TskFsMeta Class Reference

Stores metadata about a file. More...

#include <tsk_fs.h>

Public Member Functions
TSK_INUM_T	getAddr () const
time_t	getATime () const
uint32_t	getATimeNano () const
time_t	getBackUpTime () const
uint32_t	getBackUpTimeNano () const
time_t	getCrTime () const
uint32_t	getCrTimeNano () const
time_t	getCTime () const
uint32_t	getCTimeNano () const
time_t	getDTime () const
uint32_t	getDTimeNano () const
TSK_FS_META_FLAG_ENUM	getFlags () const
TSK_GID_T	getGid () const
const char *	getLink () const
uint8_t	getLs (char *a_buf, size_t a_len) const
TSK_FS_META_MODE_ENUM	getMode () const
time_t	getMTime () const
uint32_t	getMTimeNano () const
const TskFsMetaName *	getName2 (int a_idx) const
	Return a name that is stored in the metadata.
int	getName2Count () const
	Return the number of names that are stored in the metadata.
int	getNLink () const
uint32_t	getSeq () const
TSK_OFF_T	getSize () const
TSK_FS_META_TYPE_ENUM	getType () const
TSK_UID_T	getUid () const
	TskFsMeta (TSK_FS_META *a_fsMeta)

Detailed Description

Stores metadata about a file.

See TSK_FS_META for more details.

Constructor & Destructor Documentation

TskFsMeta()

TskFsMeta::TskFsMeta ( TSK_FS_META * a_fsMeta )

inline

 construct a TskFsMeta object.  If NULL is passed as an argument, the getX() behavior

is not defined.

Parameters

a_fsMeta

a pointer of TSK_FS_META

References TSK_FS_META_NAME_LIST::next.

Member Function Documentation

getAddr()

TSK_INUM_T TskFsMeta::getAddr ( ) const

inline

 get address of the meta data structure for this file

Returns

address of the meta data structure for this file

getATime()

time_t TskFsMeta::getATime ( ) const

inline

 get last file content accessed time (stored in number of seconds since Jan 1, 1970 UTC)

Returns

last file content accessed time

getATimeNano()

uint32_t TskFsMeta::getATimeNano ( ) const

inline

 get nano-second resolution of accessed time

Returns

nano-second resolution of accessed time

getBackUpTime()

time_t TskFsMeta::getBackUpTime ( ) const

inline

 get HFS+ backup time

Returns

HFS+ backup time

getBackUpTimeNano()

uint32_t TskFsMeta::getBackUpTimeNano ( ) const

inline

 get nano-second resolution of HFS+ backup time

Returns

nano-second resolution of HFS+ backup time

getCrTime()

time_t TskFsMeta::getCrTime ( ) const

inline

 get created time (stored in number of seconds since Jan 1, 1970 UTC)

Returns

created time

getCrTimeNano()

uint32_t TskFsMeta::getCrTimeNano ( ) const

inline

 get nano-second resolution of created time

Returns

nano-second resolution of created time

getCTime()

time_t TskFsMeta::getCTime ( ) const

inline

 get last file / metadata status change time (stored in number of seconds since Jan 1, 1970 UTC)

Returns

last file / metadata status change time

getCTimeNano()

uint32_t TskFsMeta::getCTimeNano ( ) const

inline

 get nano-second resolution of change time

Returns

nano-second resolution of change time

getDTime()

time_t TskFsMeta::getDTime ( ) const

inline

 get linux deletion time

Returns

linux deletion time

getDTimeNano()

uint32_t TskFsMeta::getDTimeNano ( ) const

inline

 get nano-second resolution of deletion time

Returns

nano-second resolution of deletion time

getFlags()

TSK_FS_META_FLAG_ENUM TskFsMeta::getFlags ( ) const

inline

 get flags for this file for its allocation status etc.

Returns

flags for this file

getGid()

TSK_GID_T TskFsMeta::getGid ( ) const

inline

 get group id

Returns

group id

getLink()

const char * TskFsMeta::getLink ( ) const

inline

 get name of target file if this is a symbolic link

Returns

name of target file if this is a symbolic link

getLs()

uint8_t TskFsMeta::getLs ( char * a_buf, size_t a_len ) const

inline

 Makes the "ls -l" permissions string for a file.

See tsk_fs_meta_make_ls() for details

Parameters

a_buf	[out] Buffer to write results to (must be 12 bytes or longer)
a_len	Length of buffer

References tsk_fs_meta_make_ls().

getMode()

TSK_FS_META_MODE_ENUM TskFsMeta::getMode ( ) const

inline

 get Unix-style permissions

Returns

Unix-style permissions mode

getMTime()

time_t TskFsMeta::getMTime ( ) const

inline

 get last file content modification time (stored in number of seconds since Jan 1, 1970 UTC)

Returns

last file content modification time

getMTimeNano()

uint32_t TskFsMeta::getMTimeNano ( ) const

inline

 get nano-second resolution of modification time

Returns

nano-second resolution of modification time

getName2()

const TskFsMetaName * TskFsMeta::getName2 ( int a_idx ) const

inline

Return a name that is stored in the metadata.

Parameters

a_idx

Index of the name to return

Returns

NULL on error. Caller must free this memory.

References TSK_FS_META_NAME_LIST::next.

getName2Count()

int TskFsMeta::getName2Count ( ) const

inline

Return the number of names that are stored in the metadata.

Returns

number of names.

References TSK_FS_META_NAME_LIST::next.

getNLink()

int TskFsMeta::getNLink ( ) const

inline

 get link count (number of file names pointing to this)

Returns

link count

getSeq()

uint32_t TskFsMeta::getSeq ( ) const

inline

 get sequence number for file (NTFS only, is incremented when entry is reallocated)

Returns

sequence number for file, or 0xFFFF on error.

getSize()

TSK_OFF_T TskFsMeta::getSize ( ) const

inline

 get file size (in bytes)

Returns

file size

getType()

TSK_FS_META_TYPE_ENUM TskFsMeta::getType ( ) const

inline

 get file type

Returns

file type

getUid()

TSK_UID_T TskFsMeta::getUid ( ) const

inline

 get owner id

Returns

owner id

---

The documentation for this class was generated from the following file:

• tsk/fs/tsk_fs.h