Class that represents an allocated or deleted file. More...

#include <tsk_fs.h>

Public Member Functions
void	close ()
	Close an open file. More...

const TskFsAttribute *	getAttr (int a_idx)

const TskFsAttribute *	getAttr (TSK_FS_ATTR_TYPE_ENUM a_type, uint16_t a_id, uint8_t a_id_used)

const TskFsAttribute *	getAttrDefault ()

int	getAttrSize ()

TskFsInfo *	getFsInfo ()
	Return pointer file system that the file is located in. More...

TskFsMeta *	getMeta ()
	Return pointer to the file's metadata (or NULL if name has invalid metadata address) More...

TskFsName *	getName ()
	Return pointer to the file's name (or NULL if file was opened using metadata address) More...

uint8_t	open (TskFsInfo a_fs, TskFsFile a_fs_file, TSK_INUM_T a_addr)
	Open a file given its metadata address. More...

uint8_t	open (TskFsInfo a_fs, TskFsFile a_fs_file, const char *a_path)
	Return the handle structure for a specific file, given its full path. More...

ssize_t	read (TSK_FS_ATTR_TYPE_ENUM a_type, uint16_t a_id, TSK_OFF_T a_offset, char *a_buf, size_t a_len, TSK_FS_FILE_READ_FLAG_ENUM a_flags)
	Read the contents of a specific attribute of a file using a typical read() type interface. More...

ssize_t	read (TSK_OFF_T a_offset, char *a_buf, size_t a_len, TSK_FS_FILE_READ_FLAG_ENUM a_flags)
	Read the contents of the default attribute of a file using a typical read() type interface. More...

	TskFsFile (TSK_FS_FILE *a_fsFile)
	Construct a TskFsFile object from a C struct. More...

	TskFsFile ()
	default constructor to construct a TskFsFile object

uint8_t	walk (TSK_FS_ATTR_TYPE_ENUM a_type, uint16_t a_id, TSK_FS_FILE_WALK_FLAG_ENUM a_flags, TSK_FS_FILE_WALK_CPP_CB a_action, void *a_ptr)
	Process a specific attribute in a file and call a callback function with the file contents. More...

uint8_t	walk (TSK_FS_FILE_WALK_FLAG_ENUM a_flags, TSK_FS_FILE_WALK_CPP_CB a_action, void *a_ptr)
	Process the default attribute for the file and call a callback function with the file contents. More...

	~TskFsFile ()
	Close an open file.

Friends
class	TskFsDir

Detailed Description

Class that represents an allocated or deleted file.

The non-default constructor or open method must be called first. otherwise, the results of the getX() methods are undefined. See TSK_FS_FILE for more details.

Constructor & Destructor Documentation

TskFsFile::TskFsFile ( TSK_FS_FILE * a_fsFile )

inline

Construct a TskFsFile object from a C struct.

Parameters

a_fsFile a pointer of TSK_FS_FILE

Member Function Documentation

void TskFsFile::close ( )

inline

Close an open file.

See tsk_fs_file_close() for details.

References tsk_fs_file_close().

Referenced by ~TskFsFile().

TskFsInfo* TskFsFile::getFsInfo ( )

inline

Return pointer file system that the file is located in.

Returns: pointer to file system that the file is located in.

References TSK_FS_FILE::fs_info.

TskFsMeta* TskFsFile::getMeta ( )

inline

Return pointer to the file's metadata (or NULL if name has invalid metadata address)

Returns: pointer metadata of file. It is the caller's responsibility to free this.

References TSK_FS_FILE::meta.

TskFsName* TskFsFile::getName ( )

inline

Return pointer to the file's name (or NULL if file was opened using metadata address)

Returns: pointer to name of file. It is the caller's responsibility to free this.

References TSK_FS_FILE::name.

uint8_t TskFsFile::open	(	TskFsInfo *	a_fs,
		TskFsFile *	a_fs_file,
		TSK_INUM_T	a_addr
	)

inline

Open a file given its metadata address.

This function loads the metadata and returns a handle that can be used to read and process the file. Note that the returned class will not have the file name set because it was not used to load the file and this function does not search the directory structure to find the name that points to the address. In general, if you know the metadata address of a file, this function is more efficient then tsk_fs_file_open, which first maps a file name to the metadata address and then open the file using this function. See tsk_fs_file_open_meta() for details

Parameters

a_fs	File system to analyze
a_fs_file	object to store file data in or NULL to have one allocated.
a_addr	Metadata address of file to lookup

Returns: 1 on error and 0 on success.

References tsk_fs_file_open_meta().

uint8_t TskFsFile::open	(	TskFsInfo *	a_fs,
		TskFsFile *	a_fs_file,
		const char *	a_path
	)

inline

Return the handle structure for a specific file, given its full path.

Note that if you have the metadata address fo the file, then tsk_fs_file_open_meta() is a more efficient approach. See tsk_fs_file_open() for details

Parameters

a_fs	File system to analyze
a_fs_file	Structure to store file data in or NULL to have one allocated.
a_path	Path of file to open

Returns: 1 on error and 0 on success.

References tsk_fs_file_open().

ssize_t TskFsFile::read	(	TSK_FS_ATTR_TYPE_ENUM	a_type,
		uint16_t	a_id,
		TSK_OFF_T	a_offset,
		char *	a_buf,
		size_t	a_len,
		TSK_FS_FILE_READ_FLAG_ENUM	a_flags
	)

inline

Read the contents of a specific attribute of a file using a typical read() type interface.

0s are returned for missing runs of files. See tsk_fs_file_read_type() for details

Parameters

a_type	The type of attribute to load
a_id	The id of attribute to load (use 0 and set a_flags if you do not care)
a_offset	The byte offset to start reading from.
a_buf	The buffer to read the data into.
a_len	The number of bytes to read from the file.
a_flags	Flags to use while reading

Returns: The number of bytes read or -1 on error (incl if offset is past EOF).

References tsk_fs_file_read_type().

ssize_t TskFsFile::read	(	TSK_OFF_T	a_offset,
		char *	a_buf,
		size_t	a_len,
		TSK_FS_FILE_READ_FLAG_ENUM	a_flags
	)

inline

Read the contents of the default attribute of a file using a typical read() type interface.

0s are returned for missing runs of files. See tsk_fs_file_read() for details

Parameters

a_offset	The byte offset to start reading from.
a_buf	The buffer to read the data into.
a_len	The number of bytes to read from the file.
a_flags	Flags to use while reading

Returns: The number of bytes read or -1 on error (incl if offset is past EOF).

References tsk_fs_file_read().

uint8_t TskFsFile::walk	(	TSK_FS_ATTR_TYPE_ENUM	a_type,
		uint16_t	a_id,
		TSK_FS_FILE_WALK_FLAG_ENUM	a_flags,
		TSK_FS_FILE_WALK_CPP_CB	a_action,
		void *	a_ptr
	)

inline

Process a specific attribute in a file and call a callback function with the file contents.

See tsk_fs_file_walk_type() for details

Parameters

a_type	Attribute type to process
a_id	Id if attribute to process
a_flags	Flags to use while processing file
a_action	Callback action to call with content
a_ptr	Pointer that will passed to callback