#include "fs_tools_i.h"
#include "ffs.h"
Data Structures | |
| struct | FFS_PRINT_ADDR |
Defines | |
| #define | FFS_INDIR_SIZ 64 |
Functions | |
| uint8_t | ffs_inode_walk (TSK_FS_INFO *fs, INUM_T start_inum, INUM_T end_inum, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB action, void *ptr) |
| uint8_t | ffs_block_walk (TSK_FS_INFO *fs, DADDR_T start_blk, DADDR_T end_blk, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB action, void *ptr) |
| uint8_t | ffs_file_walk (TSK_FS_INFO *fs, TSK_FS_INODE *inode, uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB action, void *ptr) |
| Calls a callback function with the contents of each block in a file. | |
| uint8_t | ffs_jopen (TSK_FS_INFO *fs, INUM_T inum) |
| uint8_t | ffs_jentry_walk (TSK_FS_INFO *fs, int flags, TSK_FS_JENTRY_WALK_CB action, void *ptr) |
| uint8_t | ffs_jblk_walk (TSK_FS_INFO *fs, DADDR_T start, DADDR_T end, int flags, TSK_FS_JBLK_WALK_CB action, void *ptr) |
| TSK_FS_INFO * | ffs_open (TSK_IMG_INFO *img_info, SSIZE_T offset, TSK_FS_INFO_TYPE_ENUM ftype) |
| Open part of a disk image as a FFS/UFS file system. | |
| uint8_t ffs_file_walk | ( | TSK_FS_INFO * | fs, | |
| TSK_FS_INODE * | inode, | |||
| uint32_t | type, | |||
| uint16_t | id, | |||
| TSK_FS_FILE_FLAG_ENUM | flags, | |||
| TSK_FS_FILE_WALK_CB | action, | |||
| void * | ptr | |||
| ) |
Calls a callback function with the contents of each block in a file.
flag values: TSK_FS_FILE_FLAG_NOSPARSE, TSK_FS_FILE_FLAG_AONLY, TSK_FS_FILE_FLAG_SLACK TSK_FS_FILE_FLAG_META
If TSK_FS_FILE_FLAG_RECOVER is set, then most error codes are set to _RECOVER. No special recovery logic exists in this code.
The action will use the flags: TSK_FS_BLOCK_FLAG_CONT, TSK_FS_BLOCK_FLAG_META -- @@ Currently do not do _ALLOC and _UNALLOC
| fs | File system file is located in | |
| inode | File to read and analyze | |
| type | Attribute type to read and analyze (does not apply to FFS) | |
| id | Attribute id to read and analyze (does not apply to FFS) | |
| flags | Flags to use while reading | |
| action | Callback function that is called for each block | |
| ptr | Pointer to data that is passed to the callback |
| TSK_FS_INFO* ffs_open | ( | TSK_IMG_INFO * | img_info, | |
| SSIZE_T | offset, | |||
| TSK_FS_INFO_TYPE_ENUM | ftype | |||
| ) |
Open part of a disk image as a FFS/UFS file system.
| img_info | Disk image to analyze | |
| offset | Byte offset where file system starts | |
| ftype | Specific type of file system |
1.5.1