The Sleuth Kit  4.2
Public Member Functions | Friends | List of all members
TskFsFile Class Reference

Class that represents an allocated or deleted file. More...

#include <tsk_fs.h>

Public Member Functions

void close ()
 Close an open file. More...
 
const TskFsAttributegetAttr (int a_idx)
 
const TskFsAttributegetAttr (TSK_FS_ATTR_TYPE_ENUM a_type, uint16_t a_id, uint8_t a_id_used)
 
const TskFsAttributegetAttrDefault ()
 
int getAttrSize ()
 
TskFsInfogetFsInfo ()
 Return pointer file system that the file is located in. More...
 
TskFsMetagetMeta ()
 Return pointer to the file's metadata (or NULL if name has invalid metadata address) More...
 
TskFsNamegetName ()
 Return pointer to the file's name (or NULL if file was opened using metadata address) More...
 
uint8_t open (TskFsInfo *a_fs, TskFsFile *a_fs_file, TSK_INUM_T a_addr)
 Open a file given its metadata address. More...
 
uint8_t open (TskFsInfo *a_fs, TskFsFile *a_fs_file, const char *a_path)
 Return the handle structure for a specific file, given its full path. More...
 
ssize_t read (TSK_FS_ATTR_TYPE_ENUM a_type, uint16_t a_id, TSK_OFF_T a_offset, char *a_buf, size_t a_len, TSK_FS_FILE_READ_FLAG_ENUM a_flags)
 Read the contents of a specific attribute of a file using a typical read() type interface. More...
 
ssize_t read (TSK_OFF_T a_offset, char *a_buf, size_t a_len, TSK_FS_FILE_READ_FLAG_ENUM a_flags)
 Read the contents of the default attribute of a file using a typical read() type interface. More...
 
 TskFsFile (TSK_FS_FILE *a_fsFile)
 Construct a TskFsFile object from a C struct. More...
 
 TskFsFile ()
 default constructor to construct a TskFsFile object
 
uint8_t walk (TSK_FS_ATTR_TYPE_ENUM a_type, uint16_t a_id, TSK_FS_FILE_WALK_FLAG_ENUM a_flags, TSK_FS_FILE_WALK_CPP_CB a_action, void *a_ptr)
 Process a specific attribute in a file and call a callback function with the file contents. More...
 
uint8_t walk (TSK_FS_FILE_WALK_FLAG_ENUM a_flags, TSK_FS_FILE_WALK_CPP_CB a_action, void *a_ptr)
 Process the default attribute for the file and call a callback function with the file contents. More...
 
 ~TskFsFile ()
 Close an open file.
 

Friends

class TskFsDir
 

Detailed Description

Class that represents an allocated or deleted file.

The non-default constructor or open method must be called first. otherwise, the results of the getX() methods are undefined. See TSK_FS_FILE for more details.

Constructor & Destructor Documentation

TskFsFile::TskFsFile ( TSK_FS_FILE a_fsFile)
inline

Construct a TskFsFile object from a C struct.

Parameters
a_fsFilea pointer of TSK_FS_FILE

Member Function Documentation

void TskFsFile::close ( )
inline

Close an open file.

See tsk_fs_file_close() for details.

References tsk_fs_file_close().

Referenced by ~TskFsFile().

TskFsInfo* TskFsFile::getFsInfo ( )
inline

Return pointer file system that the file is located in.

Returns
pointer to file system that the file is located in.

References TSK_FS_FILE::fs_info.

TskFsMeta* TskFsFile::getMeta ( )
inline

Return pointer to the file's metadata (or NULL if name has invalid metadata address)

Returns
pointer metadata of file. It is the caller's responsibility to free this.

References TSK_FS_FILE::meta.

TskFsName* TskFsFile::getName ( )
inline

Return pointer to the file's name (or NULL if file was opened using metadata address)

Returns
pointer to name of file. It is the caller's responsibility to free this.

References TSK_FS_FILE::name.

uint8_t TskFsFile::open ( TskFsInfo a_fs,
TskFsFile a_fs_file,
TSK_INUM_T  a_addr 
)
inline

Open a file given its metadata address.

This function loads the metadata and returns a handle that can be used to read and process the file. Note that the returned class will not have the file name set because it was not used to load the file and this function does not search the directory structure to find the name that points to the address. In general, if you know the metadata address of a file, this function is more effecient then tsk_fs_file_open, which first maps a file name to the metadata address and then open the file using this function. See tsk_fs_file_open_meta() for details

Parameters
a_fsFile system to analyze
a_fs_fileobject to store file data in or NULL to have one allocated.
a_addrMetadata address of file to lookup
Returns
1 on error and 0 on success.

References tsk_fs_file_open_meta().

uint8_t TskFsFile::open ( TskFsInfo a_fs,
TskFsFile a_fs_file,
const char *  a_path 
)
inline

Return the handle structure for a specific file, given its full path.

Note that if you have the metadata address fo the file, then tsk_fs_file_open_meta() is a more effecient approach. See tsk_fs_file_open() for details

Parameters
a_fsFile system to analyze
a_fs_fileStructure to store file data in or NULL to have one allocated.
a_pathPath of file to open
Returns
1 on error and 0 on success.

References tsk_fs_file_open().

ssize_t TskFsFile::read ( TSK_FS_ATTR_TYPE_ENUM  a_type,
uint16_t  a_id,
TSK_OFF_T  a_offset,
char *  a_buf,
size_t  a_len,
TSK_FS_FILE_READ_FLAG_ENUM  a_flags 
)
inline

Read the contents of a specific attribute of a file using a typical read() type interface.

0s are returned for missing runs of files. See tsk_fs_file_read_type() for details

Parameters
a_typeThe type of attribute to load
a_idThe id of attribute to load (use 0 and set a_flags if you do not care)
a_offsetThe byte offset to start reading from.
a_bufThe buffer to read the data into.
a_lenThe number of bytes to read from the file.
a_flagsFlags to use while reading
Returns
The number of bytes read or -1 on error (incl if offset is past EOF).

References tsk_fs_file_read_type().

ssize_t TskFsFile::read ( TSK_OFF_T  a_offset,
char *  a_buf,
size_t  a_len,
TSK_FS_FILE_READ_FLAG_ENUM  a_flags 
)
inline

Read the contents of the default attribute of a file using a typical read() type interface.

0s are returned for missing runs of files. See tsk_fs_file_read() for details

Parameters
a_offsetThe byte offset to start reading from.
a_bufThe buffer to read the data into.
a_lenThe number of bytes to read from the file.
a_flagsFlags to use while reading
Returns
The number of bytes read or -1 on error (incl if offset is past EOF).

References tsk_fs_file_read().

uint8_t TskFsFile::walk ( TSK_FS_ATTR_TYPE_ENUM  a_type,
uint16_t  a_id,
TSK_FS_FILE_WALK_FLAG_ENUM  a_flags,
TSK_FS_FILE_WALK_CPP_CB  a_action,
void *  a_ptr 
)
inline

Process a specific attribute in a file and call a callback function with the file contents.

See tsk_fs_file_walk_type() for details

Parameters
a_typeAttribute type to process
a_idId if attribute to process
a_flagsFlags to use while processing file
a_actionCallback action to call with content
a_ptrPointer that will passed to callback
Returns
1 on error and 0 on success.

References tsk_fs_file_walk_type().

uint8_t TskFsFile::walk ( TSK_FS_FILE_WALK_FLAG_ENUM  a_flags,
TSK_FS_FILE_WALK_CPP_CB  a_action,
void *  a_ptr 
)
inline

Process the default attribute for the file and call a callback function with the file contents.

See tsk_fs_file_walk_type() for details

Parameters
a_flagsFlags to use while processing file
a_actionCallback action to call with content
a_ptrPointer that will passed to callback
Returns
1 on error and 0 on success.

References tsk_fs_file_walk().


The documentation for this class was generated from the following file:

Copyright © 2007-2015 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.