The Sleuth Kit  4.11.1
Macros | Functions
tsk_vs_i.h File Reference

Contains the internal library definitions for the volume system functions. More...

#include "tsk/base/tsk_base_i.h"
#include "tsk/img/tsk_img_i.h"
#include "tsk_vs.h"
#include <sys/types.h>

Macros

#define tsk_vs_guessu16(vs, x, mag)   tsk_guess_end_u16(&(vs->endian), (x), (mag))
 
#define tsk_vs_guessu32(vs, x, mag)   tsk_guess_end_u32(&(vs->endian), (x), (mag))
 
#define tsk_vs_guessu64(vs, x, mag)   tsk_guess_end_u64(&(vs->endian), (x), (mag))
 

Functions

TSK_VS_INFOtsk_vs_bsd_open (TSK_IMG_INFO *, TSK_DADDR_T)
 
TSK_VS_INFOtsk_vs_dos_open (TSK_IMG_INFO *, TSK_DADDR_T, uint8_t)
 
TSK_VS_INFOtsk_vs_gpt_open (TSK_IMG_INFO *, TSK_DADDR_T)
 
TSK_VS_INFOtsk_vs_mac_open (TSK_IMG_INFO *, TSK_DADDR_T)
 
TSK_VS_PART_INFOtsk_vs_part_add (TSK_VS_INFO *, TSK_DADDR_T, TSK_DADDR_T, TSK_VS_PART_FLAG_ENUM, char *, int8_t, int8_t)
 Add a partition to a sorted list. More...
 
void tsk_vs_part_free (TSK_VS_INFO *)
 
uint8_t tsk_vs_part_unused (TSK_VS_INFO *)
 Identify regions in the partition list where there are unused sectors and create new entries for them. More...
 
TSK_VS_INFOtsk_vs_sun_open (TSK_IMG_INFO *, TSK_DADDR_T)
 

Detailed Description

Contains the internal library definitions for the volume system functions.

This should be included by the code in the volume system library.

Function Documentation

TSK_VS_PART_INFO* tsk_vs_part_add ( TSK_VS_INFO a_vs,
TSK_DADDR_T  a_start,
TSK_DADDR_T  len,
TSK_VS_PART_FLAG_ENUM  type,
char *  desc,
int8_t  table,
int8_t  slot 
)

Add a partition to a sorted list.

Parameters
a_vsVolume system that partition belongs to
a_startStarting sector address of volume (relative to start of volume)
lenLength of volume in sectors
typeType of volume
descText description of partition. Note that this is not copied and must not be freed until the volume system has been closed.
tableThe table ID that the volume was located in or -1 for volumes not in a partition table.
slotThe slot number in the partition table that the volume was located in or -1 for volumes not in a partition table.
Returns
Pointer to structure that was created for the partition or NULL on error.

References TSK_VS_PART_INFO::addr, TSK_VS_PART_INFO::desc, TSK_VS_PART_INFO::flags, TSK_VS_PART_INFO::len, TSK_VS_PART_INFO::next, TSK_VS_INFO::part_count, TSK_VS_INFO::part_list, TSK_VS_PART_INFO::prev, TSK_VS_PART_INFO::slot_num, TSK_VS_PART_INFO::start, TSK_VS_PART_INFO::table_num, and TSK_VS_PART_INFO::vs.

Referenced by tsk_vs_part_unused().

uint8_t tsk_vs_part_unused ( TSK_VS_INFO a_vs)

Identify regions in the partition list where there are unused sectors and create new entries for them.

Parameters
a_vsPointer to open volume system
Returns
1 on error and 0 on success

References TSK_VS_INFO::block_size, TSK_VS_PART_INFO::flags, TSK_VS_INFO::img_info, TSK_VS_PART_INFO::len, TSK_VS_PART_INFO::next, TSK_VS_INFO::part_list, TSK_IMG_INFO::size, TSK_VS_PART_INFO::start, tsk_vs_part_add(), TSK_VS_PART_FLAG_META, and TSK_VS_PART_FLAG_UNALLOC.


Copyright © 2007-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.