The Sleuth Kit 4.0
TSK data structure to store general file and directory metadata. More...
|Address of the meta data structure for this file. |
|last file content accessed time (stored in number of seconds since Jan 1, 1970 UTC) |
|nano-second resolution in addition to a_time |
|Contains run data on the file content (specific locations where content is stored). More...|
|State of the data in the TSK_FS_META::attr structure. |
|size of content buffer |
|Pointer to file system specific data that is used to store references to file content. |
|File system-specific and describes type of data in content_ptr in case file systems have multiple ways of storing things. |
|Created time (stored in number of seconds since Jan 1, 1970 UTC) |
|nano-second resolution in addition to cr_time |
|last file / metadata status change time (stored in number of seconds since Jan 1, 1970 UTC) |
|nano-second resolution in addition to c_time |
|Flags for this file for its allocation status etc. |
|group id |
|Name of target file if this is a symbolic link. |
|Unix-style permissions. |
|last file content modification time (stored in number of seconds since Jan 1, 1970 UTC) |
|nano-second resolution in addition to m_time |
|Name of file stored in metadata (FAT and NTFS Only) |
|link count (number of file names pointing to this) |
|Sequence number for file (NTFS only, is incremented when entry is reallocated) |
|file size (in bytes) |
|Linux deletion time. |
|nano-second resolution in addition to d_time |
|HFS+ backup time. |
|nano-second resolution in addition to bkup_time |
|File type. |
|owner id |
TSK data structure to store general file and directory metadata.
Note that the file in the file system may have more metadata than is stored here. For performance reasons, the run list of the file content is not always known when the file is loaded. It may be loaded only when needed by the internal code. The TSK_FS_META::content_ptr pointer contains file system-specific data that will be used to determine the full run. After it has been loaded, the TSK_FS_META::attr field will contain that info.
Contains run data on the file content (specific locations where content is stored).
Check attr_state to determine if data in here is valid because not all file systems load this data when a file is loaded. It may not be loaded until needed by one of the APIs. Most file systems will have only one attribute, but NTFS will have several.
Copyright © 2007-2013 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.