Macro that takes a image type and returns 1 if the type is for an AFF file format.

Macro that takes a image type and returns 1 if the type is for a logical directory file format.

Macro that takes a image type and returns 1 if the type is for an EWF file format.

Macro that takes a image type and returns 1 if the type is for a raw file format.

Closes an open disk image.

Parameters

a_img_info Pointer to the open disk image structure.

Referenced by TskAuto::closeImage(), TskAuto::findFilesInPool(), and TskIsImageSupported::getMessageForIsImageSupportedNat().

Opens one or more disk image files so that they can be read.

If a file format type is specified, this function will call the specific routine to open the file. Otherwise, it will detect the type (it will default to raw if no specific type can be detected). This function must be called before a disk image can be read from. Note that the data type used to store the image paths is a TSK_TCHAR, which changes depending on a Unix or Windows build. If you will always have UTF8, then consider using tsk_img_open_utf8().

Parameters

num_img The number of images to open (will be > 1 for split images).

images The path to the image files (the number of files must be equal to num_img and they must be in a sorted order)

type The disk image type (can be autodetection)

a_ssize Size of device sector in bytes (or 0 for default)

Returns

Pointer to TSK_IMG_INFO or NULL on error

Referenced by TskIsImageSupported::getMessageForIsImageSupportedNat(), TskImgInfo::open(), and TskAuto::openImage().

Opens an an image of type TSK_IMG_TYPE_EXTERNAL.

The void pointer parameter must be castable to a TSK_IMG_INFO pointer. It is up to the caller to set the tag value in ext_img_info. This method will initialize the cache lock.

Parameters

ext_img_info Pointer to the partially initialized disk image structure, having a TSK_IMG_INFO as its first member

size Total size of image in bytes

sector_size Sector size of device in bytes

read Pointer to user-supplied read function

close Pointer to user-supplied close function

imgstat Pointer to user-supplied imgstat function

Returns

Pointer to TSK_IMG_INFO or NULL on error

References IMG_INFO::imgstat, TSK_IMG_INFO::itype, TSK_IMG_INFO::sector_size, TSK_IMG_INFO::size, TSK_IMG_INFO::tag, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), and TSK_IMG_TYPE_EXTERNAL.

Opens a single (non-split) disk image file so that it can be read.

This is a wrapper around tsk_img_open(). See it for more details on detection etc. See tsk_img_open_sing_utf8() for a version of this function that always takes UTF-8 as input.

Parameters

a_image The path to the image file

type The disk image type (can be autodetection)

a_ssize Size of device sector in bytes (or 0 for default)

Returns

Pointer to TSK_IMG_INFO or NULL on error

Referenced by TskImgInfo::open().

Opens one or more disk image files so that they can be read.

This is a wrapper around tsk_img_open() and this version always takes a UTF-8 encoding of the image files. See its description for more details.

Parameters

num_img The number of images to open (will be > 1 for split images).

images The path to the UTF-8 encoded image files (the number of files must be equal to num_img and they must be in a sorted order)

type The disk image type (can be autodetection)

a_ssize Size of device sector in bytes (or 0 for default)

Returns

Pointer to TSK_IMG_INFO or NULL on error

Referenced by TskAuto::openImageUtf8().

Opens a single (non-split) disk image file so that it can be read.

This version always takes a UTF-8 encoding of the disk image. See tsk_img_open_sing() for a version that takes a wchar_t or char depending on the platform. This is a wrapper around tsk_img_open(). See it for more details on detection etc.

Parameters

a_image The UTF-8 path to the image file

type The disk image type (can be autodetection)

a_ssize Size of device sector in bytes (or 0 for default)

Returns

Pointer to TSK_IMG_INFO or NULL on error

Reads data from an open disk image.

Parameters

a_img_info Disk image to read from

a_off Byte offset to start reading from

a_buf Buffer to read into

a_len Number of bytes to read into buffer

Returns

-1 on error or number of bytes read

References PRIuSIZE, TSK_IMG_INFO::size, tsk_error_reset(), tsk_error_set_errno(), and tsk_error_set_errstr().

Referenced by TskImgInfo::read(), tsk_fs_block_get_flag(), tsk_fs_read_block_decrypt(), tsk_fs_read_decrypt(), tsk_vs_part_read(), tsk_vs_part_read_block(), and tsk_vs_read_block().

Prints the name and description of the supported image types to a handle.

This is used by the TSK command line tools to print the supported types to the console.

Parameters

hFile Handle to print names and descriptions to.

References tsk_fprintf().

Referenced by TskImgInfo::typePrint().

Returns the supported file format types.

Returns

A bit in the return value is set to 1 if the type is supported.

Referenced by TskImgInfo::typeSupported().

Returns the description of an image format type, given its type ID.

Parameters

type ID of image type

Returns

Pointer to string of the description

Referenced by TskImgInfo::typeToDesc().

Parses a string that specifies an image format to determine the associated type ID.

This is used by the TSK command line tools to parse the type given on the command line.

Parameters

str String of image format type

Returns

ID of image type

References tsk_img_type_toid_utf8().

Referenced by TskImgInfo::typeToId().

Parses a string that specifies an image format to determine the associated type ID.

This is used by the TSK command line tools to parse the type given on the command line.

Parameters

str String of image format type, always UTF-8

Returns

ID of image type

References TSK_IMG_TYPE_UNSUPP.

Referenced by tsk_img_type_toid().

Returns the name of an image format type, given its type ID.

Parameters

type ID of image type

Returns

Pointer to string of the name.

Referenced by TskImgInfo::typeToName().