The Sleuth Kit: Data Fields - Variables

- a -

addr : TSK_FS_BLOCK , TSK_FS_ATTR_RUN , TSK_VS_PART_INFO , TSK_FS_META
allocsize : TSK_FS_ATTR
atime : TSK_FS_META
attr : TSK_FS_META
attr_state : TSK_FS_META

- b -

bkup_time : TSK_FS_META
block_count : TSK_FS_INFO
block_size : TSK_VS_INFO , TSK_FS_INFO
block_walk : TSK_FS_INFO
buf : TSK_FS_ATTR , TSK_FS_BLOCK
buf_size : TSK_FS_ATTR

- c -

cache : TSK_IMG_INFO
cache_age : TSK_IMG_INFO
cache_len : TSK_IMG_INFO
cache_off : TSK_IMG_INFO
close : TSK_FS_INFO , TSK_IMG_INFO
compsize : TSK_FS_ATTR
content_len : TSK_FS_META
content_ptr : TSK_FS_META
crtime : TSK_FS_META
ctime : TSK_FS_META

- d -

db_fname : TSK_HDB_INFO
db_type : TSK_HDB_INFO
desc : TSK_VS_PART_INFO
dev_bsize : TSK_FS_INFO
dir_open_meta : TSK_FS_INFO
dtime : TSK_FS_META
duname : TSK_FS_INFO

- e -

endian : TSK_FS_INFO , TSK_VS_INFO

- f -

first_block : TSK_FS_INFO
first_inum : TSK_FS_INFO
flags : TSK_FS_ATTR , TSK_VS_PART_INFO , TSK_FS_META , TSK_FS_ATTR_RUN , TSK_FS_NAME , TSK_FS_INFO
fs_file : TSK_FS_ATTR , TSK_FS_DIR
fs_id : TSK_FS_INFO
fs_id_used : TSK_FS_INFO
fs_info : TSK_FS_META , TSK_FS_DIR , TSK_FS_FILE , TSK_FS_BLOCK
ftype : TSK_FS_INFO

- g -

gid : TSK_FS_META

- h -

hash_len : TSK_HDB_INFO
hash_type : TSK_HDB_INFO
hDb : TSK_HDB_INFO
hIdx : TSK_HDB_INFO
hIdxTmp : TSK_HDB_INFO

- i -

id : TSK_FS_ATTR
idx_fname : TSK_HDB_INFO
idx_lbuf : TSK_HDB_INFO
idx_llen : TSK_HDB_INFO
idx_off : TSK_HDB_INFO
idx_size : TSK_HDB_INFO
img_info : TSK_VS_INFO , TSK_FS_INFO
imgstat : TSK_IMG_INFO
initsize : TSK_FS_ATTR
inode_walk : TSK_FS_INFO
inum_count : TSK_FS_INFO
isOrphanHunting : TSK_FS_INFO
istat : TSK_FS_INFO
itype : TSK_IMG_INFO

- j -

journ_inum : TSK_FS_INFO

- k -

key : TSK_LIST

- l -

last_block : TSK_FS_INFO
last_block_act : TSK_FS_INFO
last_inum : TSK_FS_INFO
len : TSK_VS_PART_INFO , TSK_LIST , TSK_STACK , TSK_FS_ATTR_RUN
link : TSK_FS_META
list_inum_named : TSK_FS_INFO

- m -

meta : TSK_FS_FILE
meta_addr : TSK_FS_NAME
meta_seq : TSK_FS_NAME
mode : TSK_FS_META
mtime : TSK_FS_META

- n -

name : TSK_FS_ATTR , TSK_FS_META_NAME_LIST , TSK_FS_FILE , TSK_FS_NAME
name2 : TSK_FS_META
name_size : TSK_FS_ATTR , TSK_FS_NAME
names : TSK_FS_DIR
names_alloc : TSK_FS_DIR
names_used : TSK_FS_DIR
next : TSK_FS_META_NAME_LIST , TSK_FS_ATTR , TSK_VS_PART_INFO , TSK_LIST , TSK_FS_ATTR_RUN
nlink : TSK_FS_META
nrd : TSK_FS_ATTR

- o -

offset : TSK_FS_ATTR_RUN , TSK_VS_INFO , TSK_FS_INFO

- p -

par_inode : TSK_FS_META_NAME_LIST
par_seq : TSK_FS_META_NAME_LIST
part_count : TSK_VS_INFO
part_list : TSK_VS_INFO
prev : TSK_VS_PART_INFO

- r -

rd : TSK_FS_ATTR
read : TSK_IMG_INFO
root_inum : TSK_FS_INFO
run : TSK_FS_ATTR
run_end : TSK_FS_ATTR

- s -

seq : TSK_FS_META
shrt_name : TSK_FS_NAME
shrt_name_size : TSK_FS_NAME
size : TSK_FS_ATTR , TSK_FS_META , TSK_IMG_INFO
skiplen : TSK_FS_ATTR
slot_num : TSK_VS_PART_INFO
start : TSK_VS_PART_INFO

- t -

table_num : TSK_VS_PART_INFO
top : TSK_STACK
type : TSK_FS_META , TSK_FS_ATTR , TSK_FS_NAME

- u -

uid : TSK_FS_META
uns_fname : TSK_HDB_INFO

- v -

Copyright © 2007-2008 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License.