The Sleuth Kit: TSK_FS_FILE Struct Reference

The Sleuth Kit 4.13.0

Public Attributes | List of all members

TSK_FS_FILE Struct Reference

Generic structure used to refer to files in the file system. More...

#include <tsk_fs.h>

Public Attributes

TSK_FS_INFO * fs_info

Pointer to file system that the file is located in.

TSK_FS_META * meta

Pointer to metadata of file (or NULL if name has invalid metadata address)

TSK_FS_NAME * name

Pointer to name of file (or NULL if file was opened using metadata address)

int tag

Detailed Description

Generic structure used to refer to files in the file system.

A file will typically have a name and metadata. This structure holds that type of information. When deleted files are being processed, this structure may have the name defined but not metadata because it no longer exists. Or, if you are calling meta_walk and are not processing at the name level, then the name will not be defined. always check these to make sure they are not null before they are read.

The documentation for this struct was generated from the following file:

tsk/fs/tsk_fs.h