# fs_tools.h File Reference

## Detailed Description

Contains the library functions and data structures for the FS support in TSK.

`#include "img_tools.h"`
`#include <sys/types.h>`

Go to the source code of this file.

## Defines

#define | TSK_FS_DENT_TYPE_MAX_STR 15
| Number of types that have a short string name.
#define | TSK_FS_INODE_NAME_LIST_NSIZE 512
| Size of name array in TSK_FS_INODE_NAME_LIST structure.
#define | TSK_FS_ORPHAN_STR "-ORPHAN_FILE-"
| String that is prepended to orphan FAT & NTFS files when the file name is known, but the parent is not.
#define | TSK_FS_INODE_MODE_TYPE_SHIFT 12
| Number of bits to shift mode to isolate file type.
#define | TSK_FS_INODE_MODE_TYPE_STR_MAX 15
| Number of file types in shortname array.
#define | TSK_FS_ISDOT(str)
#define | tsk_fs_read_random(fsi, buf, len, offs) (fsi)->img_info->read_random((fsi)->img_info, (fsi)->offset, (buf), (len), (offs))
#define | TSK_FS_DCALC_DD 0x1
#define | TSK_FS_DCALC_DLS 0x2
#define | TSK_FS_DCALC_SLACK 0x4
#define | TSK_FS_DCAT_HEX 0x1
#define | TSK_FS_DCAT_ASCII 0x2
#define | TSK_FS_DCAT_HTML 0x4
#define | TSK_FS_DCAT_STAT 0x8
#define | TSK_FS_DLS_CAT 0x01
#define | TSK_FS_DLS_LIST 0x02
#define | TSK_FS_DLS_SLACK 0x04
#define | TSK_FS_FFIND_ALL 0x1
#define | TSK_FS_FLS_DOT 0x001
#define | TSK_FS_FLS_LONG 0x002
#define | TSK_FS_FLS_FILE 0x004
#define | TSK_FS_FLS_DIR 0x008
#define | TSK_FS_FLS_FULL 0x010
#define | TSK_FS_FLS_MAC 0x020
#define | TSK_FS_IFIND_ALL 0x01
#define | TSK_FS_IFIND_PATH 0x04
#define | TSK_FS_IFIND_DATA 0x08
#define | TSK_FS_IFIND_PAR 0x10
#define | TSK_FS_IFIND_PAR_LONG 0x20
#define | TSK_FS_ILS_OPEN (1<<0)
#define | TSK_FS_ILS_MAC (1<<1)
#define | TSK_FS_ILS_LINK (1<<2)
#define | TSK_FS_ILS_UNLINK (1<<3)

## Typedefs

typedef enum TSK_FS_INFO_TYPE_ENUM | TSK_FS_INFO_TYPE_ENUM
typedef TSK_FS_INFO | TSK_FS_INFO
typedef TSK_FS_DATA | TSK_FS_DATA
typedef TSK_FS_DATA_RUN | TSK_FS_DATA_RUN
typedef TSK_FS_INODE_NAME_LIST | TSK_FS_INODE_NAME_LIST
typedef TSK_FS_JENTRY | TSK_FS_JENTRY
typedef enum TSK_FS_DENT_FLAG_ENUM | TSK_FS_DENT_FLAG_ENUM
typedef enum TSK_FS_DENT_TYPE_ENUM | TSK_FS_DENT_TYPE_ENUM
typedef TSK_FS_DENT | TSK_FS_DENT
typedef enum TSK_FS_INODE_FLAG_ENUM | TSK_FS_INODE_FLAG_ENUM
typedef TSK_FS_INODE | TSK_FS_INODE
typedef enum TSK_FS_INODE_MODE_ENUM | TSK_FS_INODE_MODE_ENUM
typedef enum TSK_FS_BLOCK_FLAG_ENUM | TSK_FS_BLOCK_FLAG_ENUM
typedef enum TSK_FS_FILE_FLAG_ENUM | TSK_FS_FILE_FLAG_ENUM
typedef uint8_t(* | TSK_FS_INODE_WALK_CB )(TSK_FS_INFO *, TSK_FS_INODE *, void *)
typedef uint8_t(* | TSK_FS_BLOCK_WALK_CB )(TSK_FS_INFO *, DADDR_T, char *, TSK_FS_BLOCK_FLAG_ENUM, void *)
typedef uint8_t(* | TSK_FS_DENT_TYPE_WALK_CB )(TSK_FS_INFO *, TSK_FS_DENT *, void *)
typedef uint8_t(* | TSK_FS_FILE_WALK_CB )(TSK_FS_INFO *, DADDR_T, char *, size_t, TSK_FS_BLOCK_FLAG_ENUM, void *)
typedef uint8_t(* | TSK_FS_JBLK_WALK_CB )(TSK_FS_INFO *, char *, int, void *)
typedef uint8_t(* | TSK_FS_JENTRY_WALK_CB )(TSK_FS_INFO *, TSK_FS_JENTRY *, int, void *)
typedef enum TSK_FS_INFO_FLAG_ENUM | TSK_FS_INFO_FLAG_ENUM
typedef enum TSK_FS_DATA_RUN_FLAG_ENUM | TSK_FS_DATA_RUN_FLAG_ENUM
typedef enum TSK_FS_DATA_FLAG_ENUM | TSK_FS_DATA_FLAG_ENUM

## Enumerations

enum

TSK_FS_INFO_TYPE_ENUM {
TSK_FS_INFO_TYPE_FS_MASK = 0xf0, TSK_FS_INFO_TYPE_SUB_MASK = 0x0f, TSK_FS_INFO_TYPE_UNSUPP = 0x00, TSK_FS_INFO_TYPE_FFS_TYPE = 0x10,
TSK_FS_INFO_TYPE_FFS_1 = 0x11, TSK_FS_INFO_TYPE_FFS_1B = 0x12, TSK_FS_INFO_TYPE_FFS_2 = 0x13, TSK_FS_INFO_TYPE_FFS_AUTO = 0x14,
TSK_FS_INFO_TYPE_EXT_TYPE = 0x20, TSK_FS_INFO_TYPE_EXT_2 = 0x21, TSK_FS_INFO_TYPE_EXT_3 = 0x22, TSK_FS_INFO_TYPE_EXT_AUTO = 0x23,
TSK_FS_INFO_TYPE_FAT_TYPE = 0x30, TSK_FS_INFO_TYPE_FAT_12 = 0x31, TSK_FS_INFO_TYPE_FAT_16 = 0x32, TSK_FS_INFO_TYPE_FAT_32 = 0x33,
TSK_FS_INFO_TYPE_FAT_AUTO = 0x34, TSK_FS_INFO_TYPE_NTFS_TYPE = 0x40, TSK_FS_INFO_TYPE_NTFS = 0x40, TSK_FS_INFO_TYPE_NTFS_AUTO = 0x40,
TSK_FS_INFO_TYPE_SWAP_TYPE = 0x50, TSK_FS_INFO_TYPE_SWAP = 0x50, TSK_FS_INFO_TYPE_RAW_TYPE = 0x60, TSK_FS_INFO_TYPE_RAW = 0x60,
TSK_FS_INFO_TYPE_ISO9660_TYPE = 0x70, TSK_FS_INFO_TYPE_ISO9660 = 0x70, TSK_FS_INFO_TYPE_HFS_TYPE = 0x80, TSK_FS_INFO_TYPE_HFS = 0x80
}

| Values for the file system type. More...
enum | TSK_FS_DENT_FLAG_ENUM { TSK_FS_DENT_FLAG_ALLOC = (1 << 0), TSK_FS_DENT_FLAG_UNALLOC = (1 << 1), TSK_FS_DENT_FLAG_RECURSE = (1 << 2) }
| File name flags that are used when walking directories and when specifying the status of a name in the TSK_FS_DENT structure. More...
enum | TSK_FS_DENT_TYPE_ENUM { TSK_FS_DENT_TYPE_UNDEF = 0, TSK_FS_DENT_TYPE_FIFO = 1, TSK_FS_DENT_TYPE_CHR = 2, TSK_FS_DENT_TYPE_DIR = 4, TSK_FS_DENT_TYPE_BLK = 6, TSK_FS_DENT_TYPE_REG = 8, TSK_FS_DENT_TYPE_LNK = 10, TSK_FS_DENT_TYPE_SOCK = 12, TSK_FS_DENT_TYPE_SHAD = 13, TSK_FS_DENT_TYPE_WHT = 14 }
| File type values -- as specified in the directory entry structure. More...
enum | TSK_FS_INODE_FLAG_ENUM { TSK_FS_INODE_FLAG_ALLOC = (1 << 0), TSK_FS_INODE_FLAG_UNALLOC = (1 << 1), TSK_FS_INODE_FLAG_USED = (1 << 2), TSK_FS_INODE_FLAG_UNUSED = (1 << 3), TSK_FS_INODE_FLAG_ORPHAN = (1 << 4), TSK_FS_INODE_FLAG_COMP = (1 << 5) }
| Metadata flags used in TSK_FS_INODE.flags and in request to inode_walk. More...

enum

TSK_FS_INODE_MODE_ENUM {
TSK_FS_INODE_MODE_FMT = 0170000, TSK_FS_INODE_MODE_FIFO = 0010000, TSK_FS_INODE_MODE_CHR = 0020000, TSK_FS_INODE_MODE_DIR = 0040000,
TSK_FS_INODE_MODE_BLK = 0060000, TSK_FS_INODE_MODE_REG = 0100000, TSK_FS_INODE_MODE_LNK = 0120000, TSK_FS_INODE_MODE_SHAD = 0130000,
TSK_FS_INODE_MODE_SOCK = 0140000, TSK_FS_INODE_MODE_WHT = 0160000, TSK_FS_INODE_MODE_ISUID = 0004000, TSK_FS_INODE_MODE_ISGID = 0002000,
TSK_FS_INODE_MODE_ISVTX = 0001000, TSK_FS_INODE_MODE_IRUSR = 0000400, TSK_FS_INODE_MODE_IWUSR = 0000200, TSK_FS_INODE_MODE_IXUSR = 0000100,
TSK_FS_INODE_MODE_IRGRP = 0000040, TSK_FS_INODE_MODE_IWGRP = 0000020, TSK_FS_INODE_MODE_IXGRP = 0000010, TSK_FS_INODE_MODE_IROTH = 0000004,
TSK_FS_INODE_MODE_IWOTH = 0000002, TSK_FS_INODE_MODE_IXOTH = 0000001
}

| Values for the mode field -- which identifies the file type and permissions. More...
enum | TSK_FS_BLOCK_FLAG_ENUM { TSK_FS_BLOCK_FLAG_ALLOC = (1 << 0), TSK_FS_BLOCK_FLAG_UNALLOC = (1 << 1), TSK_FS_BLOCK_FLAG_CONT = (1 << 2), TSK_FS_BLOCK_FLAG_META = (1 << 3), TSK_FS_BLOCK_FLAG_BAD = (1 << 4), TSK_FS_BLOCK_FLAG_ALIGN = (1 << 5), TSK_FS_BLOCK_FLAG_RES = (1 << 6), TSK_FS_BLOCK_FLAG_SPARSE = (1 << 7), TSK_FS_BLOCK_FLAG_COMP = (1 << 8) }
| Flags that are used when calling block_walk, in callback of of block_walk, and in callback of file_walk. More...
enum | TSK_FS_FILE_FLAG_ENUM { TSK_FS_FILE_FLAG_AONLY = (1 << 0), TSK_FS_FILE_FLAG_SLACK = (1 << 1), TSK_FS_FILE_FLAG_RECOVER = (1 << 2), TSK_FS_FILE_FLAG_META = (1 << 3), TSK_FS_FILE_FLAG_NOSPARSE = (1 << 4), TSK_FS_FILE_FLAG_NOID = (1 << 5) }
| Flags used when calling file_walk, the action of file_walk uses the TSK_FS_BLOCK_FLAG flags. More...
enum | TSK_FS_INFO_FLAG_ENUM { TSK_FS_INFO_FLAG_HAVE_SEQ = (1 << 0) }
| Flags for the FS_INFO structure. More...
enum | TSK_FS_DATA_RUN_FLAG_ENUM { TSK_FS_DATA_RUN_FLAG_FILLER = 0x1, TSK_FS_DATA_RUN_FLAG_SPARSE = 0x2 }
| Flags used for data runs in attributes (FS_DATA). More...
enum | TSK_FS_DATA_FLAG_ENUM { TSK_FS_DATA_INUSE = 0x1, TSK_FS_DATA_NONRES = 0x2, TSK_FS_DATA_RES = 0x4, TSK_FS_DATA_ENC = 0x10, TSK_FS_DATA_COMP = 0x20, TSK_FS_DATA_SPARSE = 0x40 }
| Flags used for the TSK_FS_DATA structure, which is used to store attribute data. More...

## Functions

TSK_FS_INFO_TYPE_ENUM | tsk_fs_parse_type (const TSK_TCHAR *)
void | tsk_fs_print_types (FILE *)
char * | tsk_fs_get_type (TSK_FS_INFO_TYPE_ENUM)
TSK_FS_INODE * | tsk_fs_inode_alloc (int, int)
| Allocates a generic inode / metadata structure.
TSK_FS_INODE * | tsk_fs_inode_realloc (TSK_FS_INODE *, int, int)
| Resize an existing FS_INODE structure -- changes the number of block pointers.
void | tsk_fs_inode_free (TSK_FS_INODE *)
| Free the memory allocated to the FS_INODE structure.
TSK_FS_DATA * | tsk_fs_data_alloc (TSK_FS_DATA_FLAG_ENUM)
| Allocates and initializes a new structure.
TSK_FS_DATA_RUN * | tsk_fs_data_run_alloc ()
| Allocate a run list entry.
TSK_FS_DATA * | tsk_fs_data_getnew_attr (TSK_FS_DATA *, TSK_FS_DATA_FLAG_ENUM)
| Given the begining of the list, return either an empty element in the list or a new one at the end.
void | tsk_fs_data_clear_list (TSK_FS_DATA *)
| Clear the fields and run_lists in the FS_DATA list.
TSK_FS_DATA * | tsk_fs_data_put_str (TSK_FS_DATA *, char *, uint32_t, uint16_t, void *, unsigned int)
| Copy resident data to an attribute in the list.
TSK_FS_DATA * | tsk_fs_data_put_run (TSK_FS_DATA *, DADDR_T, OFF_T, TSK_FS_DATA_RUN *, char *, uint32_t, uint16_t, OFF_T, TSK_FS_DATA_FLAG_ENUM, uint32_t)
| Add a set of consecutive runs of an attribute of a specified type and id.
TSK_FS_DATA * | tsk_fs_data_lookup (TSK_FS_DATA *, uint32_t, uint16_t)
| Search the list of TSK_FS_DATA structures for an entry with a given type and id.
TSK_FS_DATA * | tsk_fs_data_lookup_noid (TSK_FS_DATA *, uint32_t)
| Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id).
void | tsk_fs_data_run_free (TSK_FS_DATA_RUN *)
| Free a list of data_runs.
void | tsk_fs_data_free (TSK_FS_DATA *)
| Free the list of TSK_FS_DATA structures and the runs that they allocated.
TSK_FS_DENT * | tsk_fs_dent_alloc (ULONG, ULONG)
TSK_FS_DENT * | tsk_fs_dent_realloc (TSK_FS_DENT *, ULONG)
void | tsk_fs_dent_free (TSK_FS_DENT *)
void | tsk_fs_dent_print (FILE *, TSK_FS_DENT *, TSK_FS_INFO *, TSK_FS_DATA *)
void | tsk_fs_dent_print_long (FILE *, TSK_FS_DENT *, TSK_FS_INFO *, TSK_FS_DATA *)
void | tsk_fs_dent_print_mac (FILE *, TSK_FS_DENT *, TSK_FS_INFO *, TSK_FS_DATA *fs_data, char *)
void | tsk_fs_make_ls (mode_t, char *)
void | tsk_fs_print_day (FILE *, time_t)
void | tsk_fs_print_time (FILE *, time_t)
TSK_FS_INFO * | tsk_fs_open (TSK_IMG_INFO *, SSIZE_T, const TSK_TCHAR *)
| Read data and process it as a file system.
SSIZE_T | tsk_fs_read_block (TSK_FS_INFO *, TSK_DATA_BUF *, OFF_T, DADDR_T)
| Read a file system block into a TSK_DATA_BUF structure.
SSIZE_T | tsk_fs_read_block_nobuf (TSK_FS_INFO *, char *, OFF_T, DADDR_T)
| Read a file system block into a char* buffer.
char * | tsk_fs_load_file (TSK_FS_INFO *, TSK_FS_INODE *, uint32_t, uint16_t, int)
| Load the contents of a file into a buffer.
SSIZE_T | tsk_fs_read_file (TSK_FS_INFO *, TSK_FS_INODE *, uint32_t, uint16_t, SSIZE_T, SSIZE_T, char *)
| Read the contents of a specific attribute of a file using a typical read() type interface.
SSIZE_T | tsk_fs_read_file_noid (TSK_FS_INFO *, TSK_FS_INODE *, SSIZE_T, SSIZE_T, char *)
| Read the contents of a file using a typical read() type interface.
int8_t | tsk_fs_dcalc (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T cnt)
uint8_t | tsk_fs_dcat (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T addr, DADDR_T read_num_units)
| Read a specific number of blocks and print the contents to STDOUT.
uint8_t | tsk_fs_dls (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T bstart, DADDR_T bend, TSK_FS_BLOCK_FLAG_ENUM flags)
uint8_t | tsk_fs_dstat (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T addr, TSK_FS_BLOCK_FLAG_ENUM flags)
uint8_t | tsk_fs_ffind (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T inode, uint32_t type, uint16_t id, int flags)
uint8_t | tsk_fs_fls (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T inode, int flags, TSK_TCHAR *pre, int32_t skew)
uint8_t | tsk_fs_icat (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T inum, uint32_t type, uint16_t id, int flags)
int8_t | tsk_fs_ifind_path (TSK_FS_INFO *fs, uint8_t lclflags, TSK_TCHAR *path, INUM_T *result)
uint8_t | tsk_fs_ifind_data (TSK_FS_INFO *fs, uint8_t lclflags, DADDR_T blk)
uint8_t | tsk_fs_ifind_par (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T par)
uint8_t | tsk_fs_ils (TSK_FS_INFO *fs, uint8_t lclflags, INUM_T istart, INUM_T ilast, int flags, int32_t skew, TSK_TCHAR *img)

## Variables

char | tsk_fs_dent_str [TSK_FS_DENT_TYPE_MAX_STR][2]
char | tsk_fs_inode_mode_str [TSK_FS_INODE_MODE_TYPE_STR_MAX][2]
| Contains the short (1 character) name of the file type.

## Define Documentation

#define TSK_FS_ISDOT | ( | str |  | ) |

Value:

    ( ((str[0] == '.') && \
     ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 )

## Enumeration Type Documentation

enum TSK_FS_BLOCK_FLAG_ENUM

Flags that are used when calling block_walk, in callback of of block_walk, and in callback of file_walk.

Enumeration values:

  TSK_FS_BLOCK_FLAG_ALLOC | Block is allocated.
  TSK_FS_BLOCK_FLAG_UNALLOC | Block is unallocated.
  TSK_FS_BLOCK_FLAG_CONT | Block contains file content.
  TSK_FS_BLOCK_FLAG_META | Block contains file system metadata.
  TSK_FS_BLOCK_FLAG_BAD | Block has been marked as bad by the file system.
  TSK_FS_BLOCK_FLAG_ALIGN | Return entire block when walking -- applies to FS with fragments.
  TSK_FS_BLOCK_FLAG_RES | The data passed in the file_walk callback is from an NTFS resident file.
  TSK_FS_BLOCK_FLAG_SPARSE | The data passed in the file_walk calback was stored as sparse (all zeros).
  TSK_FS_BLOCK_FLAG_COMP | The data passed in the file_walk callback was stored in a compressed form.

enum TSK_FS_DATA_FLAG_ENUM

Flags used for the TSK_FS_DATA structure, which is used to store attribute data.

Enumeration values:

  TSK_FS_DATA_INUSE | Attribute structure is in use.
  TSK_FS_DATA_NONRES | Attribute is for non-resident data.
  TSK_FS_DATA_RES | Attribute is for resident data.
  TSK_FS_DATA_ENC | Attribute data is encrypted.
  TSK_FS_DATA_COMP | Attribute data is compressed.
  TSK_FS_DATA_SPARSE | Attribute data is sparse.

enum TSK_FS_DATA_RUN_FLAG_ENUM

Flags used for data runs in attributes (FS_DATA).

Enumeration values:

  TSK_FS_DATA_RUN_FLAG_FILLER | Run entry is a filler because we haven't seen the actual run for this location yet.
  TSK_FS_DATA_RUN_FLAG_SPARSE | Run is sparse -- blocks in this run should contain all zeros.

enum TSK_FS_DENT_FLAG_ENUM

File name flags that are used when walking directories and when specifying the status of a name in the TSK_FS_DENT structure.

Enumeration values:

  TSK_FS_DENT_FLAG_ALLOC | Name is in an allocated state.
  TSK_FS_DENT_FLAG_UNALLOC | Name is in an unallocated state.
  TSK_FS_DENT_FLAG_RECURSE | Recurse into directories (dent_walk only).

enum TSK_FS_DENT_TYPE_ENUM

File type values -- as specified in the directory entry structure.

Enumeration values:

  TSK_FS_DENT_TYPE_UNDEF | Unknown type.
  TSK_FS_DENT_TYPE_FIFO | Named pipe.
  TSK_FS_DENT_TYPE_CHR | Character device.
  TSK_FS_DENT_TYPE_DIR | Directory.
  TSK_FS_DENT_TYPE_BLK | Block device.
  TSK_FS_DENT_TYPE_REG | Regular file.
  TSK_FS_DENT_TYPE_LNK | Symbolic link.
  TSK_FS_DENT_TYPE_SOCK | Socket.
  TSK_FS_DENT_TYPE_SHAD | Shadow inode (solaris).
  TSK_FS_DENT_TYPE_WHT | Whiteout (openbsd).

enum TSK_FS_FILE_FLAG_ENUM

Flags used when calling file_walk, the action of file_walk uses the TSK_FS_BLOCK_FLAG flags.

Enumeration values:

  TSK_FS_FILE_FLAG_AONLY | Do not include file content in callback -- supply adddress only.
  TSK_FS_FILE_FLAG_SLACK | Include the file slack space in the callback.
  TSK_FS_FILE_FLAG_RECOVER | Use special data recovery techniques for deleted files.
  TSK_FS_FILE_FLAG_META | Return blocks that contain metadata (such as indirect UFS/ExtX blocks).
  TSK_FS_FILE_FLAG_NOSPARSE | Do not use callback for sparse blocks.
  TSK_FS_FILE_FLAG_NOID | Ignore the Id argument given in the call to file_walk -- use only the type.

enum TSK_FS_INFO_FLAG_ENUM

Flags for the FS_INFO structure.

Enumeration values:

  TSK_FS_INFO_FLAG_HAVE_SEQ | File system has sequence numbers in the inode addresses.

enum TSK_FS_INFO_TYPE_ENUM

| Values for the file system type. The most-significant nibble is the high-level type. The least-sigificant nibble is the specific sub-type of implementation.

enum TSK_FS_INODE_FLAG_ENUM

Metadata flags used in TSK_FS_INODE.flags and in request to inode_walk.

Enumeration values:

  TSK_FS_INODE_FLAG_ALLOC | Metadata structure is currently in an allocated state.
  TSK_FS_INODE_FLAG_UNALLOC | Metadata structure is currently in an unallocated state.
  TSK_FS_INODE_FLAG_USED | Metadata structure has been allocated at least once.
  TSK_FS_INODE_FLAG_UNUSED | Metadata structure has never been allocated.
  TSK_FS_INODE_FLAG_ORPHAN | Metadata structure is unallocated and has no file name pointing to it.
  TSK_FS_INODE_FLAG_COMP | The file contents are compressed.

enum TSK_FS_INODE_MODE_ENUM

Values for the mode field -- which identifies the file type and permissions.

Enumeration values:

  TSK_FS_INODE_MODE_FMT | Mask to apply to mode to isolate file type.
  TSK_FS_INODE_MODE_FIFO | Named pipe (fifo).
  TSK_FS_INODE_MODE_CHR | Character device.
  TSK_FS_INODE_MODE_DIR | Directory file.
  TSK_FS_INODE_MODE_BLK | Block device.
  TSK_FS_INODE_MODE_REG | Regular file.
  TSK_FS_INODE_MODE_LNK | Symbolic link.
  TSK_FS_INODE_MODE_SHAD | SOLARIS ONLY.
  TSK_FS_INODE_MODE_SOCK | UNIX domain socket.
  TSK_FS_INODE_MODE_WHT | Whiteout.
  TSK_FS_INODE_MODE_ISUID | set user id on execution
  TSK_FS_INODE_MODE_ISGID | set group id on execution
  TSK_FS_INODE_MODE_ISVTX | sticky bit
  TSK_FS_INODE_MODE_IRUSR | R for owner.
  TSK_FS_INODE_MODE_IWUSR | W for owner.
  TSK_FS_INODE_MODE_IXUSR | X for owner.
  TSK_FS_INODE_MODE_IRGRP | R for group.
  TSK_FS_INODE_MODE_IWGRP | W for group.
  TSK_FS_INODE_MODE_IXGRP | X for group.
  TSK_FS_INODE_MODE_IROTH | R for other.
  TSK_FS_INODE_MODE_IWOTH | W for other.
  TSK_FS_INODE_MODE_IXOTH | X for other.

## Function Documentation

TSK_FS_DATA* tsk_fs_data_alloc | ( | TSK_FS_DATA_FLAG_ENUM | type | ) |

Allocates and initializes a new structure.

Parameters:

  | type | The type of attribute to create (Resident or Non-resident)

Returns:
  NULL on error

void tsk_fs_data_clear_list | ( | TSK_FS_DATA * | fs_data_head | ) |

Clear the fields and run_lists in the FS_DATA list.

Parameters:

  | fs_data_head | List of attributes to clear

void tsk_fs_data_free | ( | TSK_FS_DATA * | fs_data_head | ) |

Free the list of TSK_FS_DATA structures and the runs that they allocated.

Parameters:

  | fs_data_head | List of structures to free.

TSK_FS_DATA* tsk_fs_data_getnew_attr | ( | TSK_FS_DATA * | fs_data_head,
|  | TSK_FS_DATA_FLAG_ENUM | type
| ) |

Given the begining of the list, return either an empty element in the list or a new one at the end.

Preference is given to finding one of the same type to prevent excessive malloc's, but if one is not found then a different type is used: type = [TSK_FS_DATA_NONRES | TSK_FS_DATA_RES]

Parameters:

  | fs_data_head | Head of attribute list to search
  | type | Preference for attribute type to reuse

Returns:
  NULL on error or attribute in list to use

TSK_FS_DATA* tsk_fs_data_lookup | ( | TSK_FS_DATA * | fs_data_head,
|  | uint32_t | type,
|  | uint16_t | id
| ) |

Search the list of TSK_FS_DATA structures for an entry with a given type and id.

Parameters:

  | fs_data_head | Head of fs_data list to search
  | type | Type of attribute to find
  | id | Id of attribute to find. If 0, then the lowest id of the given type is returned.

Returns:
  NULL is returned on error and if an entry could not be found. tsk_errno will be set to 0 if entry could not be found and it will be non-zero if an error occured.

TSK_FS_DATA* tsk_fs_data_lookup_noid | ( | TSK_FS_DATA * | fs_data_head,
|  | uint32_t | type
| ) |

Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id).

The attribute with the lowest id (or the named $Data attribute if that type is specified) is returned.

Parameters:

  | fs_data_head | Head of fs_data list to search
  | type | Type of attribute to find

Returns:
  NULL is returned on error and if an entry could not be found. tsk_errno will be set to 0 if entry could not be found and it will be non-zero if an error occured.

TSK_FS_DATA* tsk_fs_data_put_run | ( | TSK_FS_DATA * | fs_data_head,
|  | DADDR_T | start_vcn,
|  | OFF_T | runlen,
|  | TSK_FS_DATA_RUN * | run,
|  | char * | name,
|  | uint32_t | type,
|  | uint16_t | id,
|  | OFF_T | size,
|  | TSK_FS_DATA_FLAG_ENUM | flags,
|  | uint32_t | compsize
| ) |

Add a set of consecutive runs of an attribute of a specified type and id.

This function first determines if the attribute exists and then either creates the attribute or adds to it. This is complicated because we could get the runs out of order so we use "filler" TSK_FS_DATA_RUN structures during the process

Parameters:

  | fs_data_head | The head of the list of attributes (or NULL if list is empty)
  | start_vcn | The virtual cluster number of the start of this run in the attribute.
  | runlen | The total number of clusters in this set of runs.
  | run | The set of runs to add
  | name | Name of the attribute (in case it needs to be created)
  | type | Type of attribute to add run to
  | id | Id of attribute to add run to
  | size | Total size of the attribute (in case it needs to be created)
  | flags | Flags about compression, sparse etc. of data
  | compsize | Compression unit size (in case it needs to be created)

Returns:
  The head of the list or NULL on error

TSK_FS_DATA* tsk_fs_data_put_str | ( | TSK_FS_DATA * | fs_data_head,
|  | char * | name,
|  | uint32_t | type,
|  | uint16_t | id,
|  | void * | res_data,
|  | unsigned int | len
| ) |

Copy resident data to an attribute in the list.

If no attributes exist yet, one will be created and the head of the resulting list will be returned.

Parameters:

  | fs_data_head | Head of the attribute list (or NULL if empty)
  | name | Name of the attribute to add
  | type | Type of the attribute to add
  | id | Id of the attribute to add
  | res_data | Pointer to where resident data is located (data will be copied from here into FS_DATA)
  | len | Length of resident data

Returns:
  NULL on error or head of attribute list

TSK_FS_DATA_RUN* tsk_fs_data_run_alloc | ( |  | ) |

Allocate a run list entry.

Returns:
  NULL on error

void tsk_fs_data_run_free | ( | TSK_FS_DATA_RUN * | fs_data_run | ) |

Free a list of data_runs.

Parameters:

  | fs_data_run | Head of list to free

uint8_t tsk_fs_dcat | ( | TSK_FS_INFO * | fs,
|  | uint8_t | lclflags,
|  | DADDR_T | addr,
|  | DADDR_T | read_num_units
| ) |

Read a specific number of blocks and print the contents to STDOUT.

Parameters:

  | fs | File system to analyze
  | lclflags | flags
  | addr | Starting block address to read from
  | read_num_units | Number of blocks to read

Returns:
  1 on error and 0 on success

TSK_FS_INODE* tsk_fs_inode_alloc | ( | int | direct_count,
|  | int | indir_count
| ) |

Allocates a generic inode / metadata structure.

Parameters:

  | direct_count | Number of direct block address pointers to include in structure
  | indir_count | Number of indirect block address pointers to include in structure

Returns:
  NULL on error

void tsk_fs_inode_free | ( | TSK_FS_INODE * | fs_inode | ) |

Free the memory allocated to the FS_INODE structure.

Parameters:

  | fs_inode | Structure to free

TSK_FS_INODE* tsk_fs_inode_realloc | ( | TSK_FS_INODE * | fs_inode,
|  | int | direct_count,
|  | int | indir_count
| ) |

Resize an existing FS_INODE structure -- changes the number of block pointers.

Parameters:

  | fs_inode | Structure to resize
  | direct_count | Number of direct block address pointers to include in structure
  | indir_count | Number of indirect block address pointers to include in structure

Returns:
  NULL on error

char* tsk_fs_load_file | ( | TSK_FS_INFO * | fs,
|  | TSK_FS_INODE * | fsi,
|  | uint32_t | type,
|  | uint16_t | id,
|  | int | flags
| ) |

Load the contents of a file into a buffer.

Parameters:

  | fs | The file system structure.
  | fsi | The inode structure of the file to read.
  | type | The type of attribute to load (ignored if TSK_FS_FILE_FLAG_NOID is given)
  | id | The id of attribute to load (ignored if TSK_FS_FILE_FLAG_NOID is given)
  | flags | Flag values of type TSK_FS_FILE_FLAG_*

Returns:
  The buffer with the file content (must be freed by caller)

TSK_FS_INFO* tsk_fs_open | ( | TSK_IMG_INFO * | img_info,
|  | SSIZE_T | offset,
|  | const TSK_TCHAR * | type
| ) |

Read data and process it as a file system.

Parameters:

  | img_info | Disk image to analyze
  | offset | Byte offset to start analyzing from
  | type | String type of file system type (autodetects if NULL)

Returns:
  NULL on error

SSIZE_T tsk_fs_read_block | ( | TSK_FS_INFO * | fs,
|  | TSK_DATA_BUF * | buf,
|  | OFF_T | len,
|  | DADDR_T | addr
| ) |

Read a file system block into a TSK_DATA_BUF structure.

This is actually a wrapper around the fs_read_random function, but it allows the starting location to be specified as a block address.

Parameters:

  | fs | The file system structure.
  | buf | The buffer to store the block in.
  | len | The number of bytes to read (must be a multiple of the device block size)
  | addr | The starting block file system address.

Returns:
  The number of bytes read or -1 on error.

SSIZE_T tsk_fs_read_block_nobuf | ( | TSK_FS_INFO * | fs,
|  | char * | buf,
|  | OFF_T | len,
|  | DADDR_T | addr
| ) |

Read a file system block into a char* buffer.

This is actually a wrapper around the fs_read_random function, but it allows the starting location to be specified as a block address.

Parameters:

  | fs | The file system structure.
  | buf | The char * buffer to store the block in.
  | len | The number of bytes to read (must be a multiple of the device block size)
  | addr | The starting block file system address.

Returns:
  The number of bytes read or -1 on error.

SSIZE_T tsk_fs_read_file | ( | TSK_FS_INFO * | fs,
|  | TSK_FS_INODE * | fsi,
|  | uint32_t | type,
|  | uint16_t | id,
|  | SSIZE_T | offset,
|  | SSIZE_T | size,
|  | char * | buf
| ) |

Read the contents of a specific attribute of a file using a typical read() type interface.

Parameters:

  | fs | The file system structure.
  | fsi | The inode structure of the file to read.
  | type | The type of attribute to load
  | id | The id of attribute to load
  | offset | The byte offset to start reading from.
  | size | The number of bytes to read from the file.
  | buf | The buffer to read the data into.

Returns:
  The number of bytes read or -1 on error.

SSIZE_T tsk_fs_read_file_noid | ( | TSK_FS_INFO * | fs,
|  | TSK_FS_INODE * | fsi,
|  | SSIZE_T | offset,
|  | SSIZE_T | size,
|  | char * | buf
| ) |

Read the contents of a file using a typical read() type interface.

Parameters:

  | fs | The file system structure.
  | fsi | The inode structure of the file to read.
  | offset | The byte offset to start reading from.
  | size | The number of bytes to read from the file.
  | buf | The buffer to read the data into.

Returns:
  The number of bytes read or -1 on error.