Walk a range of file system blocks and call the callback function with the contents and allocation status of each.

See tsk_fs_block_walk() for details.

Parameters

a_start_blk Block address to start walking from

a_end_blk Block address to walk to

a_flags Flags used during walk to determine which blocks to call callback with

a_action Callback function

a_ptr Pointer that will be passed to callback

Returns

1 on error and 0 on success

References tsk_fs_block_walk().

Close an open file system.

See tsk_fs_close() for details.

References tsk_fs_close().

return number of blocks in fs

Returns

number of blocks in fs

References TSK_FS_INFO::block_count.

return size of each file system block (in bytes)

Returns

size of each block

References TSK_FS_INFO::block_size.

return the "name" of data unit type as a string ("Cluster", for example)

Returns

string "name" of data unit type

References TSK_FS_INFO::duname.

return size of device block (typically always 512)

Returns

size of device block

References TSK_FS_INFO::dev_bsize.

return address of first block

Returns

address of first block

References TSK_FS_INFO::first_block.

return first valid metadata address

Returns

first valid metadata address

References TSK_FS_INFO::first_inum.

return flags for file system

Returns

flags for file system

References TSK_FS_INFO::flags.

return file system id (as reported in boot sector).

Use getFsIdLen() to determine how many byts in buffer are used.

Returns

Buffer with file system id

References TSK_FS_INFO::fs_id.

return the number of bytes used in the buffer returned by getFsId().

Returns

number of bytes used.

References TSK_FS_INFO::fs_id_used.

return type of file system

Returns

type of file system

References TSK_FS_INFO::ftype.

return number of metadata addresses in FS

Returns

number of metatdata addresses

References TSK_FS_INFO::inum_count.

return address of journal inode

Returns

address of journal inode

References TSK_FS_INFO::journ_inum.

return address of last block that is adjusted so that

(could be larger than last_block in image if end of image does not exist)

Returns

address of last block

References TSK_FS_INFO::last_block.

return address of last block as reported by file system

(it is equal to the last block in the image or volume (if image is not complete)

Returns

address of last block

References TSK_FS_INFO::last_block_act.

return last valid metadata address

Returns

last valid metadata address

References TSK_FS_INFO::last_inum.

return byte offset in image that fs starts

Returns

offset in bytes.

References TSK_FS_INFO::offset.

return metadata address of root directory

Returns

metadata address of root directory

References TSK_FS_INFO::root_inum.

Walk a range of metadata structures and call a callback for each structure that matches the flags supplied.

For example, it can call the callback on only allocated or unallocated entries. See tsk_fs_meta_walk() for details

Parameters

a_start Metadata address to start walking from

a_end Metadata address to walk to

a_flags Flags that specify the desired metadata features

a_cb Callback function to call

a_ptr Pointer to pass to the callback

Returns

1 on error and 0 on success

References tsk_fs_meta_walk().

Opens a file system that is inside of a Volume.

Returns a structure that can be used for analysis and reporting. See tsk_fs_open_vol() for details

Parameters

a_part_info Open volume to read from and analyze

a_ftype Type of file system (or autodetect)

Returns

1 on error 0 on success.

References tsk_fs_open_vol().

Opens a file system at a given offset in a disk image.

Returns a structure that can be used for analysis and reporting. See tsk_fs_open_img() for details

Parameters

a_img_info Disk image to analyze

a_offset Byte offset to start analyzing from

a_ftype Type of file system (or autodetect)

Returns

1 on error 0 on success.

References tsk_fs_open_img().

Parse a TSK_TCHAR string of an inode, type, and id pair (not all parts

need to be there).

This assumes the string is either: INUM, INUM-TYPE, or INUM-TYPE-ID. Return the values in integer form. See tsk_fs_parse_inum() for details

Parameters

[in] a_str Input string to parse

[out] a_inum Pointer to location where inode can be stored.

[out] a_type Pointer to location where type can be stored (or NULL)

[out] a_type_used Pointer to location where the value can be set to 1 if the type was set (to differentiate between meanings of 0) (or NULL).

[out] a_id Pointer to location where id can be stored (or NULL)

[out] a_id_used Pointer to location where the value can be set to 1 if the id was set (to differentiate between meanings of 0) (or NULL).

Returns

1 on error or if not an inode and 0 on success

References tsk_fs_parse_inum().

Find the meta data address for a given file name (UTF-8).

See tsk_fs_path2inum() for details

Parameters

a_path UTF-8 path of file to search for

[out] a_result Meta data address of file

[out] a_fs_name Copy of name details (or NULL if details not wanted)

Returns

-1 on (system) error, 0 if found, and 1 if not found

References tsk_fs_path2inum().

Read arbitrary data from inside of the file system.

See tsk_fs_block_free() for details

Parameters

a_off The byte offset to start reading from (relative to start of file system)

a_buf The buffer to store the block in.

a_len The number of bytes to read

Returns

The number of bytes read or -1 on error.

References tsk_fs_read().

Read a file system block.

See tsk_fs_read_block() for details

Parameters

a_addr The starting block file system address.

a_buf The char * buffer to store the block data in.

a_len The number of bytes to read (must be a multiple of the block size)

Returns

The number of bytes read or -1 on error.

References tsk_fs_read_block().

Print the supported file system types to a file handle

See tsk_fs_type_print() for details

Parameters

a_hFile File handle to print to

References tsk_fs_type_print().

Return the supported file system types.

See tsk_fs_type_supported() for details

Returns

The bit in the return value is 1 if the type is supported.

References tsk_fs_type_supported().

Parse a string with the file system type and return its internal ID.

See tsk_fs_type_toid() for details

Parameters

a_str String to parse.

Returns

ID of string (or unsupported if the name is unknown)

References tsk_fs_type_toid().

Return the string name of a file system type id.

See tsk_fs_type_toname() for details

Parameters

a_ftype File system type id

Returns

Name or NULL on error

References tsk_fs_type_toname().