Strings used in index header.

It is one longer than a sha-1 hash - so that it always sorts to the top

Referenced by hdb_binsrch_idx_initialize().

Process the database to create a sorted index of it.

Consecutive entries with the same hash value are not added to the index, but will be found during lookup.

Parameters

hdb_info_base Hash database to make index of.

dbtype Type of hash database (should always be TSK_HDB_DBTYPE_ENCASE_STR)

Returns

1 on error and 0 on success.

References TSK_HDB_INFO::db_fname, TSK_HDB_BINSRCH_INFO::hDb, hdb_binsrch_idx_add_entry_bin(), hdb_binsrch_idx_finalize(), hdb_binsrch_idx_initialize(), PRIttocTSK, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_error_set_errstr2(), and tsk_verbose.

Test the file to see if it is an Encase database.

Parameters

hFile File handle to hash database

Returns

1 if encase and 0 if not

Add a binary entry to the intermediate index file.

Parameters

hdb_binsrch_info Hash database state info

hvalue Array of integers of hash value to add

hlen Number of bytes in hvalue

offset Byte offset of hash entry in original database.

Returns

1 on error and 0 on success

References TSK_HDB_BINSRCH_INFO::hIdxTmp.

Referenced by encase_make_index().

Add a string entry to the intermediate index file.

Will not add an all-zero hash since this creates errors in the final index file, but does not return an error in this case.

Parameters

hdb_binsrch_info Hash database state info

hvalue String of hash value to add

offset Byte offset of hash entry in original database.

Returns

1 on error and 0 on success

References TSK_HDB_BINSRCH_INFO::hIdxTmp.

Referenced by hk_makeindex(), md5sum_makeindex(), and nsrl_makeindex().

Finalize index creation process by sorting the index and removing the intermediate temp file.

Parameters

hdb_binsrch_info Hash database state info structure.

Returns

1 on error and 0 on success

References TSK_HDB_BINSRCH_INFO::hIdx, TSK_HDB_BINSRCH_INFO::hIdxTmp, TSK_HDB_BINSRCH_INFO::idx_fname, TSK_HDB_BINSRCH_INFO::idx_lbuf, TSK_HDB_BINSRCH_INFO::idx_llen, TSK_HDB_BINSRCH_INFO::idx_off, TSK_HDB_BINSRCH_INFO::idx_size, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_error_set_errstr2(), tsk_fprintf(), TSK_HDB_MAXLEN, tsk_verbose, and TSK_HDB_BINSRCH_INFO::uns_fname.

Referenced by encase_make_index(), hk_makeindex(), md5sum_makeindex(), and nsrl_makeindex().

Initialize the TSK hash DB index file.

This creates the intermediate file, which will have entries added to it. This file must be sorted before the process is finished.

Parameters

hdb_binsrch_info Hash database state structure

htype String of index type to create

Returns

1 on error and 0 on success

References TSK_HDB_INFO::db_fname, TSK_HDB_INFO::db_name, TSK_HDB_INFO::db_type, TSK_HDB_BINSRCH_INFO::hash_type, TSK_HDB_BINSRCH_INFO::hIdxTmp, PRIcTSK, PRIttocTSK, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), TSK_HDB_DBTYPE_ENCASE_ID, TSK_HDB_DBTYPE_ENCASE_STR, TSK_HDB_DBTYPE_HK_ID, TSK_HDB_DBTYPE_HK_STR, TSK_HDB_DBTYPE_IDXONLY_ID, TSK_HDB_DBTYPE_MD5SUM_ID, TSK_HDB_DBTYPE_MD5SUM_STR, TSK_HDB_DBTYPE_NSRL_ID, TSK_HDB_DBTYPE_NSRL_MD5_STR, TSK_HDB_DBTYPE_NSRL_SHA1_STR, TSK_HDB_DBTYPE_NSRL_STR, TSK_HDB_HTYPE_INVALID_ID, TSK_HDB_HTYPE_MD5_ID, TSK_HDB_HTYPE_SHA1_ID, TSK_HDB_HTYPE_STR, TSK_HDB_IDX_HEAD_TYPE_STR, and TSK_HDB_BINSRCH_INFO::uns_fname.

Referenced by encase_make_index(), hk_makeindex(), md5sum_makeindex(), and nsrl_makeindex().

Called by the various text-based databases to setup the TSK_HDB_BINSRCH_INFO struct.

This will setup the basic function pointers, that will be overwritten by the more specific methods.

References TSK_HDB_INFO::db_type, TSK_HDB_BINSRCH_INFO::hash_len, TSK_HDB_BINSRCH_INFO::hash_type, TSK_HDB_BINSRCH_INFO::hDb, hdb_binsrch_lookup_bin(), hdb_binsrch_lookup_str(), TSK_HDB_DBTYPE_INVALID_ID, and TSK_HDB_HTYPE_INVALID_ID.

Referenced by idxonly_open().

Find the corresponding name at the given offset.

The offset was likely determined from the index. The entries in the DB following the one specified are also processed if they have the same hash value and their name is different. The callback is called for each entry.

Note: This routine assumes that &hdb_info->lock is locked by the caller.

Parameters

hdb_info Data base to get data from.

hash MD5 hash value that was searched for

offset Byte offset where hash value should be located in db_file

flags

action Callback used for each entry found in lookup

cb_ptr Pointer to data passed to callback

Returns

1 on error and 0 on success

References TSK_HDB_BINSRCH_INFO::hDb, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), TSK_HDB_FLAG_EXT, TSK_HDB_HTYPE_MD5_LEN, TSK_HDB_MAXLEN, tsk_verbose, TSK_WALK_ERROR, and TSK_WALK_STOP.

Process the database to create a sorted index of it.

Consecutive entries with the same hash value are not added to the index, but will be found during lookup.

Parameters

hdb_info_base Hash database to make index of

dbtype Text of database type (should always be TSK_HDB_DBTYPE_HK_STR)

Returns

1 on error and 0 on success.

References TSK_HDB_INFO::db_fname, TSK_HDB_BINSRCH_INFO::hDb, hdb_binsrch_idx_add_entry_str(), hdb_binsrch_idx_finalize(), hdb_binsrch_idx_initialize(), PRIttocTSK, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_error_set_errstr2(), TSK_HDB_HTYPE_MD5_LEN, TSK_HDB_MAXLEN, and tsk_verbose.

Test the file to see if it is a hashkeeper database.

Parameters

hFile File handle to hash database

Returns

1 if hk and 0 if not

References TSK_HDB_MAXLEN.

Parameters

db_path Path to DB, which probably does not exist. But it gets passed in because we need it in a bunch of places.

idx_path Path to index file (should be superset of db_path)

References TSK_HDB_INFO::db_type, TSK_HDB_BINSRCH_INFO::hash_type, hdb_binsrch_open(), PRIttocTSK, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), TSK_HDB_DBTYPE_IDXONLY_ID, TSK_HDB_HTYPE_MD5_ID, and TSK_HDB_HTYPE_SHA1_ID.

Referenced by tsk_hdb_open().

Process the database to create a sorted index of it.

Consecutive entries with the same hash value are not added to the index, but will be found during lookup.

Parameters

hdb_info_base Hash database to make index of.

dbtype Type of hash database (should always be TSK_HDB_DBTYPE_MD5SUM_STR)

Returns

1 on error and 0 on success.

References TSK_HDB_INFO::db_fname, TSK_HDB_BINSRCH_INFO::hDb, hdb_binsrch_idx_add_entry_str(), hdb_binsrch_idx_finalize(), hdb_binsrch_idx_initialize(), PRIttocTSK, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_error_set_errstr2(), TSK_HDB_MAXLEN, and tsk_verbose.

Test the file to see if it is a md5sum database.

Parameters

hFile File handle to hash database

Returns

1 if md5sum and 0 if not

References TSK_HDB_HTYPE_MD5_LEN, and TSK_HDB_MAXLEN.

Process the database to create a sorted index of it.

Consecutive entries with the same hash value are not added to the index, but will be found during lookup.

Parameters

hdb_info_base Hash database to make index of.

dbtype Type of database

Returns

1 on error and 0 on success.

References TSK_HDB_INFO::db_fname, TSK_HDB_BINSRCH_INFO::hash_len, TSK_HDB_BINSRCH_INFO::hash_type, TSK_HDB_BINSRCH_INFO::hDb, hdb_binsrch_idx_add_entry_str(), hdb_binsrch_idx_finalize(), hdb_binsrch_idx_initialize(), PRIttocTSK, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_error_set_errstr2(), TSK_HDB_HTYPE_MD5_ID, TSK_HDB_HTYPE_SHA1_ID, TSK_HDB_HTYPE_SHA1_LEN, TSK_HDB_MAXLEN, and tsk_verbose.

Test the file to see if it is an NSRL database.

Parameters

hFile File handle to hash database

Returns

1 if NSRL and 0 if not

References TSK_HDB_MAXLEN.