The Sleuth Kit: tsk/fs/tsk_exfatfs.h File Reference

Name for an exFAT access control table directory entry, with the "$" prefix that is used to indicate "special file" directory entries and non-file directory entries.

#define EXFATFS_ALLOC_BITMAP_DENTRY_NAME "$ALLOC_BITMAP"

Name for an exFAT allocation bitmap directory entry, with the "$" prefix that is used to indicate "special file" directory entries and non-file directory entries.

#define EXFATFS_EMPTY_VOLUME_LABEL_DENTRY_NAME "$EMPTY_VOLUME_LABEL"

Name for an exFAT volume label directory entry that has an empty label, with the "$" prefix that is used to indicate "special file" directory entries and non-file directory entries.

#define EXFATFS_FIRST_CLUSTER 2

#define EXFATFS_INVALID_FAT_CHAIN_MASK 0x02

#define EXFATFS_MAX_FILE_NAME_LENGTH_UTF16_CHARS 255

#define EXFATFS_MAX_FILE_NAME_SEGMENT_LENGTH_UTF16_BYTES 30

#define EXFATFS_MAX_FILE_NAME_SEGMENT_LENGTH_UTF16_CHARS 15

#define EXFATFS_MAX_FILE_SECONDARY_DENTRIES_COUNT 18

#define EXFATFS_MAX_VOLUME_LABEL_LEN_BYTE 30

#define EXFATFS_MAX_VOLUME_LABEL_LEN_CHAR 15

#define EXFATFS_MIN_FILE_SECONDARY_DENTRIES_COUNT 2

#define EXFATFS_TEX_FAT_DENTRY_NAME "$TEX_FAT"

Name for an exFAT TexFAT directory entry, with the "$" prefix that is used to indicate "special file" directory entries and non-file directory entries.

#define EXFATFS_UPCASE_TABLE_DENTRY_NAME "$UPCASE_TABLE"

Name for an exFAT upcase table directory entry, with the "$" prefix that is used to indicate "special file" directory entries and non-file directory entries.

#define EXFATFS_VOLUME_GUID_DENTRY_NAME "$VOLUME_GUID"

Name for an exFAT volume GUID directory entry, with the "$" prefix that is used to indicate "special file" directory entries and non-file directory entries.

Typedefs

typedef uint8_t EXFATFS_DIR_ENTRY_TYPE

exFAT directory entry type byte, containing both the type and the allocation status

typedef enum EXFATFS_DIR_ENTRY_TYPE_ENUM EXFATFS_DIR_ENTRY_TYPE_ENUM

Enumerations

enum EXFATFS_DIR_ENTRY_TYPE_ENUM {
  EXFATFS_DIR_ENTRY_TYPE_NONE = 0x00, EXFATFS_DIR_ENTRY_TYPE_VOLUME_LABEL = 0x03, EXFATFS_DIR_ENTRY_TYPE_VOLUME_GUID = 0x20, EXFATFS_DIR_ENTRY_TYPE_ALLOC_BITMAP = 0x01,
  EXFATFS_DIR_ENTRY_TYPE_UPCASE_TABLE = 0x02, EXFATFS_DIR_ENTRY_TYPE_TEXFAT = 0x21, EXFATFS_DIR_ENTRY_TYPE_ACT = 0x62, EXFATFS_DIR_ENTRY_TYPE_FILE = 0x05,
  EXFATFS_DIR_ENTRY_TYPE_FILE_STREAM = 0x40, EXFATFS_DIR_ENTRY_TYPE_FILE_NAME = 0x41
}

exFAT directory entry types, the first byte of a directory entry minus the high order bit (which gives allocation status) More...

Functions

TSK_RETVAL_ENUM exfatfs_dent_parse_buf (FATFS_INFO *a_fatfs, TSK_FS_DIR *a_fs_dir, char *a_buf, TSK_OFF_T a_buf_len, TSK_DADDR_T *a_sector_addrs, int recursion_depth)

TSK_RETVAL_ENUM exfatfs_dinode_copy (FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FATFS_DENTRY *a_dentry, uint8_t a_is_alloc, TSK_FS_FILE *a_fs_file)

uint8_t exfatfs_find_file_stream_dentry (FATFS_INFO *a_fatfs, TSK_INUM_T a_file_entry_inum, TSK_DADDR_T a_sector, uint8_t a_sector_is_alloc, EXFATFS_DIR_ENTRY_TYPE a_file_dentry_type, FATFS_DENTRY *a_stream_dentry)

uint8_t exfatfs_fsstat (TSK_FS_INFO *a_fs, FILE *a_hFile)

uint8_t exfatfs_get_alloc_status_from_type (EXFATFS_DIR_ENTRY_TYPE a_dir_entry_type)

EXFATFS_DIR_ENTRY_TYPE_ENUM exfatfs_get_enum_from_type (EXFATFS_DIR_ENTRY_TYPE a_dir_entry_type)

uint8_t exfatfs_inode_lookup (FATFS_INFO *a_fatfs, TSK_FS_FILE *a_fs_file, TSK_INUM_T a_inum)

uint8_t exfatfs_inode_walk_should_skip_dentry (FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FATFS_DENTRY *a_dentry, unsigned int a_selection_flags, int a_cluster_is_alloc)

uint8_t exfatfs_is_access_ctrl_table_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status)

uint8_t exfatfs_is_alloc_bitmap_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status, FATFS_INFO *a_fatfs)

int8_t exfatfs_is_cluster_alloc (FATFS_INFO *a_fatfs, TSK_DADDR_T a_cluster_addr)

uint8_t exfatfs_is_dentry (FATFS_INFO *a_fatfs, FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_cluster_is_alloc, uint8_t a_do_basic_tests_only)

uint8_t exfatfs_is_file_dentry (FATFS_DENTRY *a_dentry, FATFS_INFO *a_fatfs)

uint8_t exfatfs_is_file_dentry_standalone (FATFS_DENTRY *a_dentry, TSK_ENDIAN_ENUM a_endian)

uint8_t exfatfs_is_file_name_dentry (FATFS_DENTRY *a_dentry)

uint8_t exfatfs_is_file_stream_dentry (FATFS_DENTRY *a_dentry, FATFS_INFO *a_fatfs)

uint8_t exfatfs_is_file_stream_dentry_standalone (FATFS_DENTRY *a_dentry, TSK_ENDIAN_ENUM a_endian, uint64_t a_cluster_heap_size, TSK_DADDR_T a_last_cluster)

uint8_t exfatfs_is_texfat_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status)

uint8_t exfatfs_is_upcase_table_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status, FATFS_INFO *a_fatfs)

uint8_t exfatfs_is_vol_guid_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_alloc_status)

uint8_t exfatfs_is_vol_label_dentry (FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_cluster_is_alloc)

uint8_t exfatfs_istat_attr_flags (FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FILE *a_hFile)

uint8_t exfatfs_open (FATFS_INFO *a_fatfs)

Open an exFAT file system in an image file. More...

Detailed Description

Contains declarations of structures and functions specific to TSK exFAT file system support.

Enumeration Type Documentation

enum EXFATFS_DIR_ENTRY_TYPE_ENUM

exFAT directory entry types, the first byte of a directory entry minus the high order bit (which gives allocation status)

Enumerator
EXFATFS_DIR_ENTRY_TYPE_NONE	0x00
EXFATFS_DIR_ENTRY_TYPE_VOLUME_LABEL	0x03
EXFATFS_DIR_ENTRY_TYPE_VOLUME_GUID	0x20
EXFATFS_DIR_ENTRY_TYPE_ALLOC_BITMAP	0x01
EXFATFS_DIR_ENTRY_TYPE_UPCASE_TABLE	0x02
EXFATFS_DIR_ENTRY_TYPE_TEXFAT	0x21
EXFATFS_DIR_ENTRY_TYPE_ACT	0x62
EXFATFS_DIR_ENTRY_TYPE_FILE	0x05
EXFATFS_DIR_ENTRY_TYPE_FILE_STREAM	0x40
EXFATFS_DIR_ENTRY_TYPE_FILE_NAME	0x41

Function Documentation

uint8_t exfatfs_open ( FATFS_INFO * a_fatfs )

Open an exFAT file system in an image file.

Parameters: [in,out] a_fatfs Generic FAT file system info structure.

Returns: 0 on success, 1 otherwise, per TSK convention.

References TSK_FS_INFO::ftype, tsk_error_reset(), and TSK_FS_TYPE_EXFAT.