# mm_tools.h

Go to the documentation of this file.

    00001 /*
    00002  * The Sleuth Kit
    00003  *
    00004  * $Date: 2007/04/19 19:01:33 $
    00005  *
    00006  * Brian Carrier [carrier@sleuthkit.org]
    00007  * Copyright (c) 2003-2005 Brian Carrier.  All rights reserved
    00008  *
    00009  */
    00010
    00015 #ifndef _MM_TOOLS_H
    00016 #define _MM_TOOLS_H
    00017
    00018     /*
    00019      * External interface.
    00020      */
    00021 #include "img_tools.h"
    00022 #include <sys/types.h>
    00023
    00024
    00025
    00026 #if defined(HAVE_UNISTD)
    00027 #include <unistd.h>
    00028 #endif
    00029 #if !defined (TSK_WIN32)
    00030 #include <sys/param.h>
    00031 #endif
    00032
    00033 #ifdef __cplusplus
    00034 extern "C" {
    00035 #endif
    00036
    00037
    00038
    00039 /* Structures */
    00040     typedef struct TSK_MM_INFO TSK_MM_INFO;
    00041     typedef struct TSK_MM_PART TSK_MM_PART;
    00042
    00043 /* walk action functions */
    00044     typedef uint8_t(*TSK_MM_PART_WALK_CB) (TSK_MM_INFO *, PNUM_T,
    00045         TSK_MM_PART *, int, void *);
    00046
    00047
    00048
    00052     enum TSK_MM_INFO_TYPE_ENUM {
    00053         TSK_MM_INFO_TYPE_UNSUPP = 0,
    00054         TSK_MM_INFO_TYPE_DOS = 1,
    00055         TSK_MM_INFO_TYPE_BSD = 2,
    00056         TSK_MM_INFO_TYPE_SUN = 3,
    00057         TSK_MM_INFO_TYPE_MAC = 4,
    00058         TSK_MM_INFO_TYPE_GPT = 5,
    00059     };
    00060     typedef enum TSK_MM_INFO_TYPE_ENUM TSK_MM_INFO_TYPE_ENUM;
    00061
    00062
    00063 /***************************************************************
    00064  * TSK_MM_INFO: Allocated when a disk is opened
    00065  */
    00066     struct TSK_MM_INFO {
    00067         TSK_IMG_INFO *img_info;
    00068         TSK_MM_INFO_TYPE_ENUM mmtype;
    00069         DADDR_T offset;
    00070         char *str_type;
    00071         unsigned int block_size;
    00072         unsigned int dev_bsize;
    00073
    00074         /* endian ordering flag - values given in tsk_endian.h */
    00075         uint8_t endian;
    00076
    00077         TSK_MM_PART *part_list; /* linked list of partitions */
    00078
    00079         PNUM_T first_part;      /* number of first partition */
    00080         PNUM_T last_part;       /* number of last partition */
    00081
    00082         /* media management type specific function pointers */
    00083          uint8_t(*part_walk) (TSK_MM_INFO *, PNUM_T, PNUM_T, int,
    00084             TSK_MM_PART_WALK_CB, void *);
    00085         void (*close) (TSK_MM_INFO *);
    00086     };
    00087
    00088
    00089
    00090
    00091 /***************************************************************
    00092  * Generic structures  for partitions / slices
    00093  */
    00094
    00098     enum TSK_MM_PART_TYPE_ENUM {
    00099         TSK_MM_PART_TYPE_DESC = (1 << 0),
    00100         TSK_MM_PART_TYPE_VOL = (1 << 1)
    00101     };
    00102     typedef enum TSK_MM_PART_TYPE_ENUM TSK_MM_PART_TYPE_ENUM;
    00103
    00107     struct TSK_MM_PART {
    00108         TSK_MM_PART *prev;
    00109         TSK_MM_PART *next;
    00110
    00111         DADDR_T start;
    00112         DADDR_T len;
    00113         char *desc;
    00114         int8_t table_num;
    00115         int8_t slot_num;
    00116         TSK_MM_PART_TYPE_ENUM type;
    00117     };
    00118
    00119
    00120
    00121     extern uint8_t tsk_mm_part_unused(TSK_MM_INFO *);
    00122     extern void tsk_mm_part_print(TSK_MM_INFO *);
    00123     extern TSK_MM_PART *tsk_mm_part_add(TSK_MM_INFO *, DADDR_T, DADDR_T,
    00124         TSK_MM_PART_TYPE_ENUM, char *, int8_t, int8_t);
    00125     extern void tsk_mm_part_free(TSK_MM_INFO *);
    00126
    00127     /***** TYPES *****/
    00128     extern TSK_MM_INFO_TYPE_ENUM tsk_mm_parse_type(const TSK_TCHAR *);
    00129     extern char *tsk_mm_get_type(TSK_MM_INFO_TYPE_ENUM);
    00130
    00131
    00132 /**************************************************************8
    00133  * Generic routines.
    00134  */
    00135     extern TSK_MM_INFO *tsk_mm_open(TSK_IMG_INFO *, DADDR_T,
    00136         const TSK_TCHAR *);
    00137     extern SSIZE_T tsk_mm_read_block_nobuf(TSK_MM_INFO *, char *, OFF_T,
    00138         DADDR_T);
    00139     extern void tsk_mm_print_types(FILE *);
    00140
    00141     extern TSK_MM_INFO *tsk_mm_dos_open(TSK_IMG_INFO *, DADDR_T, uint8_t);
    00142     extern TSK_MM_INFO *tsk_mm_mac_open(TSK_IMG_INFO *, DADDR_T);
    00143     extern TSK_MM_INFO *tsk_mm_bsd_open(TSK_IMG_INFO *, DADDR_T);
    00144     extern TSK_MM_INFO *tsk_mm_sun_open(TSK_IMG_INFO *, DADDR_T);
    00145     extern TSK_MM_INFO *tsk_mm_gpt_open(TSK_IMG_INFO *, DADDR_T);
    00146
    00147
    00148 // Endian macros - actual functions in misc/
    00149 #define tsk_mm_guessu16(mm, x, mag)   \
    00150         tsk_guess_end_u16(&(mm->endian), (x), (mag))
    00151
    00152 #define tsk_mm_guessu32(mm, x, mag)   \
    00153         tsk_guess_end_u32(&(mm->endian), (x), (mag))
    00154
    00155
    00156 #ifdef __cplusplus
    00157 }
    00158 #endif
    00159 #endif