usn_journal.c File Reference

Contains the TSK Update Sequence Number journal walking code. More...

#include "tsk_fs_i.h"
#include "tsk_ntfs.h"

Functions
uint8_t	tsk_ntfs_usnjentry_walk (TSK_FS_INFO *fs, TSK_FS_USNJENTRY_WALK_CB action, void *ptr)
	Walk through the Update Sequence Number journal file opened with ntfs_usnjopen. More...
uint8_t	tsk_ntfs_usnjopen (TSK_FS_INFO *fs, TSK_INUM_T inum)
	Open the Update Sequence Number Journal stored at the inode inum. More...

Detailed Description

Contains the TSK Update Sequence Number journal walking code.

Function Documentation

uint8_t tsk_ntfs_usnjentry_walk	(	TSK_FS_INFO *	fs,
		TSK_FS_USNJENTRY_WALK_CB	action,
		void *	ptr
	)

Walk through the Update Sequence Number journal file opened with ntfs_usnjopen.

For each USN record, calls the callback action passing the USN record header, the USN record and the pointer ptr.

Parameters

ntfs	File system where the journal is stored
action	action to be called per each USN entry
ptr	pointer to data passed to the action callback

Returns

0 on success, 1 otherwise

References TSK_FS_INFO::ftype, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_fs_file_close(), and TSK_FS_TYPE_NTFS.

uint8_t tsk_ntfs_usnjopen	(	TSK_FS_INFO *	fs,
		TSK_INUM_T	inum
	)

Open the Update Sequence Number Journal stored at the inode inum.

Parameters

ntfs	File system where the journal is stored
inum	file reference number where the USN journal is located

Returns

0 on success, 1 otherwise

References TSK_FS_INFO::block_size, TSK_FS_INFO::ftype, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_fprintf(), tsk_fs_file_open_meta(), TSK_FS_TYPE_NTFS, and tsk_verbose.