The Sleuth Kit 4.15.0-develop
tsk_exfatfs.h File Reference

Contains declarations of structures and functions specific to TSK exFAT file system support. More...

#include "tsk_fs_i.h"
#include "tsk_fatfs.h"

Classes

struct  EXFATFS_ACCESS_CTRL_TABLE_DIR_ENTRY
 Access control table directory entry structure for exFAT file systems. More...
struct  EXFATFS_ALLOC_BITMAP_DIR_ENTRY
 Allocation bitmap directory entry structure for exFAT file systems. More...
struct  EXFATFS_FILE_DIR_ENTRY
struct  EXFATFS_FILE_NAME_DIR_ENTRY
 File name directory entry structure for exFAT file systems. More...
struct  EXFATFS_FILE_STREAM_DIR_ENTRY
 Stream extension directory entry structure for exFAT file systems. More...
struct  EXFATFS_MASTER_BOOT_REC
struct  EXFATFS_TEXFAT_DIR_ENTRY
 TexFAT (transactional exFAT) directory entry structure for exFAT file systems. More...
struct  EXFATFS_UPCASE_TABLE_DIR_ENTRY
 UP-Case table directory entry structure for exFAT file systems. More...
struct  EXFATFS_VOL_GUID_DIR_ENTRY
 Volume GUID directory entry structure for exFAT file systems. More...
struct  EXFATFS_VOL_LABEL_DIR_ENTRY
 Volume label directory entry structure for exFAT file systems. More...

Macros

#define EXFATFS_ACT_DENTRY_NAME   "$ACCESS_CONTROL_TABLE"
 Name for an exFAT access control table directory entry, with the "$" prefix that is used to indicate "special file" directory entries and non-file directory entries.
#define EXFATFS_ALLOC_BITMAP_DENTRY_NAME   "$ALLOC_BITMAP"
 Name for an exFAT allocation bitmap directory entry, with the "$" prefix that is used to indicate "special file" directory entries and non-file directory entries.
#define EXFATFS_EMPTY_VOLUME_LABEL_DENTRY_NAME   "$EMPTY_VOLUME_LABEL"
 Name for an exFAT volume label directory entry that has an empty label, with the "$" prefix that is used to indicate "special file" directory entries and non-file directory entries.
#define EXFATFS_FIRST_CLUSTER   2
#define EXFATFS_INVALID_FAT_CHAIN_MASK   0x02
#define EXFATFS_MAX_FILE_NAME_LENGTH_UTF16_CHARS   255
#define EXFATFS_MAX_FILE_NAME_SEGMENT_LENGTH_UTF16_BYTES   30
#define EXFATFS_MAX_FILE_NAME_SEGMENT_LENGTH_UTF16_CHARS   15
#define EXFATFS_MAX_FILE_SECONDARY_DENTRIES_COUNT   18
#define EXFATFS_MAX_VOLUME_LABEL_LEN_BYTE   30
#define EXFATFS_MAX_VOLUME_LABEL_LEN_CHAR   15
#define EXFATFS_MIN_FILE_SECONDARY_DENTRIES_COUNT   2
#define EXFATFS_TEX_FAT_DENTRY_NAME   "$TEX_FAT"
 Name for an exFAT TexFAT directory entry, with the "$" prefix that is used to indicate "special file" directory entries and non-file directory entries.
#define EXFATFS_UPCASE_TABLE_DENTRY_NAME   "$UPCASE_TABLE"
 Name for an exFAT upcase table directory entry, with the "$" prefix that is used to indicate "special file" directory entries and non-file directory entries.
#define EXFATFS_VOLUME_GUID_DENTRY_NAME   "$VOLUME_GUID"
 Name for an exFAT volume GUID directory entry, with the "$" prefix that is used to indicate "special file" directory entries and non-file directory entries.

Typedefs

typedef uint8_t EXFATFS_DIR_ENTRY_TYPE
 exFAT directory entry type byte, containing both the type and the allocation status
typedef enum EXFATFS_DIR_ENTRY_TYPE_ENUM EXFATFS_DIR_ENTRY_TYPE_ENUM

Enumerations

enum  EXFATFS_DIR_ENTRY_TYPE_ENUM {
  EXFATFS_DIR_ENTRY_TYPE_NONE = 0x00 , EXFATFS_DIR_ENTRY_TYPE_VOLUME_LABEL = 0x03 , EXFATFS_DIR_ENTRY_TYPE_VOLUME_GUID = 0x20 , EXFATFS_DIR_ENTRY_TYPE_ALLOC_BITMAP = 0x01 ,
  EXFATFS_DIR_ENTRY_TYPE_UPCASE_TABLE = 0x02 , EXFATFS_DIR_ENTRY_TYPE_TEXFAT = 0x21 , EXFATFS_DIR_ENTRY_TYPE_ACT = 0x62 , EXFATFS_DIR_ENTRY_TYPE_FILE = 0x05 ,
  EXFATFS_DIR_ENTRY_TYPE_FILE_STREAM = 0x40 , EXFATFS_DIR_ENTRY_TYPE_FILE_NAME = 0x41
}
 exFAT directory entry types, the first byte of a directory entry minus the high order bit (which gives allocation status) More...

Functions

TSK_RETVAL_ENUM exfatfs_dent_parse_buf (FATFS_INFO *a_fatfs, TSK_FS_DIR *a_fs_dir, char *a_buf, TSK_OFF_T a_buf_len, TSK_DADDR_T *a_sector_addrs, int recursion_depth)
TSK_RETVAL_ENUM exfatfs_dinode_copy (FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FATFS_DENTRY *a_dentry, uint8_t a_is_alloc, TSK_FS_FILE *a_fs_file)
uint8_t exfatfs_find_file_stream_dentry (FATFS_INFO *a_fatfs, TSK_INUM_T a_file_entry_inum, TSK_DADDR_T a_sector, uint8_t a_sector_is_alloc, EXFATFS_DIR_ENTRY_TYPE a_file_dentry_type, FATFS_DENTRY *a_stream_dentry)
uint8_t exfatfs_fsstat (TSK_FS_INFO *a_fs, FILE *a_hFile)
uint8_t exfatfs_get_alloc_status_from_type (EXFATFS_DIR_ENTRY_TYPE a_dir_entry_type)
EXFATFS_DIR_ENTRY_TYPE_ENUM exfatfs_get_enum_from_type (EXFATFS_DIR_ENTRY_TYPE a_dir_entry_type)
uint8_t exfatfs_inode_lookup (FATFS_INFO *a_fatfs, TSK_FS_FILE *a_fs_file, TSK_INUM_T a_inum)
uint8_t exfatfs_inode_walk_should_skip_dentry (FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FATFS_DENTRY *a_dentry, unsigned int a_selection_flags, int a_cluster_is_alloc)
uint8_t exfatfs_is_access_ctrl_table_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status)
uint8_t exfatfs_is_alloc_bitmap_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status, FATFS_INFO *a_fatfs)
int8_t exfatfs_is_cluster_alloc (FATFS_INFO *a_fatfs, TSK_DADDR_T a_cluster_addr)
uint8_t exfatfs_is_dentry (FATFS_INFO *a_fatfs, FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_cluster_is_alloc, uint8_t a_do_basic_tests_only)
uint8_t exfatfs_is_file_dentry (FATFS_DENTRY *a_dentry, FATFS_INFO *a_fatfs)
uint8_t exfatfs_is_file_dentry_standalone (FATFS_DENTRY *a_dentry, TSK_ENDIAN_ENUM a_endian)
uint8_t exfatfs_is_file_name_dentry (FATFS_DENTRY *a_dentry)
uint8_t exfatfs_is_file_stream_dentry (FATFS_DENTRY *a_dentry, FATFS_INFO *a_fatfs)
uint8_t exfatfs_is_file_stream_dentry_standalone (FATFS_DENTRY *a_dentry, TSK_ENDIAN_ENUM a_endian, uint64_t a_cluster_heap_size, TSK_DADDR_T a_last_cluster)
uint8_t exfatfs_is_texfat_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status)
uint8_t exfatfs_is_upcase_table_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status, FATFS_INFO *a_fatfs)
uint8_t exfatfs_is_vol_guid_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status)
uint8_t exfatfs_is_vol_label_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_cluster_is_alloc)
uint8_t exfatfs_istat_attr_flags (FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FILE *a_hFile)
uint8_t exfatfs_open (FATFS_INFO *a_fatfs)
 Open an exFAT file system in an image file.

Detailed Description

Contains declarations of structures and functions specific to TSK exFAT file system support.

Enumeration Type Documentation

◆ EXFATFS_DIR_ENTRY_TYPE_ENUM

exFAT directory entry types, the first byte of a directory entry minus the high order bit (which gives allocation status)

Enumerator
EXFATFS_DIR_ENTRY_TYPE_NONE 

0x00

EXFATFS_DIR_ENTRY_TYPE_VOLUME_LABEL 

0x03

EXFATFS_DIR_ENTRY_TYPE_VOLUME_GUID 

0x20

EXFATFS_DIR_ENTRY_TYPE_ALLOC_BITMAP 

0x01

EXFATFS_DIR_ENTRY_TYPE_UPCASE_TABLE 

0x02

EXFATFS_DIR_ENTRY_TYPE_TEXFAT 

0x21

EXFATFS_DIR_ENTRY_TYPE_ACT 

0x62

EXFATFS_DIR_ENTRY_TYPE_FILE 

0x05

EXFATFS_DIR_ENTRY_TYPE_FILE_STREAM 

0x40

EXFATFS_DIR_ENTRY_TYPE_FILE_NAME 

0x41

Function Documentation

◆ exfatfs_open()

uint8_t exfatfs_open ( FATFS_INFO * a_fatfs)
extern

Open an exFAT file system in an image file.

Parameters
[in,out]a_fatfsGeneric FAT file system info structure.
Returns
0 on success, 1 otherwise, per TSK convention.

References TSK_FS_INFO::ftype, tsk_error_reset(), and TSK_FS_TYPE_EXFAT.


Copyright © 2007-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.