|
The Sleuth Kit 4.15.0-develop
|
| tsk | |
| auto | |
| auto.cpp | Contains C++ code that creates the base file extraction automation class |
| auto_db.cpp | Contains code to populate SQLite database with volume and file system information from a specific image |
| case_db.cpp | Contains class definition for TskCaseDb class to handle creating/opening a case database and adding images to it |
| db_sqlite.cpp | Contains code to perform operations against SQLite database |
| tsk_auto.h | Contains the class definitions for the automated file extraction classes |
| tsk_case_db.h | Contains the class that creates a case-level database of file system data |
| tsk_db.cpp | Contains code related to abstract TSK database handling class |
| tsk_db.h | Contains TSK interface to abstract database handling class |
| tsk_db_sqlite.h | Contains the SQLite code for maintaining the case-level database |
| base | |
| md5c.c | Local copy of RSA Data Security, Inc |
| mymalloc.c | These functions allocate and reallocate memory and set the error handling functions when an error occurs |
| sha1c.c | Local copy of the public domain SHA-1 library code by David Ireland |
| tsk_base.h | Contains the type and function definitions that are needed by external programs to use the TSK library |
| tsk_base_i.h | Contains the general internal TSK type and function definitions |
| tsk_endian.c | Contains the routines to read data in different endian orderings |
| tsk_error.c | Contains the error handling code and variables |
| tsk_list.c | Tsk_lists are a linked list of buckets that store a key in REVERSE sorted order |
| tsk_os.h | Contains some OS-specific type settings |
| tsk_parse.c | Contains code to parse specific types of data from the command line |
| tsk_printf.c | These are printf wrappers that are needed so that we can easily print in both Unix and Windows |
| tsk_stack.c | Contains the functions to create and maintain a stack, which supports basic popping, pushing, and searching |
| tsk_unicode.c | A local copy of the Unicode conversion routines from unicode.org |
| tsk_unicode.h | Contains the definitions for Unicode-based conversion methods |
| tsk_version.c | Contains functions to print and obtain the library version |
| XGetopt.c | Parses arguments for win32 programs – written by Hans Dietrich |
| fs | |
| btrfs.cpp | Contains the internal TSK Btrfs file system functions |
| dcat_lib.cpp | Contains the library API functions used by the TSK blkcat command line tool |
| fatfs_dent.cpp | Contains the internal TSK FAT file name processing code |
| fatfs_utils.c | Contains utility functions for processing FAT file systems |
| fs_attrlist.c | File that contains functions to process TSK_FS_ATTRLIST structures, which hold a linked list of TSK_FS_ATTR attribute structures |
| fs_block.c | Contains functions to allocate, free, and read data into a TSK_FS_BLOCK structure |
| fs_inode.c | Contains functions to allocate, free, and process the generic inode structures |
| fs_io.c | Contains functions to read data from a disk image and wrapper functions to read file content |
| fs_open.c | Contains the general code to open a file system – this calls the file system -specific opening routines |
| fs_parse.c | Contains code to parse specific types of data from the command line |
| fs_types.c | Contains TSK functions that deal with parsing and printing file system type strings |
| logical_fs.cpp | Contains the internal TSK logical file system functions |
| ntfs_dent.cpp | NTFS file name processing internal functions |
| rawfs.c | Contains internal "raw" specific file system functions |
| swapfs.c | Contains the internal "swapfs" specific functions |
| tsk_exfatfs.h | Contains declarations of structures and functions specific to TSK exFAT file system support |
| tsk_fatfs.h | Contains the structures and function APIs for TSK FAT (FAT12, FAT16, FAT32, exFAT) file system support |
| tsk_fatxxfs.h | Contains the structures and function APIs for TSK FATXX (FAT12, FAT16, FAT32) file system support |
| tsk_fs.h | External header file for file system support |
| tsk_fs_i.h | Contains the internal library definitions for the file system functions |
| yaffs.cpp | Contains the internal TSK YAFFS2 file system functions |
| hashdb | |
| binsrch_index.cpp | Functions common to all text hash databases (i.e |
| hashkeeper.c | Contains functions to read and process hash keeper database files |
| sqlite_hdb.cpp | Contains hash database functions for SQLite hash databases |
| tsk_hash_info.h | |
| tsk_hashdb.h | External header file for hash database support |
| tsk_hashdb_i.h | Contains the internal library definitions for the hash database functions |
| img | |
| aff.c | Internal code to interface with afflib to read and open AFF image files |
| img_types.c | Contains basic functions to parse and print the names of the supported disk image types |
| tsk_img.h | Contains the external library definitions for the disk image functions |
| vs | |
| bsd.c | Contains the internal functions required to process BSD disk labels |
| dos.c | Contains the internal functions to process DOS Partition tables |
| gpt.c | The internal functions required to process the GPT GUID Partiition Table |
| mac.c | Contains the internal functions to process and load a Mac partition table |
| mm_io.c | Contains the wrapper code that allows one to read sectors from a TSK_VS_INFO or TSK_VS_PART_INFO structure |
| mm_open.c | Contains general code to open volume systems |
| mm_part.c | Contains the functions need to create, maintain, and access the linked list of partitions in a volume |
| mm_types.c | Contains the code to parse and print the strings for the supported volume system types |
| sun.c | Contains the internal SUN VTOC volume system processing code |
| tsk_vs.h | External header file for media management (volume system) support |
| tsk_vs_i.h | Contains the internal library definitions for the volume system functions |
Copyright © 2007-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.