#include "img_tools.h"
#include <sys/types.h>
Go to the source code of this file.
Defines | |
#define | TSK_FS_DENT_TYPE_MAX_STR 15 |
Number of types that have a short string name. | |
#define | TSK_FS_INODE_NAME_LIST_NSIZE 512 |
Size of name array in TSK_FS_INODE_NAME_LIST structure. | |
#define | TSK_FS_ORPHAN_STR "-ORPHAN_FILE-" |
String that is prepended to orphan FAT & NTFS files when the file name is known, but the parent is not. | |
#define | TSK_FS_INODE_MODE_TYPE_SHIFT 12 |
Number of bits to shift mode to isolate file type. | |
#define | TSK_FS_INODE_MODE_TYPE_STR_MAX 15 |
Number of file types in shortname array. | |
#define | TSK_FS_ISDOT(str) |
#define | tsk_fs_read_random(fsi, buf, len, offs) (fsi)->img_info->read_random((fsi)->img_info, (fsi)->offset, (buf), (len), (offs)) |
#define | TSK_FS_DCALC_DD 0x1 |
#define | TSK_FS_DCALC_DLS 0x2 |
#define | TSK_FS_DCALC_SLACK 0x4 |
#define | TSK_FS_DCAT_HEX 0x1 |
#define | TSK_FS_DCAT_ASCII 0x2 |
#define | TSK_FS_DCAT_HTML 0x4 |
#define | TSK_FS_DCAT_STAT 0x8 |
#define | TSK_FS_DLS_CAT 0x01 |
#define | TSK_FS_DLS_LIST 0x02 |
#define | TSK_FS_DLS_SLACK 0x04 |
#define | TSK_FS_FFIND_ALL 0x1 |
#define | TSK_FS_FLS_DOT 0x001 |
#define | TSK_FS_FLS_LONG 0x002 |
#define | TSK_FS_FLS_FILE 0x004 |
#define | TSK_FS_FLS_DIR 0x008 |
#define | TSK_FS_FLS_FULL 0x010 |
#define | TSK_FS_FLS_MAC 0x020 |
#define | TSK_FS_IFIND_ALL 0x01 |
#define | TSK_FS_IFIND_PATH 0x04 |
#define | TSK_FS_IFIND_DATA 0x08 |
#define | TSK_FS_IFIND_PAR 0x10 |
#define | TSK_FS_IFIND_PAR_LONG 0x20 |
#define | TSK_FS_ILS_OPEN (1<<0) |
#define | TSK_FS_ILS_MAC (1<<1) |
#define | TSK_FS_ILS_LINK (1<<2) |
#define | TSK_FS_ILS_UNLINK (1<<3) |
Typedefs | |
typedef enum TSK_FS_INFO_TYPE_ENUM | TSK_FS_INFO_TYPE_ENUM |
typedef TSK_FS_INFO | TSK_FS_INFO |
typedef TSK_FS_DATA | TSK_FS_DATA |
typedef TSK_FS_DATA_RUN | TSK_FS_DATA_RUN |
typedef TSK_FS_INODE_NAME_LIST | TSK_FS_INODE_NAME_LIST |
typedef TSK_FS_JENTRY | TSK_FS_JENTRY |
typedef enum TSK_FS_DENT_FLAG_ENUM | TSK_FS_DENT_FLAG_ENUM |
typedef enum TSK_FS_DENT_TYPE_ENUM | TSK_FS_DENT_TYPE_ENUM |
typedef TSK_FS_DENT | TSK_FS_DENT |
typedef enum TSK_FS_INODE_FLAG_ENUM | TSK_FS_INODE_FLAG_ENUM |
typedef TSK_FS_INODE | TSK_FS_INODE |
typedef enum TSK_FS_INODE_MODE_ENUM | TSK_FS_INODE_MODE_ENUM |
typedef enum TSK_FS_BLOCK_FLAG_ENUM | TSK_FS_BLOCK_FLAG_ENUM |
typedef enum TSK_FS_FILE_FLAG_ENUM | TSK_FS_FILE_FLAG_ENUM |
typedef uint8_t(* | TSK_FS_INODE_WALK_CB )(TSK_FS_INFO *, TSK_FS_INODE *, void *) |
typedef uint8_t(* | TSK_FS_BLOCK_WALK_CB )(TSK_FS_INFO *, DADDR_T, char *, TSK_FS_BLOCK_FLAG_ENUM, void *) |
typedef uint8_t(* | TSK_FS_DENT_TYPE_WALK_CB )(TSK_FS_INFO *, TSK_FS_DENT *, void *) |
typedef uint8_t(* | TSK_FS_FILE_WALK_CB )(TSK_FS_INFO *, DADDR_T, char *, size_t, TSK_FS_BLOCK_FLAG_ENUM, void *) |
typedef uint8_t(* | TSK_FS_JBLK_WALK_CB )(TSK_FS_INFO *, char *, int, void *) |
typedef uint8_t(* | TSK_FS_JENTRY_WALK_CB )(TSK_FS_INFO *, TSK_FS_JENTRY *, int, void *) |
typedef enum TSK_FS_INFO_FLAG_ENUM | TSK_FS_INFO_FLAG_ENUM |
typedef enum TSK_FS_DATA_RUN_FLAG_ENUM | TSK_FS_DATA_RUN_FLAG_ENUM |
typedef enum TSK_FS_DATA_FLAG_ENUM | TSK_FS_DATA_FLAG_ENUM |
Enumerations | |
enum | TSK_FS_INFO_TYPE_ENUM { TSK_FS_INFO_TYPE_FS_MASK = 0xf0, TSK_FS_INFO_TYPE_SUB_MASK = 0x0f, TSK_FS_INFO_TYPE_UNSUPP = 0x00, TSK_FS_INFO_TYPE_FFS_TYPE = 0x10, TSK_FS_INFO_TYPE_FFS_1 = 0x11, TSK_FS_INFO_TYPE_FFS_1B = 0x12, TSK_FS_INFO_TYPE_FFS_2 = 0x13, TSK_FS_INFO_TYPE_FFS_AUTO = 0x14, TSK_FS_INFO_TYPE_EXT_TYPE = 0x20, TSK_FS_INFO_TYPE_EXT_2 = 0x21, TSK_FS_INFO_TYPE_EXT_3 = 0x22, TSK_FS_INFO_TYPE_EXT_AUTO = 0x23, TSK_FS_INFO_TYPE_FAT_TYPE = 0x30, TSK_FS_INFO_TYPE_FAT_12 = 0x31, TSK_FS_INFO_TYPE_FAT_16 = 0x32, TSK_FS_INFO_TYPE_FAT_32 = 0x33, TSK_FS_INFO_TYPE_FAT_AUTO = 0x34, TSK_FS_INFO_TYPE_NTFS_TYPE = 0x40, TSK_FS_INFO_TYPE_NTFS = 0x40, TSK_FS_INFO_TYPE_NTFS_AUTO = 0x40, TSK_FS_INFO_TYPE_SWAP_TYPE = 0x50, TSK_FS_INFO_TYPE_SWAP = 0x50, TSK_FS_INFO_TYPE_RAW_TYPE = 0x60, TSK_FS_INFO_TYPE_RAW = 0x60, TSK_FS_INFO_TYPE_ISO9660_TYPE = 0x70, TSK_FS_INFO_TYPE_ISO9660 = 0x70, TSK_FS_INFO_TYPE_HFS_TYPE = 0x80, TSK_FS_INFO_TYPE_HFS = 0x80 } |
Values for the file system type. More... | |
enum | TSK_FS_DENT_FLAG_ENUM { TSK_FS_DENT_FLAG_ALLOC = (1 << 0), TSK_FS_DENT_FLAG_UNALLOC = (1 << 1), TSK_FS_DENT_FLAG_RECURSE = (1 << 2) } |
File name flags that are used when walking directories and when specifying the status of a name in the TSK_FS_DENT structure. More... | |
enum | TSK_FS_DENT_TYPE_ENUM { TSK_FS_DENT_TYPE_UNDEF = 0, TSK_FS_DENT_TYPE_FIFO = 1, TSK_FS_DENT_TYPE_CHR = 2, TSK_FS_DENT_TYPE_DIR = 4, TSK_FS_DENT_TYPE_BLK = 6, TSK_FS_DENT_TYPE_REG = 8, TSK_FS_DENT_TYPE_LNK = 10, TSK_FS_DENT_TYPE_SOCK = 12, TSK_FS_DENT_TYPE_SHAD = 13, TSK_FS_DENT_TYPE_WHT = 14 } |
File type values -- as specified in the directory entry structure. More... | |
enum | TSK_FS_INODE_FLAG_ENUM { TSK_FS_INODE_FLAG_ALLOC = (1 << 0), TSK_FS_INODE_FLAG_UNALLOC = (1 << 1), TSK_FS_INODE_FLAG_USED = (1 << 2), TSK_FS_INODE_FLAG_UNUSED = (1 << 3), TSK_FS_INODE_FLAG_ORPHAN = (1 << 4), TSK_FS_INODE_FLAG_COMP = (1 << 5) } |
Metadata flags used in TSK_FS_INODE.flags and in request to inode_walk. More... | |
enum | TSK_FS_INODE_MODE_ENUM { TSK_FS_INODE_MODE_FMT = 0170000, TSK_FS_INODE_MODE_FIFO = 0010000, TSK_FS_INODE_MODE_CHR = 0020000, TSK_FS_INODE_MODE_DIR = 0040000, TSK_FS_INODE_MODE_BLK = 0060000, TSK_FS_INODE_MODE_REG = 0100000, TSK_FS_INODE_MODE_LNK = 0120000, TSK_FS_INODE_MODE_SHAD = 0130000, TSK_FS_INODE_MODE_SOCK = 0140000, TSK_FS_INODE_MODE_WHT = 0160000, TSK_FS_INODE_MODE_ISUID = 0004000, TSK_FS_INODE_MODE_ISGID = 0002000, TSK_FS_INODE_MODE_ISVTX = 0001000, TSK_FS_INODE_MODE_IRUSR = 0000400, TSK_FS_INODE_MODE_IWUSR = 0000200, TSK_FS_INODE_MODE_IXUSR = 0000100, TSK_FS_INODE_MODE_IRGRP = 0000040, TSK_FS_INODE_MODE_IWGRP = 0000020, TSK_FS_INODE_MODE_IXGRP = 0000010, TSK_FS_INODE_MODE_IROTH = 0000004, TSK_FS_INODE_MODE_IWOTH = 0000002, TSK_FS_INODE_MODE_IXOTH = 0000001 } |
Values for the mode field -- which identifies the file type and permissions. More... | |
enum | TSK_FS_BLOCK_FLAG_ENUM { TSK_FS_BLOCK_FLAG_ALLOC = (1 << 0), TSK_FS_BLOCK_FLAG_UNALLOC = (1 << 1), TSK_FS_BLOCK_FLAG_CONT = (1 << 2), TSK_FS_BLOCK_FLAG_META = (1 << 3), TSK_FS_BLOCK_FLAG_BAD = (1 << 4), TSK_FS_BLOCK_FLAG_ALIGN = (1 << 5), TSK_FS_BLOCK_FLAG_RES = (1 << 6), TSK_FS_BLOCK_FLAG_SPARSE = (1 << 7), TSK_FS_BLOCK_FLAG_COMP = (1 << 8) } |
Flags that are used when calling block_walk, in callback of of block_walk, and in callback of file_walk. More... | |
enum | TSK_FS_FILE_FLAG_ENUM { TSK_FS_FILE_FLAG_AONLY = (1 << 0), TSK_FS_FILE_FLAG_SLACK = (1 << 1), TSK_FS_FILE_FLAG_RECOVER = (1 << 2), TSK_FS_FILE_FLAG_META = (1 << 3), TSK_FS_FILE_FLAG_NOSPARSE = (1 << 4), TSK_FS_FILE_FLAG_NOID = (1 << 5) } |
Flags used when calling file_walk, the action of file_walk uses the TSK_FS_BLOCK_FLAG flags. More... | |
enum | TSK_FS_INFO_FLAG_ENUM { TSK_FS_INFO_FLAG_HAVE_SEQ = (1 << 0) } |
Flags for the FS_INFO structure. More... | |
enum | TSK_FS_DATA_RUN_FLAG_ENUM { TSK_FS_DATA_RUN_FLAG_FILLER = 0x1, TSK_FS_DATA_RUN_FLAG_SPARSE = 0x2 } |
Flags used for data runs in attributes (FS_DATA). More... | |
enum | TSK_FS_DATA_FLAG_ENUM { TSK_FS_DATA_INUSE = 0x1, TSK_FS_DATA_NONRES = 0x2, TSK_FS_DATA_RES = 0x4, TSK_FS_DATA_ENC = 0x10, TSK_FS_DATA_COMP = 0x20, TSK_FS_DATA_SPARSE = 0x40 } |
Flags used for the TSK_FS_DATA structure, which is used to store attribute data. More... | |
Functions | |
TSK_FS_INFO_TYPE_ENUM | tsk_fs_parse_type (const TSK_TCHAR *) |
void | tsk_fs_print_types (FILE *) |
char * | tsk_fs_get_type (TSK_FS_INFO_TYPE_ENUM) |
TSK_FS_INODE * | tsk_fs_inode_alloc (int, int) |
Allocates a generic inode / metadata structure. | |
TSK_FS_INODE * | tsk_fs_inode_realloc (TSK_FS_INODE *, int, int) |
Resize an existing FS_INODE structure -- changes the number of block pointers. | |
void | tsk_fs_inode_free (TSK_FS_INODE *) |
Free the memory allocated to the FS_INODE structure. | |
TSK_FS_DATA * | tsk_fs_data_alloc (TSK_FS_DATA_FLAG_ENUM) |
Allocates and initializes a new structure. | |
TSK_FS_DATA_RUN * | tsk_fs_data_run_alloc () |
Allocate a run list entry. | |
TSK_FS_DATA * | tsk_fs_data_getnew_attr (TSK_FS_DATA *, TSK_FS_DATA_FLAG_ENUM) |
Given the begining of the list, return either an empty element in the list or a new one at the end. | |
void | tsk_fs_data_clear_list (TSK_FS_DATA *) |
Clear the fields and run_lists in the FS_DATA list. | |
TSK_FS_DATA * | tsk_fs_data_put_str (TSK_FS_DATA *, char *, uint32_t, uint16_t, void *, unsigned int) |
Copy resident data to an attribute in the list. | |
TSK_FS_DATA * | tsk_fs_data_put_run (TSK_FS_DATA *, DADDR_T, OFF_T, TSK_FS_DATA_RUN *, char *, uint32_t, uint16_t, OFF_T, TSK_FS_DATA_FLAG_ENUM, uint32_t) |
Add a set of consecutive runs of an attribute of a specified type and id. | |
TSK_FS_DATA * | tsk_fs_data_lookup (TSK_FS_DATA *, uint32_t, uint16_t) |
Search the list of TSK_FS_DATA structures for an entry with a given type and id. | |
TSK_FS_DATA * | tsk_fs_data_lookup_noid (TSK_FS_DATA *, uint32_t) |
Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id). | |
void | tsk_fs_data_run_free (TSK_FS_DATA_RUN *) |
Free a list of data_runs. | |
void | tsk_fs_data_free (TSK_FS_DATA *) |
Free the list of TSK_FS_DATA structures and the runs that they allocated. | |
TSK_FS_DENT * | tsk_fs_dent_alloc (ULONG, ULONG) |
TSK_FS_DENT * | tsk_fs_dent_realloc (TSK_FS_DENT *, ULONG) |
void | tsk_fs_dent_free (TSK_FS_DENT *) |
void | tsk_fs_dent_print (FILE *, TSK_FS_DENT *, TSK_FS_INFO *, TSK_FS_DATA *) |
void | tsk_fs_dent_print_long (FILE *, TSK_FS_DENT *, TSK_FS_INFO *, TSK_FS_DATA *) |
void | tsk_fs_dent_print_mac (FILE *, TSK_FS_DENT *, TSK_FS_INFO *, TSK_FS_DATA *fs_data, char *) |
void | tsk_fs_make_ls (mode_t, char *) |
void | tsk_fs_print_day (FILE *, time_t) |
void | tsk_fs_print_time (FILE *, time_t) |
TSK_FS_INFO * | tsk_fs_open (TSK_IMG_INFO *, SSIZE_T, const TSK_TCHAR *) |
Read data and process it as a file system. | |
SSIZE_T | tsk_fs_read_block (TSK_FS_INFO *, TSK_DATA_BUF *, OFF_T, DADDR_T) |
Read a file system block into a TSK_DATA_BUF structure. | |
SSIZE_T | tsk_fs_read_block_nobuf (TSK_FS_INFO *, char *, OFF_T, DADDR_T) |
Read a file system block into a char* buffer. | |
char * | tsk_fs_load_file (TSK_FS_INFO *, TSK_FS_INODE *, uint32_t, uint16_t, int) |
Load the contents of a file into a buffer. | |
SSIZE_T | tsk_fs_read_file (TSK_FS_INFO *, TSK_FS_INODE *, uint32_t, uint16_t, SSIZE_T, SSIZE_T, char *) |
Read the contents of a specific attribute of a file using a typical read() type interface. | |
SSIZE_T | tsk_fs_read_file_noid (TSK_FS_INFO *, TSK_FS_INODE *, SSIZE_T, SSIZE_T, char *) |
Read the contents of a file using a typical read() type interface. | |
int8_t | tsk_fs_dcalc (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T cnt) |
uint8_t | tsk_fs_dcat (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T addr, DADDR_T read_num_units) |
Read a specific number of blocks and print the contents to STDOUT. | |
uint8_t | tsk_fs_dls (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T bstart, DADDR_T bend, TSK_FS_BLOCK_FLAG_ENUM flags) |
uint8_t | tsk_fs_dstat (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T addr, TSK_FS_BLOCK_FLAG_ENUM flags) |
uint8_t | tsk_fs_ffind (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T inode, uint32_t type, uint16_t id, int flags) |
uint8_t | tsk_fs_fls (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T inode, int flags, TSK_TCHAR *pre, int32_t skew) |
uint8_t | tsk_fs_icat (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T inum, uint32_t type, uint16_t id, int flags) |
int8_t | tsk_fs_ifind_path (TSK_FS_INFO *fs, uint8_t lclflags, TSK_TCHAR *path, INUM_T *result) |
uint8_t | tsk_fs_ifind_data (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T blk) |
uint8_t | tsk_fs_ifind_par (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T par) |
uint8_t | tsk_fs_ils (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T istart, INUM_T ilast, int flags, int32_t skew, TSK_TCHAR *img) |
Variables | |
char | tsk_fs_dent_str [TSK_FS_DENT_TYPE_MAX_STR][2] |
char | tsk_fs_inode_mode_str [TSK_FS_INODE_MODE_TYPE_STR_MAX][2] |
Contains the short (1 character) name of the file type. |
|
Value: ( ((str[0] == '.') && \ ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 ) |
|
|
Flags used for the TSK_FS_DATA structure, which is used to store attribute data.
|
|
Flags used for data runs in attributes (FS_DATA).
|
|
File name flags that are used when walking directories and when specifying the status of a name in the TSK_FS_DENT structure.
|
|
File type values -- as specified in the directory entry structure.
|
|
Flags used when calling file_walk, the action of file_walk uses the TSK_FS_BLOCK_FLAG flags.
|
|
Flags for the FS_INFO structure.
|
|
Values for the file system type. The most-significant nibble is the high-level type. The least-sigificant nibble is the specific sub-type of implementation. |
|
Metadata flags used in TSK_FS_INODE.flags and in request to inode_walk.
|
|
Values for the mode field -- which identifies the file type and permissions.
|
|
Allocates and initializes a new structure.
|
|
Clear the fields and run_lists in the FS_DATA list.
|
|
Free the list of TSK_FS_DATA structures and the runs that they allocated.
|
|
Given the begining of the list, return either an empty element in the list or a new one at the end. Preference is given to finding one of the same type to prevent excessive malloc's, but if one is not found then a different type is used: type = [TSK_FS_DATA_NONRES | TSK_FS_DATA_RES]
|
|
Search the list of TSK_FS_DATA structures for an entry with a given type and id.
|
|
Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id). The attribute with the lowest id (or the named $Data attribute if that type is specified) is returned.
|
|
Add a set of consecutive runs of an attribute of a specified type and id. This function first determines if the attribute exists and then either creates the attribute or adds to it. This is complicated because we could get the runs out of order so we use "filler" TSK_FS_DATA_RUN structures during the process
|
|
Copy resident data to an attribute in the list. If no attributes exist yet, one will be created and the head of the resulting list will be returned.
|
|
Allocate a run list entry.
|
|
Free a list of data_runs.
|
|
Read a specific number of blocks and print the contents to STDOUT.
|
|
Allocates a generic inode / metadata structure.
|
|
Free the memory allocated to the FS_INODE structure.
|
|
Resize an existing FS_INODE structure -- changes the number of block pointers.
|
|
Load the contents of a file into a buffer.
|
|
Read data and process it as a file system.
|
|
Read a file system block into a TSK_DATA_BUF structure. This is actually a wrapper around the fs_read_random function, but it allows the starting location to be specified as a block address.
|
|
Read a file system block into a char* buffer. This is actually a wrapper around the fs_read_random function, but it allows the starting location to be specified as a block address.
|
|
Read the contents of a specific attribute of a file using a typical read() type interface.
|
|
Read the contents of a file using a typical read() type interface.
|