The Sleuth Kit: TskFsMeta Class Reference

The Sleuth Kit 4.13.0

Public Member Functions | List of all members

TskFsMeta Class Reference

C++ File System Classes

Stores metadata about a file. More...

#include <tsk_fs.h>

Public Member Functions

TSK_INUM_T getAddr () const

get address of the meta data structure for this file More...

time_t getATime () const

get last file content accessed time (stored in number of seconds since Jan 1, 1970 UTC) More...

uint32_t getATimeNano () const

get nano-second resolution of accessed time More...

time_t getBackUpTime () const

get HFS+ backup time More...

uint32_t getBackUpTimeNano () const

get nano-second resolution of HFS+ backup time More...

time_t getCrTime () const

get created time (stored in number of seconds since Jan 1, 1970 UTC) More...

uint32_t getCrTimeNano () const

get nano-second resolution of created time More...

time_t getCTime () const

get last file / metadata status change time (stored in number of seconds since Jan 1, 1970 UTC) More...

uint32_t getCTimeNano () const

get nano-second resolution of change time More...

time_t getDTime () const

get linux deletion time More...

uint32_t getDTimeNano () const

get nano-second resolution of deletion time More...

TSK_FS_META_FLAG_ENUM getFlags () const

get flags for this file for its allocation status etc. More...

TSK_GID_T getGid () const

get group id More...

const char * getLink () const

get name of target file if this is a symbolic link More...

uint8_t getLs (char *a_buf, size_t a_len) const

Makes the "ls -l" permissions string for a file. More...

TSK_FS_META_MODE_ENUM getMode () const

get Unix-style permissions More...

time_t getMTime () const

get last file content modification time (stored in number of seconds since Jan 1, 1970 UTC) More...

uint32_t getMTimeNano () const

get nano-second resolution of modification time More...

const TskFsMetaName * getName2 (int a_idx) const

Return a name that is stored in the metadata. More...

int getName2Count () const

Return the number of names that are stored in the metadata. More...

int getNLink () const

get link count (number of file names pointing to this) More...

uint32_t getSeq () const

get sequence number for file (NTFS only, is incremented when entry is reallocated) More...

TSK_OFF_T getSize () const

get file size (in bytes) More...

TSK_FS_META_TYPE_ENUM getType () const

get file type More...

TSK_UID_T getUid () const

get owner id More...

TskFsMeta (TSK_FS_META *a_fsMeta)

construct a TskFsMeta object. More...

Detailed Description

Stores metadata about a file.

See TSK_FS_META for more details.

Constructor & Destructor Documentation

TskFsMeta::TskFsMeta ( TSK_FS_META * a_fsMeta )

inline

construct a TskFsMeta object.

If NULL is passed as an argument, the getX() behavior is not defined.

Parameters: a_fsMeta a pointer of TSK_FS_META

References TSK_FS_META::name2, and TSK_FS_META_NAME_LIST::next.

Member Function Documentation

TSK_INUM_T TskFsMeta::getAddr ( ) const

inline

get address of the meta data structure for this file

Returns: address of the meta data structure for this file

time_t TskFsMeta::getATime ( ) const

inline

get last file content accessed time (stored in number of seconds since Jan 1, 1970 UTC)

Returns: last file content accessed time

References TSK_FS_META::atime.

uint32_t TskFsMeta::getATimeNano ( ) const

inline

get nano-second resolution of accessed time

Returns: nano-second resolution of accessed time

References TSK_FS_META::atime_nano.

time_t TskFsMeta::getBackUpTime ( ) const

inline

get HFS+ backup time

Returns: HFS+ backup time

uint32_t TskFsMeta::getBackUpTimeNano ( ) const

inline

get nano-second resolution of HFS+ backup time

Returns: nano-second resolution of HFS+ backup time

time_t TskFsMeta::getCrTime ( ) const

inline

get created time (stored in number of seconds since Jan 1, 1970 UTC)

Returns: created time

References TSK_FS_META::crtime.

uint32_t TskFsMeta::getCrTimeNano ( ) const

inline

get nano-second resolution of created time

Returns: nano-second resolution of created time

References TSK_FS_META::crtime_nano.

time_t TskFsMeta::getCTime ( ) const

inline

get last file / metadata status change time (stored in number of seconds since Jan 1, 1970 UTC)

Returns: last file / metadata status change time

References TSK_FS_META::ctime.

uint32_t TskFsMeta::getCTimeNano ( ) const

inline

get nano-second resolution of change time

Returns: nano-second resolution of change time

References TSK_FS_META::ctime_nano.

time_t TskFsMeta::getDTime ( ) const

inline

get linux deletion time

Returns: linux deletion time

uint32_t TskFsMeta::getDTimeNano ( ) const

inline

get nano-second resolution of deletion time

Returns: nano-second resolution of deletion time

TSK_FS_META_FLAG_ENUM TskFsMeta::getFlags ( ) const

inline

get flags for this file for its allocation status etc.

Returns: flags for this file

References TSK_FS_META::flags.

TSK_GID_T TskFsMeta::getGid ( ) const

inline

get group id

Returns: group id

References TSK_FS_META::gid.

const char* TskFsMeta::getLink ( ) const

inline

get name of target file if this is a symbolic link

Returns: name of target file if this is a symbolic link

References TSK_FS_META::link.

uint8_t TskFsMeta::getLs ( char * a_buf,

size_t a_len

) const

inline

Makes the "ls -l" permissions string for a file.

See tsk_fs_meta_make_ls() for details

Parameters: a_buf [out] Buffer to write results to (must be 12 bytes or longer)

a_len Length of buffer

References tsk_fs_meta_make_ls().

TSK_FS_META_MODE_ENUM TskFsMeta::getMode ( ) const

inline

get Unix-style permissions

Returns: Unix-style permissions mode

References TSK_FS_META::mode.

time_t TskFsMeta::getMTime ( ) const

inline

get last file content modification time (stored in number of seconds since Jan 1, 1970 UTC)

Returns: last file content modification time

References TSK_FS_META::mtime.

uint32_t TskFsMeta::getMTimeNano ( ) const

inline

get nano-second resolution of modification time

Returns: nano-second resolution of modification time

References TSK_FS_META::mtime_nano.

const TskFsMetaName* TskFsMeta::getName2 ( int a_idx ) const

inline

Return a name that is stored in the metadata.

Parameters: a_idx Index of the name to return

Returns: NULL on error. Caller must free this memory.

References TSK_FS_META::name2, and TSK_FS_META_NAME_LIST::next.

int TskFsMeta::getName2Count ( ) const

inline

Return the number of names that are stored in the metadata.

Returns: number of names.

References TSK_FS_META::name2, and TSK_FS_META_NAME_LIST::next.

int TskFsMeta::getNLink ( ) const

inline

get link count (number of file names pointing to this)

Returns: link count

References TSK_FS_META::nlink.

uint32_t TskFsMeta::getSeq ( ) const

inline

get sequence number for file (NTFS only, is incremented when entry is reallocated)

Returns: sequence number for file, or 0xFFFF on error.

References TSK_FS_META::seq.

TSK_OFF_T TskFsMeta::getSize ( ) const

inline

get file size (in bytes)

Returns: file size

References TSK_FS_META::size.

TSK_FS_META_TYPE_ENUM TskFsMeta::getType ( ) const

inline

get file type

Returns: file type

References TSK_FS_META::type.

TSK_UID_T TskFsMeta::getUid ( ) const

inline

get owner id

Returns: owner id

References TSK_FS_META::uid.

The documentation for this class was generated from the following file:

tsk/fs/tsk_fs.h