exfatfs_meta.c File Reference

Contains the internal TSK exFAT file system code to access the data in the metadata data category as defined in the book "File System Forensic Analysis" by Brian Carrier (pp. More...

#include "tsk_exfatfs.h"
#include "tsk_fs_i.h"
#include "tsk_fatfs.h"
#include <assert.h>

Functions
TSK_RETVAL_ENUM	exfatfs_dinode_copy (FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FATFS_DENTRY *a_dentry, uint8_t a_is_alloc, TSK_FS_FILE *a_fs_file)
uint8_t	exfatfs_find_file_stream_dentry (FATFS_INFO *a_fatfs, TSK_INUM_T a_file_entry_inum, TSK_DADDR_T a_sector, uint8_t a_sector_is_alloc, EXFATFS_DIR_ENTRY_TYPE a_file_dentry_type, FATFS_DENTRY *a_stream_dentry)
uint8_t	exfatfs_get_alloc_status_from_type (EXFATFS_DIR_ENTRY_TYPE a_dir_entry_type)
EXFATFS_DIR_ENTRY_TYPE_ENUM	exfatfs_get_enum_from_type (EXFATFS_DIR_ENTRY_TYPE a_dir_entry_type)
uint8_t	exfatfs_inode_lookup (FATFS_INFO *a_fatfs, TSK_FS_FILE *a_fs_file, TSK_INUM_T a_inum)
uint8_t	exfatfs_inode_walk_should_skip_dentry (FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FATFS_DENTRY *a_dentry, unsigned int a_selection_flags, int a_cluster_is_alloc)
uint8_t	exfatfs_is_access_ctrl_table_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status)
uint8_t	exfatfs_is_alloc_bitmap_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status, FATFS_INFO *a_fatfs)
int8_t	exfatfs_is_cluster_alloc (FATFS_INFO *a_fatfs, TSK_DADDR_T a_cluster_addr)
uint8_t	exfatfs_is_dentry (FATFS_INFO *a_fatfs, FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_cluster_is_alloc, uint8_t a_do_basic_tests_only)
uint8_t	exfatfs_is_file_dentry (FATFS_DENTRY *a_dentry, FATFS_INFO *a_fatfs)
uint8_t	exfatfs_is_file_dentry_standalone (FATFS_DENTRY *a_dentry, TSK_ENDIAN_ENUM a_endian)
uint8_t	exfatfs_is_file_name_dentry (FATFS_DENTRY *a_dentry)
uint8_t	exfatfs_is_file_stream_dentry (FATFS_DENTRY *a_dentry, FATFS_INFO *a_fatfs)
uint8_t	exfatfs_is_file_stream_dentry_standalone (FATFS_DENTRY *a_dentry, TSK_ENDIAN_ENUM a_endian, uint64_t a_cluster_heap_size, TSK_DADDR_T a_last_cluster)
uint8_t	exfatfs_is_texfat_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status)
uint8_t	exfatfs_is_upcase_table_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status, FATFS_INFO *a_fatfs)
uint8_t	exfatfs_is_vol_guid_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status)
uint8_t	exfatfs_is_vol_label_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_cluster_is_alloc)
uint8_t	exfatfs_istat_attr_flags (FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FILE *a_hFile)

Detailed Description

Contains the internal TSK exFAT file system code to access the data in the metadata data category as defined in the book "File System Forensic Analysis" by Brian Carrier (pp.

174-175).