The Sleuth Kit  4.11.1
Classes | Macros | Functions
tsk_fatxxfs.h File Reference

Contains the structures and function APIs for TSK FATXX (FAT12, FAT16, FAT32) file system support. More...

#include "tsk_fs_i.h"
#include "tsk_fatfs.h"

Classes

struct  FATXXFS_DENTRY
 
struct  FATXXFS_DENTRY_LFN
 
struct  FATXXFS_FSINFO
 
struct  FATXXFS_SB
 

Macros

#define FATXXFS_CASE_LOWER_ALL   0x18 /* both are lower */
 
#define FATXXFS_CASE_LOWER_BASE   0x08 /* base is lower case */
 
#define FATXXFS_CASE_LOWER_EXT   0x10 /* extension is lower case */
 
#define FATXXFS_DENTRY_CLUST(fsi, de)   (TSK_DADDR_T)((tsk_getu16(fsi->endian, de->startclust)) | (tsk_getu16(fsi->endian, de->highclust)<<16))
 
#define FATXXFS_IS_83_EXT(c)   (FATXXFS_IS_83_NAME((c)) && ((c) < 0x7f))
 
#define FATXXFS_IS_83_NAME(c)
 
#define FATXXFS_IS_DELETED(name, fatfs)
 
#define FATXXFS_LFN_SEQ_FIRST   0x40 /* This bit is set for the first lfn entry */
 
#define FATXXFS_LFN_SEQ_MASK
 
#define FATXXFS_SLOT_DELETED   0xe5
 
#define FATXXFS_SLOT_E5   0x05 /* actual value is 0xe5 */
 
#define FATXXFS_SLOT_EMPTY   0x00
 

Functions

TSK_RETVAL_ENUM fatxxfs_dent_parse_buf (FATFS_INFO *fatfs, TSK_FS_DIR *a_fs_dir, char *buf, TSK_OFF_T len, TSK_DADDR_T *addrs, int recursion_depth)
 /internal Parse a buffer containing the contents of a directory and add TSK_FS_NAME objects for each named file found to the TSK_FS_DIR representation of the directory. More...
 
TSK_RETVAL_ENUM fatxxfs_dinode_copy (FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FATFS_DENTRY *a_dentry, uint8_t a_cluster_is_alloc, TSK_FS_FILE *a_fs_file)
 
uint8_t fatxxfs_inode_lookup (FATFS_INFO *a_fatfs, TSK_FS_FILE *a_fs_file, TSK_INUM_T a_inum)
 
uint8_t fatxxfs_inode_walk_should_skip_dentry (FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FATFS_DENTRY *a_dentry, unsigned int a_selection_flags, int a_cluster_is_alloc)
 
int8_t fatxxfs_is_cluster_alloc (FATFS_INFO *fatfs, TSK_DADDR_T clust)
 
uint8_t fatxxfs_is_dentry (FATFS_INFO *a_fatfs, FATFS_DENTRY *a_dentry, FATFS_DATA_UNIT_ALLOC_STATUS_ENUM a_cluster_is_alloc, uint8_t a_do_basic_tests_only)
 
uint8_t fatxxfs_istat_attr_flags (FATFS_INFO *a_fatfs, TSK_INUM_T a_inum, FILE *a_hFile)
 Output the file attributes of an exFAT file directory entry in human-readable form. More...
 
uint8_t fatxxfs_open (FATFS_INFO *fatfs)
 

Detailed Description

Contains the structures and function APIs for TSK FATXX (FAT12, FAT16, FAT32) file system support.

Macro Definition Documentation

#define FATXXFS_IS_83_NAME (   c)
Value:
((((c) < 0x20) || \
((c) == 0x22) || \
(((c) >= 0x2a) && ((c) <= 0x2c)) || \
((c) == 0x2e) || \
((c) == 0x2f) || \
(((c) >= 0x3a) && ((c) <= 0x3f)) || \
(((c) >= 0x5b) && ((c) <= 0x5d)) || \
((c) == 0x7c)) == 0)
#define FATXXFS_IS_DELETED (   name,
  fatfs 
)
Value:
(fatfs->subtype == TSK_FATFS_SUBTYPE_ANDROID_1) ? \
((name[0] == 0) && (name[1] == 0)) : \
(name[0] == FATXXFS_SLOT_DELETED)
#define FATXXFS_LFN_SEQ_MASK
Value:
0x3f /* These bits are a mask for the decreasing
* sequence number for the entries */

Function Documentation

TSK_RETVAL_ENUM fatxxfs_dent_parse_buf ( FATFS_INFO fatfs,
TSK_FS_DIR a_fs_dir,
char *  buf,
TSK_OFF_T  len,
TSK_DADDR_T addrs,
int  recursion_depth 
)

/internal Parse a buffer containing the contents of a directory and add TSK_FS_NAME objects for each named file found to the TSK_FS_DIR representation of the directory.

Parameters
fatfsFile system information structure for file system that contains the directory.
a_fs_dirDirectory structure into to which parsed file metadata will be added.
bufBuffer that contains the directory contents.
lenLength of buffer in bytes (must be a multiple of sector size).
addrsArray where each element is the original address of the corresponding sector in a_buf (size of array is number of sectors in the directory).
recursion_depthRecursion depth to limit the number of self-calls
Returns
TSK_RETVAL_ENUM

References TSK_FS_META::addr, TSK_FS_DIR::addr, TSK_FS_INFO::endian, fatfs_dir_buf_add(), fatfs_dir_buf_get(), TSK_FS_DIR::fs_file, TSK_FS_INFO::last_inum, TSK_FS_FILE::meta, TSK_FS_INFO::root_inum, TSK_COR, TSK_ERR, tsk_error_print(), tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_fprintf(), TSK_FS_DIR_WALK_FLAG_ALLOC, TSK_FS_DIR_WALK_FLAG_RECURSE, TSK_FS_DIR_WALK_FLAG_UNALLOC, TSK_FS_NAME_FLAG_ALLOC, TSK_FS_NAME_FLAG_UNALLOC, TSK_FS_NAME_TYPE_DIR, TSK_FS_NAME_TYPE_REG, TSK_OK, tsk_UTF16toUTF8(), tsk_verbose, TSKconversionOK, and TSKlenientConversion.

uint8_t fatxxfs_istat_attr_flags ( FATFS_INFO a_fatfs,
TSK_INUM_T  a_inum,
FILE *  a_hFile 
)

Output the file attributes of an exFAT file directory entry in human-readable form.

Parameters
a_fatfsSource file system for the directory entry.
a_inumInode address associated with the directory entry.
a_hFileHandle of the file to which to write.
Returns
0 on success, 1 on failure, per TSK convention

References tsk_error_reset(), and tsk_fprintf().


Copyright © 2007-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.