tsk_fs_i.h File Reference

---

Detailed Description

Contains the internal library definitions for the file system functions.

This should be included by the code in the file system library.

#include "tsk/base/tsk_base_i.h"
#include "tsk/img/tsk_img_i.h"
#include "tsk_fs.h"
#include <time.h>
#include <locale.h>
#include <sys/fcntl.h>
#include <sys/time.h>

Data Structures
struct	TSK_FS_LOAD_FILE
Defines
#define	TSK_USE_HFS   0
#define	NBBY   8
#define	isset(a, i)   (((uint8_t *)(a))[(i)/NBBY] & (1<<((i)%NBBY)))
#define	setbit(a, i)   (((uint8_t *)(a))[(i)/NBBY] |= (1<<((i)%NBBY)))
#define	tsk_fs_guessu16(fs, x, mag)   tsk_guess_end_u16(&(fs->endian), (x), (mag))
#define	tsk_fs_guessu32(fs, x, mag)   tsk_guess_end_u32(&(fs->endian), (x), (mag))
Functions
TSK_WALK_RET_ENUM	tsk_fs_load_file_action (TSK_FS_INFO *, TSK_DADDR_T, char *, size_t, TSK_FS_BLOCK_FLAG_ENUM, void *)
TSK_FS_INFO *	ext2fs_open (TSK_IMG_INFO *, TSK_OFF_T, TSK_FS_INFO_TYPE_ENUM, uint8_t)
	Open part of a disk image as a Ext2/3 file system.
TSK_FS_INFO *	fatfs_open (TSK_IMG_INFO *, TSK_OFF_T, TSK_FS_INFO_TYPE_ENUM, uint8_t)
	Open part of a disk image as a FAT file system.
TSK_FS_INFO *	ffs_open (TSK_IMG_INFO *, TSK_OFF_T, TSK_FS_INFO_TYPE_ENUM)
	Open part of a disk image as a FFS/UFS file system.
TSK_FS_INFO *	ntfs_open (TSK_IMG_INFO *, TSK_OFF_T, TSK_FS_INFO_TYPE_ENUM, uint8_t)
	Open part of a disk image as an NTFS file system.
TSK_FS_INFO *	rawfs_open (TSK_IMG_INFO *, TSK_OFF_T)
	Open part of a disk image as a raw file system -- which basically means that it has no file system structure.
TSK_FS_INFO *	swapfs_open (TSK_IMG_INFO *, TSK_OFF_T)
	Open part of a disk image as "swap" space.
TSK_FS_INFO *	iso9660_open (TSK_IMG_INFO *, TSK_OFF_T, TSK_FS_INFO_TYPE_ENUM, uint8_t)
TSK_FS_INFO *	hfs_open (TSK_IMG_INFO *, TSK_OFF_T, TSK_FS_INFO_TYPE_ENUM, uint8_t)

---

Function Documentation

TSK_FS_INFO* ext2fs_open	(	TSK_IMG_INFO *	img_info,
		TSK_OFF_T	offset,
		TSK_FS_INFO_TYPE_ENUM	ftype,
		uint8_t	test
	)

Open part of a disk image as a Ext2/3 file system.

Parameters:

	img_info	Disk image to analyze
	offset	Byte offset where file system starts
	ftype	Specific type of file system
	test	NOT USED

Returns:

NULL on error or if data is not an Ext2/3 file system

TSK_FS_INFO* fatfs_open	(	TSK_IMG_INFO *	img_info,
		TSK_OFF_T	offset,
		TSK_FS_INFO_TYPE_ENUM	ftype,
		uint8_t	test
	)

Open part of a disk image as a FAT file system.

Parameters:

	img_info	Disk image to analyze
	offset	Byte offset where FAT file system starts
	ftype	Specific type of FAT file system
	test	NOT USED

Returns:

NULL on error or if data is not a FAT file system

TSK_FS_INFO* ffs_open	(	TSK_IMG_INFO *	img_info,
		TSK_OFF_T	offset,
		TSK_FS_INFO_TYPE_ENUM	ftype
	)

Open part of a disk image as a FFS/UFS file system.

Parameters:

	img_info	Disk image to analyze
	offset	Byte offset where file system starts
	ftype	Specific type of file system

Returns:

NULL on error or if data is not a FFS file system

TSK_FS_INFO* ntfs_open	(	TSK_IMG_INFO *	img_info,
		TSK_OFF_T	offset,
		TSK_FS_INFO_TYPE_ENUM	ftype,
		uint8_t	test
	)

Open part of a disk image as an NTFS file system.

Parameters:

	img_info	Disk image to analyze
	offset	Byte offset where NTFS file system starts
	ftype	Specific type of NTFS file system
	test	NOT USED

Returns:

NULL on error or if data is not an NTFS file system

TSK_FS_INFO* rawfs_open	(	TSK_IMG_INFO *	img_info,
		TSK_OFF_T	offset
	)

Open part of a disk image as a raw file system -- which basically means that it has no file system structure.

The data is considered to be in 512-byte sectors.

Parameters:

	img_info	Disk image to analyze
	offset	Byte offset where "file system" starts

Returns:

NULL on error

TSK_FS_INFO* swapfs_open	(	TSK_IMG_INFO *	img_info,
		TSK_OFF_T	offset
	)

Open part of a disk image as "swap" space.

This assumes no structure exists. Data are organized into 4096-byte pages.

Parameters:

	img_info	Disk image to analyze
	offset	Byte offset where swap space starts.

Returns:

NULL on error

---