#include "fs_tools_i.h"
#include "fatfs.h"
Data Structures | |
| struct | FATFS_PRINT_ADDR |
Functions | |
| int8_t | is_clustalloc (FATFS_INFO *fatfs, DADDR_T clust) |
| int8_t | is_sectalloc (FATFS_INFO *fatfs, DADDR_T sect) |
| uint8_t | fatfs_block_walk (TSK_FS_INFO *fs, DADDR_T start_blk, DADDR_T end_blk, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB action, void *ptr) |
| TSK_RETVAL_ENUM | fatfs_dinode_copy (FATFS_INFO *fatfs, TSK_FS_INODE *fs_inode, fatfs_dentry *in, DADDR_T sect, INUM_T inum) |
| Copy the contents of a raw directry entry into a TSK_FS_INFO structure. | |
| uint8_t | fatfs_make_root (FATFS_INFO *fatfs, TSK_FS_INODE *fs_inode) |
| Create an FS_INODE structure for the root directory. | |
| uint8_t | fatfs_isdentry (FATFS_INFO *fatfs, fatfs_dentry *de) |
| uint8_t | fatfs_inode_walk (TSK_FS_INFO *fs, INUM_T start_inum, INUM_T end_inum, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB action, void *ptr) |
| uint8_t | fatfs_file_walk_off (TSK_FS_INFO *fs, TSK_FS_INODE *fs_inode, uint32_t type, uint16_t id, OFF_T a_st_off, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB action, void *ptr) |
| Calls a callback function with the contents of each block in a file. | |
| uint8_t | fatfs_jopen (TSK_FS_INFO *fs, INUM_T inum) |
| uint8_t | fatfs_jentry_walk (TSK_FS_INFO *fs, int flags, TSK_FS_JENTRY_WALK_CB action, void *ptr) |
| uint8_t | fatfs_jblk_walk (TSK_FS_INFO *fs, DADDR_T start, DADDR_T end, int flags, TSK_FS_JBLK_WALK_CB action, void *ptr) |
| TSK_FS_INFO * | fatfs_open (TSK_IMG_INFO *img_info, SSIZE_T offset, TSK_FS_INFO_TYPE_ENUM ftype, uint8_t test) |
| Open part of a disk image as a FAT file system. | |
| TSK_RETVAL_ENUM fatfs_dinode_copy | ( | FATFS_INFO * | fatfs, | |
| TSK_FS_INODE * | fs_inode, | |||
| fatfs_dentry * | in, | |||
| DADDR_T | sect, | |||
| INUM_T | inum | |||
| ) |
Copy the contents of a raw directry entry into a TSK_FS_INFO structure.
| fatfs | File system that directory entry is from | |
| fs_inode | Generic inode structure to copy data into | |
| in | Directory entry to copy data from | |
| sect | Sector address where directory entry is from -- used to determine allocation status. | |
| inum | Address of the inode. |
| uint8_t fatfs_file_walk_off | ( | TSK_FS_INFO * | fs, | |
| TSK_FS_INODE * | fs_inode, | |||
| uint32_t | type, | |||
| uint16_t | id, | |||
| OFF_T | a_st_off, | |||
| TSK_FS_FILE_FLAG_ENUM | flags, | |||
| TSK_FS_FILE_WALK_CB | action, | |||
| void * | ptr | |||
| ) |
Calls a callback function with the contents of each block in a file.
Flags: TSK_FS_FILE_FLAG_SLACK, TSK_FS_FILE_FLAG_AONLY, TSK_FS_FILE_FLAG_RECOVER
no notion of NOSPARSE or META
flags on action: TSK_FS_BLOCK_FLAG_CONT, TSK_FS_BLOCK_FLAG_META, TSK_FS_BLOCK_FLAG_ALLOC, TSK_FS_BLOCK_FLAG_UNALLOC
| fs | File system file is located in | |
| fs_inode | File to read and analyze | |
| type | Attribute type to read and analyze (does not apply to FAT) | |
| id | Attribute id to read and analyze (does not apply to FAT) | |
| a_st_off | Byte offset in the file to start calling the callback on (must be multiple of block size) | |
| flags | Flags to use while reading | |
| action | Callback function that is called for each block | |
| ptr | Pointer to data that is passed to the callback |
| uint8_t fatfs_make_root | ( | FATFS_INFO * | fatfs, | |
| TSK_FS_INODE * | fs_inode | |||
| ) |
Create an FS_INODE structure for the root directory.
FAT does not have a directory entry for the root directory, but this function collects the needed data to make one.
| fatfs | File system to analyze | |
| fs_inode | Inode structure to copy root directory information into. |
| TSK_FS_INFO* fatfs_open | ( | TSK_IMG_INFO * | img_info, | |
| SSIZE_T | offset, | |||
| TSK_FS_INFO_TYPE_ENUM | ftype, | |||
| uint8_t | test | |||
| ) |
Open part of a disk image as a FAT file system.
| img_info | Disk image to analyze | |
| offset | Byte offset where FAT file system starts | |
| ftype | Specific type of FAT file system | |
| test | NOT USED |
1.5.1