The Sleuth Kit: TSK_FS_NAME Struct Reference

The Sleuth Kit 4.13.0

Public Attributes | List of all members

TSK_FS_NAME Struct Reference

Generic structure to store the file name information that is stored in a directory. More...

#include <tsk_fs.h>

Public Attributes

uint64_t date_added

Time entry was added to a directory (APFS only)

TSK_FS_NAME_FLAG_ENUM flags

Flags that describe allocation status etc.

TSK_INUM_T meta_addr

Address of the metadata structure that the name points to.

uint32_t meta_seq

Sequence number for metadata structure (NTFS only)

char * name

The name of the file (in UTF-8)

size_t name_size

The number of bytes allocated to name.

TSK_INUM_T par_addr

Metadata address of parent directory (equal to meta_addr if this entry is for root directory).

uint32_t par_seq

Sequence number for parent directory (NTFS only)

char * shrt_name

The short name of the file or null (in UTF-8)

size_t shrt_name_size

The number of bytes allocated to shrt_name.

int tag

TSK_FS_NAME_TYPE_ENUM type

File type information (directory, file, etc.)

Detailed Description

Generic structure to store the file name information that is stored in a directory.

Most file systems separate the file name from the metadata, but some do not (such as FAT). This structure contains the name and address of the metadata.

The documentation for this struct was generated from the following file:

tsk/fs/tsk_fs.h