|
The Sleuth Kit
4.0
|
| Contains C++ code that creates the base file extraction automation class | |
| Contains code to populate SQLite database with volume and file system information from a specific image | |
| Contains class definition for TskCaseDb class to handle creating/opening a case database and adding images to it | |
| Contains code to perform operations against SQLite database | |
| Contains the class definitions for the automated file extraction classes | |
| Contains the class that creates a case-level database of file system data | |
| Contains the SQLite code for maintaining the case-level database | |
| Local copy of RSA Data Security, Inc | |
| These functions allocate and realocate memory and set the error handling functions when an error occurs | |
| Local copy of the public domain SHA-1 library code by David Ireland | |
| Contains the type and function definitions that are needed by external programs to use the TSK library | |
| Contains the general internal TSK type and function definitions | |
| Contains the routines to read data in different endian orderings | |
| Contains the error handling code and variables | |
| Tsk_lists are a linked list of buckets that store a key in REVERSE sorted order | |
| Contains some OS-specific type settings | |
| Contains code to parse specific types of data from the command line | |
| These are printf wrappers that are needed so that we can easily print in both Unix and Windows | |
| Contains the functions to create and maintain a stack, which supports basic popping, pushing, and searching | |
| A local copy of the Unicode conversion routines from unicode.org | |
| Contains functions to print and obtain the library version | |
| Parses arguments for win32 programs – written by Hans Dietrich | |
| Contains the library API functions used by the TSK blkcalc command line tool | |
| Contains the library API functions used by the TSK blkcat command line tool | |
| Contains the library API functions used by the TSK blkls command line tool | |
| Contains the library API functions used by the TSK blkstat command line tool | |
| Contains the internal TSK ext2/ext3 file system functions | |
| Contains the internal TSK file name processing code for Ext2 / ext3 | |
| Contains the internal TSK Ext3 journal walking code | |
| Contains the internal TSK FAT file system code to handle basic file system processing for opening file system, processing sectors, and directory entries | |
| Contains the internal TSK FAT file name processing code | |
| Contains the internal TSK FAT file system code to handle metadata structures | |
| Contains the library API functions used by the TSK ffind command line tool | |
| Contains the internal TSK UFS / FFS file system functions | |
| Contains the internal TSK UFS/FFS file name (directory entry) processing functions | |
| Contains the library code associated with the TSK fls tool to list files in a directory | |
| Functions to allocate and add structures to maintain generic file system attributes and run lists | |
| File that contains functions to process TSK_FS_ATTRLIST structures, which hold a linked list of TSK_FS_ATTR attribute structures | |
| Contains functions to allocate, free, and read data into a TSK_FS_BLOCK structure | |
| Create, manage, etc | |
| Create, manage, etc | |
| Contains functions to allocate, free, and process the generic inode structures | |
| Contains functions to read data from a disk image and wrapper functions to read file content | |
| Contains a general file walk callback that can be used to load file content into a buffer | |
| Code to allocate and free the TSK_FS_NAME structures | |
| Contains the general code to open a file system – this calls the file system -specific opening routines | |
| Contains code to parse specific types of data from the command line | |
| Contains TSK functions that deal with parsing and printing file system type strings | |
| Contains the general internal TSK HFS metadata and data unit code | |
| Contains the file name layer code for HFS+ file systems – not included in code by default | |
| Contains the internal TSK HFS+ journal code – not included in code by default | |
| Contains the library API functions used by the TSK icat command line tool | |
| Contains the library API functions used by the TSK ifind command line tool | |
| Library functionality of the TSK ils tool | |
| Contains the internal TSK ISO9660 file system code to handle basic file system processing for opening file system, processing sectors, and directory entries | |
| Contains the internal TSK ISO9660 file system code to handle the parsing of file names and directory structures | |
| Contains internal functions that are common to the "non-file system" file systems, such as raw and swap | |
| Contains the TSK internal general NTFS processing code | |
| NTFS file name processing internal functions | |
| Contains internal "raw" specific file system functions | |
| Contains the internal "swapfs" specific functions | |
| External header file for file system support | |
| Contains the internal library definitions for the file system functions | |
| Contains code that is common to both UFS1/2 and Ext2/3 file systems | |
| Contains the Encase hash database specific extraction and printing routines | |
| Contains functions to read and process hash keeper database files | |
| Contains the dummy functions that are used when only an index is used for lookups and the original database is gone | |
| Contains the MD5sum hash database specific extraction and printing routines | |
| NSRL specific functions to read the database | |
| Contains the generic hash database creation and lookup code | |
| External header file for hash database support | |
| Contains the internal library definitions for the hash database functions | |
| Internal code to interface with afflib to read and open AFF image files | |
| Internal code for TSK to interface with libewf | |
| Contains the basic img reading API redirection functions | |
| Contains the basic img_open function call, that interfaces with the format specific _open calls | |
| Contains basic functions to parse and print the names of the supported disk image types | |
| Internal code to find remainder of files in a split raw set | |
| Internal code to open and read single or split raw disk images | |
| Contains the external library definitions for the disk image functions | |
| Contains the internal functions required to process BSD disk labels | |
| Contains the internal functions to process DOS Partition tables | |
| The internal functions required to process the GPT GUID Partiition Table | |
| Contains the internal functions to process and load a Mac partition table | |
| Contains the wrapper code that allows one to read sectors from a TSK_VS_INFO or TSK_VS_PART_INFO structure | |
| Contains general code to open volume systems | |
| Contains the functions need to create, maintain, and access the linked list of partitions in a volume | |
| Contains the code to parse and print the strings for the supported volume system types | |
| Contains the internal SUN VTOC volume system processing code | |
| External header file for media management (volume system) support | |
| Contains the internal library definitions for the volume system functions |
Copyright © 2007-2013 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.