Closes an open volume system.

Parameters

a_vs Pointer to the open volume system structure.

Referenced by TskVsInfo::close(), and TskAuto::findFilesInVs().

Open a disk image and process the media management system data.

This calls VS specific code to determine the type and collect data.

Parameters

img_info The opened disk image.

offset Byte offset in the disk image to start analyzing from.

type Type of volume system (including auto detect)

Returns

NULL on error.

References TSK_VS_PART_INFO::desc, TSK_VS_INFO::is_backup, TSK_IMG_INFO::itype, TSK_VS_PART_INFO::next, TSK_VS_INFO::part_list, TSK_VS_PART_INFO::start, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_fprintf(), TSK_IMG_TYPE_LOGICAL, tsk_verbose, TSK_VS_TYPE_APFS, TSK_VS_TYPE_BSD, TSK_VS_TYPE_DETECT, TSK_VS_TYPE_DOS, TSK_VS_TYPE_GPT, TSK_VS_TYPE_LVM, TSK_VS_TYPE_MAC, TSK_VS_TYPE_SUN, and TSK_VS_TYPE_UNSUPP.

Referenced by TskAuto::findFilesInVs(), and TskVsInfo::open().

Return handle to a volume in the volume system.

Parameters

a_vs Open volume system

a_idx Index for volume to return (0-based)

Returns

Handle to volume or NULL on error

References TSK_VS_PART_INFO::addr, TSK_VS_PART_INFO::next, TSK_VS_INFO::part_count, TSK_VS_INFO::part_list, tsk_error_reset(), tsk_error_set_errno(), and tsk_error_set_errstr().

Referenced by TskVsInfo::getPart().

Reads data starting at a byte address relative to the start of a VOLUME in a volume system.

Parameters

a_vs_part info Pointer to open volume in a volume system

a_off Byte offset to read from, relative to start of VOLUME in volume system.

a_buf Buffer to store data in

a_len Amount of data to read (in bytes)

Returns

Number of bytes read or -1 on error

References TSK_VS_INFO::block_size, TSK_VS_INFO::img_info, TSK_VS_INFO::offset, TSK_VS_PART_INFO::start, tsk_img_read(), and TSK_VS_PART_INFO::vs.

Referenced by TskVsPartInfo::read().

Reads one or more blocks of data with an address relative to the start of a VOLUME in a volume system.

Parameters

a_vs_part info Pointer to open volume in a volume system

a_addr Block address to start reading from, relative to start of VOLUME in volume system.

a_buf Buffer to store data in

a_len Amount of data to read (in bytes - must be a multiple of block_size)

Returns

Number of bytes read or -1 on error

References TSK_VS_INFO::block_size, TSK_VS_INFO::img_info, TSK_VS_INFO::offset, PRIuSIZE, TSK_VS_PART_INFO::start, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_img_read(), and TSK_VS_PART_INFO::vs.

Referenced by TskVsPartInfo::readBlock().

Walk a range of partitions and pass the data to a callback function.

Parameters

a_vs Pointer to open volume system

a_start Address of first partition to walk from.

a_last Address of last partition to walk to.

a_flags Flags that are used to identify which of the partitions in the range should be returned (if 0, all partitions will be returned).

a_action Callback action to call for each partition.

a_ptr Pointer to data that will be passed to callback.

Returns

1 on error and 0 on success

References TSK_VS_PART_INFO::addr, TSK_VS_PART_INFO::flags, TSK_VS_PART_INFO::next, TSK_VS_INFO::part_count, TSK_VS_INFO::part_list, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), TSK_VS_PART_FLAG_ALLOC, TSK_VS_PART_FLAG_META, TSK_VS_PART_FLAG_UNALLOC, TSK_WALK_CONT, TSK_WALK_ERROR, and TSK_WALK_STOP.

Referenced by TskAuto::findFilesInVs(), and TskVsInfo::vsPartWalk().

Reads one or more blocks of data with an address relative to the start of the volume system.

Parameters

a_vs Pointer to open volume system

a_addr Sector address to read from, relative to start of VOLUME SYSTEM.

a_buf Buffer to store data in

a_len Amount of data to read (in bytes - must be a multiple of block_size)

Returns

Number of bytes read or -1 on error

References TSK_VS_INFO::block_size, TSK_VS_INFO::img_info, TSK_VS_INFO::offset, PRIuSIZE, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), and tsk_img_read().

Referenced by TskVsInfo::readBlock().

Print the supported volume system type names to an open handle.

Parameters

hFile Handle to print to.

References tsk_fprintf().

Referenced by TskVsInfo::typePrint().

Return the supported volume system types.

Returns

The bit in the return value is 1 if the type is supported.

Referenced by TskVsInfo::typeSupported().

Return the string description of a partition type ID.

Parameters

type Volume system type

Returns

description of type or NULL on error

Referenced by TskVsInfo::typeToDesc().

Parse a string with the volume system type and return its internal ID.

Parameters

str String to parse.

Returns

ID of string (or unsupported if the name is unknown)

References tsk_vs_type_toid_utf8().

Referenced by TskVsInfo::typeToId().

Parse a string with the volume system type and return its internal ID.

Parameters

str String to parse (always in UTF-8).

Returns

ID of string (or unsupported if the name is unknown)

References TSK_VS_TYPE_UNSUPP.

Referenced by tsk_vs_type_toid().

Return the string name of a partition type ID.

Parameters

type Volume system type

Returns

name of type or NULL on error

References TSK_VS_TYPE_DBFILLER.

Referenced by TskVsInfo::typeToName().