The Sleuth Kit  4.10.2
Classes | Macros | Typedefs | Enumerations | Functions
tsk_img.h File Reference

Contains the external library definitions for the disk image functions. More...

Classes

struct  TSK_IMG_INFO
 Created when a disk image has been opened and stores general information and handles. More...
 
class  TskImgInfo
 Stores information about an image that is open and being analyzed. More...
 

Macros

#define TSK_IMG_INFO_CACHE_LEN   65536
 
#define TSK_IMG_INFO_CACHE_NUM   32
 
#define TSK_IMG_INFO_TAG   0x39204231
 
#define TSK_IMG_TYPE_ISAFF(t)
 Macro that takes a image type and returns 1 if the type is for an AFF file format. More...
 
#define TSK_IMG_TYPE_ISEWF(t)   ((((t) & TSK_IMG_TYPE_EWF_EWF))?1:0)
 Macro that takes a image type and returns 1 if the type is for an EWF file format. More...
 
#define TSK_IMG_TYPE_ISRAW(t)   ((((t) & TSK_IMG_TYPE_RAW))?1:0)
 Macro that takes a image type and returns 1 if the type is for a raw file format. More...
 

Typedefs

typedef struct TSK_IMG_INFO TSK_IMG_INFO
 

Enumerations

enum  TSK_IMG_TYPE_ENUM {
  TSK_IMG_TYPE_DETECT = 0x0000, TSK_IMG_TYPE_RAW = 0x0001, TSK_IMG_TYPE_RAW_SING = TSK_IMG_TYPE_RAW, TSK_IMG_TYPE_RAW_SPLIT = TSK_IMG_TYPE_RAW,
  TSK_IMG_TYPE_AFF_AFF = 0x0004, TSK_IMG_TYPE_AFF_AFD = 0x0008, TSK_IMG_TYPE_AFF_AFM = 0x0010, TSK_IMG_TYPE_AFF_ANY = 0x0020,
  TSK_IMG_TYPE_EWF_EWF = 0x0040, TSK_IMG_TYPE_VMDK_VMDK = 0x0080, TSK_IMG_TYPE_VHD_VHD = 0x0100, TSK_IMG_TYPE_EXTERNAL = 0x1000,
  TSK_IMG_TYPE_POOL = 0x4000, TSK_IMG_TYPE_UNSUPP = 0xffff
}
 Flag values for the disk image format type. More...
 

Functions

void tsk_img_close (TSK_IMG_INFO *)
 Closes an open disk image. More...
 
TSK_IMG_INFOtsk_img_open (int, const TSK_TCHAR *const images[], TSK_IMG_TYPE_ENUM, unsigned int a_ssize)
 Opens one or more disk image files so that they can be read. More...
 
TSK_IMG_INFOtsk_img_open_external (void *ext_img_info, TSK_OFF_T size, unsigned int sector_size, ssize_t(*read)(TSK_IMG_INFO *img, TSK_OFF_T off, char *buf, size_t len), void(*close)(TSK_IMG_INFO *), void(*imgstat)(TSK_IMG_INFO *, FILE *))
 Opens an an image of type TSK_IMG_TYPE_EXTERNAL. More...
 
TSK_IMG_INFOtsk_img_open_sing (const TSK_TCHAR *a_image, TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)
 Opens a single (non-split) disk image file so that it can be read. More...
 
TSK_IMG_INFOtsk_img_open_utf8 (int num_img, const char *const images[], TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)
 Opens one or more disk image files so that they can be read. More...
 
TSK_IMG_INFOtsk_img_open_utf8_sing (const char *a_image, TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)
 Opens a single (non-split) disk image file so that it can be read. More...
 
ssize_t tsk_img_read (TSK_IMG_INFO *img, TSK_OFF_T off, char *buf, size_t len)
 Reads data from an open disk image. More...
 
void tsk_img_type_print (FILE *)
 Prints the name and description of the supported image types to a handle. More...
 
TSK_IMG_TYPE_ENUM tsk_img_type_supported ()
 Returns the supported file format types. More...
 
const char * tsk_img_type_todesc (TSK_IMG_TYPE_ENUM)
 Returns the description of an image format type, given its type ID. More...
 
TSK_IMG_TYPE_ENUM tsk_img_type_toid (const TSK_TCHAR *)
 Parses a string that specifies an image format to determine the associated type ID. More...
 
TSK_IMG_TYPE_ENUM tsk_img_type_toid_utf8 (const char *)
 Parses a string that specifies an image format to determine the associated type ID. More...
 
const char * tsk_img_type_toname (TSK_IMG_TYPE_ENUM)
 Returns the name of an image format type, given its type ID. More...
 

Detailed Description

Contains the external library definitions for the disk image functions.

Note that this file is not meant to be directly included. It is included by both libtsk.h and tsk_img_i.h.

Enumeration Type Documentation

Flag values for the disk image format type.

Each type has a bit associated with it. There are TSK_IMG_TYPE_ISXXX macros to determine the broad group of the type (raw vs aff etc.)

Enumerator
TSK_IMG_TYPE_DETECT 

Use autodetection methods.

TSK_IMG_TYPE_RAW 

Raw disk image (single or split)

TSK_IMG_TYPE_RAW_SING 

Raw single (backward compatibility) depreciated.

TSK_IMG_TYPE_RAW_SPLIT 

Raw single (backward compatibility) depreciated.

TSK_IMG_TYPE_AFF_AFF 

AFF AFF Format.

TSK_IMG_TYPE_AFF_AFD 

AFD AFF Format.

TSK_IMG_TYPE_AFF_AFM 

AFM AFF Format.

TSK_IMG_TYPE_AFF_ANY 

Any format supported by AFFLIB (including beta ones)

TSK_IMG_TYPE_EWF_EWF 

EWF version.

TSK_IMG_TYPE_VMDK_VMDK 

VMDK version.

TSK_IMG_TYPE_VHD_VHD 

VHD version.

TSK_IMG_TYPE_EXTERNAL 

external defined format which at least implements TSK_IMG_INFO, used by pytsk

TSK_IMG_TYPE_POOL 

Pool.

TSK_IMG_TYPE_UNSUPP 

Unsupported disk image type.


Copyright © 2007-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.