The Sleuth Kit: TSK_FS_ATTR_RUN Struct Reference

The Sleuth Kit 4.13.0

Public Attributes | List of all members

TSK_FS_ATTR_RUN Struct Reference

Holds information about a single data run, which has a starting address and length. More...

#include <tsk_fs.h>

Public Attributes

TSK_DADDR_T addr

Starting block address (in file system) of run.

TSK_DADDR_T crypto_id

Starting block number used for XTS encryption IV.

TSK_FS_ATTR_RUN_FLAG_ENUM flags

Flags for run.

TSK_DADDR_T len

Number of blocks in run (0 when entry is not in use)

TSK_FS_ATTR_RUN * next

Pointer to the next run in the attribute (or NULL)

TSK_DADDR_T offset

Offset (in blocks) of this run in the file.

Detailed Description

Holds information about a single data run, which has a starting address and length.

A run describes a consecutive list of blocks that have been allocated to a file. A file may have many such runs and they are stringed together in a linked list. The entries in the list must be stored in sequential order (based on offset in file).

The documentation for this struct was generated from the following file:

tsk/fs/tsk_fs.h

Copyright © 2007-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.