Find the corresponding name at the given offset.

The offset was likely determined from the index. The entries in the DB following the one specified are also processed if they have the same hash value and their name is different. The callback is called for each entry.

Note: This routine assumes that &hdb_info->lock is locked by the caller.

Parameters

hdb_info Data base to get data from.

hash MD5 hash value that was searched for

offset Byte offset where hash value should be located in db_file

flags

action Callback used for each entry found in lookup

cb_ptr Pointer to data passed to callback

Returns

1 on error and 0 on success

References TSK_HDB_BINSRCH_INFO::hDb, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), TSK_HDB_FLAG_EXT, TSK_HDB_HTYPE_MD5_LEN, TSK_HDB_MAXLEN, tsk_verbose, TSK_WALK_ERROR, and TSK_WALK_STOP.

Process the database to create a sorted index of it.

Consecutive entries with the same hash value are not added to the index, but will be found during lookup.

Parameters

hdb_info_base Hash database to make index of

dbtype Text of database type (should always be TSK_HDB_DBTYPE_HK_STR)

Returns

1 on error and 0 on success.

References TSK_HDB_INFO::db_fname, TSK_HDB_BINSRCH_INFO::hDb, hdb_binsrch_idx_add_entry_str(), hdb_binsrch_idx_finalize(), hdb_binsrch_idx_initialize(), PRIttocTSK, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_error_set_errstr2(), TSK_HDB_HTYPE_MD5_LEN, TSK_HDB_MAXLEN, and tsk_verbose.

Test the file to see if it is a hashkeeper database.

Parameters

hFile File handle to hash database

Returns

1 if hk and 0 if not

References TSK_HDB_MAXLEN.