The Sleuth Kit: TskFsBlock Class Reference

Must be created by either allocating an empty block and opening one or by passing in a TSK_FS_BLOCK struct. If NULL is passed to the constructor and open() is not called, the other methods return undefined data. See TSK_FS_BLOCK for more details.

Constructor & Destructor Documentation

TskFsBlock::TskFsBlock ( const TSK_FS_BLOCK * a_fsBlock )

inline

construct a TskFsBlock using a TSK_FS_BLOCK structure

Parameters: a_fsBlock a pointer of TSK_FS_BLOCK. If NULL, the getX() methods return undefined data.

TskFsBlock::TskFsBlock ( )

inline

default constructor to construct a TskFsBlock.

Must call open() before using other methods.

TskFsBlock::~TskFsBlock ( )

inline

Free the memory associated with the TSK_FS_BLOCK structure.

See tsk_fs_block_free() for details

References tsk_fs_block_free().

Member Function Documentation

TSK_DADDR_T TskFsBlock::getAddr ( ) const

inline

Get address of block.

Returns: address of block

References TSK_FS_BLOCK::addr.

const char* TskFsBlock::getBuf ( ) const

inline

Get buffer with block data (of size TSK_FS_INFO::block_size)

Returns: buffer with block data

References TSK_FS_BLOCK::buf.

TSK_FS_BLOCK_FLAG_ENUM TskFsBlock::getFlags ( ) const

inline

Get flags for block (alloc or unalloc)

Returns: flags for block

uint8_t TskFsBlock::open ( TskFsInfo * a_fs,

TSK_DADDR_T a_addr

)

inline

Open a block (use only if created with default constructor).

Parameters: a_fs The file system to read the block from.

a_addr The file system address to read.

Returns: 1 on error and 0 on success.

The documentation for this class was generated from the following file:

tsk/fs/tsk_fs.h