#include "aux_tools.h"
#include <string.h>
#include <ctype.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <locale.h>
Go to the source code of this file.
Data Structures | |
| struct | TSK_HDB_INFO |
| Holds information about an open hash database. More... | |
Defines | |
| #define | TSK_HDB_HTYPE_MD5_STR "md5" |
| String name for MD5 algorithm. | |
| #define | TSK_HDB_HTYPE_SHA1_STR "sha1" |
| String name for SHA1 algorithm. | |
| #define | TSK_HDB_HTYPE_SHA1_LEN 40 |
| Length of SHA1 hash. | |
| #define | TSK_HDB_HTYPE_MD5_LEN 32 |
| Length of MD5 hash. | |
| #define | TSK_HDB_HTYPE_CRC32_LEN 8 |
| Length of CRC hash. | |
| #define | TSK_HDB_HTYPE_STR(x) |
| Return the name of the hash algorithm, given its ID. | |
| #define | TSK_HDB_HTYPE_LEN(x) |
| Return the length of a hash, given its ID. | |
| #define | TSK_HDB_DBTYPE_NSRL_STR "nsrl" |
| NSRL String name. | |
| #define | TSK_HDB_DBTYPE_NSRL_MD5_STR "nsrl-md5" |
| NSRL md5 string name. | |
| #define | TSK_HDB_DBTYPE_NSRL_SHA1_STR "nsrl-sha1" |
| NSRL SHA1 string name. | |
| #define | TSK_HDB_DBTYPE_MD5SUM_STR "md5sum" |
| md5sum db string n ame | |
| #define | TSK_HDB_DBTYPE_HK_STR "hk" |
| hash keeper string name | |
| #define | TSK_HDB_DBTYPE_SUPPORT_STR "nsrl-md5, nsrl-sha1, md5sum, hk" |
| List of supported data base types. | |
Typedefs | |
| typedef enum TSK_HDB_FLAG_ENUM | TSK_HDB_FLAG_ENUM |
| typedef enum TSK_HDB_HTYPE_ENUM | TSK_HDB_HTYPE_ENUM |
| typedef enum TSK_HDB_DBTYPE_ENUM | TSK_HDB_DBTYPE_ENUM |
| typedef TSK_HDB_INFO | TSK_HDB_INFO |
| typedef uint8_t(*) | TSK_HDB_LOOKUP_FN (TSK_HDB_INFO *, char *hash, char *name, void *) |
| typedef enum TSK_HDB_OPEN_ENUM | TSK_HDB_OPEN_ENUM |
Enumerations | |
| enum | TSK_HDB_FLAG_ENUM { TSK_HDB_FLAG_QUICK = 0x01, TSK_HDB_FLAG_EXT = 0x02 } |
| Flags used for lookups. More... | |
| enum | TSK_HDB_HTYPE_ENUM { TSK_HDB_HTYPE_MD5_ID = 1, TSK_HDB_HTYPE_SHA1_ID = 2 } |
| Hash algorithm types. More... | |
| enum | TSK_HDB_DBTYPE_ENUM { TSK_HDB_DBTYPE_NSRL_ID = 1, TSK_HDB_DBTYPE_MD5SUM_ID = 2, TSK_HDB_DBTYPE_HK_ID = 3, TSK_HDB_DBTYPE_IDXONLY_ID = 4 } |
| Hash Database types. More... | |
| enum | TSK_HDB_OPEN_ENUM { TSK_HDB_OPEN_NONE = 0, TSK_HDB_OPEN_IDXONLY = (0x1 << 0) } |
| Options for opening a hash database. More... | |
Functions | |
| TSK_HDB_INFO * | tsk_hdb_open (TSK_TCHAR *db_file, TSK_HDB_OPEN_ENUM flags) |
| Open a hash database and index for lookup. | |
| void | tsk_hdb_close (TSK_HDB_INFO *hdb) |
| Close the HDB_INFO structure and free the memory. | |
| uint8_t | tsk_hdb_hasindex (TSK_HDB_INFO *, uint8_t htype) |
| Determine if the hash database that is open has an index that has been created. | |
| int8_t | tsk_hdb_lookup (TSK_HDB_INFO *, char *, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *) |
| Perform the binary search in the index for the text/ASCII hash value. | |
| int8_t | tsk_hdb_lookup_raw (TSK_HDB_INFO *, uint8_t *hash, uint8_t len, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *) |
| Perform the binary search in the index for a hash value given in a raw (non-text) format. | |
| #define TSK_HDB_HTYPE_LEN | ( | x | ) |
Value:
( ((x) & TSK_HDB_HTYPE_MD5_ID) ? (TSK_HDB_HTYPE_MD5_LEN) : ( \ ( ((x) & TSK_HDB_HTYPE_SHA1_ID) ? TSK_HDB_HTYPE_SHA1_LEN : 0) ) )
| #define TSK_HDB_HTYPE_STR | ( | x | ) |
Value:
( ((x) & TSK_HDB_HTYPE_MD5_ID) ? (TSK_HDB_HTYPE_MD5_STR) : ( \ ( ((x) & TSK_HDB_HTYPE_SHA1_ID) ? TSK_HDB_HTYPE_SHA1_STR : "") ) )
| enum TSK_HDB_DBTYPE_ENUM |
| enum TSK_HDB_FLAG_ENUM |
| enum TSK_HDB_HTYPE_ENUM |
| enum TSK_HDB_OPEN_ENUM |
| void tsk_hdb_close | ( | TSK_HDB_INFO * | hdb_info | ) |
Close the HDB_INFO structure and free the memory.
| hdb_info | Structure to free. |
| uint8_t tsk_hdb_hasindex | ( | TSK_HDB_INFO * | hdb_info, | |
| uint8_t | htype | |||
| ) |
Determine if the hash database that is open has an index that has been created.
| hdb_info | Hash database to consider | |
| htype | Hash type that index should be of |
| int8_t tsk_hdb_lookup | ( | TSK_HDB_INFO * | hdb_info, | |
| char * | hash, | |||
| TSK_HDB_FLAG_ENUM | flags, | |||
| TSK_HDB_LOOKUP_FN | action, | |||
| void * | ptr | |||
| ) |
Perform the binary search in the index for the text/ASCII hash value.
| hdb_info | Hash database state information | |
| hash | Hash value to search for | |
| flags | ||
| action | Callback function to call for each hash db entry (not called if QUICK flag is given) | |
| ptr | Pointer to data to pass to each callback |
| int8_t tsk_hdb_lookup_raw | ( | TSK_HDB_INFO * | hdb_info, | |
| uint8_t * | hash, | |||
| uint8_t | len, | |||
| TSK_HDB_FLAG_ENUM | flags, | |||
| TSK_HDB_LOOKUP_FN | action, | |||
| void * | ptr | |||
| ) |
Perform the binary search in the index for a hash value given in a raw (non-text) format.
this is a wrapper around the normal lookup function.
| hdb_info | Hash database state information | |
| hash | Array with binary hash value to search for | |
| len | Number of bytes in binary hash value | |
| flags | ||
| action | Callback function to call for each hash db entry (not called if QUICK flag is given) | |
| ptr | Pointer to data to pass to each callback |
| TSK_HDB_INFO* tsk_hdb_open | ( | TSK_TCHAR * | db_file, | |
| TSK_HDB_OPEN_ENUM | flags | |||
| ) |
Open a hash database and index for lookup.
| db_file | Path to database. | |
| flags | Flags for opening the database. |
1.5.1