The Sleuth Kit  4.3
Functions
mm_part.c File Reference

Contains the functions need to create, maintain, and access the linked list of partitions in a volume. More...

#include "tsk_vs_i.h"

Functions

TSK_VS_PART_INFOtsk_vs_part_add (TSK_VS_INFO *a_vs, TSK_DADDR_T a_start, TSK_DADDR_T len, TSK_VS_PART_FLAG_ENUM type, char *desc, int8_t table, int8_t slot)
 Add a partition to a sorted list. More...
 
void tsk_vs_part_free (TSK_VS_INFO *a_vs)
 
const TSK_VS_PART_INFOtsk_vs_part_get (const TSK_VS_INFO *a_vs, TSK_PNUM_T a_idx)
 Return handle to a volume in the volume system. More...
 
uint8_t tsk_vs_part_unused (TSK_VS_INFO *a_vs)
 Identify regions in the partition list where there are unused sectors and create new entries for them. More...
 
uint8_t tsk_vs_part_walk (TSK_VS_INFO *a_vs, TSK_PNUM_T a_start, TSK_PNUM_T a_last, TSK_VS_PART_FLAG_ENUM a_flags, TSK_VS_PART_WALK_CB a_action, void *a_ptr)
 Walk a range of partitions and pass the data to a callback function. More...
 

Detailed Description

Contains the functions need to create, maintain, and access the linked list of partitions in a volume.

Function Documentation

TSK_VS_PART_INFO* tsk_vs_part_add ( TSK_VS_INFO a_vs,
TSK_DADDR_T  a_start,
TSK_DADDR_T  len,
TSK_VS_PART_FLAG_ENUM  type,
char *  desc,
int8_t  table,
int8_t  slot 
)

Add a partition to a sorted list.

Parameters
a_vsVolume system that partition belongs to
a_startStarting sector address of volume (relative to start of volume)
lenLength of volume in sectors
typeType of volume
descText description of partition. Note that this is not copied and must not be freed until the volume system has been closed.
tableThe table ID that the volume was located in or -1 for volumes not in a partition table.
slotThe slot number in the partition table that the volume was located in or -1 for volumes not in a partition table.
Returns
Pointer to structure that was created for the partition or NULL on error.

References TSK_VS_PART_INFO::addr, TSK_VS_PART_INFO::desc, TSK_VS_PART_INFO::flags, TSK_VS_PART_INFO::len, TSK_VS_PART_INFO::next, TSK_VS_INFO::part_count, TSK_VS_INFO::part_list, TSK_VS_PART_INFO::prev, TSK_VS_PART_INFO::slot_num, TSK_VS_PART_INFO::start, TSK_VS_PART_INFO::table_num, and TSK_VS_PART_INFO::vs.

Referenced by tsk_vs_part_unused().

uint8_t tsk_vs_part_unused ( TSK_VS_INFO a_vs)

Identify regions in the partition list where there are unused sectors and create new entries for them.

Parameters
a_vsPointer to open volume system
Returns
1 on error and 0 on success

References TSK_VS_INFO::block_size, TSK_VS_PART_INFO::flags, TSK_VS_INFO::img_info, TSK_VS_PART_INFO::len, TSK_VS_PART_INFO::next, TSK_VS_INFO::part_list, TSK_IMG_INFO::size, TSK_VS_PART_INFO::start, tsk_vs_part_add(), TSK_VS_PART_FLAG_META, and TSK_VS_PART_FLAG_UNALLOC.


Copyright © 2007-2015 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.