The Sleuth Kit: TskFsAttrRun Class Reference

The Sleuth Kit 4.13.0

Public Member Functions | List of all members

TskFsAttrRun Class Reference

C++ File System Classes

Contains information about a single data run, which has a starting address and length. More...

#include <tsk_fs.h>

Public Member Functions

TSK_DADDR_T getAddr () const

get starting block address (in file system) of run More...

TSK_FS_ATTR_RUN_FLAG_ENUM getFlags () const

get flags for run More...

TSK_DADDR_T getOffset () const

get offset (in blocks) of this run in the file More...

TSK_DADDR_T length () const

get number of blocks in run (0 when entry is not in use) More...

TskFsAttrRun (TSK_FS_ATTR_RUN *a_fsAttrRun)

construct a TskFsAttrRun object. More...

Detailed Description

Contains information about a single data run, which has a starting address and length.

A run describes a consecutive list of blocks that have been allocated to a file. A file may have many such runs and they are stringed together in a linked list. The entries in the list must be stored in sequential order (based on offset in file). See TSK_FS_ATTR_RUN for more details.

Constructor & Destructor Documentation

TskFsAttrRun::TskFsAttrRun ( TSK_FS_ATTR_RUN * a_fsAttrRun )

inline

construct a TskFsAttrRun object.

Parameters: a_fsAttrRun pointer of TSK_FS_ATTR_RUN. If NULL, then the getX() method return values are undefined.

Member Function Documentation

TSK_DADDR_T TskFsAttrRun::getAddr ( ) const

inline

get starting block address (in file system) of run

Returns: starting block address

References TSK_FS_ATTR_RUN::addr.

TSK_FS_ATTR_RUN_FLAG_ENUM TskFsAttrRun::getFlags ( ) const

inline

get flags for run

Returns: flags for run

References TSK_FS_ATTR_RUN::flags.

TSK_DADDR_T TskFsAttrRun::getOffset ( ) const

inline

get offset (in blocks) of this run in the file

Returns: offset of run

References TSK_FS_ATTR_RUN::offset.

TSK_DADDR_T TskFsAttrRun::length ( ) const

inline

get number of blocks in run (0 when entry is not in use)

Returns: offset

References TSK_FS_ATTR_RUN::len.

The documentation for this class was generated from the following file:

tsk/fs/tsk_fs.h

Copyright © 2007-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.