The Sleuth Kit Framework
4.1
|
Stores information that can map a region in the original disk image to a region in one of the chunks of unallocated space (as created by the CarvePrep implementation. More...
#include <UnallocRun.h>
Public Member Functions | |
uint64_t | getAllocStart () const |
uint64_t | getLength () const |
int | getUnallocImgId () const |
uint64_t | getUnallocStart () const |
int | getVolId () const |
UnallocRun (int a_volId, int a_unallocImgId, uint64_t a_unallocStart, uint64_t a_length, uint64_t a_allocStart) | |
Stores mapping between the unallocated images that are used for carving and the original images. More... | |
Stores information that can map a region in the original disk image to a region in one of the chunks of unallocated space (as created by the CarvePrep implementation.
UnallocRun::UnallocRun | ( | int | a_volId, |
int | a_unallocImgId, | ||
uint64_t | a_unallocStart, | ||
uint64_t | a_length, | ||
uint64_t | a_allocStart | ||
) |
Stores mapping between the unallocated images that are used for carving and the original images.
a_volId | Volume ID in original image that sector run is located in. |
a_unallocImgId | ID of the unallocated image |
a_unallocStart | Starting sector in unallocated image |
a_length | Number of sectors in run |
a_allocStart | Starting sector in original image |
Copyright © 2011-2013 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.