Main Page | Data Structures | Directories | File List | Data Fields | Globals

# hashdb_tools.h File Reference

## Detailed Description

Header file that defines internal data structures and functions.

`#include "aux_tools.h"`
`#include <string.h>`
`#include <ctype.h>`
`#include <sys/types.h>`
`#include <sys/stat.h>`
`#include <locale.h>`

Go to the source code of this file.

## Defines
#define | TSK_HDB_HTYPE_MD5_STR "md5"
| String name for MD5 algorithm.
#define | TSK_HDB_HTYPE_SHA1_STR "sha1"
| String name for SHA1 algorithm.
#define | TSK_HDB_HTYPE_SHA1_LEN 40
| Length of SHA1 hash.
#define | TSK_HDB_HTYPE_MD5_LEN 32
| Length of MD5 hash.
#define | TSK_HDB_HTYPE_CRC32_LEN 8
| Length of CRC hash.
#define | TSK_HDB_HTYPE_STR(x)
| Return the name of the hash algorithm, given its ID.
#define | TSK_HDB_HTYPE_LEN(x)
| Return the length of a hash, given its ID.
#define | TSK_HDB_DBTYPE_NSRL_STR "nsrl"
| NSRL String name.
#define | TSK_HDB_DBTYPE_NSRL_MD5_STR "nsrl-md5"
| NSRL md5 string name.
#define | TSK_HDB_DBTYPE_NSRL_SHA1_STR "nsrl-sha1"
| NSRL SHA1 string name.
#define | TSK_HDB_DBTYPE_MD5SUM_STR "md5sum"
| md5sum db string n ame
#define | TSK_HDB_DBTYPE_HK_STR "hk"
| hash keeper string name
#define | TSK_HDB_DBTYPE_SUPPORT_STR "nsrl-md5, nsrl-sha1, md5sum, hk"
| List of supported data base types.
## Typedefs
typedef enum TSK_HDB_FLAG_ENUM | TSK_HDB_FLAG_ENUM
typedef enum TSK_HDB_HTYPE_ENUM | TSK_HDB_HTYPE_ENUM
typedef enum TSK_HDB_DBTYPE_ENUM | TSK_HDB_DBTYPE_ENUM
typedef TSK_HDB_INFO | TSK_HDB_INFO
typedef uint8_t(* | TSK_HDB_LOOKUP_FN )(TSK_HDB_INFO *, char *hash, char *name, void *)
typedef enum TSK_HDB_OPEN_ENUM | TSK_HDB_OPEN_ENUM
## Enumerations
enum | TSK_HDB_FLAG_ENUM { TSK_HDB_FLAG_QUICK = 0x01, TSK_HDB_FLAG_EXT = 0x02 }
| Flags used for lookups. More...
enum | TSK_HDB_HTYPE_ENUM { TSK_HDB_HTYPE_MD5_ID = 1, TSK_HDB_HTYPE_SHA1_ID = 2 }
| Hash algorithm types. More...
enum | TSK_HDB_DBTYPE_ENUM { TSK_HDB_DBTYPE_NSRL_ID = 1, TSK_HDB_DBTYPE_MD5SUM_ID = 2, TSK_HDB_DBTYPE_HK_ID = 3, TSK_HDB_DBTYPE_IDXONLY_ID = 4 }
| Hash Database types. More...
enum | TSK_HDB_OPEN_ENUM { TSK_HDB_OPEN_NONE = 0, TSK_HDB_OPEN_IDXONLY = (0x1 << 0) }
| Options for opening a hash database. More...
## Functions
TSK_HDB_INFO * | tsk_hdb_open (TSK_TCHAR *db_file, TSK_HDB_OPEN_ENUM flags)
| Open a hash database and index for lookup.
void | tsk_hdb_close (TSK_HDB_INFO *hdb)
| Close the HDB_INFO structure and free the memory.
uint8_t | tsk_hdb_hasindex (TSK_HDB_INFO *, uint8_t htype)
| Determine if the hash database that is open has an index that has been created.
int8_t | tsk_hdb_lookup (TSK_HDB_INFO *, char *, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *)
| Perform the binary search in the index for the text/ASCII hash value.
int8_t | tsk_hdb_lookup_raw (TSK_HDB_INFO *, uint8_t *hash, uint8_t len, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *)
| Perform the binary search in the index for a hash value given in a raw (non-text) format.

## Define Documentation

#define TSK_HDB_HTYPE_LEN | ( | x |  | ) |

| Value:
    ( ((x) & TSK_HDB_HTYPE_MD5_ID) ? (TSK_HDB_HTYPE_MD5_LEN) : ( \
            ( ((x) & TSK_HDB_HTYPE_SHA1_ID) ? TSK_HDB_HTYPE_SHA1_LEN : 0) ) )
Return the length of a hash, given its ID.

#define TSK_HDB_HTYPE_STR | ( | x |  | ) |

| Value:
    ( ((x) & TSK_HDB_HTYPE_MD5_ID) ? (TSK_HDB_HTYPE_MD5_STR) : ( \
            ( ((x) & TSK_HDB_HTYPE_SHA1_ID) ? TSK_HDB_HTYPE_SHA1_STR : "") ) )
Return the name of the hash algorithm, given its ID.

## Enumeration Type Documentation

enum TSK_HDB_DBTYPE_ENUM

  | Hash Database types. Enumeration values:
  TSK_HDB_DBTYPE_NSRL_ID | NIST NSRL format.
  TSK_HDB_DBTYPE_MD5SUM_ID | md5sum format
  TSK_HDB_DBTYPE_HK_ID | hashkeeper format
  TSK_HDB_DBTYPE_IDXONLY_ID | Only the database index was opened -- original dbtype is unknown.

enum TSK_HDB_FLAG_ENUM

  | Flags used for lookups. Enumeration values:
  TSK_HDB_FLAG_QUICK | Quickly return if hash is found (do not return file name etc.).
  TSK_HDB_FLAG_EXT | Return other details besides only file name (not used.

enum TSK_HDB_HTYPE_ENUM

  | Hash algorithm types. Enumeration values:
  TSK_HDB_HTYPE_MD5_ID | MD5 Algorithm.
  TSK_HDB_HTYPE_SHA1_ID | SHA1 Algorithm.

enum TSK_HDB_OPEN_ENUM

  | Options for opening a hash database. Enumeration values:
  TSK_HDB_OPEN_NONE | No special flags.
  TSK_HDB_OPEN_IDXONLY | Open only the index -- do not look for the original DB.

## Function Documentation

void tsk_hdb_close | ( | TSK_HDB_INFO * | hdb_info | ) |

  | Close the HDB_INFO structure and free the memory. Parameters:
  | hdb_info | Structure to free.

uint8_t tsk_hdb_hasindex | ( | TSK_HDB_INFO * | hdb_info,
|  | uint8_t | htype
| ) |

  | Determine if the hash database that is open has an index that has been created. Parameters:
  | hdb_info | Hash database to consider
  | htype | Hash type that index should be of
Returns: 1 if index exists and 0 if not

int8_t tsk_hdb_lookup | ( | TSK_HDB_INFO * | hdb_info,
|  | char * | hash,
|  | TSK_HDB_FLAG_ENUM | flags,
|  | TSK_HDB_LOOKUP_FN | action,
|  | void * | ptr
| ) |

  | Perform the binary search in the index for the text/ASCII hash value. Parameters:
  | hdb_info | Hash database state information
  | hash | Hash value to search for
  | flags |
  | action | Callback function to call for each hash db entry (not called if QUICK flag is given)
  | ptr | Pointer to data to pass to each callback
Returns: -1 on error, 0 if hash value not found, and 1 if value was found.

int8_t tsk_hdb_lookup_raw | ( | TSK_HDB_INFO * | hdb_info,
|  | uint8_t * | hash,
|  | uint8_t | len,
|  | TSK_HDB_FLAG_ENUM | flags,
|  | TSK_HDB_LOOKUP_FN | action,
|  | void * | ptr
| ) |

  | Perform the binary search in the index for a hash value given in a raw (non-text) format. this is a wrapper around the normal lookup function. Parameters:
  | hdb_info | Hash database state information
  | hash | Array with binary hash value to search for
  | len | Number of bytes in binary hash value
  | flags |
  | action | Callback function to call for each hash db entry (not called if QUICK flag is given)
  | ptr | Pointer to data to pass to each callback
Returns: -1 on error, 0 if hash value not found, and 1 if value was found.

TSK_HDB_INFO* tsk_hdb_open | ( | TSK_TCHAR * | db_file,
|  | TSK_HDB_OPEN_ENUM | flags
| ) |

  | Open a hash database and index for lookup. Parameters:
  | db_file | Path to database.
  | flags | Flags for opening the database.
Returns: Poiner to hash database state structure or NULL on error