found and it will be non-zero if an error occured.

TSK_FS_DATA* tsk_fs_data_put_run TSK_FS_DATA fs_data_head,
DADDR_T  start_vcn,
OFF_T  runlen,
TSK_FS_DATA_RUN run,
char *  name,
uint32_t  type,
uint16_t  id,
OFF_T  size,
TSK_FS_DATA_FLAG_ENUM  flags,
uint32_t  compsize
 

Add a set of consecutive runs of an attribute of a specified type and id.

This function first determines if the attribute exists and then either creates the attribute or adds to it. This is complicated because we could get the runs out of order so we use "filler" TSK_FS_DATA_RUN structures during the process

Parameters:
fs_data_head The head of the list of attributes (or NULL if list is empty)
start_vcn The virtual cluster number of the start of this run in the attribute.
runlen The total number of clusters in this set of runs.
run The set of runs to add
name Name of the attribute (in case it needs to be created)
type Type of attribute to add run to
id Id of attribute to add run to
size Total size of the attribute (in case it needs to be created)
flags Flags about compression, sparse etc. of data
compsize Compression unit size (in case it needs to be created)
Returns:
The head of the list or NULL on error

TSK_FS_DATA* tsk_fs_data_put_str TSK_FS_DATA fs_data_head,
char *  name,
uint32_t  type,
uint16_t  id,
void *  res_data,
unsigned int  len
 

Copy resident data to an attribute in the list.

If no attributes exist yet, one will be created and the head of the resulting list will be returned.

Parameters:
fs_data_head Head of the attribute list (or NULL if empty)
name Name of the attribute to add
type Type of the attribute to add
id Id of the attribute to add
res_data Pointer to where resident data is located (data will be copied from here into FS_DATA)
len Length of resident data
Returns:
NULL on error or head of attribute list

TSK_FS_DATA_RUN* tsk_fs_data_run_alloc  ) 
 

Allocate a run list entry.

Returns:
NULL on error

void tsk_fs_data_run_free TSK_FS_DATA_RUN fs_data_run  ) 
 

Free a list of data_runs.

Parameters:
fs_data_run Head of list to free


Generated on Thu Apr 19 14:58:53 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.4.2