The Sleuth Kit  4.10.2
Public Member Functions | List of all members
TskFsBlock Class Reference

Stores information about a file system block. More...

#include <tsk_fs.h>

Public Member Functions

TSK_DADDR_T getAddr () const
 Get address of block. More...
 
const char * getBuf () const
 Get buffer with block data (of size TSK_FS_INFO::block_size) More...
 
TSK_FS_BLOCK_FLAG_ENUM getFlags () const
 Get flags for block (alloc or unalloc) More...
 
uint8_t open (TskFsInfo *a_fs, TSK_DADDR_T a_addr)
 Open a block (use only if created with default constructor). More...
 
 TskFsBlock (const TSK_FS_BLOCK *a_fsBlock)
 construct a TskFsBlock using a TSK_FS_BLOCK structure More...
 
 TskFsBlock ()
 default constructor to construct a TskFsBlock. More...
 
 ~TskFsBlock ()
 Free the memory associated with the TSK_FS_BLOCK structure. More...
 

Detailed Description

Stores information about a file system block.

Must be created by either allocating an empty block and opening one or by passing in a TSK_FS_BLOCK struct. If NULL is passed to the constructor and open() is not called, the other methods return undefined data. See TSK_FS_BLOCK for more details.

Constructor & Destructor Documentation

TskFsBlock::TskFsBlock ( const TSK_FS_BLOCK a_fsBlock)
inline

construct a TskFsBlock using a TSK_FS_BLOCK structure

Parameters
a_fsBlocka pointer of TSK_FS_BLOCK. If NULL, the getX() methods return undefined data.
TskFsBlock::TskFsBlock ( )
inline

default constructor to construct a TskFsBlock.

Must call open() before using other methods.

TskFsBlock::~TskFsBlock ( )
inline

Free the memory associated with the TSK_FS_BLOCK structure.

See tsk_fs_block_free() for details

References tsk_fs_block_free().

Member Function Documentation

TSK_DADDR_T TskFsBlock::getAddr ( ) const
inline

Get address of block.

Returns
address of block

References TSK_FS_BLOCK::addr.

const char* TskFsBlock::getBuf ( ) const
inline

Get buffer with block data (of size TSK_FS_INFO::block_size)

Returns
buffer with block data

References TSK_FS_BLOCK::buf.

TSK_FS_BLOCK_FLAG_ENUM TskFsBlock::getFlags ( ) const
inline

Get flags for block (alloc or unalloc)

Returns
flags for block
uint8_t TskFsBlock::open ( TskFsInfo a_fs,
TSK_DADDR_T  a_addr 
)
inline

Open a block (use only if created with default constructor).

Parameters
a_fsThe file system to read the block from.
a_addrThe file system address to read.
Returns
1 on error and 0 on success.

The documentation for this class was generated from the following file:

Copyright © 2007-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.