tsk_img.h File Reference

Contains the external library definitions for the disk image functions. More...

Classes
struct	TSK_IMG_INFO
	Created when a disk image has been opened and stores general information and handles. More...
class	TskImgInfo
	Stores information about an image that is open and being analyzed. More...

Macros
#define	TSK_IMG_INFO_CACHE_LEN   65536
#define	TSK_IMG_INFO_CACHE_NUM   32
#define	TSK_IMG_INFO_TAG   0x39204231
#define	TSK_IMG_TYPE_ISAFF(t)
	Macro that takes a image type and returns 1 if the type is for an AFF file format. More...
#define	TSK_IMG_TYPE_ISDIR(t)   ((((t) & TSK_IMG_TYPE_LOGICAL))?1:0)
	Macro that takes a image type and returns 1 if the type is for a logical directory file format. More...
#define	TSK_IMG_TYPE_ISEWF(t)   ((((t) & TSK_IMG_TYPE_EWF_EWF))?1:0)
	Macro that takes a image type and returns 1 if the type is for an EWF file format. More...
#define	TSK_IMG_TYPE_ISRAW(t)   ((((t) & TSK_IMG_TYPE_RAW))?1:0)
	Macro that takes a image type and returns 1 if the type is for a raw file format. More...

Typedefs
typedef struct TSK_IMG_INFO	TSK_IMG_INFO

Enumerations
enum	TSK_IMG_TYPE_ENUM {   TSK_IMG_TYPE_DETECT = 0x0000, TSK_IMG_TYPE_RAW = 0x0001, TSK_IMG_TYPE_RAW_SING = TSK_IMG_TYPE_RAW, TSK_IMG_TYPE_RAW_SPLIT = TSK_IMG_TYPE_RAW,   TSK_IMG_TYPE_AFF_AFF = 0x0004, TSK_IMG_TYPE_AFF_AFD = 0x0008, TSK_IMG_TYPE_AFF_AFM = 0x0010, TSK_IMG_TYPE_AFF_ANY = 0x0020,   TSK_IMG_TYPE_EWF_EWF = 0x0040, TSK_IMG_TYPE_VMDK_VMDK = 0x0080, TSK_IMG_TYPE_VHD_VHD = 0x0100, TSK_IMG_TYPE_EXTERNAL = 0x1000,   TSK_IMG_TYPE_POOL = 0x4000, TSK_IMG_TYPE_LOGICAL = 0x8000, TSK_IMG_TYPE_UNSUPP = 0xffff }
	Flag values for the disk image format type. More...

Functions
void	tsk_img_close (TSK_IMG_INFO *)
	Closes an open disk image. More...
TSK_IMG_INFO *	tsk_img_open (int, const TSK_TCHAR *const images[], TSK_IMG_TYPE_ENUM, unsigned int a_ssize)
	Opens one or more disk image files so that they can be read. More...
TSK_IMG_INFO *	tsk_img_open_external (void *ext_img_info, TSK_OFF_T size, unsigned int sector_size, ssize_t(*read)(TSK_IMG_INFO *img, TSK_OFF_T off, char *buf, size_t len), void(*close)(TSK_IMG_INFO *), void(*imgstat)(TSK_IMG_INFO *, FILE *))
	Opens an an image of type TSK_IMG_TYPE_EXTERNAL. More...
TSK_IMG_INFO *	tsk_img_open_sing (const TSK_TCHAR *a_image, TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)
	Opens a single (non-split) disk image file so that it can be read. More...
TSK_IMG_INFO *	tsk_img_open_utf8 (int num_img, const char *const images[], TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)
	Opens one or more disk image files so that they can be read. More...
TSK_IMG_INFO *	tsk_img_open_utf8_sing (const char *a_image, TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)
	Opens a single (non-split) disk image file so that it can be read. More...
ssize_t	tsk_img_read (TSK_IMG_INFO *img, TSK_OFF_T off, char *buf, size_t len)
	Reads data from an open disk image. More...
void	tsk_img_type_print (FILE *)
	Prints the name and description of the supported image types to a handle. More...
TSK_IMG_TYPE_ENUM	tsk_img_type_supported ()
	Returns the supported file format types. More...
const char *	tsk_img_type_todesc (TSK_IMG_TYPE_ENUM)
	Returns the description of an image format type, given its type ID. More...
TSK_IMG_TYPE_ENUM	tsk_img_type_toid (const TSK_TCHAR *)
	Parses a string that specifies an image format to determine the associated type ID. More...
TSK_IMG_TYPE_ENUM	tsk_img_type_toid_utf8 (const char *)
	Parses a string that specifies an image format to determine the associated type ID. More...
const char *	tsk_img_type_toname (TSK_IMG_TYPE_ENUM)
	Returns the name of an image format type, given its type ID. More...

Detailed Description

Contains the external library definitions for the disk image functions.

Note that this file is not meant to be directly included. It is included by both libtsk.h and tsk_img_i.h.

Enumeration Type Documentation

enum TSK_IMG_TYPE_ENUM

Flag values for the disk image format type.

Each type has a bit associated with it. There are TSK_IMG_TYPE_ISXXX macros to determine the broad group of the type (raw vs aff etc.)

Enumerator
TSK_IMG_TYPE_DETECT	Use autodetection methods.
TSK_IMG_TYPE_RAW	Raw disk image (single or split)
TSK_IMG_TYPE_RAW_SING	Raw single (backward compatibility) depreciated.
TSK_IMG_TYPE_RAW_SPLIT	Raw single (backward compatibility) depreciated.
TSK_IMG_TYPE_AFF_AFF	AFF AFF Format.
TSK_IMG_TYPE_AFF_AFD	AFD AFF Format.
TSK_IMG_TYPE_AFF_AFM	AFM AFF Format.
TSK_IMG_TYPE_AFF_ANY	Any format supported by AFFLIB (including beta ones)
TSK_IMG_TYPE_EWF_EWF	EWF version.
TSK_IMG_TYPE_VMDK_VMDK	VMDK version.
TSK_IMG_TYPE_VHD_VHD	VHD version.
TSK_IMG_TYPE_EXTERNAL	external defined format which at least implements TSK_IMG_INFO, used by pytsk
TSK_IMG_TYPE_POOL	Pool.
TSK_IMG_TYPE_LOGICAL	Logical directory.
TSK_IMG_TYPE_UNSUPP	Unsupported disk image type.