# nsrl_index.c File Reference

## Detailed Description

NSRL specific functions to read the database.

`#include "hashdb_tools_i.h"`

## Defines

#define | is_valid_nsrl(x)
| Perform a basic check on a string to see if it starts with quotes and contains a possible SHA-1 value.

## Typedefs

typedef enum TSK_HDB_NSRL_FORM_ENUM | TSK_HDB_NSRL_FORM_ENUM

## Enumerations

enum | TSK_HDB_NSRL_FORM_ENUM { TSK_HDB_NSRL_FORM1 = (1 << 0), TSK_HDB_NSRL_FORM2 = (1 << 1) }
| Version of NSRL Database. More...

## Functions

uint8_t | nsrl_test (FILE *hFile)
| Test the file to see if it is an NSRL database.
uint8_t | nsrl_makeindex (TSK_HDB_INFO *hdb_info, TSK_TCHAR *dbtype)
| Process the database to create a sorted index of it.
uint8_t | nsrl_getentry (TSK_HDB_INFO *hdb_info, char *hash, OFF_T offset, TSK_HDB_FLAG_ENUM flags, TSK_HDB_LOOKUP_FN action, void *cb_ptr)
| Find the corresponding name at a given offset.

## Define Documentation

#define is_valid_nsrl | ( | x |  | ) |

Value:

    ( (strlen((x)) > TSK_HDB_HTYPE_SHA1_LEN + 4) && \
            ((x)[0] == '"') && ((x)[TSK_HDB_HTYPE_SHA1_LEN + 1] == '"') && \
            ((x)[TSK_HDB_HTYPE_SHA1_LEN + 2] == ',') && ((x)[TSK_HDB_HTYPE_SHA1_LEN + 3] == '"') )

Perform a basic check on a string to see if it starts with quotes and contains a possible SHA-1 value.

Parameters:

  | x | string to test

Returns:
  1 if NSRL and 0 if not

## Enumeration Type Documentation

enum TSK_HDB_NSRL_FORM_ENUM

Version of NSRL Database.

Enumeration values:

  TSK_HDB_NSRL_FORM1 | Version 1.
  TSK_HDB_NSRL_FORM2 | Version 2.

## Function Documentation

uint8_t nsrl_getentry | ( | TSK_HDB_INFO * | hdb_info,
|  | char * | hash,
|  | OFF_T | offset,
|  | TSK_HDB_FLAG_ENUM | flags,
|  | TSK_HDB_LOOKUP_FN | action,
|  | void * | cb_ptr
| ) |

Find the corresponding name at a given offset.

The offset was likely determined from the index. The entries in the DB following the one specified are also processed if they have the same hash value and their name is different. The callback is called for each entry.

Parameters:

  | hdb_info | Database to get data from.
  | hash | MD5/SHA-1 hash value that was searched for
  | offset | Byte offset where hash value should be located in db_file
  | flags | (not used)
  | action | Callback used for each entry found in lookup
  | cb_ptr | Pointer to data passed to callback

Returns:
  1 on error and 0 on success

uint8_t nsrl_makeindex | ( | TSK_HDB_INFO * | hdb_info,
|  | TSK_TCHAR * | dbtype
| ) |

Process the database to create a sorted index of it.

Consecutive entries with the same hash value are not added to the index, but will be found during lookup.

Parameters:

  | hdb_info | Hash database to make index of.
  | dbtype | Type of database

Returns:
  1 on error and 0 on success.

uint8_t nsrl_test | ( | FILE * | hFile | ) |

Test the file to see if it is an NSRL database.

Parameters:

  | hFile | File handle to hash database

Returns:
  1 if NSRL and 0 if not