The Sleuth Kit: tsk/fs/tsk_fatfs.h File Reference

The Sleuth Kit 4.13.0

Classes | Macros | Typedefs | Enumerations | Functions

tsk_fatfs.h File Reference

Contains the structures and function APIs for TSK FAT (FAT12, FAT16, FAT32, exFAT) file system support. More...

#include "tsk_fs_i.h"

Classes

struct FATFS_DENTRY

Generic directory entry structure for FAT file systems. More...

struct FATFS_INFO

struct FATFS_MASTER_BOOT_RECORD

Macros

#define EXFATFS_MASK 0x0fffffff

#define FATFS_12_MASK 0x00000fff

#define FATFS_16_MASK 0x0000ffff

#define FATFS_32_MASK 0x0fffffff

#define FATFS_ATTR_ALL 0x3f /* all flags set */

#define FATFS_ATTR_ARCHIVE 0x20 /* file is new or modified */

#define FATFS_ATTR_DIRECTORY 0x10 /* entry is a directory name */

#define FATFS_ATTR_HIDDEN 0x02 /* file is hidden */

#define FATFS_ATTR_LFN 0x0f /* A long file name entry */

#define FATFS_ATTR_NORMAL 0x00 /* normal file */

#define FATFS_ATTR_READONLY 0x01 /* file is readonly */

#define FATFS_ATTR_SYSTEM 0x04 /* file is a system file */

#define FATFS_ATTR_VOLUME 0x08 /* entry is a volume label */

#define FATFS_BAD 0x0ffffff7

#define FATFS_CLUST_2_SECT(fatfs, c) (TSK_DADDR_T)(fatfs->firstclustsect + ((((c) & fatfs->mask) - 2) * fatfs->csize))

#define FATFS_DAY_MASK 0x1f /* day of month 1-31 */

#define FATFS_DAY_MAX 31

#define FATFS_DAY_MIN 1

#define FATFS_DAY_SHIFT 0

#define FATFS_DENTRY_SIZE 32

Directory entries for all FAT file systems are currently 32 bytes long.

#define FATFS_EOFE 0x0fffffff

#define FATFS_EOFS 0x0ffffff8

#define FATFS_FAIL 1

#define FATFS_FAT1NAME "$FAT1"

#define FATFS_FAT2NAME "$FAT2"

#define FATFS_FAT_CACHE_B 4096

#define FATFS_FAT_CACHE_N 4

#define FATFS_FILE_CONTENT_LEN sizeof(TSK_DADDR_T)

#define FATFS_FIRST_CLUSTER_ADDR 2

#define FATFS_FIRST_NORMINO 3

#define FATFS_FIRSTINO 2

#define FATFS_FS_MAGIC 0xaa55

#define FATFS_HOUR_MASK 0xf800 /* number of hours 0-23 */

#define FATFS_HOUR_MAX 23

#define FATFS_HOUR_MIN 0

#define FATFS_HOUR_SHIFT 11

#define FATFS_INODE_2_OFF(fatfs, i) (size_t)(((i - FATFS_FIRST_NORMINO) % fatfs->dentry_cnt_se) * sizeof(FATFS_DENTRY))

#define FATFS_INODE_2_SECT(fatfs, i) (TSK_DADDR_T)((i - FATFS_FIRST_NORMINO)/(fatfs->dentry_cnt_se) + fatfs->firstdatasect)

#define FATFS_ISBAD(val, mask) ((val) == (FATFS_BAD & mask))

#define FATFS_ISDATE(x)

#define FATFS_ISEOF(val, mask) ((val >= (FATFS_EOFS & mask)) && (val <= (FATFS_EOFE)))

#define FATFS_ISTIME(x)

#define FATFS_MASTER_BOOT_RECORD_SIZE 512

#define FATFS_MAXNAMLEN_UTF8 1024

#define FATFS_MBRNAME "$MBR"

#define FATFS_MIN_MASK 0x7e0 /* number of minutes 0-59 */

#define FATFS_MIN_MAX 59

#define FATFS_MIN_MIN 0

#define FATFS_MIN_SHIFT 5

#define FATFS_MON_MASK 0x1e0 /* month 1-12 */

#define FATFS_MON_MAX 12

#define FATFS_MON_MIN 1

#define FATFS_MON_SHIFT 5

#define FATFS_NUM_VIRT_FILES(fatfs) (fatfs->numfat + 2)

#define FATFS_OK 0

#define FATFS_ROOTINO 2 /* location of root directory inode */

#define FATFS_ROOTNAME "$ROOT"

#define FATFS_SEC_MASK 0x1f /* number of seconds div by 2 */

#define FATFS_SEC_MAX 30

#define FATFS_SEC_MIN 0

#define FATFS_SEC_SHIFT 0

#define FATFS_SECT_2_CLUST(fatfs, s) (TSK_DADDR_T)(2 + ((s) - fatfs->firstclustsect) / fatfs->csize)

#define FATFS_SECT_2_INODE(fatfs, s) (TSK_INUM_T)((s - fatfs->firstdatasect) * fatfs->dentry_cnt_se + FATFS_FIRST_NORMINO)

#define FATFS_UNALLOC 0

#define FATFS_YEAR_MASK 0xfe00 /* year, from 1980 0-127 */

#define FATFS_YEAR_MAX 127

#define FATFS_YEAR_MIN 0

#define FATFS_YEAR_SHIFT 9

Typedefs

typedef enum FATFS_DATA_UNIT_ALLOC_STATUS_ENUM FATFS_DATA_UNIT_ALLOC_STATUS_ENUM

typedef struct FATFS_INFO FATFS_INFO

Enumerations

enum FATFS_DATA_UNIT_ALLOC_STATUS_ENUM { FATFS_DATA_UNIT_ALLOC_STATUS_UNALLOC = 0, FATFS_DATA_UNIT_ALLOC_STATUS_ALLOC = 1, FATFS_DATA_UNIT_ALLOC_STATUS_UNKNOWN = 2 }

enum TSK_FATFS_SUBTYPE_ENUM { TSK_FATFS_SUBTYPE_SPEC = 0, TSK_FATFS_SUBTYPE_ANDROID_1 = 1 }

Functions

TSK_FS_BLOCK_FLAG_ENUM fatfs_block_getflags (TSK_FS_INFO *a_fs, TSK_DADDR_T a_addr)

uint8_t fatfs_block_walk (TSK_FS_INFO *fs, TSK_DADDR_T a_start_blk, TSK_DADDR_T a_end_blk, TSK_FS_BLOCK_WALK_FLAG_ENUM a_flags, TSK_FS_BLOCK_WALK_CB a_action, void *a_ptr)

void fatfs_cleanup_ascii (char *)

void fatfs_close (TSK_FS_INFO *fs)

uint8_t fatfs_dentry_load (FATFS_INFO *a_fatfs, FATFS_DENTRY *a_dentry, TSK_INUM_T a_inum)

uint8_t fatfs_dir_buf_add (FATFS_INFO *fatfs, TSK_INUM_T par_inum, TSK_INUM_T dir_inum)

Adds an entry to the parent directory map. More...

void fatfs_dir_buf_free (FATFS_INFO *fatfs)

Frees the memory associated with the parent map.

uint8_t fatfs_dir_buf_get (FATFS_INFO *fatfs, TSK_INUM_T dir_inum, TSK_INUM_T *par_inum)

Looks up the parent meta address for a child from the cached list. More...

TSK_RETVAL_ENUM fatfs_dir_open_meta (TSK_FS_INFO *a_fs, TSK_FS_DIR **a_fs_dir, TSK_INUM_T a_addr, int recursion_depth)

uint32_t fatfs_dos_2_nanosec (uint8_t timetens)

time_t fatfs_dos_2_unix_time (uint16_t date, uint16_t time, uint8_t timetens)

TSK_WALK_RET_ENUM fatfs_find_parent_act (TSK_FS_FILE *fs_file, const char *a_path, void *ptr)

uint8_t fatfs_fscheck (TSK_FS_INFO *fs, FILE *hFile)

TSK_FS_ATTR_TYPE_ENUM fatfs_get_default_attr_type (const TSK_FS_FILE *a_file)

uint8_t fatfs_getFAT (FATFS_INFO *fatfs, TSK_DADDR_T clust, TSK_DADDR_T *value)

uint8_t fatfs_inode_lookup (TSK_FS_INFO *a_fs, TSK_FS_FILE *a_fs_file, TSK_INUM_T a_inum)

uint8_t fatfs_inode_walk (TSK_FS_INFO *fs, TSK_INUM_T start_inum, TSK_INUM_T end_inum, TSK_FS_META_FLAG_ENUM a_flags, TSK_FS_META_WALK_CB a_action, void *a_ptr)

Walk the inodes in a specified range and do a TSK_FS_META_WALK_CB callback for each inode that satisfies criteria specified by a set of TSK_FS_META_FLAG_ENUM flags. More...

uint8_t fatfs_inum_arg_is_in_range (FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, const char *func_name)

uint8_t fatfs_inum_is_in_range (FATFS_INFO *a_fatfs, TSK_INUM_T a_inum)

int8_t fatfs_is_sectalloc (FATFS_INFO *, TSK_DADDR_T)

uint8_t fatfs_istat (TSK_FS_INFO *fs, TSK_FS_ISTAT_FLAG_ENUM istat_flags, FILE *hFile, TSK_INUM_T inum, TSK_DADDR_T numblock, int32_t sec_skew)

Print details on a specific file to a file handle. More...

uint8_t fatfs_jblk_walk (TSK_FS_INFO *fs, TSK_DADDR_T start, TSK_DADDR_T end, int a_flags, TSK_FS_JBLK_WALK_CB a_action, void *a_ptr)

uint8_t fatfs_jentry_walk (TSK_FS_INFO *fs, int a_flags, TSK_FS_JENTRY_WALK_CB a_action, void *a_ptr)

uint8_t fatfs_jopen (TSK_FS_INFO *fs, TSK_INUM_T inum)

uint8_t fatfs_make_data_runs (TSK_FS_FILE *a_fs_file)

int fatfs_name_cmp (TSK_FS_INFO *, const char *, const char *)

TSK_FS_INFO * fatfs_open (TSK_IMG_INFO *a_img_info, TSK_OFF_T a_offset, TSK_FS_TYPE_ENUM a_ftype, const char *a_pass, uint8_t a_test)

uint8_t fatfs_ptr_arg_is_null (void *ptr, const char *param_name, const char *func_name)

TSKConversionResult fatfs_utf16_inode_str_2_utf8 (FATFS_INFO *a_fatfs, UTF16 *src, size_t src_len, UTF8 *dest, size_t dest_len, TSK_INUM_T a_inum, const char *a_desc)

Detailed Description

Contains the structures and function APIs for TSK FAT (FAT12, FAT16, FAT32, exFAT) file system support.

Macro Definition Documentation

#define FATFS_ISDATE ( x )

Value:

(((((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) > FATFS_DAY_MAX) || \

(((x & FATFS_DAY_MASK) >> FATFS_DAY_SHIFT) < FATFS_DAY_MIN) || \

(((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) > FATFS_MON_MAX) || \

(((x & FATFS_MON_MASK) >> FATFS_MON_SHIFT) < FATFS_MON_MIN) || \

(((x & FATFS_YEAR_MASK) >> FATFS_YEAR_SHIFT) > FATFS_YEAR_MAX) ) == 0)

#define FATFS_ISTIME ( x )

Value:

(((((x & FATFS_SEC_MASK) >> FATFS_SEC_SHIFT) > FATFS_SEC_MAX) || \

(((x & FATFS_MIN_MASK) >> FATFS_MIN_SHIFT) > FATFS_MIN_MAX) || \

(((x & FATFS_HOUR_MASK) >> FATFS_HOUR_SHIFT) > FATFS_HOUR_MAX) ) == 0)

Function Documentation

uint8_t fatfs_dir_buf_add ( FATFS_INFO * fatfs,

TSK_INUM_T par_inum,

TSK_INUM_T dir_inum

)

Adds an entry to the parent directory map.

Used to make further processing faster.

Parameters: fatfs File system

par_inum Parent folder meta data address.

dir_inum Sub-folder meta data address.

Returns: 0

Referenced by fatxxfs_dent_parse_buf().

uint8_t fatfs_dir_buf_get ( FATFS_INFO * fatfs,

TSK_INUM_T dir_inum,

TSK_INUM_T * par_inum

)

Looks up the parent meta address for a child from the cached list.

Parameters: fatfs File system

dir_inum Inode of sub-directory to look up

par_inum [out] Result of lookup

Returns: 0 if found and 1 if not.

Referenced by fatxxfs_dent_parse_buf().

uint8_t fatfs_inode_walk ( TSK_FS_INFO * a_fs,

TSK_INUM_T a_start_inum,

TSK_INUM_T a_end_inum,

TSK_FS_META_FLAG_ENUM a_selection_flags,

TSK_FS_META_WALK_CB a_action,

void * a_ptr

)

Walk the inodes in a specified range and do a TSK_FS_META_WALK_CB callback for each inode that satisfies criteria specified by a set of TSK_FS_META_FLAG_ENUM flags.

The following flags are supported: TSK_FS_META_FLAG_ALLOC, TSK_FS_META_FLAG_UNALLOC, TSK_FS_META_FLAG_ORPHAN, TSK_FS_META_FLAG_USED (FATXX only), and TSK_FS_META_FLAG_UNUSED (FATXX only).

Parameters: [in] a_fs File system that contains the inodes.

[in] a_start_inum Inclusive lower bound of inode range.

[in] a_end_inum Inclusive upper bound of inode range.

[in] a_selection_flags Inode selection criteria.

[in] a_action Callback function for selected inodes.

[in] a_ptr Private data pointer passed through to callback function.

Returns: 0 on success, 1 on failure, per TSK convention

References TSK_FS_INFO::block_count, TSK_FS_INFO::last_block, TSK_FS_INFO::last_inum, TSK_FS_FILE::meta, TSK_FS_INFO::root_inum, TSK_COR, tsk_error_errstr2_concat(), tsk_error_print(), tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_error_set_errstr2(), tsk_fprintf(), tsk_fs_dir_walk(), TSK_FS_DIR_WALK_FLAG_ALLOC, TSK_FS_DIR_WALK_FLAG_NOORPHAN, TSK_FS_DIR_WALK_FLAG_RECURSE, tsk_fs_file_close(), tsk_fs_file_walk(), TSK_FS_FILE_WALK_FLAG_AONLY, TSK_FS_FILE_WALK_FLAG_SLACK, TSK_FS_META_FLAG_ALLOC, TSK_FS_META_FLAG_ORPHAN, TSK_FS_META_FLAG_UNALLOC, TSK_FS_META_FLAG_UNUSED, TSK_FS_META_FLAG_USED, tsk_fs_read_block(), TSK_OK, tsk_verbose, TSK_WALK_CONT, TSK_WALK_ERROR, and TSK_WALK_STOP.

uint8_t fatfs_istat ( TSK_FS_INFO * a_fs,

TSK_FS_ISTAT_FLAG_ENUM istat_flags,

FILE * a_hFile,

TSK_INUM_T a_inum,

TSK_DADDR_T a_numblock,

int32_t a_sec_skew

)

Print details on a specific file to a file handle.

Parameters: a_fs File system file is located in.

a_hFile File handle to print text to.

a_inum Address of file in file system.

a_numblock The number of blocks in file to force print (can go beyond file size).

a_sec_skew Clock skew in seconds to also print times in.

Returns: 1 on error and 0 on success.

References TSK_FS_META::addr, TSK_FS_META::atime, TSK_FS_INFO::block_size, TSK_FS_META::crtime, TSK_FS_ATTR::flags, TSK_FS_META::flags, TSK_FS_FILE::meta, TSK_FS_META::mtime, TSK_FS_META_NAME_LIST::name, TSK_FS_META::name2, TSK_FS_INFO::root_inum, TSK_FS_META::size, tsk_error_print(), tsk_error_reset(), tsk_fprintf(), TSK_FS_ATTR_NONRES, tsk_fs_file_attr_get_type(), tsk_fs_file_close(), tsk_fs_file_open_meta(), tsk_fs_file_walk(), TSK_FS_FILE_WALK_FLAG_AONLY, TSK_FS_FILE_WALK_FLAG_SLACK, TSK_FS_META_FLAG_UNALLOC, TSK_FS_META_TYPE_VIRT, tsk_fs_time_to_str(), and TSK_FS_META::type.