ffs.c File Reference

---

Detailed Description

General UFS / FFS file system functions.

#include "tsk_fs_i.h"
#include "tsk_ffs.h"

Defines
#define	FFS_INDIR_SIZ   64
Functions
uint8_t	ffs_inode_walk (TSK_FS_INFO *fs, TSK_INUM_T start_inum, TSK_INUM_T end_inum, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB action, void *ptr)
uint8_t	ffs_block_walk (TSK_FS_INFO *fs, TSK_DADDR_T start_blk, TSK_DADDR_T end_blk, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB action, void *ptr)
uint8_t	ffs_file_walk (TSK_FS_INFO *fs, TSK_FS_INODE *inode, uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB action, void *ptr)
	Calls a callback function with the contents of each block in a file.
uint8_t	ffs_jopen (TSK_FS_INFO *fs, TSK_INUM_T inum)
uint8_t	ffs_jentry_walk (TSK_FS_INFO *fs, int flags, TSK_FS_JENTRY_WALK_CB action, void *ptr)
uint8_t	ffs_jblk_walk (TSK_FS_INFO *fs, TSK_DADDR_T start, TSK_DADDR_T end, int flags, TSK_FS_JBLK_WALK_CB action, void *ptr)
TSK_FS_INFO *	ffs_open (TSK_IMG_INFO *img_info, TSK_OFF_T offset, TSK_FS_INFO_TYPE_ENUM ftype)
	Open part of a disk image as a FFS/UFS file system.

---

Function Documentation

uint8_t ffs_file_walk	(	TSK_FS_INFO *	fs,
		TSK_FS_INODE *	inode,
		uint32_t	type,
		uint16_t	id,
		TSK_FS_FILE_FLAG_ENUM	flags,
		TSK_FS_FILE_WALK_CB	action,
		void *	ptr
	)

Calls a callback function with the contents of each block in a file.

flag values: TSK_FS_FILE_FLAG_NOSPARSE, TSK_FS_FILE_FLAG_AONLY, TSK_FS_FILE_FLAG_SLACK TSK_FS_FILE_FLAG_META

If TSK_FS_FILE_FLAG_RECOVER is set, then most error codes are set to _RECOVER. No special recovery logic exists in this code.

The action will use the flags: TSK_FS_BLOCK_FLAG_CONT, TSK_FS_BLOCK_FLAG_META -- @@ Currently do not do _ALLOC and _UNALLOC

Parameters:

	fs	File system file is located in
	inode	File to read and analyze
	type	Attribute type to read and analyze (does not apply to FFS)
	id	Attribute id to read and analyze (does not apply to FFS)
	flags	Flags to use while reading
	action	Callback function that is called for each block
	ptr	Pointer to data that is passed to the callback

Returns:

1 on error and 0 on success

TSK_FS_INFO* ffs_open	(	TSK_IMG_INFO *	img_info,
		TSK_OFF_T	offset,
		TSK_FS_INFO_TYPE_ENUM	ftype
	)

Open part of a disk image as a FFS/UFS file system.

Parameters:

	img_info	Disk image to analyze
	offset	Byte offset where file system starts
	ftype	Specific type of file system

Returns:

NULL on error or if data is not a FFS file system

---