The Sleuth Kit
4.3
|
Contains the functions need to create, maintain, and access the linked list of partitions in a volume. More...
#include "tsk_vs_i.h"
Functions | |
TSK_VS_PART_INFO * | tsk_vs_part_add (TSK_VS_INFO *a_vs, TSK_DADDR_T a_start, TSK_DADDR_T len, TSK_VS_PART_FLAG_ENUM type, char *desc, int8_t table, int8_t slot) |
Add a partition to a sorted list. More... | |
void | tsk_vs_part_free (TSK_VS_INFO *a_vs) |
const TSK_VS_PART_INFO * | tsk_vs_part_get (const TSK_VS_INFO *a_vs, TSK_PNUM_T a_idx) |
Return handle to a volume in the volume system. More... | |
uint8_t | tsk_vs_part_unused (TSK_VS_INFO *a_vs) |
Identify regions in the partition list where there are unused sectors and create new entries for them. More... | |
uint8_t | tsk_vs_part_walk (TSK_VS_INFO *a_vs, TSK_PNUM_T a_start, TSK_PNUM_T a_last, TSK_VS_PART_FLAG_ENUM a_flags, TSK_VS_PART_WALK_CB a_action, void *a_ptr) |
Walk a range of partitions and pass the data to a callback function. More... | |
Contains the functions need to create, maintain, and access the linked list of partitions in a volume.
TSK_VS_PART_INFO* tsk_vs_part_add | ( | TSK_VS_INFO * | a_vs, |
TSK_DADDR_T | a_start, | ||
TSK_DADDR_T | len, | ||
TSK_VS_PART_FLAG_ENUM | type, | ||
char * | desc, | ||
int8_t | table, | ||
int8_t | slot | ||
) |
Add a partition to a sorted list.
a_vs | Volume system that partition belongs to |
a_start | Starting sector address of volume (relative to start of volume) |
len | Length of volume in sectors |
type | Type of volume |
desc | Text description of partition. Note that this is not copied and must not be freed until the volume system has been closed. |
table | The table ID that the volume was located in or -1 for volumes not in a partition table. |
slot | The slot number in the partition table that the volume was located in or -1 for volumes not in a partition table. |
References TSK_VS_PART_INFO::addr, TSK_VS_PART_INFO::desc, TSK_VS_PART_INFO::flags, TSK_VS_PART_INFO::len, TSK_VS_PART_INFO::next, TSK_VS_INFO::part_count, TSK_VS_INFO::part_list, TSK_VS_PART_INFO::prev, TSK_VS_PART_INFO::slot_num, TSK_VS_PART_INFO::start, TSK_VS_PART_INFO::table_num, and TSK_VS_PART_INFO::vs.
Referenced by tsk_vs_part_unused().
uint8_t tsk_vs_part_unused | ( | TSK_VS_INFO * | a_vs | ) |
Identify regions in the partition list where there are unused sectors and create new entries for them.
a_vs | Pointer to open volume system |
References TSK_VS_INFO::block_size, TSK_VS_PART_INFO::flags, TSK_VS_INFO::img_info, TSK_VS_PART_INFO::len, TSK_VS_PART_INFO::next, TSK_VS_INFO::part_list, TSK_IMG_INFO::size, TSK_VS_PART_INFO::start, tsk_vs_part_add(), TSK_VS_PART_FLAG_META, and TSK_VS_PART_FLAG_UNALLOC.
Copyright © 2007-2015 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.