# fs_tools.h

Go to the documentation of this file.

    00001 /*
    00002 ** fs_tools
    00003 ** The Sleuth Kit
    00004 **
    00005 ** This header file is to be included if file system routines
    00006 ** are used from the library.
    00007 **
    00008 ** $Date: 2007/04/19 19:01:32 $
    00009 **
    00010 ** Brian Carrier [carrier@sleuthkit.org]
    00011 ** Copyright (c) 2003-2007 Brian Carrier.  All rights reserved
    00012 **
    00013 ** TASK
    00014 ** Copyright (c) 2002 @stake Inc.  All rights reserved
    00015 **
    00016 ** Copyright (c) 1997,1998,1999, International Business Machines
    00017 ** Corporation and others. All Rights Reserved.
    00018 */
    00019
    00027 #ifndef _TSK_FS_TOOLS_H
    00028 #define _TSK_FS_TOOLS_H
    00029
    00030 #include "img_tools.h"
    00031 #include <sys/types.h>
    00032
    00033
    00034
    00035 #ifdef __cplusplus
    00036 extern "C" {
    00037 #endif
    00038
    00039 /****************  FILE SYSTEM TYPES SECTION ********************/
    00040
    00046     enum TSK_FS_INFO_TYPE_ENUM {
    00047         TSK_FS_INFO_TYPE_FS_MASK = 0xf0,
    00048         TSK_FS_INFO_TYPE_SUB_MASK = 0x0f,
    00049
    00050         TSK_FS_INFO_TYPE_UNSUPP = 0x00,
    00051
    00052         TSK_FS_INFO_TYPE_FFS_TYPE = 0x10,
    00053         TSK_FS_INFO_TYPE_FFS_1 = 0x11,  /* UFS1 - FreeBSD, OpenBSD, BSDI ... */
    00054         TSK_FS_INFO_TYPE_FFS_1B = 0x12, /* Solaris (no type) */
    00055         TSK_FS_INFO_TYPE_FFS_2 = 0x13,  /* UFS2 - FreeBSD, NetBSD */
    00056         TSK_FS_INFO_TYPE_FFS_AUTO = 0x14,
    00057
    00058         TSK_FS_INFO_TYPE_EXT_TYPE = 0x20,
    00059         TSK_FS_INFO_TYPE_EXT_2 = 0x21,
    00060         TSK_FS_INFO_TYPE_EXT_3 = 0x22,
    00061         TSK_FS_INFO_TYPE_EXT_AUTO = 0x23,
    00062
    00063         TSK_FS_INFO_TYPE_FAT_TYPE = 0x30,
    00064         TSK_FS_INFO_TYPE_FAT_12 = 0x31,
    00065         TSK_FS_INFO_TYPE_FAT_16 = 0x32,
    00066         TSK_FS_INFO_TYPE_FAT_32 = 0x33,
    00067         TSK_FS_INFO_TYPE_FAT_AUTO = 0x34,
    00068
    00069         TSK_FS_INFO_TYPE_NTFS_TYPE = 0x40,
    00070         TSK_FS_INFO_TYPE_NTFS = 0x40,
    00071         TSK_FS_INFO_TYPE_NTFS_AUTO = 0x40,
    00072
    00073         TSK_FS_INFO_TYPE_SWAP_TYPE = 0x50,
    00074         TSK_FS_INFO_TYPE_SWAP = 0x50,
    00075
    00076         TSK_FS_INFO_TYPE_RAW_TYPE = 0x60,
    00077         TSK_FS_INFO_TYPE_RAW = 0x60,
    00078
    00079         TSK_FS_INFO_TYPE_ISO9660_TYPE = 0x70,
    00080         TSK_FS_INFO_TYPE_ISO9660 = 0x70,
    00081
    00082         TSK_FS_INFO_TYPE_HFS_TYPE = 0x80,
    00083         TSK_FS_INFO_TYPE_HFS = 0x80,
    00084     };
    00085     typedef enum TSK_FS_INFO_TYPE_ENUM TSK_FS_INFO_TYPE_ENUM;
    00086
    00087     extern TSK_FS_INFO_TYPE_ENUM tsk_fs_parse_type(const TSK_TCHAR *);
    00088     extern void tsk_fs_print_types(FILE *);
    00089     extern char *tsk_fs_get_type(TSK_FS_INFO_TYPE_ENUM);
    00090
    00091     typedef struct TSK_FS_INFO TSK_FS_INFO;
    00092     typedef struct TSK_FS_DATA TSK_FS_DATA;
    00093     typedef struct TSK_FS_DATA_RUN TSK_FS_DATA_RUN;
    00094     typedef struct TSK_FS_INODE_NAME_LIST TSK_FS_INODE_NAME_LIST;
    00095     typedef struct TSK_FS_JENTRY TSK_FS_JENTRY;
    00096
    00097
    00098
    00099
    00100 /*************************************************************************
    00101  * Directory entries
    00102  */
    00103
    00108     enum TSK_FS_DENT_FLAG_ENUM {
    00109         TSK_FS_DENT_FLAG_ALLOC = (1 << 0),
    00110         TSK_FS_DENT_FLAG_UNALLOC = (1 << 1),
    00111         TSK_FS_DENT_FLAG_RECURSE = (1 << 2),
    00112     };
    00113     typedef enum TSK_FS_DENT_FLAG_ENUM TSK_FS_DENT_FLAG_ENUM;
    00114
    00115
    00119     enum TSK_FS_DENT_TYPE_ENUM {
    00120         TSK_FS_DENT_TYPE_UNDEF = 0,
    00121         TSK_FS_DENT_TYPE_FIFO = 1,
    00122         TSK_FS_DENT_TYPE_CHR = 2,
    00123         TSK_FS_DENT_TYPE_DIR = 4,
    00124         TSK_FS_DENT_TYPE_BLK = 6,
    00125         TSK_FS_DENT_TYPE_REG = 8,
    00126         TSK_FS_DENT_TYPE_LNK = 10,
    00127         TSK_FS_DENT_TYPE_SOCK = 12,
    00128         TSK_FS_DENT_TYPE_SHAD = 13,
    00129         TSK_FS_DENT_TYPE_WHT = 14,
    00130     };
    00131     typedef enum TSK_FS_DENT_TYPE_ENUM TSK_FS_DENT_TYPE_ENUM;
    00132
    00133 #define TSK_FS_DENT_TYPE_MAX_STR 15
    00134
    00135 /* ascii representation of above types */
    00136     extern char tsk_fs_dent_str[TSK_FS_DENT_TYPE_MAX_STR][2];
    00137
    00144     struct TSK_FS_DENT {
    00145         char *name;
    00146         ULONG name_max;
    00147
    00148         char *shrt_name;
    00149         ULONG shrt_name_max;
    00150
    00151         char *path;
    00152         unsigned int pathdepth;
    00153
    00154         INUM_T inode;
    00155         struct TSK_FS_INODE *fsi;
    00156
    00157         TSK_FS_DENT_TYPE_ENUM ent_type;
    00158         TSK_FS_DENT_FLAG_ENUM flags;
    00159     };
    00160
    00161     typedef struct TSK_FS_DENT TSK_FS_DENT;
    00162
    00163
    00164 /******************* INODE / META DATA **************/
    00165
    00166
    00170     enum TSK_FS_INODE_FLAG_ENUM {
    00171         TSK_FS_INODE_FLAG_ALLOC = (1 << 0),
    00172         TSK_FS_INODE_FLAG_UNALLOC = (1 << 1),
    00173         TSK_FS_INODE_FLAG_USED = (1 << 2),
    00174         TSK_FS_INODE_FLAG_UNUSED = (1 << 3),
    00175         TSK_FS_INODE_FLAG_ORPHAN = (1 << 4),
    00176         TSK_FS_INODE_FLAG_COMP = (1 << 5)
    00177     };
    00178     typedef enum TSK_FS_INODE_FLAG_ENUM TSK_FS_INODE_FLAG_ENUM;
    00179
    00180
    00181
    00185 #define TSK_FS_INODE_NAME_LIST_NSIZE    512
    00186
    00194     struct TSK_FS_INODE_NAME_LIST {
    00195         TSK_FS_INODE_NAME_LIST *next;
    00196         char name[TSK_FS_INODE_NAME_LIST_NSIZE];
    00197         INUM_T par_inode;
    00198         uint32_t par_seq;
    00199     };
    00200
    00204     struct TSK_FS_INODE {
    00205         INUM_T addr;
    00206         mode_t mode;
    00207         int nlink;
    00208         OFF_T size;
    00209         uid_t uid;
    00210         gid_t gid;
    00211
    00212         /* @@@ Need to make these 64-bits ... ? */
    00213         time_t mtime;
    00214         time_t atime;
    00215         time_t ctime;
    00216
    00217         /* filesystem specific times */
    00218         union {
    00219             struct {
    00220                 time_t crtime;
    00221             };
    00222             struct {
    00223                 time_t dtime;
    00224             };
    00225             struct {
    00226                 time_t bkup_time;
    00227                 time_t attr_mtime;
    00228             };
    00229         };
    00230
    00231         DADDR_T *direct_addr;
    00232         int direct_count;
    00233         DADDR_T *indir_addr;
    00234         int indir_count;
    00235
    00236         uint32_t seq;
    00237         TSK_FS_DATA *attr;
    00238         TSK_FS_INODE_NAME_LIST *name;
    00239         char *link;
    00240
    00241         TSK_FS_INODE_FLAG_ENUM flags;
    00242     };
    00243
    00244     typedef struct TSK_FS_INODE TSK_FS_INODE;
    00245
    00246     extern TSK_FS_INODE *tsk_fs_inode_alloc(int, int);
    00247     extern TSK_FS_INODE *tsk_fs_inode_realloc(TSK_FS_INODE *, int, int);
    00248     extern void tsk_fs_inode_free(TSK_FS_INODE *);
    00249
    00250
    00253 #define TSK_FS_ORPHAN_STR "-ORPHAN_FILE-"
    00254
    00255 /* Type of file in the mode field of Inodes.  FAT and NTFS are converted
    00256  * to this mode value */
    00257
    00262     enum TSK_FS_INODE_MODE_ENUM {
    00263
    00264         /* the following are file types */
    00265         TSK_FS_INODE_MODE_FMT = 0170000,
    00266         TSK_FS_INODE_MODE_FIFO = 0010000,
    00267         TSK_FS_INODE_MODE_CHR = 0020000,
    00268         TSK_FS_INODE_MODE_DIR = 0040000,
    00269         TSK_FS_INODE_MODE_BLK = 0060000,
    00270         TSK_FS_INODE_MODE_REG = 0100000,
    00271         TSK_FS_INODE_MODE_LNK = 0120000,
    00272         TSK_FS_INODE_MODE_SHAD = 0130000,
    00273         TSK_FS_INODE_MODE_SOCK = 0140000,
    00274         TSK_FS_INODE_MODE_WHT = 0160000,
    00275
    00276         /* The following describe the file permissions */
    00277         TSK_FS_INODE_MODE_ISUID = 0004000,
    00278         TSK_FS_INODE_MODE_ISGID = 0002000,
    00279         TSK_FS_INODE_MODE_ISVTX = 0001000,
    00280
    00281         TSK_FS_INODE_MODE_IRUSR = 0000400,
    00282         TSK_FS_INODE_MODE_IWUSR = 0000200,
    00283         TSK_FS_INODE_MODE_IXUSR = 0000100,
    00284
    00285         TSK_FS_INODE_MODE_IRGRP = 0000040,
    00286         TSK_FS_INODE_MODE_IWGRP = 0000020,
    00287         TSK_FS_INODE_MODE_IXGRP = 0000010,
    00288
    00289         TSK_FS_INODE_MODE_IROTH = 0000004,
    00290         TSK_FS_INODE_MODE_IWOTH = 0000002,
    00291         TSK_FS_INODE_MODE_IXOTH = 0000001
    00292     };
    00293     typedef enum TSK_FS_INODE_MODE_ENUM TSK_FS_INODE_MODE_ENUM;
    00294
    00295
    00296 #define TSK_FS_INODE_MODE_TYPE_SHIFT    12
    00297 #define TSK_FS_INODE_MODE_TYPE_STR_MAX 15
    00298
    00299     extern char tsk_fs_inode_mode_str[TSK_FS_INODE_MODE_TYPE_STR_MAX][2];
    00300
    00301
    00304     enum TSK_FS_BLOCK_FLAG_ENUM {
    00305         TSK_FS_BLOCK_FLAG_ALLOC = (1 << 0),
    00306         TSK_FS_BLOCK_FLAG_UNALLOC = (1 << 1),
    00307         TSK_FS_BLOCK_FLAG_CONT = (1 << 2),
    00308         TSK_FS_BLOCK_FLAG_META = (1 << 3),
    00309         TSK_FS_BLOCK_FLAG_BAD = (1 << 4),
    00310         TSK_FS_BLOCK_FLAG_ALIGN = (1 << 5),
    00311         TSK_FS_BLOCK_FLAG_RES = (1 << 6),
    00312         TSK_FS_BLOCK_FLAG_SPARSE = (1 << 7),
    00313         TSK_FS_BLOCK_FLAG_COMP = (1 << 8)
    00314     };
    00315     typedef enum TSK_FS_BLOCK_FLAG_ENUM TSK_FS_BLOCK_FLAG_ENUM;
    00316
    00317
    00318
    00322     enum TSK_FS_FILE_FLAG_ENUM {
    00323         TSK_FS_FILE_FLAG_AONLY = (1 << 0),
    00324         TSK_FS_FILE_FLAG_SLACK = (1 << 1),
    00325         TSK_FS_FILE_FLAG_RECOVER = (1 << 2),
    00326         TSK_FS_FILE_FLAG_META = (1 << 3),
    00327         TSK_FS_FILE_FLAG_NOSPARSE = (1 << 4),
    00328         TSK_FS_FILE_FLAG_NOID = (1 << 5)
    00329     };
    00330     typedef enum TSK_FS_FILE_FLAG_ENUM TSK_FS_FILE_FLAG_ENUM;
    00331
    00332 /* walk callback functions */
    00333     typedef uint8_t(*TSK_FS_INODE_WALK_CB) (TSK_FS_INFO *, TSK_FS_INODE *,
    00334         void *);
    00335     typedef uint8_t(*TSK_FS_BLOCK_WALK_CB) (TSK_FS_INFO *, DADDR_T, char *,
    00336         TSK_FS_BLOCK_FLAG_ENUM, void *);
    00337     typedef uint8_t(*TSK_FS_DENT_TYPE_WALK_CB) (TSK_FS_INFO *,
    00338         TSK_FS_DENT *, void *);
    00339     typedef uint8_t(*TSK_FS_FILE_WALK_CB) (TSK_FS_INFO *, DADDR_T, char *,
    00340         size_t, TSK_FS_BLOCK_FLAG_ENUM, void *);
    00341     typedef uint8_t(*TSK_FS_JBLK_WALK_CB) (TSK_FS_INFO *, char *, int,
    00342         void *);
    00343     typedef uint8_t(*TSK_FS_JENTRY_WALK_CB) (TSK_FS_INFO *,
    00344         TSK_FS_JENTRY *, int, void *);
    00345
    00346
    00347 /******************************* TSK_FS_INFO ******************/
    00348
    00352     enum TSK_FS_INFO_FLAG_ENUM {
    00353         TSK_FS_INFO_FLAG_HAVE_SEQ = (1 << 0)
    00354     };
    00355     typedef enum TSK_FS_INFO_FLAG_ENUM TSK_FS_INFO_FLAG_ENUM;
    00356
    00357
    00364     struct TSK_FS_INFO {
    00365         TSK_IMG_INFO *img_info;
    00366         SSIZE_T offset;
    00367
    00368         /* meta data */
    00369         INUM_T inum_count;
    00370         INUM_T root_inum;
    00371         INUM_T first_inum;
    00372         INUM_T last_inum;
    00373
    00374         /* content */
    00375         DADDR_T block_count;
    00376         DADDR_T first_block;
    00377         DADDR_T last_block;
    00378         unsigned int block_size;
    00379         unsigned int dev_bsize;
    00380
    00381         /* Journal */
    00382         INUM_T journ_inum;
    00383
    00384         TSK_FS_INFO_TYPE_ENUM ftype;
    00385         char *duname;
    00386         TSK_FS_INFO_FLAG_ENUM flags;
    00387
    00388         uint8_t endian;
    00389
    00390         TSK_LIST *list_inum_named;
    00396          uint8_t(*block_walk) (TSK_FS_INFO *, DADDR_T, DADDR_T,
    00397             TSK_FS_BLOCK_FLAG_ENUM, TSK_FS_BLOCK_WALK_CB, void *);
    00398
    00400          uint8_t(*inode_walk) (TSK_FS_INFO *, INUM_T, INUM_T,
    00401             TSK_FS_INODE_FLAG_ENUM, TSK_FS_INODE_WALK_CB, void *);
    00402
    00404         TSK_FS_INODE *(*inode_lookup) (TSK_FS_INFO *, INUM_T);
    00405
    00407          uint8_t(*istat) (TSK_FS_INFO *, FILE *, INUM_T, DADDR_T, int32_t);
    00408
    00410          uint8_t(*file_walk) (TSK_FS_INFO *, TSK_FS_INODE *, uint32_t,
    00411             uint16_t, TSK_FS_FILE_FLAG_ENUM, TSK_FS_FILE_WALK_CB, void *);
    00412
    00414          uint8_t(*dent_walk) (TSK_FS_INFO *, INUM_T, TSK_FS_DENT_FLAG_ENUM,
    00415             TSK_FS_DENT_TYPE_WALK_CB, void *);
    00416
    00418          uint8_t(*jopen) (TSK_FS_INFO *, INUM_T);
    00419
    00421          uint8_t(*jblk_walk) (TSK_FS_INFO *, DADDR_T, DADDR_T, int,
    00422             TSK_FS_JBLK_WALK_CB, void *);
    00423
    00425          uint8_t(*jentry_walk) (TSK_FS_INFO *, int, TSK_FS_JENTRY_WALK_CB,
    00426             void *);
    00427
    00428
    00430          uint8_t(*fsstat) (TSK_FS_INFO *, FILE *);
    00431
    00433          uint8_t(*fscheck) (TSK_FS_INFO *, FILE *);
    00434
    00436         void (*close) (TSK_FS_INFO *);
    00437     };
    00438
    00439
    00440
    00441 /***************************************************************
    00442  * Generic inode structure for filesystem-independent operations.
    00443  */
    00444
    00445
    00446 /*
    00447  * All non-resident addresses will be stored here so that the search
    00448  * programs (find_inode) can account for the addresses.
    00449  *
    00450  * All resident non-standard attributes will be stored here so they
    00451  * can be displayed.  By default, the $Data attribute will be saved
    00452  * in the TSK_FS_INODE structure. If the $Data attribute is resident,
    00453  * then the dir/indir stuff will be 0 and the $Data will be the
    00454  * first element in this linked list
    00455  */
    00456
    00460     enum TSK_FS_DATA_RUN_FLAG_ENUM {
    00461         TSK_FS_DATA_RUN_FLAG_FILLER = 0x1,
    00462         TSK_FS_DATA_RUN_FLAG_SPARSE = 0x2
    00463     };
    00464     typedef enum TSK_FS_DATA_RUN_FLAG_ENUM TSK_FS_DATA_RUN_FLAG_ENUM;
    00465
    00466 /* len = 0 when not being used */
    00471     struct TSK_FS_DATA_RUN {
    00472         TSK_FS_DATA_RUN *next;
    00473         DADDR_T addr;
    00474         DADDR_T len;
    00475         TSK_FS_DATA_RUN_FLAG_ENUM flags;
    00476     };
    00477
    00478
    00482     enum TSK_FS_DATA_FLAG_ENUM {
    00483         TSK_FS_DATA_INUSE = 0x1,
    00484         TSK_FS_DATA_NONRES = 0x2,
    00485         TSK_FS_DATA_RES = 0x4,
    00486         TSK_FS_DATA_ENC = 0x10,
    00487         TSK_FS_DATA_COMP = 0x20,
    00488         TSK_FS_DATA_SPARSE = 0x40,
    00489     };
    00490     typedef enum TSK_FS_DATA_FLAG_ENUM TSK_FS_DATA_FLAG_ENUM;
    00491
    00500     struct TSK_FS_DATA {
    00501         TSK_FS_DATA *next;
    00502         TSK_FS_DATA_FLAG_ENUM flags;
    00503         char *name;
    00504         size_t nsize;
    00505         uint32_t type;
    00506         uint16_t id;
    00507
    00508         OFF_T size;
    00509
    00510         /* Run-List data (non-resident) */
    00511         TSK_FS_DATA_RUN *run;
    00512         OFF_T allocsize;
    00513         uint32_t compsize;
    00514
    00515         /* stream data (resident) */
    00516         size_t buflen;
    00517         uint8_t *buf;
    00518     };
    00519
    00520
    00521
    00522     extern TSK_FS_DATA *tsk_fs_data_alloc(TSK_FS_DATA_FLAG_ENUM);
    00523     extern TSK_FS_DATA_RUN *tsk_fs_data_run_alloc();
    00524     extern TSK_FS_DATA *tsk_fs_data_getnew_attr(TSK_FS_DATA *,
    00525         TSK_FS_DATA_FLAG_ENUM);
    00526     extern void tsk_fs_data_clear_list(TSK_FS_DATA *);
    00527
    00528     extern TSK_FS_DATA *tsk_fs_data_put_str(TSK_FS_DATA *, char *,
    00529         uint32_t, uint16_t, void *, unsigned int);
    00530
    00531     extern TSK_FS_DATA *tsk_fs_data_put_run(TSK_FS_DATA *, DADDR_T, OFF_T,
    00532         TSK_FS_DATA_RUN *, char *, uint32_t, uint16_t, OFF_T,
    00533         TSK_FS_DATA_FLAG_ENUM, uint32_t);
    00534
    00535     extern TSK_FS_DATA *tsk_fs_data_lookup(TSK_FS_DATA *, uint32_t,
    00536         uint16_t);
    00537     extern TSK_FS_DATA *tsk_fs_data_lookup_noid(TSK_FS_DATA *, uint32_t);
    00538
    00539     extern void tsk_fs_data_run_free(TSK_FS_DATA_RUN *);
    00540     extern void tsk_fs_data_free(TSK_FS_DATA *);
    00541
    00542
    00543
    00544 /**************** Journal Stuff **********************/
    00545     struct TSK_FS_JENTRY {
    00546         DADDR_T jblk;           /* journal block address */
    00547         DADDR_T fsblk;          /* fs block that journal entry is about */
    00548     };
    00549
    00550
    00551
    00552 /* function decs */
    00553     extern TSK_FS_DENT *tsk_fs_dent_alloc(ULONG, ULONG);
    00554     extern TSK_FS_DENT *tsk_fs_dent_realloc(TSK_FS_DENT *, ULONG);
    00555     extern void tsk_fs_dent_free(TSK_FS_DENT *);
    00556     extern void tsk_fs_dent_print(FILE *, TSK_FS_DENT *,
    00557         TSK_FS_INFO *, TSK_FS_DATA *);
    00558     extern void tsk_fs_dent_print_long(FILE *, TSK_FS_DENT *,
    00559         TSK_FS_INFO *, TSK_FS_DATA *);
    00560     extern void tsk_fs_dent_print_mac(FILE *, TSK_FS_DENT *,
    00561         TSK_FS_INFO *, TSK_FS_DATA * fs_data, char *);
    00562
    00563     extern void tsk_fs_make_ls(mode_t, char *);
    00564     extern void tsk_fs_print_day(FILE *, time_t);
    00565     extern void tsk_fs_print_time(FILE *, time_t);
    00566
    00567 /*
    00568 ** Is this string a "." or ".."
    00569 */
    00570 #define TSK_FS_ISDOT(str) ( ((str[0] == '.') && \
    00571  ( ((str[1] == '.') && (str[2] == '\0')) || (str[1] == '\0') ) ) ? 1 : 0 )
    00572
    00573
    00574
    00575 /**************************************************************8
    00576  * Generic routines.
    00577  */
    00578     extern TSK_FS_INFO *tsk_fs_open(TSK_IMG_INFO *, SSIZE_T,
    00579         const TSK_TCHAR *);
    00580
    00581 /* fs_io routines */
    00582     extern SSIZE_T tsk_fs_read_block(TSK_FS_INFO *, TSK_DATA_BUF *, OFF_T,
    00583         DADDR_T);
    00584     extern SSIZE_T tsk_fs_read_block_nobuf(TSK_FS_INFO *, char *, OFF_T,
    00585         DADDR_T);
    00586 #define tsk_fs_read_random(fsi, buf, len, offs) \
    00587         (fsi)->img_info->read_random((fsi)->img_info, (fsi)->offset, (buf), (len), (offs))
    00588
    00589     extern char *tsk_fs_load_file(TSK_FS_INFO *, TSK_FS_INODE *, uint32_t,
    00590         uint16_t, int);
    00591
    00592     extern SSIZE_T
    00593         tsk_fs_read_file(TSK_FS_INFO *, TSK_FS_INODE *, uint32_t, uint16_t,
    00594         SSIZE_T, SSIZE_T, char *);
    00595
    00596     extern SSIZE_T
    00597         tsk_fs_read_file_noid(TSK_FS_INFO *, TSK_FS_INODE *, SSIZE_T,
    00598         SSIZE_T, char *);
    00599
    00600
    00601
    00602 /***** LIBRARY ROUTINES FOR COMMAND LINE FUNCTIONS */
    00603 #define TSK_FS_DCALC_DD        0x1
    00604 #define TSK_FS_DCALC_DLS       0x2
    00605 #define TSK_FS_DCALC_SLACK     0x4
    00606     extern int8_t tsk_fs_dcalc(TSK_FS_INFO * fs, uint8_t lclflags,
    00607         DADDR_T cnt);
    00608
    00609
    00610 #define TSK_FS_DCAT_HEX                0x1
    00611 #define TSK_FS_DCAT_ASCII   0x2
    00612 #define TSK_FS_DCAT_HTML       0x4
    00613 #define TSK_FS_DCAT_STAT       0x8
    00614     extern uint8_t tsk_fs_dcat(TSK_FS_INFO * fs, uint8_t lclflags,
    00615         DADDR_T addr, DADDR_T read_num_units);
    00616
    00617
    00618 #define TSK_FS_DLS_CAT     0x01
    00619 #define TSK_FS_DLS_LIST    0x02
    00620 #define TSK_FS_DLS_SLACK   0x04
    00621     extern uint8_t tsk_fs_dls(TSK_FS_INFO * fs, uint8_t lclflags,
    00622         DADDR_T bstart, DADDR_T bend, TSK_FS_BLOCK_FLAG_ENUM flags);
    00623
    00624     extern uint8_t tsk_fs_dstat(TSK_FS_INFO * fs, uint8_t lclflags,
    00625         DADDR_T addr, TSK_FS_BLOCK_FLAG_ENUM flags);
    00626
    00627 #define TSK_FS_FFIND_ALL 0x1
    00628     extern uint8_t tsk_fs_ffind(TSK_FS_INFO * fs, uint8_t lclflags,
    00629         INUM_T inode, uint32_t type, uint16_t id, int flags);
    00630
    00631
    00632
    00633 #define TSK_FS_FLS_DOT         0x001
    00634 #define TSK_FS_FLS_LONG        0x002
    00635 #define TSK_FS_FLS_FILE        0x004
    00636 #define TSK_FS_FLS_DIR         0x008
    00637 #define TSK_FS_FLS_FULL        0x010
    00638 #define TSK_FS_FLS_MAC         0x020
    00639     extern uint8_t tsk_fs_fls(TSK_FS_INFO * fs, uint8_t lclflags,
    00640         INUM_T inode, int flags, TSK_TCHAR * pre, int32_t skew);
    00641
    00642
    00643     extern uint8_t tsk_fs_icat(TSK_FS_INFO * fs, uint8_t lclflags,
    00644         INUM_T inum, uint32_t type, uint16_t id, int flags);
    00645
    00646
    00647 #define TSK_FS_IFIND_ALL       0x01
    00648 #define TSK_FS_IFIND_PATH      0x04
    00649 #define TSK_FS_IFIND_DATA      0x08
    00650 #define TSK_FS_IFIND_PAR       0x10
    00651 #define TSK_FS_IFIND_PAR_LONG  0x20
    00652     extern int8_t tsk_fs_ifind_path(TSK_FS_INFO * fs, uint8_t lclflags,
    00653         TSK_TCHAR * path, INUM_T * result);
    00654     extern uint8_t tsk_fs_ifind_data(TSK_FS_INFO * fs, uint8_t lclflags,
    00655         DADDR_T blk);
    00656     extern uint8_t tsk_fs_ifind_par(TSK_FS_INFO * fs, uint8_t lclflags,
    00657         INUM_T par);
    00658
    00659
    00660 #define TSK_FS_ILS_OPEN        (1<<0)
    00661 #define TSK_FS_ILS_MAC          (1<<1)
    00662 #define TSK_FS_ILS_LINK (1<<2)
    00663 #define TSK_FS_ILS_UNLINK       (1<<3)
    00664
    00665     extern uint8_t tsk_fs_ils(TSK_FS_INFO * fs, uint8_t lclflags,
    00666         INUM_T istart, INUM_T ilast, int flags, int32_t skew,
    00667         TSK_TCHAR * img);
    00668
    00669
    00670
    00671 #ifdef __cplusplus
    00672 }
    00673 #endif
    00674 #endif
    00675 /* LICENSE
    00676  * .ad
    00677  * .fi
    00678  *      This software is distributed under the IBM Public License.
    00679  * AUTHOR(S)
    00680  *      Wietse Venema
    00681  *      IBM T.J. Watson Research
    00682  *      P.O. Box 704
    00683  *      Yorktown Heights, NY 10598, USA
    00684  --*/