# hfs.h

    00001 /*
    00002 ** The Sleuth Kit
    00003 **
    00004 ** This software is subject to the IBM Public License ver. 1.0,
    00005 ** which was displayed prior to download and is included in the readme.txt
    00006 ** file accompanying the Sleuth Kit files.  It may also be requested from:
    00007 ** Crucial Security Inc.
    00008 ** 14900 Conference Center Drive
    00009 ** Chantilly, VA 20151
    00010 **
    00011 ** Wyatt Banks [wbanks@crucialsecurity.com]
    00012 ** Copyright (c) 2005 Crucial Security Inc.  All rights reserved.
    00013 **
    00014 ** Brian Carrier [carrier@sleuthkit.org]
    00015 ** Copyright (c) 2003-2005 Brian Carrier.  All rights reserved
    00016 **
    00017 ** Copyright (c) 1997,1998,1999, International Business Machines
    00018 ** Corporation and others. All Rights Reserved.
    00019 */
    00020
    00021 /* TCT
    00022  * LICENSE
    00023  *      This software is distributed under the IBM Public License.
    00024  * AUTHOR(S)
    00025  *      Wietse Venema
    00026  *      IBM T.J. Watson Research
    00027  *      P.O. Box 704
    00028  *      Yorktown Heights, NY 10598, USA
    00029  --*/
    00030
    00031 /*
    00032 ** You may distribute the Sleuth Kit, or other software that incorporates
    00033 ** part of all of the Sleuth Kit, in object code form under a license agreement,
    00034 ** provided that:
    00035 ** a) you comply with the terms and conditions of the IBM Public License
    00036 **    ver 1.0; and
    00037 ** b) the license agreement
    00038 **     i) effectively disclaims on behalf of all Contributors all warranties
    00039 **        and conditions, express and implied, including warranties or
    00040 **        conditions of title and non-infringement, and implied warranties
    00041 **        or conditions of merchantability and fitness for a particular
    00042 **        purpose.
    00043 **    ii) effectively excludes on behalf of all Contributors liability for
    00044 **        damages, including direct, indirect, special, incidental and
    00045 **        consequential damages such as lost profits.
    00046 **   iii) states that any provisions which differ from IBM Public License
    00047 **        ver. 1.0 are offered by that Contributor alone and not by any
    00048 **        other party; and
    00049 **    iv) states that the source code for the program is available from you,
    00050 **        and informs licensees how to obtain it in a reasonable manner on or
    00051 **        through a medium customarily used for software exchange.
    00052 **
    00053 ** When the Sleuth Kit or other software that incorporates part or all of
    00054 ** the Sleuth Kit is made available in source code form:
    00055 **     a) it must be made available under IBM Public License ver. 1.0; and
    00056 **     b) a copy of the IBM Public License ver. 1.0 must be included with
    00057 **        each copy of the program.
    00058 */
    00059
    00060 #ifndef _HFS_H
    00061 #define _HFS_H
    00062
    00063
    00064 /*
    00065  * All structures created using technote 1150 from Apple.com
    00066  * http://developer.apple.com/technotes/tn/tn1150.html
    00067  */
    00068
    00069 /*
    00070  * Constants
    00071  */
    00072
    00073 #define HFS_MAGIC       0x4244  /* HX in big endian */
    00074 #define HFSPLUS_MAGIC   0x482b  /* H+ in big endian */
    00075
    00076 #define HFS_SBOFF       1024
    00077 #define HFS_NDADDR      0001
    00078 #define HFS_NIADDR      0001
    00079
    00080 #define HFS_FIRST_USER_CNID     16
    00081
    00082 /* b-tree kind types */
    00083 #define HFS_BTREE_LEAF_NODE     -1
    00084 #define HFS_BTREE_INDEX_NODE     0
    00085 #define HFS_BTREE_HEADER_NODE    1
    00086 #define HFS_BTREE_MAP_NODE       2
    00087
    00088 #define HFS_MAXNAMLEN           255
    00089
    00090 #define HFS_ROOT_INUM           2
    00091
    00092 /* catalog file data types */
    00093 #define HFS_FOLDER_RECORD       0x0001
    00094 #define HFS_FILE_RECORD         0X0002
    00095 #define HFS_FOLDER_THREAD       0x0003
    00096 #define HFS_FILE_THREAD         0x0004
    00097
    00098 /*
    00099  * HFS uses its own time system, which is seconds since Jan 1 1904
    00100  * instead of the typical Jan 1 1970.  This number is the seconds between
    00101  * 1 Jan 1904 and 1 Jan 1970 which will make ctime(3) work instead of
    00102  * re-writing the Apple library function to convert this time.
    00103  */
    00104 #define NSEC_BTWN_1904_1970     (uint32_t) 2082844800U
    00105
    00106 #define HFS_BIT_VOLUME_UNMOUNTED        (uint32_t)(1 << 8)
    00107 #define HFS_BIT_VOLUME_INCONSISTENT     (uint32_t)(1 << 11)
    00108 #define HFS_BIT_VOLUME_JOURNALED        (uint32_t)(1 << 13)
    00109
    00110 /*
    00111  * HFS structures
    00112  */
    00113
    00114 /* File and Folder name struct */
    00115 typedef struct {
    00116     uint16_t length[2];
    00117     uint16_t unicode[255];
    00118 } hfs_uni_str;
    00119
    00120 /* access permissions */
    00121 typedef struct {
    00122     uint8_t owner[4];           /* file owner */
    00123     uint8_t group[4];           /* file group */
    00124     uint8_t a_flags;            /* admin flags */
    00125     uint8_t o_flags;            /* owner flags */
    00126     uint8_t mode[2];            /* file mode */
    00127     union {
    00128         uint8_t inum[4];        /* inode number */
    00129         uint8_t nlink[4];       /* link count */
    00130         uint8_t raw[4];         /* raw device */
    00131     } special;
    00132 } hfs_access_perm;
    00133
    00134 typedef struct {
    00135     uint32_t uid;               /* owner id */
    00136     uint32_t gid;               /* group id */
    00137     uint32_t mode;              /* permissions */
    00138     uint32_t dev;               /* special device */
    00139 } hfs_file_perm;
    00140
    00141 /* HFS extent descriptor */
    00142 //typedef struct {
    00143 struct hfs_ext_desc {
    00144     uint8_t start_blk[4];       /* start block */
    00145     uint8_t blk_cnt[4];         /* block count */
    00146 };
    00147 //} hfs_ext_desc;
    00148 typedef struct hfs_ext_desc hfs_ext_desc;
    00149
    00150 /* fork data structure */
    00151 //typedef struct {
    00152 struct hfs_fork {
    00153     uint8_t logic_sz[8];        /* logical size */
    00154     uint8_t clmp_sz[4];         /* clump size */
    00155     uint8_t total_blk[4];       /* total blocks */
    00156     hfs_ext_desc extents[8];
    00157 };
    00158 //} hfs_fork;
    00159 typedef struct hfs_fork hfs_fork;
    00160
    00161 /*
    00162 ** Super Block
    00163 */
    00164 typedef struct {
    00165     uint8_t signature[2];       /* "H+" for HFS+, "HX" for HFSX */
    00166     uint8_t version[2];         /* 4 for HFS+, 5 for HFSX */
    00167     uint8_t attr[4];            /* volume attributes */
    00168     uint8_t last_mnt_ver[4];    /* last mounted version */
    00169     uint8_t jinfo_blk[4];       /* journal info block */
    00170     uint8_t c_date[4];          /* volume creation date */
    00171     uint8_t m_date[4];          /* volume last modified date */
    00172     uint8_t bkup_date[4];       /* volume last backup date */
    00173     uint8_t chk_date[4];        /* date of last consistency check */
    00174     uint8_t file_cnt[4];        /* number of files on volume */
    00175     uint8_t fldr_cnt[4];        /* number of folders on volume */
    00176     uint8_t blk_sz[4];          /* allocation block size */
    00177     uint8_t blk_cnt[4];         /* number of blocks on disk */
    00178     uint8_t free_blks[4];       /* unused block count */
    00179     uint8_t next_alloc[4];      /* start of next allocation search */
    00180     uint8_t rsrc_clmp_sz[4];    /* default clump size for resource forks */
    00181     uint8_t data_clmp_sz[4];    /* default clump size for data forks */
    00182     uint8_t next_cat_id[4];     /* next catalog id */
    00183     uint8_t write_cnt[4];       /* write count */
    00184     uint8_t enc_bmp[8];         /* encoding bitmap */
    00185     uint8_t finder_info[32];
    00186     hfs_fork alloc_file;        /* location and size of allocation file */
    00187     hfs_fork ext_file;          /* location and size of extents file */
    00188     hfs_fork cat_file;          /* location and size of catalog file */
    00189     hfs_fork attr_file;         /* location and size of attributes file */
    00190     hfs_fork start_file;        /* location and size of startup file */
    00191 } hfs_sb;
    00192
    00193 typedef struct {
    00194     uint8_t key_len[2];
    00195     uint8_t parent_cnid[4];
    00196     uint8_t name[510];
    00197 } hfs_cat_key;
    00198
    00199 typedef struct {
    00200     uint32_t inum;              /* inode number */
    00201     uint32_t parent;            /* parent directoy number */
    00202     uint32_t node;              /* btree leaf node */
    00203     DADDR_T offs;               /* offset of beginning of inode */
    00204 } htsk_fs_inode_mode_struct;
    00205
    00206 typedef struct {
    00207     uint8_t flink[4];           /* next node number */
    00208     uint8_t blink[4];           /* previous node number */
    00209     int8_t kind;                /* type of node */
    00210     uint8_t height;             /* level in B-tree */
    00211     uint8_t num_rec[2];         /* number of records this node */
    00212     uint8_t res[2];             /* reserved */
    00213 } hfs_btree_node;
    00214
    00215 typedef struct {
    00216     uint8_t depth[2];           /* current depth of btree */
    00217     uint8_t root[4];            /* node number of root node */
    00218     uint8_t leaf[4];            /* number of records in leaf nodes */
    00219     uint8_t firstleaf[4];       /* number of first leaf node */
    00220     uint8_t lastleaf[4];        /* number of last leaf node */
    00221     uint8_t size[2];            /* byte size of leaf node (512..32768) */
    00222     uint8_t max_len[2];         /* max key length in an index or leaf node */
    00223     uint8_t total[4];           /* number of nodes in btree (free or in use) */
    00224     uint8_t free[4];            /* unused nodes in btree */
    00225     uint8_t res[2];             /* reserved */
    00226     uint8_t clmp_sz[4];         /* clump size */
    00227     uint8_t bt_type;            /* btree type */
    00228     uint8_t k_type;             /* key compare type */
    00229     uint8_t attr[4];            /* attributes */
    00230     uint8_t res2[64];           /* reserved */
    00231 } hfs_btree_header_record;
    00232
    00233 typedef struct {
    00234     int8_t v[2];
    00235     int8_t h[2];
    00236 } hfs_point;
    00237
    00238 typedef struct {
    00239     uint8_t file_type[4];       /* file type */
    00240     uint8_t file_cr[4];         /* file creator */
    00241     uint8_t flags[2];           /* finder flags */
    00242     hfs_point loc;              /* location in the folder */
    00243     uint8_t res[2];             /* reserved */
    00244 } hfs_fileinfo;
    00245
    00246 typedef struct {
    00247     uint8_t res1[8];            /* reserved 1 */
    00248     uint8_t extflags[2];        /* extended finder flags */
    00249     uint8_t res2[2];            /* reserved 2 */
    00250     uint8_t folderid[4];        /* putaway folder id */
    00251 } hfs_extendedfileinfo;
    00252
    00253 typedef struct {
    00254     uint8_t rec_type[2];        /* record type */
    00255     uint8_t flags[2];           /* flags - reserved */
    00256     uint8_t valence[4];         /* valence - items in this folder */
    00257     uint8_t cnid[4];            /* catalog node id */
    00258     uint8_t ctime[4];           /* create date */
    00259     uint8_t cmtime[4];          /* content mod date */
    00260     uint8_t amtime[4];          /* attribute mod date */
    00261     uint8_t atime[4];           /* access date */
    00262     uint8_t bkup_time[4];       /* backup time */
    00263     hfs_access_perm perm;       /* HFS permissions */
    00264     hfs_fileinfo u_info;        /* user info */
    00265     hfs_extendedfileinfo f_info;        /* finder info */
    00266     uint8_t txt_enc[4];         /* text encoding */
    00267     uint8_t res[4];             /* reserved */
    00268 } hfs_folder;
    00269
    00270 typedef struct {
    00271     uint8_t rec_type[2];        /* record type */
    00272     uint8_t flags[2];
    00273     uint8_t res[4];             /* reserved */
    00274     uint8_t cnid[4];            /* catalog node id */
    00275     uint8_t ctime[4];           /* create date */
    00276     uint8_t cmtime[4];          /* content modification date */
    00277     uint8_t attr_mtime[4];      /* attribute mod date */
    00278     uint8_t atime[4];           /* access date */
    00279     uint8_t bkup_date[4];       /* backup date */
    00280     hfs_access_perm perm;       /* permissions */
    00281     hfs_fileinfo u_info;        /* user info */
    00282     hfs_extendedfileinfo f_info;        /* finder info */
    00283     uint8_t text_enc[4];        /* text encoding */
    00284     uint8_t res2[4];            /* reserved 2 */
    00285     hfs_fork data;              /* data fork */
    00286     hfs_fork resource;          /* resource fork */
    00287 } hfs_file;
    00288
    00289 typedef struct {
    00290     int16_t type;
    00291     int16_t res;
    00292     uint8_t cnid[4];
    00293     char name[255];
    00294 } hfs_thread;
    00295
    00296 typedef struct {
    00297     TSK_FS_INFO fs_info;        /* SUPER CLASS */
    00298     hfs_sb *fs;                 /* cached superblock */
    00299     TSK_FS_INODE *cat_inode;    /* contains the data entry for the cat */
    00300
    00301     htsk_fs_inode_mode_struct *inodes;
    00302     uint8_t *block_map;         /* cached block allocation bitmap */
    00303     uint8_t *leaf_map;          /* bitmap of btree leaf nodes */
    00304     uint8_t *del_map;           /* bitmap of btree deleted leaf nodes */
    00305     hfs_file *cat;              /* cache for on-disk inode */
    00306     int flags;                  /* flags for on-disk inode */
    00307     INUM_T inum;                /* number of above cached cat */
    00308
    00309     hfs_btree_header_record *hdr;       /* stored btree header node */
    00310
    00311     OFF_T key;                  /* offset of key for cached inode */
    00312
    00313 } HFS_INFO;
    00314
    00315 /************** JOURNAL ******************/
    00316
    00317 /* HFS Journal Info Block */
    00318 typedef struct {
    00319     uint8_t flags[4];
    00320     uint8_t dev_sig[32];
    00321     uint8_t offs[8];
    00322     uint8_t size[8];
    00323     uint8_t res[128];
    00324 } hfs_journ_sb;
    00325
    00326 /*
    00327  * Prototypes
    00328  */
    00329 extern uint8_t hfs_dent_walk(TSK_FS_INFO *, INUM_T, TSK_FS_DENT_FLAG_ENUM,
    00330     TSK_FS_DENT_TYPE_WALK_CB, void *);
    00331 extern uint8_t hfs_jopen(TSK_FS_INFO *, INUM_T);
    00332 extern uint8_t hfs_jblk_walk(TSK_FS_INFO *, DADDR_T, DADDR_T, int,
    00333     TSK_FS_JBLK_WALK_CB, void *);
    00334 extern uint8_t hfs_jentry_walk(TSK_FS_INFO *, int, TSK_FS_JENTRY_WALK_CB,
    00335     void *);
    00336 #endif