The Sleuth Kit  4.10.0
Macros | Functions
C Disk Image Functions

Macros

#define TSK_IMG_TYPE_ISAFF(t)
 Macro that takes a image type and returns 1 if the type is for an AFF file format. More...
 
#define TSK_IMG_TYPE_ISEWF(t)   ((((t) & TSK_IMG_TYPE_EWF_EWF))?1:0)
 Macro that takes a image type and returns 1 if the type is for an EWF file format. More...
 
#define TSK_IMG_TYPE_ISRAW(t)   ((((t) & TSK_IMG_TYPE_RAW))?1:0)
 Macro that takes a image type and returns 1 if the type is for a raw file format. More...
 

Functions

void tsk_img_close (TSK_IMG_INFO *a_img_info)
 Closes an open disk image. More...
 
TSK_IMG_INFOtsk_img_open (int num_img, const TSK_TCHAR *const images[], TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)
 Opens one or more disk image files so that they can be read. More...
 
TSK_IMG_INFOtsk_img_open_external (void *ext_img_info, TSK_OFF_T size, unsigned int sector_size, ssize_t(*read)(TSK_IMG_INFO *img, TSK_OFF_T off, char *buf, size_t len), void(*close)(TSK_IMG_INFO *), void(*imgstat)(TSK_IMG_INFO *, FILE *))
 Opens an an image of type TSK_IMG_TYPE_EXTERNAL. More...
 
TSK_IMG_INFOtsk_img_open_sing (const TSK_TCHAR *a_image, TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)
 Opens a single (non-split) disk image file so that it can be read. More...
 
TSK_IMG_INFOtsk_img_open_utf8 (int num_img, const char *const images[], TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)
 Opens one or more disk image files so that they can be read. More...
 
TSK_IMG_INFOtsk_img_open_utf8_sing (const char *a_image, TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)
 Opens a single (non-split) disk image file so that it can be read. More...
 
ssize_t tsk_img_read (TSK_IMG_INFO *a_img_info, TSK_OFF_T a_off, char *a_buf, size_t a_len)
 Reads data from an open disk image. More...
 
void tsk_img_type_print (FILE *hFile)
 Prints the name and description of the supported image types to a handle. More...
 
TSK_IMG_TYPE_ENUM tsk_img_type_supported ()
 Returns the supported file format types. More...
 
const char * tsk_img_type_todesc (TSK_IMG_TYPE_ENUM type)
 Returns the description of an image format type, given its type ID. More...
 
TSK_IMG_TYPE_ENUM tsk_img_type_toid (const TSK_TCHAR *str)
 Parses a string that specifies an image format to determine the associated type ID. More...
 
TSK_IMG_TYPE_ENUM tsk_img_type_toid_utf8 (const char *str)
 Parses a string that specifies an image format to determine the associated type ID. More...
 
const char * tsk_img_type_toname (TSK_IMG_TYPE_ENUM type)
 Returns the name of an image format type, given its type ID. More...
 

Detailed Description

Macro Definition Documentation

#define TSK_IMG_TYPE_ISAFF (   t)
Value:
((t) & TSK_IMG_TYPE_AFF_ANY))?1:0)
AFM AFF Format.
Definition: tsk_img.h:64
AFD AFF Format.
Definition: tsk_img.h:63
AFF AFF Format.
Definition: tsk_img.h:62
Any format supported by AFFLIB (including beta ones)
Definition: tsk_img.h:65

Macro that takes a image type and returns 1 if the type is for an AFF file format.

#define TSK_IMG_TYPE_ISEWF (   t)    ((((t) & TSK_IMG_TYPE_EWF_EWF))?1:0)

Macro that takes a image type and returns 1 if the type is for an EWF file format.

#define TSK_IMG_TYPE_ISRAW (   t)    ((((t) & TSK_IMG_TYPE_RAW))?1:0)

Macro that takes a image type and returns 1 if the type is for a raw file format.

Function Documentation

void tsk_img_close ( TSK_IMG_INFO a_img_info)

Closes an open disk image.

Parameters
a_img_infoPointer to the open disk image structure.

References TSK_IMG_INFO::cache_lock.

Referenced by TskAuto::closeImage(), and TskAuto::findFilesInPool().

TSK_IMG_INFO* tsk_img_open ( int  num_img,
const TSK_TCHAR *const  images[],
TSK_IMG_TYPE_ENUM  type,
unsigned int  a_ssize 
)

Opens one or more disk image files so that they can be read.

If a file format type is specified, this function will call the specific routine to open the file. Otherwise, it will detect the type (it will default to raw if no specific type can be detected). This function must be called before a disk image can be read from. Note that the data type used to store the image paths is a TSK_TCHAR, which changes depending on a Unix or Windows build. If you will always have UTF8, then consider using tsk_img_open_utf8().

Parameters
num_imgThe number of images to open (will be > 1 for split images).
imagesThe path to the image files (the number of files must be equal to num_img and they must be in a sorted order)
typeThe disk image type (can be autodetection)
a_ssizeSize of device sector in bytes (or 0 for default)
Returns
Pointer to TSK_IMG_INFO or NULL on error

References TSK_IMG_INFO::cache_lock, TSK_IMG_INFO::itype, tsk_error_get_errno(), tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), TSK_IMG_TYPE_AFF_AFD, TSK_IMG_TYPE_AFF_AFF, TSK_IMG_TYPE_AFF_AFM, TSK_IMG_TYPE_AFF_ANY, TSK_IMG_TYPE_DETECT, TSK_IMG_TYPE_EWF_EWF, TSK_IMG_TYPE_RAW, TSK_IMG_TYPE_VHD_VHD, TSK_IMG_TYPE_VMDK_VMDK, and tsk_verbose.

Referenced by TskImgInfo::open(), TskAuto::openImage(), tsk_img_open_sing(), and tsk_img_open_utf8().

TSK_IMG_INFO* tsk_img_open_external ( void *  ext_img_info,
TSK_OFF_T  size,
unsigned int  sector_size,
ssize_t(*)(TSK_IMG_INFO *img, TSK_OFF_T off, char *buf, size_t len)  read,
void(*)(TSK_IMG_INFO *)  close,
void(*)(TSK_IMG_INFO *, FILE *)  imgstat 
)

Opens an an image of type TSK_IMG_TYPE_EXTERNAL.

The void pointer parameter must be castable to a TSK_IMG_INFO pointer. It is up to the caller to set the tag value in ext_img_info. This method will initialize the cache lock.

Parameters
ext_img_infoPointer to the partially initialized disk image structure, having a TSK_IMG_INFO as its first member
sizeTotal size of image in bytes
sector_sizeSector size of device in bytes
readPointer to user-supplied read function
closePointer to user-supplied close function
imgstatPointer to user-supplied imgstat function
Returns
Pointer to TSK_IMG_INFO or NULL on error

References TSK_IMG_INFO::cache_lock, TSK_IMG_INFO::imgstat, TSK_IMG_INFO::itype, TSK_IMG_INFO::sector_size, TSK_IMG_INFO::size, TSK_IMG_INFO::tag, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), and TSK_IMG_TYPE_EXTERNAL.

TSK_IMG_INFO* tsk_img_open_sing ( const TSK_TCHAR a_image,
TSK_IMG_TYPE_ENUM  type,
unsigned int  a_ssize 
)

Opens a single (non-split) disk image file so that it can be read.

This is a wrapper around tsk_img_open(). See it for more details on detection etc. See tsk_img_open_sing_utf8() for a version of this function that always takes UTF-8 as input.

Parameters
a_imageThe path to the image file
typeThe disk image type (can be autodetection)
a_ssizeSize of device sector in bytes (or 0 for default)
Returns
Pointer to TSK_IMG_INFO or NULL on error

References tsk_img_open().

Referenced by TskImgInfo::open().

TSK_IMG_INFO* tsk_img_open_utf8 ( int  num_img,
const char *const  images[],
TSK_IMG_TYPE_ENUM  type,
unsigned int  a_ssize 
)

Opens one or more disk image files so that they can be read.

This is a wrapper around tsk_img_open() and this version always takes a UTF-8 encoding of the image files. See its description for more details.

Parameters
num_imgThe number of images to open (will be > 1 for split images).
imagesThe path to the UTF-8 encoded image files (the number of files must be equal to num_img and they must be in a sorted order)
typeThe disk image type (can be autodetection)
a_ssizeSize of device sector in bytes (or 0 for default)
Returns
Pointer to TSK_IMG_INFO or NULL on error

References TSK_IMG_INFO::cache_lock, tsk_error_set_errno(), tsk_error_set_errstr(), tsk_img_open(), tsk_UTF8toUTF16(), TSKconversionOK, and TSKlenientConversion.

Referenced by TskAuto::openImageUtf8(), and tsk_img_open_utf8_sing().

TSK_IMG_INFO* tsk_img_open_utf8_sing ( const char *  a_image,
TSK_IMG_TYPE_ENUM  type,
unsigned int  a_ssize 
)

Opens a single (non-split) disk image file so that it can be read.

This version always takes a UTF-8 encoding of the disk image. See tsk_img_open_sing() for a version that takes a wchar_t or char depending on the platform. This is a wrapper around tsk_img_open(). See it for more details on detection etc.

Parameters
a_imageThe UTF-8 path to the image file
typeThe disk image type (can be autodetection)
a_ssizeSize of device sector in bytes (or 0 for default)
Returns
Pointer to TSK_IMG_INFO or NULL on error

References tsk_img_open_utf8().

ssize_t tsk_img_read ( TSK_IMG_INFO a_img_info,
TSK_OFF_T  a_off,
char *  a_buf,
size_t  a_len 
)

Reads data from an open disk image.

Parameters
a_img_infoDisk image to read from
a_offByte offset to start reading from
a_bufBuffer to read into
a_lenNumber of bytes to read into buffer
Returns
-1 on error or number of bytes read

References TSK_IMG_INFO::cache, TSK_IMG_INFO::cache_age, TSK_IMG_INFO::cache_len, TSK_IMG_INFO::cache_lock, TSK_IMG_INFO::cache_off, TSK_IMG_INFO::size, tsk_error_reset(), tsk_error_set_errno(), and tsk_error_set_errstr().

Referenced by TskImgInfo::read(), tsk_fs_block_get_flag(), tsk_fs_read_block_decrypt(), tsk_fs_read_decrypt(), tsk_vs_part_read(), tsk_vs_part_read_block(), and tsk_vs_read_block().

void tsk_img_type_print ( FILE *  hFile)

Prints the name and description of the supported image types to a handle.

This is used by the TSK command line tools to print the supported types to the console.

Parameters
hFileHandle to print names and descriptions to.

References tsk_fprintf().

Referenced by TskImgInfo::typePrint().

TSK_IMG_TYPE_ENUM tsk_img_type_supported ( )

Returns the supported file format types.

Returns
A bit in the return value is set to 1 if the type is supported.

Referenced by TskImgInfo::typeSupported().

const char* tsk_img_type_todesc ( TSK_IMG_TYPE_ENUM  type)

Returns the description of an image format type, given its type ID.

Parameters
typeID of image type
Returns
Pointer to string of the description

Referenced by TskImgInfo::typeToDesc().

TSK_IMG_TYPE_ENUM tsk_img_type_toid ( const TSK_TCHAR str)

Parses a string that specifies an image format to determine the associated type ID.

This is used by the TSK command line tools to parse the type given on the command line.

Parameters
strString of image format type
Returns
ID of image type

References tsk_img_type_toid_utf8().

Referenced by TskImgInfo::typeToId().

TSK_IMG_TYPE_ENUM tsk_img_type_toid_utf8 ( const char *  str)

Parses a string that specifies an image format to determine the associated type ID.

This is used by the TSK command line tools to parse the type given on the command line.

Parameters
strString of image format type, always UTF-8
Returns
ID of image type

References TSK_IMG_TYPE_UNSUPP.

Referenced by tsk_img_type_toid().

const char* tsk_img_type_toname ( TSK_IMG_TYPE_ENUM  type)

Returns the name of an image format type, given its type ID.

Parameters
typeID of image type
Returns
Pointer to string of the name.

Referenced by TskImgInfo::typeToName().


Copyright © 2007-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.