tsk_vs_i.h File Reference

Contains the internal library definitions for the volume system functions. More...

#include "tsk/base/tsk_base_i.h"
#include "tsk/img/tsk_img_i.h"
#include "tsk_vs.h"
#include <sys/types.h>

Macros
#define	tsk_vs_guessu16(vs, x, mag)
#define	tsk_vs_guessu32(vs, x, mag)
#define	tsk_vs_guessu64(vs, x, mag)

Functions
TSK_VS_INFO *	tsk_vs_bsd_open (TSK_IMG_INFO *, TSK_DADDR_T)
TSK_VS_INFO *	tsk_vs_dos_open (TSK_IMG_INFO *, TSK_DADDR_T, uint8_t)
TSK_VS_INFO *	tsk_vs_gpt_open (TSK_IMG_INFO *, TSK_DADDR_T)
TSK_VS_INFO *	tsk_vs_mac_open (TSK_IMG_INFO *, TSK_DADDR_T)
TSK_VS_PART_INFO *	tsk_vs_part_add (TSK_VS_INFO *, TSK_DADDR_T, TSK_DADDR_T, TSK_VS_PART_FLAG_ENUM, char *, int8_t, int16_t)
	Add a partition to a sorted list.
void	tsk_vs_part_free (TSK_VS_INFO *)
uint8_t	tsk_vs_part_unused (TSK_VS_INFO *)
	Identify regions in the partition list where there are unused sectors and create new entries for them.
TSK_VS_INFO *	tsk_vs_sun_open (TSK_IMG_INFO *, TSK_DADDR_T)

Detailed Description

Contains the internal library definitions for the volume system functions.

This should be included by the code in the volume system library.

Macro Definition Documentation

tsk_vs_guessu16

#define tsk_vs_guessu16	(		vs,
			x,
			mag )

Value:

tsk_guess_end_u16(&(vs->endian), (x), (mag))

tsk_vs_guessu32

#define tsk_vs_guessu32	(		vs,
			x,
			mag )

Value:

tsk_guess_end_u32(&(vs->endian), (x), (mag))

tsk_vs_guessu64

#define tsk_vs_guessu64	(		vs,
			x,
			mag )

Value:

tsk_guess_end_u64(&(vs->endian), (x), (mag))

Function Documentation

tsk_vs_part_add()

TSK_VS_PART_INFO * tsk_vs_part_add ( TSK_VS_INFO * a_vs, TSK_DADDR_T a_start, TSK_DADDR_T len, TSK_VS_PART_FLAG_ENUM type, char * desc, int8_t table, int16_t slot )

extern

Add a partition to a sorted list.

Parameters

a_vs	Volume system that partition belongs to
a_start	Starting sector address of volume (relative to start of volume)
len	Length of volume in sectors
type	Type of volume
desc	Text description of partition. Note that this is not copied and must not be freed until the volume system has been closed.
table	The table ID that the volume was located in or -1 for volumes not in a partition table.
slot	The slot number in the partition table that the volume was located in or -1 for volumes not in a partition table.

Returns

Pointer to structure that was created for the partition or NULL on error.

References TSK_VS_PART_INFO::addr, TSK_VS_PART_INFO::desc, TSK_VS_PART_INFO::flags, TSK_VS_PART_INFO::len, TSK_VS_PART_INFO::next, TSK_VS_INFO::part_count, TSK_VS_INFO::part_list, TSK_VS_PART_INFO::prev, TSK_VS_PART_INFO::slot_num, TSK_VS_PART_INFO::start, TSK_VS_PART_INFO::table_num, and TSK_VS_PART_INFO::vs.

Referenced by tsk_vs_part_unused().

tsk_vs_part_unused()

uint8_t tsk_vs_part_unused ( TSK_VS_INFO * a_vs )

extern

Identify regions in the partition list where there are unused sectors and create new entries for them.

Parameters

a_vs	Pointer to open volume system

Returns

1 on error and 0 on success

References TSK_VS_INFO::block_size, TSK_VS_PART_INFO::flags, TSK_VS_INFO::img_info, TSK_VS_PART_INFO::len, TSK_VS_PART_INFO::next, TSK_VS_INFO::part_list, TSK_IMG_INFO::size, TSK_VS_PART_INFO::start, tsk_vs_part_add(), TSK_VS_PART_FLAG_META, and TSK_VS_PART_FLAG_UNALLOC.