The Sleuth Kit  4.11.0
Public Member Functions | Static Public Member Functions | Friends | List of all members
TskImgInfo Class Reference

Stores information about an image that is open and being analyzed. More...

#include <tsk_img.h>

Public Member Functions

unsigned int getSectorSize () const
 Returns the sector size of the disk. More...
 
TSK_OFF_T getSize () const
 Returns the size of the image. More...
 
TSK_IMG_TYPE_ENUM getType () const
 returns the image format type. More...
 
uint8_t open (const TSK_TCHAR *a_image, TSK_IMG_TYPE_ENUM a_type, unsigned int a_ssize)
 Opens a single (non-split) disk image file so that it can be read. More...
 
uint8_t open (int a_num_img, const TSK_TCHAR *const a_images[], TSK_IMG_TYPE_ENUM a_type, unsigned int a_ssize)
 Opens one or more disk image files so that they can be read. More...
 
ssize_t read (TSK_OFF_T a_off, char *a_buf, size_t a_len)
 Reads data from an open disk image. More...
 
 TskImgInfo (TSK_IMG_INFO *a_imgInfo)
 

Static Public Member Functions

static void typePrint (FILE *a_file)
 Prints the name and description of the supported image types to a handle. More...
 
static TSK_IMG_TYPE_ENUM typeSupported ()
 Returns the supported file format types. More...
 
static const char * typeToDesc (TSK_IMG_TYPE_ENUM a_type)
 Returns the description of an image format type, given its type ID. More...
 
static TSK_IMG_TYPE_ENUM typeToId (const TSK_TCHAR *a_str)
 Parses a string that specifies an image format to determine the associated type ID. More...
 
static const char * typeToName (TSK_IMG_TYPE_ENUM a_type)
 Returns the name of an image format type, given its type ID. More...
 

Friends

class TskFsInfo
 
class TskVsInfo
 

Detailed Description

Stores information about an image that is open and being analyzed.

To use this object, open() should be called first. Otherwise, the get() methods will return undefined values.

Member Function Documentation

unsigned int TskImgInfo::getSectorSize ( ) const
inline

Returns the sector size of the disk.

Returns
sector size of original device in bytes

References TSK_IMG_INFO::sector_size.

TSK_OFF_T TskImgInfo::getSize ( ) const
inline

Returns the size of the image.

Returns
total size of image in bytes

References TSK_IMG_INFO::size.

TSK_IMG_TYPE_ENUM TskImgInfo::getType ( ) const
inline

returns the image format type.

Returns
image format type

References TSK_IMG_INFO::itype.

uint8_t TskImgInfo::open ( const TSK_TCHAR a_image,
TSK_IMG_TYPE_ENUM  a_type,
unsigned int  a_ssize 
)
inline

Opens a single (non-split) disk image file so that it can be read.

See tsk_img_open_sing() for more details.

Parameters
a_imageThe path to the image file
a_typeThe disk image type (can be autodetection)
a_ssizeSize of device sector in bytes (or 0 for default)
Returns
1 on error and 0 on success

References tsk_img_open_sing().

uint8_t TskImgInfo::open ( int  a_num_img,
const TSK_TCHAR *const  a_images[],
TSK_IMG_TYPE_ENUM  a_type,
unsigned int  a_ssize 
)
inline

Opens one or more disk image files so that they can be read.

e UTF8, then consider See tsk_img_open() for more details.

Parameters
a_num_imgThe number of images to open (will be > 1 for split images).
a_imagesThe path to the image files (the number of files must be equal to num_img and they must be in a sorted order)
a_typeThe disk image type (can be autodetection)
a_ssizeSize of device sector in bytes (or 0 for default)
Returns
1 on error and 0 on success

References tsk_img_open().

ssize_t TskImgInfo::read ( TSK_OFF_T  a_off,
char *  a_buf,
size_t  a_len 
)
inline

Reads data from an open disk image.

Parameters
a_offByte offset to start reading from
a_bufBuffer to read into
a_lenNumber of bytes to read into buffer
Returns
number of bytes read or -1 on error

References tsk_img_read().

static void TskImgInfo::typePrint ( FILE *  a_file)
inlinestatic

Prints the name and description of the supported image types to a handle.

This is used by the TSK command line tools to print the supported types to the console.

Parameters
a_fileHandle to print names and descriptions to.

References tsk_img_type_print().

static TSK_IMG_TYPE_ENUM TskImgInfo::typeSupported ( )
inlinestatic

Returns the supported file format types.

Returns
A bit in the return value is set to 1 if the type is supported.

References tsk_img_type_supported().

static const char* TskImgInfo::typeToDesc ( TSK_IMG_TYPE_ENUM  a_type)
inlinestatic

Returns the description of an image format type, given its type ID.

Parameters
a_typeID of image type
Returns
Pointer to string of the description

References tsk_img_type_todesc().

static TSK_IMG_TYPE_ENUM TskImgInfo::typeToId ( const TSK_TCHAR a_str)
inlinestatic

Parses a string that specifies an image format to determine the associated type ID.

This is used by the TSK command line tools to parse the type given on the command line.

Parameters
a_strString of image format type
Returns
ID of image type

References tsk_img_type_toid().

static const char* TskImgInfo::typeToName ( TSK_IMG_TYPE_ENUM  a_type)
inlinestatic

Returns the name of an image format type, given its type ID.

Parameters
a_typeID of image type
Returns
Pointer to string of the name.

References tsk_img_type_toname().


The documentation for this class was generated from the following file:

Copyright © 2007-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.