# hashdb_tools.h

Go to the documentation of this file.

    00001 /*
    00002  * The Sleuth Kit
    00003  *
    00004  * $Date: 2007/04/19 19:01:34 $
    00005  *
    00006  * Brian Carrier [carrier@sleuthkit.org]
    00007  * Copyright (c) 2003-2007 Brian Carrier.  All rights reserved
    00008  */
    00009
    00015 #ifndef _TSK_HDB_TOOLS_H
    00016 #define _TSK_HDB_TOOLS_H
    00017
    00018 #include "aux_tools.h"
    00019
    00020 #ifdef HAVE_UNISTD
    00021 #include <unistd.h>
    00022 #endif
    00023 #include <string.h>
    00024 #include <ctype.h>
    00025
    00026 #include <sys/types.h>
    00027 #include <sys/stat.h>
    00028
    00029 #include <locale.h>
    00030
    00031 #ifdef TSK_WIN32
    00032 #include <io.h>
    00033 #include <fcntl.h>
    00034 #endif
    00035
    00036 #ifdef __cplusplus
    00037 extern "C" {
    00038 #endif
    00039
    00040
    00044     enum TSK_HDB_FLAG_ENUM {
    00045         TSK_HDB_FLAG_QUICK = 0x01,
    00046         TSK_HDB_FLAG_EXT = 0x02
    00047     };
    00048     typedef enum TSK_HDB_FLAG_ENUM TSK_HDB_FLAG_ENUM;
    00049
    00050
    00054     enum TSK_HDB_HTYPE_ENUM {
    00055         TSK_HDB_HTYPE_MD5_ID = 1,
    00056         TSK_HDB_HTYPE_SHA1_ID = 2,
    00057     };
    00058     typedef enum TSK_HDB_HTYPE_ENUM TSK_HDB_HTYPE_ENUM;
    00059
    00060 #define TSK_HDB_HTYPE_MD5_STR   "md5"
    00061 #define TSK_HDB_HTYPE_SHA1_STR  "sha1"
    00062
    00063 #define TSK_HDB_HTYPE_SHA1_LEN 40
    00064 #define TSK_HDB_HTYPE_MD5_LEN 32
    00065 #define TSK_HDB_HTYPE_CRC32_LEN 8
    00066
    00067
    00071 #define TSK_HDB_HTYPE_STR(x) \
    00072     ( ((x) & TSK_HDB_HTYPE_MD5_ID) ? (TSK_HDB_HTYPE_MD5_STR) : ( \
    00073         ( ((x) & TSK_HDB_HTYPE_SHA1_ID) ? TSK_HDB_HTYPE_SHA1_STR : "") ) )
    00074
    00078 #define TSK_HDB_HTYPE_LEN(x) \
    00079     ( ((x) & TSK_HDB_HTYPE_MD5_ID) ? (TSK_HDB_HTYPE_MD5_LEN) : ( \
    00080         ( ((x) & TSK_HDB_HTYPE_SHA1_ID) ? TSK_HDB_HTYPE_SHA1_LEN : 0) ) )
    00081
    00082
    00083
    00087     enum TSK_HDB_DBTYPE_ENUM {
    00088         TSK_HDB_DBTYPE_NSRL_ID = 1,
    00089         TSK_HDB_DBTYPE_MD5SUM_ID = 2,
    00090         TSK_HDB_DBTYPE_HK_ID = 3,
    00091         TSK_HDB_DBTYPE_IDXONLY_ID = 4
    00092     };
    00093     typedef enum TSK_HDB_DBTYPE_ENUM TSK_HDB_DBTYPE_ENUM;
    00094
    00095
    00096 /* String versions of DB types */
    00097 #define TSK_HDB_DBTYPE_NSRL_STR                 "nsrl"
    00098 #define TSK_HDB_DBTYPE_NSRL_MD5_STR             "nsrl-md5"
    00099 #define TSK_HDB_DBTYPE_NSRL_SHA1_STR            "nsrl-sha1"
    00100 #define TSK_HDB_DBTYPE_MD5SUM_STR               "md5sum"
    00101 #define TSK_HDB_DBTYPE_HK_STR                   "hk"
    00102
    00103 #define TSK_HDB_DBTYPE_SUPPORT_STR              "nsrl-md5, nsrl-sha1, md5sum, hk"
    00104
    00105
    00106     typedef struct TSK_HDB_INFO TSK_HDB_INFO;
    00107
    00108     typedef uint8_t(*TSK_HDB_LOOKUP_FN) (TSK_HDB_INFO *, char *hash,
    00109                                          char *name, void *);
    00110
    00115     struct TSK_HDB_INFO {
    00116
    00117         TSK_TCHAR *db_fname;
    00118
    00119         TSK_TCHAR *uns_fname;
    00120
    00121         FILE *hDb;
    00122         FILE *hIdxTmp;
    00123         FILE *hIdx;
    00124
    00125         OFF_T idx_size;
    00126         uint16_t idx_off;
    00127         size_t idx_llen;
    00128         char *idx_lbuf;
    00129         TSK_TCHAR *idx_fname;
    00130
    00131         TSK_HDB_HTYPE_ENUM hash_type;
    00132         uint16_t hash_len;
    00133
    00134         TSK_HDB_DBTYPE_ENUM db_type;
    00135
    00136          uint8_t(*getentry) (TSK_HDB_INFO *, char *, OFF_T, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *);
    00137          uint8_t(*makeindex) (TSK_HDB_INFO *, TSK_TCHAR *);
    00138     };
    00139
    00143     enum TSK_HDB_OPEN_ENUM {
    00144         TSK_HDB_OPEN_NONE = 0,
    00145         TSK_HDB_OPEN_IDXONLY = (0x1 << 0)
    00146     };
    00147     typedef enum TSK_HDB_OPEN_ENUM TSK_HDB_OPEN_ENUM;
    00148
    00149
    00150     extern TSK_HDB_INFO *tsk_hdb_open(TSK_TCHAR * db_file,
    00151                                       TSK_HDB_OPEN_ENUM flags);
    00152     extern void tsk_hdb_close(TSK_HDB_INFO * hdb);
    00153
    00154     extern uint8_t tsk_hdb_hasindex(TSK_HDB_INFO *, uint8_t htype);
    00155
    00156
    00157 /* Functions */
    00158     extern int8_t tsk_hdb_lookup(TSK_HDB_INFO *, char *, TSK_HDB_FLAG_ENUM,
    00159                                  TSK_HDB_LOOKUP_FN, void *);
    00160
    00161     extern int8_t tsk_hdb_lookup_raw(TSK_HDB_INFO *, uint8_t * hash,
    00162                                      uint8_t len, TSK_HDB_FLAG_ENUM,
    00163                                      TSK_HDB_LOOKUP_FN, void *);
    00164
    00165 #ifdef __cplusplus
    00166 }
    00167 #endif
    00168 #endif