# fs_data.c File Reference

## Detailed Description

Functions to allocate and add structures to maintain generic file system attributes and run lists.

Currently used only for NTFS, but could be expanded to other file systems in the future.

`#include "fs_tools_i.h"`
`#include "ntfs.h"`

## Functions

TSK_FS_DATA * | tsk_fs_data_alloc (TSK_FS_DATA_FLAG_ENUM type)
| Allocates and initializes a new structure.
TSK_FS_DATA_RUN * | tsk_fs_data_run_alloc ()
| Allocate a run list entry.
void | tsk_fs_data_run_free (TSK_FS_DATA_RUN *fs_data_run)
| Free a list of data_runs.
void | tsk_fs_data_free (TSK_FS_DATA *fs_data_head)
| Free the list of TSK_FS_DATA structures and the runs that they allocated.
void | tsk_fs_data_clear_list (TSK_FS_DATA *fs_data_head)
| Clear the fields and run_lists in the FS_DATA list.
TSK_FS_DATA * | tsk_fs_data_getnew_attr (TSK_FS_DATA *fs_data_head, TSK_FS_DATA_FLAG_ENUM type)
| Given the begining of the list, return either an empty element in the list or a new one at the end.
TSK_FS_DATA * | tsk_fs_data_lookup (TSK_FS_DATA *fs_data_head, uint32_t type, uint16_t id)
| Search the list of TSK_FS_DATA structures for an entry with a given type and id.
TSK_FS_DATA * | tsk_fs_data_lookup_noid (TSK_FS_DATA *fs_data_head, uint32_t type)
| Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id).
TSK_FS_DATA * | tsk_fs_data_put_str (TSK_FS_DATA *fs_data_head, char *name, uint32_t type, uint16_t id, void *res_data, unsigned int len)
| Copy resident data to an attribute in the list.
TSK_FS_DATA * | tsk_fs_data_put_run (TSK_FS_DATA *fs_data_head, DADDR_T start_vcn, OFF_T runlen, TSK_FS_DATA_RUN *run, char *name, uint32_t type, uint16_t id, OFF_T size, TSK_FS_DATA_FLAG_ENUM flags, uint32_t compsize)
| Add a set of consecutive runs of an attribute of a specified type and id.

## Function Documentation

TSK_FS_DATA* tsk_fs_data_alloc | ( | TSK_FS_DATA_FLAG_ENUM | type | ) |

Allocates and initializes a new structure.

Parameters:

  | type | The type of attribute to create (Resident or Non-resident)

Returns:
  NULL on error

void tsk_fs_data_clear_list | ( | TSK_FS_DATA * | fs_data_head | ) |

Clear the fields and run_lists in the FS_DATA list.

Parameters:

  | fs_data_head | List of attributes to clear

void tsk_fs_data_free | ( | TSK_FS_DATA * | fs_data_head | ) |

Free the list of TSK_FS_DATA structures and the runs that they allocated.

Parameters:

  | fs_data_head | List of structures to free.

TSK_FS_DATA* tsk_fs_data_getnew_attr | ( | TSK_FS_DATA * | fs_data_head,
|  | TSK_FS_DATA_FLAG_ENUM | type
| ) |

Given the begining of the list, return either an empty element in the list or a new one at the end.

Preference is given to finding one of the same type to prevent excessive malloc's, but if one is not found then a different type is used: type = [TSK_FS_DATA_NONRES | TSK_FS_DATA_RES]

Parameters:

  | fs_data_head | Head of attribute list to search
  | type | Preference for attribute type to reuse

Returns:
  NULL on error or attribute in list to use

TSK_FS_DATA* tsk_fs_data_lookup | ( | TSK_FS_DATA * | fs_data_head,
|  | uint32_t | type,
|  | uint16_t | id
| ) |

Search the list of TSK_FS_DATA structures for an entry with a given type and id.

Parameters:

  | fs_data_head | Head of fs_data list to search
  | type | Type of attribute to find
  | id | Id of attribute to find. If 0, then the lowest id of the given type is returned.

Returns:
  NULL is returned on error and if an entry could not be found. tsk_errno will be set to 0 if entry could not be found and it will be non-zero if an error occured.

TSK_FS_DATA* tsk_fs_data_lookup_noid | ( | TSK_FS_DATA * | fs_data_head,
|  | uint32_t | type
| ) |

Search the list of TSK_FS_DATA structures for an entry with a given type (and ANY id).

The attribute with the lowest id (or the named $Data attribute if that type is specified) is returned.

Parameters:

  | fs_data_head | Head of fs_data list to search
  | type | Type of attribute to find

Returns:
  NULL is returned on error and if an entry could not be found. tsk_errno will be set to 0 if entry could not be found and it will be non-zero if an error occured.

TSK_FS_DATA* tsk_fs_data_put_run | ( | TSK_FS_DATA * | fs_data_head,
|  | DADDR_T | start_vcn,
|  | OFF_T | runlen,
|  | TSK_FS_DATA_RUN * | run,
|  | char * | name,
|  | uint32_t | type,
|  | uint16_t | id,
|  | OFF_T | size,
|  | TSK_FS_DATA_FLAG_ENUM | flags,
|  | uint32_t | compsize
| ) |

Add a set of consecutive runs of an attribute of a specified type and id.

This function first determines if the attribute exists and then either creates the attribute or adds to it. This is complicated because we could get the runs out of order so we use "filler" TSK_FS_DATA_RUN structures during the process

Parameters:

  | fs_data_head | The head of the list of attributes (or NULL if list is empty)
  | start_vcn | The virtual cluster number of the start of this run in the attribute.
  | runlen | The total number of clusters in this set of runs.
  | run | The set of runs to add
  | name | Name of the attribute (in case it needs to be created)
  | type | Type of attribute to add run to
  | id | Id of attribute to add run to
  | size | Total size of the attribute (in case it needs to be created)
  | flags | Flags about compression, sparse etc. of data
  | compsize | Compression unit size (in case it needs to be created)

Returns:
  The head of the list or NULL on error

TSK_FS_DATA* tsk_fs_data_put_str | ( | TSK_FS_DATA * | fs_data_head,
|  | char * | name,
|  | uint32_t | type,
|  | uint16_t | id,
|  | void * | res_data,
|  | unsigned int | len
| ) |

Copy resident data to an attribute in the list.

If no attributes exist yet, one will be created and the head of the resulting list will be returned.

Parameters:

  | fs_data_head | Head of the attribute list (or NULL if empty)
  | name | Name of the attribute to add
  | type | Type of the attribute to add
  | id | Id of the attribute to add
  | res_data | Pointer to where resident data is located (data will be copied from here into FS_DATA)
  | len | Length of resident data

Returns:
  NULL on error or head of attribute list

TSK_FS_DATA_RUN* tsk_fs_data_run_alloc | ( |  | ) |

Allocate a run list entry.

Returns:
  NULL on error

void tsk_fs_data_run_free | ( | TSK_FS_DATA_RUN * | fs_data_run | ) |

Free a list of data_runs.

Parameters:

  | fs_data_run | Head of list to free