The Sleuth Kit: FATFS_INFO Struct Reference

The Sleuth Kit 4.13.0

FATFS_INFO Struct Reference

Public Attributes

char boot_sector_buffer [FATFS_MASTER_BOOT_RECORD_SIZE]

tsk_lock_t cache_lock

TSK_DADDR_T clustcnt

uint32_t csize

TSK_RETVAL_ENUM(* dent_parse_buf )(FATFS_INFO *a_fatfs, TSK_FS_DIR *a_fs_dir, char *a_buf, TSK_OFF_T a_buf_len, TSK_DADDR_T *a_sector_addrs, int recursion_depth)

uint32_t dentry_cnt_cl

uint32_t dentry_cnt_se

TSK_RETVAL_ENUM(* dinode_copy )(FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FATFS_DENTRY *a_dentry, uint8_t a_cluster_is_alloc, TSK_FS_FILE *a_fs_file)

tsk_lock_t dir_lock

struct {

uint64_t first_sector_of_alloc_bitmap

uint64_t length_of_alloc_bitmap_in_bytes

} EXFATFS_INFO

TSK_INUM_T fat1_virt_inum

TSK_INUM_T fat2_virt_inum

TSK_DADDR_T fatc_addr [FATFS_FAT_CACHE_N]

char fatc_buf [FATFS_FAT_CACHE_N][FATFS_FAT_CACHE_B]

uint8_t fatc_ttl [FATFS_FAT_CACHE_N]

TSK_DADDR_T firstclustsect

TSK_DADDR_T firstdatasect

TSK_DADDR_T firstfatsect

TSK_FS_INFO fs_info

uint8_t(* inode_lookup )(FATFS_INFO *a_fatfs, TSK_FS_FILE *a_fs_file, TSK_INUM_T a_inum)

uint8_t(* inode_walk_should_skip_dentry )(FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FATFS_DENTRY *a_dentry, unsigned int a_selection_flags, int a_cluster_is_alloc)

void * inum2par

int8_t(* is_cluster_alloc )(FATFS_INFO *fatfs, TSK_DADDR_T clust)

uint8_t(* is_dentry )(FATFS_INFO *a_fatfs, FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_cluster_is_alloc, uint8_t a_do_basic_tests_only)

uint8_t(* istat_attr_flags )(FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FILE *a_hFile)

TSK_DADDR_T lastclust

uint32_t mask

TSK_INUM_T mbr_virt_inum

uint8_t numfat

uint16_t numroot

TSK_DADDR_T rootsect

uint32_t sectperfat

uint16_t ssize

uint16_t ssize_sh

TSK_FATFS_SUBTYPE_ENUM subtype

int using_backup_boot_sector

The documentation for this struct was generated from the following file:

tsk/fs/tsk_fatfs.h