The Sleuth Kit
4.11.1
|
Public Attributes | |
uint8_t | boot_code [390] |
Boot program. | |
uint8_t | bytes_per_sector |
Power of 2. Minimum 2^9 = 512 bytes, maximum 2^12 = 4096 bytes. | |
uint8_t | cluster_cnt [4] |
Number of clusters in the cluster heap. | |
uint8_t | cluster_heap_offset [4] |
Sector address of the data region. | |
uint8_t | drive_select |
Used by INT 13. | |
uint8_t | fat_len_in_sectors [4] |
Size of FAT in sectors. | |
uint8_t | fat_offset [4] |
Sector address of first FAT. | |
uint8_t | fs_name [8] |
"EXFAT " | |
uint8_t | fs_revision [2] |
VV.MM. | |
uint8_t | jump_to_boot_code [3] |
0xEB7690 | |
uint8_t | must_be_zeros [53] |
Must be 0x00. | |
uint8_t | num_fats |
1 or 2 (only 2 if TexFAT is in use) | |
uint8_t | partition_offset [8] |
Sector address. | |
uint8_t | percent_of_cluster_heap_in_use |
Percentage of the heap in use. | |
uint8_t | reserved [7] |
Reserved. | |
uint8_t | root_dir_cluster [4] |
Cluster address of the root directory. | |
uint8_t | sectors_per_cluster |
Power of 2. Minimum 2^1 = 2. Maximum is dependant on the fact that the max cluster size is 32 MiB. | |
uint8_t | signature [2] |
0xAA55 | |
uint8_t | vol_flags [2] |
Flags: ActiveFAT, Volume Dirty, Media Failure, Clear to Zero, and Reserved. | |
uint8_t | vol_len_in_sectors [8] |
Size of total volume in sectors. | |
uint8_t | vol_serial_no [4] |
Volume serial number. | |
Copyright © 2007-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.