#include "fs_tools.h"
#include <time.h>
#include <locale.h>
#include <sys/fcntl.h>
#include <sys/time.h>
Go to the source code of this file.
Data Structures | |
| struct | TSK_FS_LOAD_FILE |
Defines | |
| #define | NBBY 8 |
| #define | isset(a, i) (((uint8_t *)(a))[(i)/NBBY] & (1<<((i)%NBBY))) |
| #define | setbit(a, i) (((uint8_t *)(a))[(i)/NBBY] |= (1<<((i)%NBBY))) |
| #define | tsk_fs_guessu16(fs, x, mag) tsk_guess_end_u16(&(fs->endian), (x), (mag)) |
| #define | tsk_fs_guessu32(fs, x, mag) tsk_guess_end_u32(&(fs->endian), (x), (mag)) |
Functions | |
| uint8_t | tsk_fs_load_file_action (TSK_FS_INFO *, DADDR_T, char *, size_t, TSK_FS_BLOCK_FLAG_ENUM, void *) |
| TSK_FS_INFO * | ext2fs_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM, uint8_t) |
| Open part of a disk image as a Ext2/3 file system. | |
| TSK_FS_INFO * | fatfs_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM, uint8_t) |
| Open part of a disk image as a FAT file system. | |
| TSK_FS_INFO * | ffs_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM) |
| Open part of a disk image as a FFS/UFS file system. | |
| TSK_FS_INFO * | ntfs_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM, uint8_t) |
| Open part of a disk image as an NTFS file system. | |
| TSK_FS_INFO * | rawfs_open (TSK_IMG_INFO *, SSIZE_T) |
| Open part of a disk image as a raw file system -- which basically means that it has no file system structure. | |
| TSK_FS_INFO * | swapfs_open (TSK_IMG_INFO *, SSIZE_T) |
| Open part of a disk image as "swap" space. | |
| TSK_FS_INFO * | iso9660_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM, uint8_t) |
| TSK_FS_INFO * | hfs_open (TSK_IMG_INFO *, SSIZE_T, TSK_FS_INFO_TYPE_ENUM, uint8_t) |
| TSK_FS_INFO* ext2fs_open | ( | TSK_IMG_INFO * | img_info, | |
| SSIZE_T | offset, | |||
| TSK_FS_INFO_TYPE_ENUM | ftype, | |||
| uint8_t | test | |||
| ) |
Open part of a disk image as a Ext2/3 file system.
| img_info | Disk image to analyze | |
| offset | Byte offset where file system starts | |
| ftype | Specific type of file system | |
| test | NOT USED |
| TSK_FS_INFO* fatfs_open | ( | TSK_IMG_INFO * | img_info, | |
| SSIZE_T | offset, | |||
| TSK_FS_INFO_TYPE_ENUM | ftype, | |||
| uint8_t | test | |||
| ) |
Open part of a disk image as a FAT file system.
| img_info | Disk image to analyze | |
| offset | Byte offset where FAT file system starts | |
| ftype | Specific type of FAT file system | |
| test | NOT USED |
| TSK_FS_INFO* ffs_open | ( | TSK_IMG_INFO * | img_info, | |
| SSIZE_T | offset, | |||
| TSK_FS_INFO_TYPE_ENUM | ftype | |||
| ) |
Open part of a disk image as a FFS/UFS file system.
| img_info | Disk image to analyze | |
| offset | Byte offset where file system starts | |
| ftype | Specific type of file system |
| TSK_FS_INFO* ntfs_open | ( | TSK_IMG_INFO * | img_info, | |
| SSIZE_T | offset, | |||
| TSK_FS_INFO_TYPE_ENUM | ftype, | |||
| uint8_t | test | |||
| ) |
Open part of a disk image as an NTFS file system.
| img_info | Disk image to analyze | |
| offset | Byte offset where NTFS file system starts | |
| ftype | Specific type of NTFS file system | |
| test | NOT USED |
| TSK_FS_INFO* rawfs_open | ( | TSK_IMG_INFO * | img_info, | |
| SSIZE_T | offset | |||
| ) |
Open part of a disk image as a raw file system -- which basically means that it has no file system structure.
The data is considered to be in 512-byte sectors.
| img_info | Disk image to analyze | |
| offset | Byte offset where "file system" starts |
| TSK_FS_INFO* swapfs_open | ( | TSK_IMG_INFO * | img_info, | |
| SSIZE_T | offset | |||
| ) |
Open part of a disk image as "swap" space.
This assumes no structure exists. Data are organized into 4096-byte pages.
| img_info | Disk image to analyze | |
| offset | Byte offset where swap space starts. |
1.5.1