#include <tsk_fs.h>
A run describes a consecutive list of blocks that have been allocated to a file. A file may have many such runs and they are stringed together in a linked list. The entries in the list must be stored in sequential order (based on offset in file).
Data Fields | |
| TSK_DADDR_T | addr |
| Starting block address (in file system) of run. | |
| TSK_FS_ATTR_RUN_FLAG_ENUM | flags |
| Flags for run. | |
| TSK_DADDR_T | len |
| Number of blocks in run (0 when entry is not in use). | |
| TSK_FS_ATTR_RUN * | next |
| Pointer to the next run in the attribute (or NULL). | |
| TSK_DADDR_T | offset |
| Offset (in blocks) of this run in the file. | |
Copyright © 2007-2008 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License.