# fs_io.c File Reference

## Detailed Description

Contains functions to read data from a disk image and wrapper functions to read file content.

`#include <errno.h>`
`#include "fs_tools_i.h"`
`#include "ntfs.h"`

## Defines

#define | FS_READ_FILE_CACHE_SZ 8 * 1024

## Functions

SSIZE_T | tsk_fs_read_block (TSK_FS_INFO *fs, TSK_DATA_BUF *buf, OFF_T len, DADDR_T addr)
| Read a file system block into a TSK_DATA_BUF structure.
SSIZE_T | tsk_fs_read_block_nobuf (TSK_FS_INFO *fs, char *buf, OFF_T len, DADDR_T addr)
| Read a file system block into a char* buffer.
char * | tsk_fs_load_file (TSK_FS_INFO *fs, TSK_FS_INODE *fsi, uint32_t type, uint16_t id, int flags)
| Load the contents of a file into a buffer.
SSIZE_T | tsk_fs_read_file_noid (TSK_FS_INFO *fs, TSK_FS_INODE *fsi, SSIZE_T offset, SSIZE_T size, char *buf)
| Read the contents of a file using a typical read() type interface.
SSIZE_T | tsk_fs_read_file (TSK_FS_INFO *fs, TSK_FS_INODE *fsi, uint32_t type, uint16_t id, SSIZE_T offset, SSIZE_T size, char *buf)
| Read the contents of a specific attribute of a file using a typical read() type interface.

## Function Documentation

char* tsk_fs_load_file | ( | TSK_FS_INFO * | fs,
|  | TSK_FS_INODE * | fsi,
|  | uint32_t | type,
|  | uint16_t | id,
|  | int | flags
| ) |

Load the contents of a file into a buffer.

Parameters:

  | fs | The file system structure.
  | fsi | The inode structure of the file to read.
  | type | The type of attribute to load (ignored if TSK_FS_FILE_FLAG_NOID is given)
  | id | The id of attribute to load (ignored if TSK_FS_FILE_FLAG_NOID is given)
  | flags | Flag values of type TSK_FS_FILE_FLAG_*

Returns:
  The buffer with the file content (must be freed by caller)

SSIZE_T tsk_fs_read_block | ( | TSK_FS_INFO * | fs,
|  | TSK_DATA_BUF * | buf,
|  | OFF_T | len,
|  | DADDR_T | addr
| ) |

Read a file system block into a TSK_DATA_BUF structure.

This is actually a wrapper around the fs_read_random function, but it allows the starting location to be specified as a block address.

Parameters:

  | fs | The file system structure.
  | buf | The buffer to store the block in.
  | len | The number of bytes to read (must be a multiple of the device block size)
  | addr | The starting block file system address.

Returns:
  The number of bytes read or -1 on error.

SSIZE_T tsk_fs_read_block_nobuf | ( | TSK_FS_INFO * | fs,
|  | char * | buf,
|  | OFF_T | len,
|  | DADDR_T | addr
| ) |

Read a file system block into a char* buffer.

This is actually a wrapper around the fs_read_random function, but it allows the starting location to be specified as a block address.

Parameters:

  | fs | The file system structure.
  | buf | The char * buffer to store the block in.
  | len | The number of bytes to read (must be a multiple of the device block size)
  | addr | The starting block file system address.

Returns:
  The number of bytes read or -1 on error.

SSIZE_T tsk_fs_read_file | ( | TSK_FS_INFO * | fs,
|  | TSK_FS_INODE * | fsi,
|  | uint32_t | type,
|  | uint16_t | id,
|  | SSIZE_T | offset,
|  | SSIZE_T | size,
|  | char * | buf
| ) |

Read the contents of a specific attribute of a file using a typical read() type interface.

Parameters:

  | fs | The file system structure.
  | fsi | The inode structure of the file to read.
  | type | The type of attribute to load
  | id | The id of attribute to load
  | offset | The byte offset to start reading from.
  | size | The number of bytes to read from the file.
  | buf | The buffer to read the data into.

Returns:
  The number of bytes read or -1 on error.

SSIZE_T tsk_fs_read_file_noid | ( | TSK_FS_INFO * | fs,
|  | TSK_FS_INODE * | fsi,
|  | SSIZE_T | offset,
|  | SSIZE_T | size,
|  | char * | buf
| ) |

Read the contents of a file using a typical read() type interface.

Parameters:

  | fs | The file system structure.
  | fsi | The inode structure of the file to read.
  | offset | The byte offset to start reading from.
  | size | The number of bytes to read from the file.
  | buf | The buffer to read the data into.

Returns:
  The number of bytes read or -1 on error.