The Sleuth Kit: C Base TSK Library Functions

fprintf wrapper function that takes UTF-8 strings as input (on all platforms) and does what is necessary to output strings in the correct encoding (UTF-8 on Unix and UTF-16 on Windows). More...

uint8_t tsk_list_add (TSK_LIST **a_tsk_list_head, uint64_t a_key)

Add an entry to a TSK_LIST (and create one if one does not exist) More...

uint8_t tsk_list_find (TSK_LIST *a_tsk_list_head, uint64_t a_key)

Search a TSK_LIST for the existence of a value. More...

void tsk_list_free (TSK_LIST *a_tsk_list_head)

Free a TSK_LIST. More...

void TSK_MD5_Final (TSK_MD5_CTX *context, unsigned char digest[16])

Calculate the MD5 hash of the data added to this context. More...

void TSK_MD5_Init (TSK_MD5_CTX *context)

Initialize a MD5 context structure so that data can be added to it. More...

void TSK_MD5_Update (TSK_MD5_CTX *context, const unsigned char *input, unsigned int inputLen)

Add data to an initialized MD5 operation. More...

TSK_OFF_T tsk_parse_offset (const TSK_TCHAR *a_offset_str)

Parse a TSK_TCHAR block address string. More...

int tsk_parse_pnum (const TSK_TCHAR *a_pnum_str, TSK_PNUM_T *a_pnum)

Parse a TSK_TCHAR string of a partition byte offset and the integer version of it. More...

int tsk_print_sanitized (FILE *fd, const char *str)

Prints the string removing control characters. More...

void tsk_printf (const char *msg,...)

printf wrapper function that takes UTF-8 strings as input (on all platforms) and does what is necessary to output strings in the correct encoding (UTF-8 on Unix and UTF-16 on Windows). More...

void TSK_SHA_Final (TSK_SHA_CTX *shsInfo, BYTE *output)

Calculate the hash of the data added to the context. More...

void TSK_SHA_Init (TSK_SHA_CTX *shsInfo)

Initialize a SHA-1 context so that data can be added to it. More...

void TSK_SHA_Update (TSK_SHA_CTX *shsInfo, const BYTE *buffer, unsigned int count)

Add data to an initialized SHA-1 context. More...

TSK_STACK * tsk_stack_create ()

Create a TSK_STACK structure. More...

uint8_t tsk_stack_find (TSK_STACK *a_tsk_stack, uint64_t a_val)

Search a TSK_STACK for a given value. More...

void tsk_stack_free (TSK_STACK *a_tsk_stack)

Free an allocated TSK_STACK structure. More...

void tsk_stack_pop (TSK_STACK *a_tsk_stack)

Pop a value from the top of the stack. More...

uint8_t tsk_stack_push (TSK_STACK *a_tsk_stack, uint64_t a_val)

Push a value to the top of TSK_STACK. More...

TSKConversionResult tsk_UTF16toUTF8 (TSK_ENDIAN_ENUM endian, const UTF16 **sourceStart, const UTF16 *sourceEnd, UTF8 **targetStart, UTF8 *targetEnd, TSKConversionFlags flags)

Convert a UTF-16 string to UTF-8. More...

TSKConversionResult tsk_UTF16toUTF8_lclorder (const UTF16 **sourceStart, const UTF16 *sourceEnd, UTF8 **targetStart, UTF8 *targetEnd, TSKConversionFlags flags)

Convert a UTF-16 string in local endian ordering to UTF-8. More...

TSKConversionResult tsk_UTF8toUTF16 (const UTF8 **sourceStart, const UTF8 *sourceEnd, UTF16 **targetStart, UTF16 *targetEnd, TSKConversionFlags flags)

Convert a UTF-8 string to UTF-16 (in local endian ordering). More...

const char * tsk_version_get_str ()

Return the library version as a string. More...

void tsk_version_print (FILE *hFile)

Print the library name and version to a handle (such as "The Sleuth Kit ver 1.00"). More...

Detailed Description

Function Documentation

void tsk_error_errstr2_concat ( const char * format,

...

)

Concatenate a message onto the end of the errstr2.

Parameters: format

Referenced by btrfs_open(), and fatfs_inode_walk().

const char* tsk_error_get ( )

Return the string with the current error message.

Return a human-readable form of tsk_error_get_errno.

The string does not end with a newline.

Returns: String with error message or NULL if there is no error

Referenced by TskError::get(), and tsk_error_print().

uint32_t tsk_error_get_errno ( )

Return the current error number.

Returns: the current error number.

Referenced by TskAuto::findFilesInVs(), TskAuto::registerError(), tsk_error_print(), and tsk_fs_open_img_decrypt().

char* tsk_error_get_errstr ( )

Retrieve the current, basic error string.

Additional information is in errstr2. Use tsk_error_get() to get a fully formatted string.

Returns: the string. This is only valid until the next call to a tsk function.

Referenced by TskIsImageSupported::getMessageForIsImageSupportedNat(), TskAuto::registerError(), and tsk_fs_open_img_decrypt().

char* tsk_error_get_errstr2 ( )

Retrieve the current error string #2.

This has additional information than string #1.

Returns: the string. This is only valid until the next call to a tsk function.

Referenced by TskAuto::registerError().

void tsk_error_print ( FILE * hFile )

Print the current fully formed error message to a file.

Parameters: hFile File to print message to

References tsk_error_get(), tsk_error_get_errno(), and tsk_fprintf().

Referenced by fatfs_inode_walk(), fatfs_istat(), fatxxfs_dent_parse_buf(), TskError::print(), and tsk_fs_dir_get().

void tsk_error_set_errno ( uint32_t t_errno )

Set the current TSK error number.

Parameters: t_errno the error number.

Referenced by TskAutoDb::addFilesInImgToDb(), TskAutoDb::commitAddImage(), TskAuto::enableImageWriter(), encase_make_index(), fatfs_inode_walk(), fatxxfs_dent_parse_buf(), TskAuto::findFilesInFs(), TskAuto::findFilesInFsRet(), TskAuto::findFilesInImg(), TskAuto::findFilesInPool(), TskAuto::findFilesInVs(), TskDbSqlite::getFsInfos(), TskDbSqlite::getVsInfos(), TskDbSqlite::getVsPartInfos(), TskAuto::hasPool(), hdb_binsrch_idx_finalize(), hdb_binsrch_idx_initialize(), hdb_binsrch_lookup_bin(), hdb_binsrch_lookup_str(), hk_getentry(), hk_makeindex(), idxonly_open(), md5sum_makeindex(), TskCaseDb::newDb(), nsrl_makeindex(), TskCaseDb::openDb(), TskAutoDb::revertAddImage(), TskAutoDb::startAddImage(), tsk_fs_attr_read(), tsk_fs_attr_walk(), tsk_fs_blkcat(), tsk_fs_block_get_flag(), tsk_fs_block_walk(), tsk_fs_dir_get(), tsk_fs_dir_get_name(), tsk_fs_dir_getsize(), tsk_fs_dir_open(), tsk_fs_file_attr_get_id(), tsk_fs_file_get_owner_sid(), tsk_fs_file_hash_calc(), tsk_fs_file_open(), tsk_fs_file_open_meta(), tsk_fs_file_read(), tsk_fs_file_read_type(), tsk_fs_file_walk(), tsk_fs_file_walk_type(), tsk_fs_ifind_path(), tsk_fs_open_img_decrypt(), tsk_fs_open_vol_decrypt(), tsk_fs_path2inum(), tsk_fs_read_block_decrypt(), tsk_fs_read_decrypt(), tsk_hdb_accepts_updates(), tsk_hdb_add_entry(), tsk_hdb_begin_transaction(), tsk_hdb_close(), tsk_hdb_commit_transaction(), tsk_hdb_create(), tsk_hdb_has_idx(), tsk_hdb_is_idx_only(), tsk_hdb_lookup_raw(), tsk_hdb_lookup_str(), tsk_hdb_make_index(), tsk_hdb_open(), tsk_hdb_rollback_transaction(), tsk_img_open_external(), tsk_img_read(), tsk_ntfs_usnjentry_walk(), tsk_ntfs_usnjopen(), tsk_parse_offset(), tsk_parse_pnum(), tsk_vs_open(), tsk_vs_part_get(), tsk_vs_part_read_block(), tsk_vs_part_walk(), and tsk_vs_read_block().

void tsk_error_set_errstr ( const char * format,

...

)

Set the error string #1.

This should contain the basic message.

Parameters: format the printf-style format string

void tsk_error_set_errstr2 ( const char * format,

...

)

Set the error string #2.

This is called by methods who encounter the error, but did not set errno.

Parameters: format the printf-style format string

Referenced by btrfs_open(), encase_make_index(), fatfs_inode_walk(), TskAuto::findFilesInFs(), TskAuto::findFilesInFsRet(), TskAuto::findFilesInPool(), hdb_binsrch_idx_finalize(), hdb_binsrch_lookup_str(), hk_makeindex(), md5sum_makeindex(), nsrl_makeindex(), TskAutoDb::startAddImage(), and tsk_fs_attr_read().

void tsk_error_vset_errstr ( const char * format,

va_list args

)

Set the error string.

Parameters: format the printf-style format string

args the printf-style args

void tsk_error_vset_errstr2 ( const char * format,

va_list args

)

Set the error string.

Parameters: format the printf-style format string

args the printf-style format args

void tsk_fprintf ( FILE * fd,

const char * msg,

...

)

fprintf wrapper function that takes UTF-8 strings as input (on all platforms) and does what is necessary to output strings in the correct encoding (UTF-8 on Unix and UTF-16 on Windows).

Parameters: fd File to print to

msg printf message

Referenced by btrfs_open(), TskAutoDb::commitAddImage(), fatfs_inode_walk(), fatfs_istat(), fatxxfs_dent_parse_buf(), fatxxfs_istat_attr_flags(), hdb_binsrch_idx_finalize(), TskAutoDb::processFile(), TskAutoDb::revertAddImage(), TskAutoDb::startAddImage(), TskAutoDb::stopAddImage(), tsk_error_print(), tsk_fs_file_walk(), tsk_fs_file_walk_type(), tsk_fs_open_img_decrypt(), tsk_fs_path2inum(), tsk_fs_type_print(), tsk_img_type_print(), tsk_ntfs_usnjopen(), tsk_print_sanitized(), tsk_version_print(), tsk_vs_open(), and tsk_vs_type_print().

uint8_t tsk_list_add ( TSK_LIST ** a_tsk_list_head,

uint64_t a_key

)

Add an entry to a TSK_LIST (and create one if one does not exist)

Parameters: a_tsk_list_head Pointer to pointer for head of list (can point to NULL if no list exists).

a_key Value to add to list

Returns: 1 on error

References TSK_LIST::key, TSK_LIST::len, and TSK_LIST::next.

uint8_t tsk_list_find ( TSK_LIST * a_tsk_list_head,

uint64_t a_key

)

Search a TSK_LIST for the existence of a value.

Parameters: a_tsk_list_head Head of list to search

a_key Value to search for

Returns: 1 if value is found and 0 if not

References TSK_LIST::key, TSK_LIST::len, and TSK_LIST::next.

void tsk_list_free ( TSK_LIST * a_tsk_list_head )

Free a TSK_LIST.

Parameters: a_tsk_list_head Head of list to free

References TSK_LIST::next.

void TSK_MD5_Final ( TSK_MD5_CTX * context,

unsigned char digest[16]

)

Calculate the MD5 hash of the data added to this context.

Context will be zeroed after this call.

Parameters: context Context that has data added to it.

digest Buffer to store MD5 value in.

References TSK_MD5_Update().

Referenced by tsk_fs_file_hash_calc().

void TSK_MD5_Init ( TSK_MD5_CTX * context )

Initialize a MD5 context structure so that data can be added to it.

Parameters: context Pointer to context to initialize

Referenced by tsk_fs_file_hash_calc().

void TSK_MD5_Update ( TSK_MD5_CTX * context,

const unsigned char * input,

unsigned int inputLen

)

Add data to an initialized MD5 operation.

Parameters: context Initialized context to add data to

input Buffer of data to process

inputLen Number of bytes in input

Referenced by TSK_MD5_Final().

TSK_OFF_T tsk_parse_offset ( const TSK_TCHAR * a_offset_str )

Parse a TSK_TCHAR block address string.

Note that the cnt@size format is no longer supported. Set the device sector size in img_open to set the block size.

Parameters: [in] a_offset_str The string version of the offset

Returns: -1 on error or block offset on success

References PRIttocTSK, tsk_error_reset(), tsk_error_set_errno(), and tsk_error_set_errstr().

int tsk_parse_pnum ( const TSK_TCHAR * a_pnum_str,

TSK_PNUM_T * a_pnum

)

Parse a TSK_TCHAR string of a partition byte offset and the integer version of it.

Parameters: [in] a_pnum_str The string version of the address

[out] a_pnum The parsed integer version of the address

Returns: 1 on error and 0 on success

References PRIttocTSK, tsk_error_reset(), tsk_error_set_errno(), and tsk_error_set_errstr().

int tsk_print_sanitized ( FILE * fd,

const char * str

)

Prints the string removing control characters.

Parameters: fd File to print to

str string to be printed

Returns: 0 on success and 1 on error

References tsk_fprintf().

void tsk_printf ( const char * msg,

...

)

printf wrapper function that takes UTF-8 strings as input (on all platforms) and does what is necessary to output strings in the correct encoding (UTF-8 on Unix and UTF-16 on Windows).

Parameters: msg printf message

Referenced by tsk_fs_blkcat().

void TSK_SHA_Final ( TSK_SHA_CTX * shsInfo,

BYTE * output

)

Calculate the hash of the data added to the context.

Parameters: shsInfo Context that has data added to it.

output Buffer to store hash value

Referenced by tsk_fs_file_hash_calc().

void TSK_SHA_Init ( TSK_SHA_CTX * shsInfo )

Initialize a SHA-1 context so that data can be added to it.

Parameters: shsInfo Pointer to context structure to initialize

Referenced by tsk_fs_file_hash_calc().

void TSK_SHA_Update ( TSK_SHA_CTX * shsInfo,

const BYTE * buffer,

unsigned int count

)

Add data to an initialized SHA-1 context.

Parameters: shsInfo Context to add data to

buffer Data to process

count Number of bytes in buffer

TSK_STACK* tsk_stack_create ( )

Create a TSK_STACK structure.

Returns: Pointer to structure or NULL on error

References TSK_STACK::len, TSK_STACK::top, and TSK_STACK::vals.

uint8_t tsk_stack_find ( TSK_STACK * a_tsk_stack,

uint64_t a_val

)

Search a TSK_STACK for a given value.

Parameters: a_tsk_stack Stack to search

a_val Value to search for

Returns: 1 if found and 0 if not

References TSK_STACK::top, and TSK_STACK::vals.

void tsk_stack_free ( TSK_STACK * a_tsk_stack )

Free an allocated TSK_STACK structure.

Parameters: a_tsk_stack Stack to free

References TSK_STACK::vals.

void tsk_stack_pop ( TSK_STACK * a_tsk_stack )

Pop a value from the top of the stack.

Parameters: a_tsk_stack Stack to pop from

References TSK_STACK::top.

uint8_t tsk_stack_push ( TSK_STACK * a_tsk_stack,

uint64_t a_val

)

Push a value to the top of TSK_STACK.

Parameters: a_tsk_stack Pointer to stack to push onto

a_val Value to push on

Returns: 1 on error

References TSK_STACK::len, TSK_STACK::top, and TSK_STACK::vals.

TSKConversionResult tsk_UTF16toUTF8 ( TSK_ENDIAN_ENUM endian,

const UTF16 ** sourceStart,

const UTF16 * sourceEnd,

UTF8 ** targetStart,

UTF8 * targetEnd,

TSKConversionFlags flags

)

Convert a UTF-16 string to UTF-8.

Parameters: endian Endian ordering flag of UTF-16 text

sourceStart Pointer to pointer to start of UTF-16 string. Will be updated to last char processed.

sourceEnd Pointer to one entry past end of UTF-16 string

targetStart Pointer to pointer to place where UTF-8 string should be written. Will be updated to next place to write to.

targetEnd Pointer to end of UTF-8 buffer

flags Flags used during conversion

Returns: error code

References TSKconversionOK, TSKsourceExhausted, TSKsourceIllegal, TSKstrictConversion, and TSKtargetExhausted.

Referenced by fatxxfs_dent_parse_buf().

TSKConversionResult tsk_UTF16toUTF8_lclorder ( const UTF16 ** sourceStart,

const UTF16 * sourceEnd,

UTF8 ** targetStart,

UTF8 * targetEnd,

TSKConversionFlags flags

)

Convert a UTF-16 string in local endian ordering to UTF-8.

Parameters: sourceStart Pointer to pointer to start of UTF-16 string. Will be updated to last char processed.

sourceEnd Pointer to one entry past end of UTF-16 string

targetStart Pointer to pointer to place where UTF-8 string should be written. Will be updated to next place to write to.

targetEnd Pointer to end of UTF-8 buffer

flags Flags used during conversion

Returns: error code

References TSKconversionOK, TSKsourceExhausted, TSKsourceIllegal, TSKstrictConversion, and TSKtargetExhausted.

Referenced by tsk_fs_ifind_path().

TSKConversionResult tsk_UTF8toUTF16 ( const UTF8 ** sourceStart,

const UTF8 * sourceEnd,

UTF16 ** targetStart,

UTF16 * targetEnd,

TSKConversionFlags flags

)

Convert a UTF-8 string to UTF-16 (in local endian ordering).

Parameters: sourceStart Pointer to pointer to start of UTF-8 string. Will be updated to last char processed.

sourceEnd Pointer to one entry past end of UTF-8 string

targetStart Pointer to pointer to place where UTF-16 string should be written. Will be updated to next place to write to.

targetEnd Pointer to end of UTF-16 buffer

flags Flags used during conversion

Returns: error code

References TSKconversionOK, TSKsourceExhausted, TSKsourceIllegal, TSKstrictConversion, and TSKtargetExhausted.

Referenced by TskAuto::enableImageWriter().

const char* tsk_version_get_str ( )

Return the library version as a string.

Returns: String version of version (1.00 for example)

References TSK_VERSION_STR.

void tsk_version_print ( FILE * hFile )

Print the library name and version to a handle (such as "The Sleuth Kit ver 1.00").

Parameters: hFile Handle to print to

References tsk_fprintf(), and TSK_VERSION_STR.