|
The Sleuth Kit Framework
4.1
|
Stores a list of runs (which have a starting sector and length). More...
#include <SectorRuns.h>
Public Member Functions | |
| int | addRun (uint64_t start, uint64_t len, int vol_id) |
| Add a run to the list. More... | |
| int | getData (uint64_t offset, int len, char *buffer) const |
| Read data in the current entry into the buffer. More... | |
| uint64_t | getDataLen () const |
| Get the length of the current entry. More... | |
| uint64_t | getDataStart () const |
| Get starting address of current entry. More... | |
| int | getVolID () const |
| Get volume id of current entry. More... | |
| int | next () |
| Advances internal pointer to next run. More... | |
| void | reset () |
| reset so that the next get() returns data on the first entry. | |
Stores a list of runs (which have a starting sector and length).
Can be used to store information about a file, unused areas of an image, or ...
| int SectorRuns::addRun | ( | uint64_t | a_start, |
| uint64_t | a_len, | ||
| int | a_vol_id | ||
| ) |
Add a run to the list.
| a_start | Starting sector address relative to start of image file |
| a_len | Length of run in sectors. |
| a_vol_id | Volume ID that run is located in |
References TskServices::getLog(), TskServices::Instance(), and Log::logError().
Referenced by TskImgDBSqlite::getFreeSectors(), and TskImgDBPostgreSQL::getFreeSectors().
| int SectorRuns::getData | ( | uint64_t | a_offsetSect, |
| int | a_lenSect, | ||
| char * | a_buffer | ||
| ) | const |
Read data in the current entry into the buffer.
| a_offsetSect | Sector offset to start reading from (relative to start of current sector run) |
| a_lenSect | Number of sectors to read |
| a_buffer | Buffer to read into (must be of size a_len * 512 or larger) |
References TskServices::getImageFile(), TskImageFile::getSectorData(), and TskServices::Instance().
| uint64_t SectorRuns::getDataLen | ( | ) | const |
Get the length of the current entry.
| uint64_t SectorRuns::getDataStart | ( | ) | const |
Get starting address of current entry.
| int SectorRuns::getVolID | ( | ) | const |
Get volume id of current entry.
| int SectorRuns::next | ( | ) |
Advances internal pointer to next run.
Copyright © 2011-2013 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.