# ext2fs.h

    00001 /*
    00002 ** The Sleuth Kit
    00003 **
    00004 ** $Date: 2007/04/19 19:01:32 $
    00005 **
    00006 ** Brian Carrier [carrier@sleuthkit.org]
    00007 ** Copyright (c) 2003-2005 Brian Carrier.  All rights reserved
    00008 **
    00009 ** TASK
    00010 ** Copyright (c) 2002 Brian Carrier, @stake Inc.  All rights reserved
    00011 **
    00012 */
    00013 #ifndef _EXT2FS_H
    00014 #define _EXT2FS_H
    00015
    00016 #ifdef __cplusplus
    00017 extern "C" {
    00018 #endif
    00019
    00020     typedef uint32_t EXT2_GRPNUM_T;
    00021 #define PRI_EXT2GRP     PRIu32
    00022
    00023 /*
    00024 ** Constants
    00025 */
    00026 #define EXT2FS_FIRSTINO    1    /* inode 1 contains the bad blocks */
    00027 #define EXT2FS_ROOTINO     2    /* location of root directory inode */
    00028 #define EXT2FS_NDADDR      12
    00029 #define EXT2FS_NIADDR      3
    00030 #define EXT2FS_SBOFF       1024
    00031 #define EXT2FS_FS_MAGIC    0xef53
    00032 #define EXT2FS_MAXNAMLEN        255
    00033 #define EXT2FS_MAXPATHLEN       4096
    00034 #define EXT2FS_MIN_BLOCK_SIZE   1024
    00035 #define EXT2FS_MAX_BLOCK_SIZE   4096
    00036 #define EXT2FS_DEV_BSIZE        512
    00037
    00038 /*
    00039 ** Super Block
    00040 */
    00041     typedef struct {
    00042         uint8_t s_inodes_count[4];      /* u32 */
    00043         uint8_t s_blocks_count[4];      /* u32 */
    00044         uint8_t s_r_blocks_count[4];
    00045         uint8_t s_free_blocks_count[4]; /* u32 */
    00046         uint8_t s_free_inode_count[4];  /* u32 */
    00047         uint8_t s_first_data_block[4];  /* u32 */
    00048         uint8_t s_log_block_size[4];    /* u32 */
    00049         uint8_t s_log_frag_size[4];     /* s32 */
    00050         uint8_t s_blocks_per_group[4];  /* u32 */
    00051         uint8_t s_frags_per_group[4];   /* u32 */
    00052         uint8_t s_inodes_per_group[4];  /* u32 */
    00053         uint8_t s_mtime[4];     /* u32 *//* mount time */
    00054         uint8_t s_wtime[4];     /* u32 *//* write time */
    00055         uint8_t s_mnt_count[2]; /* u16 *//* mount count */
    00056         uint8_t s_max_mnt_count[2];     /* s16 */
    00057         uint8_t s_magic[2];     /* u16 */
    00058         uint8_t s_state[2];     /* u16 *//* fs state */
    00059         uint8_t s_errors[2];    /* u16 */
    00060         uint8_t s_minor_rev_level[2];   /* u16 */
    00061         uint8_t s_lastcheck[4]; /* u32 */
    00062         uint8_t s_checkinterval[4];     /* u32 */
    00063         uint8_t s_creator_os[4];        /* u32 */
    00064         uint8_t s_rev_level[4]; /* u32 */
    00065         uint8_t s_def_resuid[2];        /* u16 */
    00066         uint8_t s_def_resgid[2];        /* u16 */
    00067         uint8_t s_first_ino[4]; /* u32 */
    00068         uint8_t s_inode_size[2];        /* u16 */
    00069         uint8_t s_block_group_nr[2];    /* u16 */
    00070         uint8_t s_feature_compat[4];    /* u32 */
    00071         uint8_t s_feature_incompat[4];  /* u32 */
    00072         uint8_t s_feature_ro_compat[4]; /* u32 */
    00073         uint8_t s_uuid[16];     /* u8[16] */
    00074         char s_volume_name[16];
    00075         char s_last_mounted[64];
    00076         uint8_t s_algorithm_usage_bitmap[4];    /* u32 */
    00077         uint8_t s_prealloc_blocks;      /* u8 */
    00078         uint8_t s_prealloc_dir_blocks;  /* u8 */
    00079         uint8_t s_padding1[2];  /* u16 */
    00080         uint8_t s_journal_uuid[16];     /* u8[16] */
    00081         uint8_t s_journal_inum[4];      /* u32 */
    00082         uint8_t s_journal_dev[4];       /* u32 */
    00083         uint8_t s_last_orphan[4];       /* u32 */
    00084         uint8_t s_padding[788];
    00085     } ext2fs_sb;
    00086
    00087 /* File system State Values */
    00088 #define EXT2FS_STATE_VALID      0x0001  /* unmounted correctly */
    00089 #define EXT2FS_STATE_ERROR      0x0002  /* errors detected */
    00090
    00091 /* Operating System Codes */
    00092 #define EXT2FS_OS_LINUX         0
    00093 #define EXT2FS_OS_HURD          1
    00094 #define EXT2FS_OS_MASIX         2
    00095 #define EXT2FS_OS_FREEBSD       3
    00096 #define EXT2FS_OS_LITES         4
    00097
    00098 /* Revision Levels */
    00099 #define EXT2FS_REV_ORIG         0
    00100 #define EXT2FS_REV_DYN          1
    00101
    00102 /* feature flags */
    00103 #define EXT2FS_FEATURE_COMPAT_DIR_PREALLOC      0x0001
    00104 #define EXT2FS_FEATURE_COMPAT_IMAGIC_INODES     0x0002
    00105 #define EXT2FS_FEATURE_COMPAT_HAS_JOURNAL       0x0004
    00106 #define EXT2FS_FEATURE_COMPAT_EXT_ATTR          0x0008
    00107 #define EXT2FS_FEATURE_COMPAT_RESIZE_INO        0x0010
    00108 #define EXT2FS_FEATURE_COMPAT_DIR_INDEX         0x0020
    00109
    00110 #define EXT2FS_FEATURE_INCOMPAT_COMPRESSION     0x0001
    00111 #define EXT2FS_FEATURE_INCOMPAT_FILETYPE        0x0002
    00112 #define EXT2FS_FEATURE_INCOMPAT_RECOVER         0x0004
    00113 #define EXT2FS_FEATURE_INCOMPAT_JOURNAL_DEV     0x0008
    00114
    00115 #define EXT2FS_FEATURE_RO_COMPAT_SPARSE_SUPER   0x0001
    00116 #define EXT2FS_FEATURE_RO_COMPAT_LARGE_FILE             0x0002
    00117 #define EXT2FS_FEATURE_RO_COMPAT_BTREE_DIR              0x0004
    00118
    00119
    00120
    00121 /*
    00122  * Group Descriptor
    00123  */
    00124     typedef struct {
    00125         uint8_t bg_block_bitmap[4];     /* u32: block of blocks bitmap */
    00126         uint8_t bg_inode_bitmap[4];     /* u32: block of inodes bitmap */
    00127         uint8_t bg_inode_table[4];      /* u32: block of inodes table */
    00128         uint8_t bg_free_blocks_count[2];        /* u16: num of free blocks */
    00129         uint8_t bg_free_inodes_count[2];        /* u16: num of free inodes */
    00130         uint8_t bg_used_dirs_count[2];  /* u16: num of use directories  */
    00131         uint8_t f1[14];
    00132     } ext2fs_gd;
    00133
    00134
    00135 /* data address to group number */
    00136 #define ext2_dtog_lcl(fsi, fs, d)       \
    00137         (EXT2_GRPNUM_T)(((d) - tsk_getu32(fsi->endian, fs->s_first_data_block)) / \
    00138         tsk_getu32(fsi->endian, fs->s_blocks_per_group))
    00139
    00140
    00141 /* first fragment of group */
    00142 #define ext2_cgbase_lcl(fsi, fs, c)     \
    00143         ((DADDR_T)((tsk_getu32(fsi->endian, fs->s_blocks_per_group) * (c)) + \
    00144         tsk_getu32(fsi->endian, fs->s_first_data_block)))
    00145
    00146
    00147 /*
    00148  * Inode
    00149  */
    00150     typedef struct {
    00151         uint8_t i_mode[2];      /* u16 */
    00152         uint8_t i_uid[2];       /* u16 */
    00153         uint8_t i_size[4];      /* u32 */
    00154         uint8_t i_atime[4];     /* u32 */
    00155         uint8_t i_ctime[4];     /* u32 */
    00156         uint8_t i_mtime[4];     /* u32 */
    00157         uint8_t i_dtime[4];     /* u32 */
    00158         uint8_t i_gid[2];       /* u16 */
    00159         uint8_t i_nlink[2];     /* u16 */
    00160         uint8_t i_nblk[4];
    00161         uint8_t i_flags[4];
    00162         uint8_t i_f5[4];
    00163         uint8_t i_block[15][4]; /*s32 */
    00164         uint8_t i_generation[4];
    00165         uint8_t i_file_acl[4];
    00166         uint8_t i_size_high[4]; /* u32 - also i_dir_acl for non-regular  */
    00167         uint8_t i_faddr[4];
    00168         uint8_t i_frag;
    00169         uint8_t i_fsize;
    00170         uint8_t f1[2];
    00171         uint8_t i_uid_high[2];
    00172         uint8_t i_gid_high[2];
    00173         uint8_t f7[4];
    00174     } ext2fs_inode;
    00175
    00176 /* MODE */
    00177 #define EXT2_IN_FMT  0017000
    00178 #define EXT2_IN_SOCK 0140000
    00179 #define EXT2_IN_LNK  0120000
    00180 #define EXT2_IN_REG  0100000
    00181 #define EXT2_IN_BLK  0060000
    00182 #define EXT2_IN_DIR  0040000
    00183 #define EXT2_IN_CHR  0020000
    00184 #define EXT2_IN_FIFO  0010000
    00185
    00186 #define EXT2_IN_SECDEL          0x00000001      /* Secure deletion */
    00187 #define EXT2_IN_UNRM            0x00000002      /* Undelete */
    00188 #define EXT2_IN_COMP            0x00000004      /* Compress file */
    00189 #define EXT2_IN_SYNC            0x00000008      /* Synchronous updates */
    00190 #define EXT2_IN_IMM                     0x00000010      /* Immutable file */
    00191 #define EXT2_IN_APPEND          0x00000020      /* writes to file may only append */
    00192 #define EXT2_IN_NODUMP          0x00000040      /* do not dump file */
    00193 #define EXT2_IN_NOA                     0x00000080      /* do not update atime */
    00194
    00195
    00196
    00197 /*
    00198  * directory entries
    00199  */
    00200     typedef struct {
    00201         uint8_t inode[4];       /* u32 */
    00202         uint8_t rec_len[2];     /* u16 */
    00203         uint8_t name_len[2];    /* u16 */
    00204         char name[EXT2FS_MAXNAMLEN];
    00205     } ext2fs_dentry1;
    00206
    00207 /* new structure starting at 2.2 */
    00208     typedef struct {
    00209         uint8_t inode[4];       /* u32 */
    00210         uint8_t rec_len[2];     /* u16 */
    00211         uint8_t name_len;
    00212         uint8_t type;
    00213         char name[EXT2FS_MAXNAMLEN];
    00214     } ext2fs_dentry2;
    00215
    00216 #define EXT2FS_DIRSIZ_lcl(len) \
    00217     ((len + 8 + 3) & ~(3))
    00218
    00219
    00220 /* Ext2 directory file types (not the same as FFS. Sigh. */
    00221 #define EXT2_DE_UNKNOWN         0
    00222 #define EXT2_DE_REG_FILE        1
    00223 #define EXT2_DE_DIR             2
    00224 #define EXT2_DE_CHRDEV          3
    00225 #define EXT2_DE_BLKDEV          4
    00226 #define EXT2_DE_FIFO            5
    00227 #define EXT2_DE_SOCK            6
    00228 #define EXT2_DE_SYMLINK         7
    00229 #define EXT2_DE_MAX             8
    00230
    00231
    00232 #define EXT2_DE_V1      1
    00233 #define EXT2_DE_V2      2
    00234
    00235
    00236
    00237
    00238 /* Extended Attributes
    00239  */
    00240
    00241 #define EXT2_EA_MAGIC   0xEA020000
    00242
    00243     typedef struct {
    00244         uint8_t magic[4];
    00245         uint8_t refcount[4];
    00246         uint8_t blocks[4];
    00247         uint8_t hash[4];
    00248         uint8_t f1[16];
    00249         uint8_t entry;
    00250     } ext2fs_ea_header;
    00251
    00252
    00253 #define EXT2_EA_IDX_USER                   1
    00254 #define EXT2_EA_IDX_POSIX_ACL_ACCESS       2
    00255 #define EXT2_EA_IDX_POSIX_ACL_DEFAULT      3
    00256 #define EXT2_EA_IDX_TRUSTED                4
    00257 #define EXT2_EA_IDX_LUSTRE                 5
    00258 #define EXT2_EA_IDX_SECURITY               6
    00259
    00260 /* Entries follow the header and are aligned to 4-byte boundaries
    00261  * the value of the attribute is stored at the bottom of the block
    00262  */
    00263     typedef struct {
    00264         uint8_t nlen;
    00265         uint8_t nidx;
    00266         uint8_t val_off[2];
    00267         uint8_t val_blk[4];
    00268         uint8_t val_size[4];
    00269         uint8_t hash[4];
    00270         uint8_t name;
    00271     } ext2fs_ea_entry;
    00272
    00273 #define EXT2_EA_LEN(nlen) \
    00274         ((((nlen) + 19 ) / 4) * 4)
    00275
    00276
    00277     typedef struct {
    00278         uint8_t ver[4];
    00279     } ext2fs_pos_acl_head;
    00280
    00281
    00282 #define EXT2_PACL_TAG_USERO     0x01
    00283 #define EXT2_PACL_TAG_USER      0x02
    00284 #define EXT2_PACL_TAG_GRPO      0x04
    00285 #define EXT2_PACL_TAG_GRP       0x08
    00286 #define EXT2_PACL_TAG_MASK      0x10
    00287 #define EXT2_PACL_TAG_OTHER     0x20
    00288
    00289
    00290 #define EXT2_PACL_PERM_EXEC     0x01
    00291 #define EXT2_PACL_PERM_WRITE    0x02
    00292 #define EXT2_PACL_PERM_READ     0x04
    00293
    00294
    00295     typedef struct {
    00296         uint8_t tag[2];
    00297         uint8_t perm[2];
    00298     } ext2fs_pos_acl_entry_sh;
    00299
    00300     typedef struct {
    00301         uint8_t tag[2];
    00302         uint8_t perm[2];
    00303         uint8_t id[4];
    00304     } ext2fs_pos_acl_entry_lo;
    00305
    00306
    00307
    00308
    00309 /************** JOURNAL ******************/
    00310
    00311 /* These values are always in big endian */
    00312
    00313 #define EXT2_JMAGIC     0xC03b3998
    00314
    00315     typedef struct {
    00316         uint8_t magic[4];
    00317         uint8_t entrytype[4];
    00318         uint8_t entryseq[4];    /* sequence of this entry */
    00319         uint8_t bsize[4];       /* size of block */
    00320
    00321         uint8_t num_blk[4];     /* num of blks in journal */
    00322         uint8_t first_blk[4];   /* bl where log starts */
    00323         uint8_t start_seq[4];   /* first commit ID in log */
    00324         uint8_t start_blk[4];   /* journ blk for 1st valid entry */
    00325
    00326         uint8_t j_errno[4];     /* signed error number */
    00327
    00328 /* the rest are not valid for v1 sb */
    00329         uint8_t feature_compat[4];
    00330         uint8_t feature_incompat[4];
    00331         uint8_t feature_ro_incompat[4];
    00332         uint8_t uuid[16];
    00333         uint8_t num_fs[4];      /* num of fs sharing log */
    00334         uint8_t dynsuper[4];    /* fs block of sb copy */
    00335         uint8_t max_trans[4];   /* limit of blk per trans */
    00336         uint8_t max_trans_data[4];      /* limit of data blocks per */
    00337         uint8_t reserved[176];
    00338         uint8_t id_fs[16][48];  /* Ids of fs sharing log */
    00339     } ext2fs_journ_sb;
    00340
    00341
    00342 #define EXT2_J_ETYPE_DESC       1       /* descriptor block */
    00343 #define EXT2_J_ETYPE_COM        2       /* commit */
    00344 #define EXT2_J_ETYPE_SB1        3       /* super block v1 */
    00345 #define EXT2_J_ETYPE_SB2        4       /* sb v2 */
    00346 #define EXT2_J_ETYPE_REV        5       /* revoke */
    00347
    00348
    00349 /* Header that is used for all structures */
    00350     typedef struct {
    00351         uint8_t magic[4];
    00352         uint8_t entry_type[4];
    00353         uint8_t entry_seq[4];
    00354     } ext2fs_journ_head;
    00355
    00356
    00357 /* dentry flags */
    00358 #define EXT2_J_DENTRY_ESC       1       /* The orig block starts with magic */
    00359 #define EXT2_J_DENTRY_SAMEID    2       /* Entry is for same id, so do not skip 16 ahead */
    00360 #define EXT2_J_DENTRY_DEL       4       /* not currently used in src */
    00361 #define EXT2_J_DENTRY_LAST      8       /* Last tag */
    00362
    00363 /* Entry in the descriptor table */
    00364     typedef struct {
    00365         uint8_t fs_blk[4];
    00366         uint8_t flag[4];
    00367     } ext2fs_journ_dentry;
    00368
    00369
    00370 /* Journal Info */
    00371     typedef struct {
    00372
    00373         TSK_FS_INODE *fs_inode;
    00374         INUM_T j_inum;
    00375
    00376         uint32_t bsize;
    00377         DADDR_T first_block;
    00378         DADDR_T last_block;
    00379
    00380         uint32_t start_seq;
    00381         DADDR_T start_blk;
    00382
    00383     } EXT2FS_JINFO;
    00384
    00385
    00386
    00387     /*
    00388      * Structure of an ext2fs file system handle.
    00389      */
    00390     typedef struct {
    00391         TSK_FS_INFO fs_info;    /* super class */
    00392         ext2fs_sb *fs;          /* super block */
    00393
    00394         ext2fs_gd *grp_buf;     /* cached group descriptor */
    00395         EXT2_GRPNUM_T grp_num;  /* cached group number */
    00396
    00397         UCHAR *bmap_buf;        /* cached block allocation bitmap */
    00398         EXT2_GRPNUM_T bmap_grp_num;     /* cached block bitmap nr */
    00399
    00400         UCHAR *imap_buf;        /* cached inode allocation bitmap */
    00401         EXT2_GRPNUM_T imap_grp_num;     /* cached inode bitmap nr */
    00402
    00403         ext2fs_inode *dino_buf; /* cached disk inode */
    00404         INUM_T dino_inum;       /* cached inode number */
    00405
    00406         OFF_T groups_offset;    /* offset to first group desc */
    00407         EXT2_GRPNUM_T groups_count;     /* nr of descriptor group blocks */
    00408         uint8_t deentry_type;   /* v1 or v2 of dentry */
    00409         uint16_t inode_size;    /* size of each inode */
    00410         DADDR_T first_data_block;
    00411
    00412         EXT2FS_JINFO *jinfo;
    00413     } EXT2FS_INFO;
    00414
    00415     extern uint8_t ext2fs_dent_walk(TSK_FS_INFO *, INUM_T,
    00416         TSK_FS_DENT_FLAG_ENUM, TSK_FS_DENT_TYPE_WALK_CB, void *);
    00417     extern uint8_t ext2fs_jentry_walk(TSK_FS_INFO *, int,
    00418         TSK_FS_JENTRY_WALK_CB, void *);
    00419     extern uint8_t ext2fs_jblk_walk(TSK_FS_INFO *, DADDR_T, DADDR_T, int,
    00420         TSK_FS_JBLK_WALK_CB, void *);
    00421     extern uint8_t ext2fs_jopen(TSK_FS_INFO *, INUM_T);
    00422
    00423 #ifdef __cplusplus
    00424 }
    00425 #endif
    00426 #endif