Contains the structures and function APIs for TSK FATXX (FAT12, FAT16, FAT32) file system support.
More...
Classes
Macros
#define FATXXFS_CASE_LOWER_ALL 0x18 /* both are lower */
#define FATXXFS_CASE_LOWER_BASE 0x08 /* base is lower case */
#define FATXXFS_CASE_LOWER_EXT 0x10 /* extension is lower case */
#define
FATXXFS_DENTRY_CLUST(fsi, de) (
TSK_DADDR_T)((tsk_getu16(fsi->endian, de->startclust)) | (tsk_getu16(fsi->endian, de->highclust)<<16))
#define FATXXFS_ENCRYPTED_DATA 0x01 /* data is EFS-encrypted */
#define FATXXFS_IS_83_EXT(c) (FATXXFS_IS_83_NAME((c)) && ((c) < 0x7f))
#define FATXXFS_IS_83_NAME(c)
#define FATXXFS_IS_DELETED(name, fatfs)
#define FATXXFS_LARGE_EFS_HEADER 0x02 /* data has large EFS header (if not set, its size is 4096 bytes) */
#define FATXXFS_LFN_SEQ_FIRST 0x40 /* This bit is set for the first lfn entry */
#define FATXXFS_LFN_SEQ_MASK
#define FATXXFS_SLOT_DELETED 0xe5
#define FATXXFS_SLOT_E5 0x05 /* actual value is 0xe5 */
#define FATXXFS_SLOT_EMPTY 0x00
Functions
/internal Parse a buffer containing the contents of a directory and add
TSK_FS_NAME objects for each named file found to the
TSK_FS_DIR representation of the directory.
More...
uint8_t
fatxxfs_inode_walk_should_skip_dentry (
FATFS_INFO *a_fatfs,
TSK_INUM_T a_inum,
FATFS_DENTRY *a_dentry, unsigned int a_selection_flags, int a_cluster_is_alloc)
uint8_t
fatxxfs_is_dentry (
FATFS_INFO *a_fatfs,
FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_cluster_is_alloc, uint8_t a_do_basic_tests_only)
Output the file attributes of an exFAT file directory entry in human-readable form.
More...
Detailed Description
Contains the structures and function APIs for TSK FATXX (FAT12, FAT16, FAT32) file system support.
Macro Definition Documentation
#define FATXXFS_IS_83_NAME
(
c )
Value:((((c) < 0x20) || \
((c) == 0x22) || \
(((c) >= 0x2a) && ((c) <= 0x2c)) || \
((c) == 0x2e) || \
((c) == 0x2f) || \
(((c) >= 0x3a) && ((c) <= 0x3f)) || \
(((c) >= 0x5b) && ((c) <= 0x5d)) || \
((c) == 0x7c)) == 0)
#define FATXXFS_IS_DELETED
(
name,
fatfs
)
Value:(fatfs->subtype == TSK_FATFS_SUBTYPE_ANDROID_1) ? \
((name[0] == 0) && (name[1] == 0)) : \
(name[0] == FATXXFS_SLOT_DELETED)
#define FATXXFS_LFN_SEQ_MASK
Value:0x3f /* These bits are a mask for the decreasing
* sequence number for the entries */
Function Documentation
char *
buf,
int
recursion_depth
)
/internal Parse a buffer containing the contents of a directory and add TSK_FS_NAME objects for each named file found to the TSK_FS_DIR representation of the directory.
- Parameters
-
fatfs File system information structure for file system that contains the directory.
a_fs_dir Directory structure into to which parsed file metadata will be added.
buf Buffer that contains the directory contents.
len Length of buffer in bytes (must be a multiple of sector size).
addrs Array where each element is the original address of the corresponding sector in a_buf (size of array is number of sectors in the directory).
recursion_depth Recursion depth to limit the number of self-calls
- Returns
- TSK_RETVAL_ENUM
References TSK_FS_META::addr, TSK_FS_DIR::addr, TSK_FS_INFO::endian, fatfs_dir_buf_add(), fatfs_dir_buf_get(), TSK_FS_DIR::fs_file, TSK_FS_INFO::last_inum, TSK_FS_FILE::meta, TSK_FS_INFO::root_inum, TSK_COR, TSK_ERR, tsk_error_print(), tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_fprintf(), TSK_FS_DIR_WALK_FLAG_ALLOC, TSK_FS_DIR_WALK_FLAG_RECURSE, TSK_FS_DIR_WALK_FLAG_UNALLOC, TSK_FS_NAME_FLAG_ALLOC, TSK_FS_NAME_FLAG_UNALLOC, TSK_FS_NAME_TYPE_DIR, TSK_FS_NAME_TYPE_REG, TSK_OK, tsk_UTF16toUTF8(), tsk_verbose, TSKconversionOK, and TSKlenientConversion.
uint8_t fatxxfs_istat_attr_flags
(
FATFS_INFO *
a_fatfs,
FILE *
a_hFile
)
Output the file attributes of an exFAT file directory entry in human-readable form.
- Parameters
-
a_fatfs Source file system for the directory entry.
a_inum Inode address associated with the directory entry.
a_hFile Handle of the file to which to write.
- Returns
- 0 on success, 1 on failure, per TSK convention
References tsk_error_reset(), and tsk_fprintf().