The Sleuth Kit: tsk/img/tsk_img.h File Reference

The Sleuth Kit 4.13.0

Classes | Macros | Typedefs | Enumerations | Functions

tsk_img.h File Reference

Contains the external library definitions for the disk image functions. More...

Classes

struct Stats

struct TSK_IMG_INFO

Created when a disk image has been opened and stores general information and handles. More...

struct TSK_IMG_OPTIONS

class TskImgInfo

Stores information about an image that is open and being analyzed. More...

Macros

#define TSK_IMG_INFO_CACHE_LEN 65536

#define TSK_IMG_INFO_CACHE_NUM 32

#define TSK_IMG_INFO_TAG 0x39204231

#define TSK_IMG_TYPE_ISAFF(t)

Macro that takes a image type and returns 1 if the type is for an AFF file format. More...

#define TSK_IMG_TYPE_ISDIR(t) ((((t) & TSK_IMG_TYPE_LOGICAL))?1:0)

Macro that takes a image type and returns 1 if the type is for a logical directory file format. More...

#define TSK_IMG_TYPE_ISEWF(t) ((((t) & TSK_IMG_TYPE_EWF_EWF))?1:0)

Macro that takes a image type and returns 1 if the type is for an EWF file format. More...

#define TSK_IMG_TYPE_ISRAW(t) ((((t) & TSK_IMG_TYPE_RAW))?1:0)

Macro that takes a image type and returns 1 if the type is for a raw file format. More...

Typedefs

typedef struct Stats Stats

typedef struct TSK_IMG_INFO TSK_IMG_INFO

typedef struct TSK_IMG_OPTIONS TSK_IMG_OPTIONS

Enumerations

enum TSK_IMG_TYPE_ENUM {
  TSK_IMG_TYPE_DETECT = 0x0000, TSK_IMG_TYPE_RAW = 0x0001, TSK_IMG_TYPE_RAW_SING = TSK_IMG_TYPE_RAW, TSK_IMG_TYPE_RAW_SPLIT = TSK_IMG_TYPE_RAW,
  TSK_IMG_TYPE_AFF_AFF = 0x0004, TSK_IMG_TYPE_AFF_AFD = 0x0008, TSK_IMG_TYPE_AFF_AFM = 0x0010, TSK_IMG_TYPE_AFF_ANY = 0x0020,
  TSK_IMG_TYPE_EWF_EWF = 0x0040, TSK_IMG_TYPE_VMDK_VMDK = 0x0080, TSK_IMG_TYPE_VHD_VHD = 0x0100, TSK_IMG_TYPE_AFF4_AFF4 = 0x0200,
  TSK_IMG_TYPE_QCOW_QCOW = 0x0400, TSK_IMG_TYPE_EXTERNAL = 0x1000, TSK_IMG_TYPE_POOL = 0x4000, TSK_IMG_TYPE_LOGICAL = 0x8000,
  TSK_IMG_TYPE_UNSUPP = 0xffff
}

Flag values for the disk image format type. More...

Functions

void tsk_img_close (TSK_IMG_INFO *)

Closes an open disk image. More...

TSK_IMG_INFO * tsk_img_open (int num_img, const TSK_TCHAR *const images[], TSK_IMG_TYPE_ENUM, unsigned int a_ssize)

Opens one or more disk image files so that they can be read. More...

TSK_IMG_INFO * tsk_img_open_external (void *ext_img_info, TSK_OFF_T size, unsigned int sector_size, ssize_t(*read)(TSK_IMG_INFO *img, TSK_OFF_T off, char *buf, size_t len), void(*close)(TSK_IMG_INFO *), void(*imgstat)(TSK_IMG_INFO *, FILE *))

Opens an an image of type TSK_IMG_TYPE_EXTERNAL. More...

TSK_IMG_INFO * tsk_img_open_opt (int num_img, const TSK_TCHAR *const images[], TSK_IMG_TYPE_ENUM, unsigned int a_ssize, const TSK_IMG_OPTIONS *opts)

TSK_IMG_INFO * tsk_img_open_sing (const TSK_TCHAR *a_image, TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)

Opens a single (non-split) disk image file so that it can be read. More...

TSK_IMG_INFO * tsk_img_open_sing_opt (const TSK_TCHAR *a_image, TSK_IMG_TYPE_ENUM type, unsigned int a_ssize, const TSK_IMG_OPTIONS *opts)

TSK_IMG_INFO * tsk_img_open_utf8 (int num_img, const char *const images[], TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)

Opens one or more disk image files so that they can be read. More...

TSK_IMG_INFO * tsk_img_open_utf8_opt (int num_img, const char *const images[], TSK_IMG_TYPE_ENUM type, unsigned int a_ssize, const TSK_IMG_OPTIONS *opts)

TSK_IMG_INFO * tsk_img_open_utf8_sing (const char *a_image, TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)

Opens a single (non-split) disk image file so that it can be read. More...

TSK_IMG_INFO * tsk_img_open_utf8_sing_opt (const char *a_image, TSK_IMG_TYPE_ENUM type, unsigned int a_ssize, const TSK_IMG_OPTIONS *opts)

ssize_t tsk_img_read (TSK_IMG_INFO *img, TSK_OFF_T off, char *buf, size_t len)

Reads data from an open disk image. More...

void tsk_img_type_print (FILE *)

Prints the name and description of the supported image types to a handle. More...

TSK_IMG_TYPE_ENUM tsk_img_type_supported ()

Returns the supported file format types. More...

const char * tsk_img_type_todesc (TSK_IMG_TYPE_ENUM)

Returns the description of an image format type, given its type ID. More...

TSK_IMG_TYPE_ENUM tsk_img_type_toid (const TSK_TCHAR *)

Parses a string that specifies an image format to determine the associated type ID. More...

TSK_IMG_TYPE_ENUM tsk_img_type_toid_utf8 (const char *)

Parses a string that specifies an image format to determine the associated type ID. More...

const char * tsk_img_type_toname (TSK_IMG_TYPE_ENUM)

Returns the name of an image format type, given its type ID. More...

Detailed Description

Contains the external library definitions for the disk image functions.

Note that this file is not meant to be directly included. It is included by both libtsk.h and tsk_img_i.h.

Enumeration Type Documentation

enum TSK_IMG_TYPE_ENUM

Flag values for the disk image format type.

Each type has a bit associated with it. There are TSK_IMG_TYPE_ISXXX macros to determine the broad group of the type (raw vs aff etc.)

Enumerator
TSK_IMG_TYPE_DETECT	Use autodetection methods.
TSK_IMG_TYPE_RAW	Raw disk image (single or split)
TSK_IMG_TYPE_RAW_SING	Raw single (backward compatibility) depreciated.
TSK_IMG_TYPE_RAW_SPLIT	Raw single (backward compatibility) depreciated.
TSK_IMG_TYPE_AFF_AFF	AFF AFF Format.
TSK_IMG_TYPE_AFF_AFD	AFD AFF Format.
TSK_IMG_TYPE_AFF_AFM	AFM AFF Format.
TSK_IMG_TYPE_AFF_ANY	Any format supported by AFFLIB (including beta ones)
TSK_IMG_TYPE_EWF_EWF	EWF version.
TSK_IMG_TYPE_VMDK_VMDK	VMDK version.
TSK_IMG_TYPE_VHD_VHD	VHD version.
TSK_IMG_TYPE_AFF4_AFF4	AFF4 version.
TSK_IMG_TYPE_QCOW_QCOW	QCOW version.
TSK_IMG_TYPE_EXTERNAL	external defined format which at least implements TSK_IMG_INFO, used by pytsk
TSK_IMG_TYPE_POOL	Pool.
TSK_IMG_TYPE_LOGICAL	Logical directory.
TSK_IMG_TYPE_UNSUPP	Unsupported disk image type.