tsk_img.h File Reference

---

Detailed Description

Contains the external library definitions for the disk image functions.

Note that this file is not meant to be directly included. It is included by both libtsk.h and tsk_img_i.h.

Data Structures
struct	TSK_IMG_INFO
	Generic structure used to store information about disk image files. More...
Typedefs
typedef TSK_IMG_INFO	TSK_IMG_INFO
Enumerations
enum	TSK_IMG_INFO_TYPE_ENUM {   TSK_IMG_INFO_TYPE_IMG_MASK = 0xf0, TSK_IMG_INFO_TYPE_SUB_MASK = 0x0f, TSK_IMG_INFO_TYPE_UNSUPP = 0x00, TSK_IMG_INFO_TYPE_RAW_TYPE = 0x10,   TSK_IMG_INFO_TYPE_RAW_SING = 0x11, TSK_IMG_INFO_TYPE_RAW_SPLIT = 0x12, TSK_IMG_INFO_TYPE_AFF_TYPE = 0x20, TSK_IMG_INFO_TYPE_AFF_AFF = 0x21,   TSK_IMG_INFO_TYPE_AFF_AFD = 0x22, TSK_IMG_INFO_TYPE_AFF_AFM = 0x23, TSK_IMG_INFO_TYPE_EWF_TYPE = 0x30, TSK_IMG_INFO_TYPE_EWF_EWF = 0x31 }
	Values for the disk image type. More...
Functions
TSK_IMG_INFO *	tsk_img_open (const TSK_TCHAR *, const int, const TSK_TCHAR **)
	Open one or more files as a disk image.
TSK_IMG_INFO_TYPE_ENUM	tsk_img_parse_type (const TSK_TCHAR *)
	Parse a string and return the image type ID.
void	tsk_img_print_types (FILE *)
	Print the supported image types to a handle.
const char *	tsk_img_get_type (TSK_IMG_INFO_TYPE_ENUM)
	Get the name of an image type give its type ID.

---

Enumeration Type Documentation

enum TSK_IMG_INFO_TYPE_ENUM

Values for the disk image type.

The most-significant nibble is the high-level image type. The least-sigificant nibble is the specific sub-type of implementation.

Enumerator:

TSK_IMG_INFO_TYPE_IMG_MASK	Mask to isolate high-level image type.
TSK_IMG_INFO_TYPE_SUB_MASK	Mask to isolte sub-type.
TSK_IMG_INFO_TYPE_UNSUPP	Unsupported disk image type.
TSK_IMG_INFO_TYPE_RAW_TYPE	Raw type (general).
TSK_IMG_INFO_TYPE_RAW_SING	Raw single disk image.
TSK_IMG_INFO_TYPE_RAW_SPLIT	Raw split image.
TSK_IMG_INFO_TYPE_AFF_TYPE	AFF Type (general).
TSK_IMG_INFO_TYPE_AFF_AFF	AFF version.
TSK_IMG_INFO_TYPE_AFF_AFD	AFD Version.
TSK_IMG_INFO_TYPE_AFF_AFM	AFM version.
TSK_IMG_INFO_TYPE_EWF_TYPE	EWF/EnCase Type (General).
TSK_IMG_INFO_TYPE_EWF_EWF	EWF version.

---

Function Documentation

const char* tsk_img_get_type

(

TSK_IMG_INFO_TYPE_ENUM

type

)

Get the name of an image type give its type ID.

Parameters:

type

ID of image type

Returns:

Pointer to string of name.

TSK_IMG_INFO* tsk_img_open	(	const TSK_TCHAR *	type,
		const int	num_img,
		const TSK_TCHAR **	images
	)

Open one or more files as a disk image.

This serves as a wrapper around the specific types of disk image formats. You can specify the type or autodetection can be used.

Parameters:

	type	The text a user supplied for the type of format. Examples include "raw", "split", "aff", etc.
	num_img	The number of images that are being considered.
	images	The path to the files (the number of files must be equal to num_img)

Returns:

Pointer to the Image state structure or NULL on error

TSK_IMG_INFO_TYPE_ENUM tsk_img_parse_type

(

const TSK_TCHAR *

str

)

Parse a string and return the image type ID.

Parameters:

str

String of image type

Returns:

ID of image type

void tsk_img_print_types

(

FILE *

hFile

)

Print the supported image types to a handle.

Parameters:

hFile

Handle to print to.

---