The Sleuth Kit
4.12.1
|
Stores information about a volume / partition inside of an open volume system. More...
#include <tsk_vs.h>
Public Member Functions | |
TSK_PNUM_T | getAddr () const |
Return address of this partition. More... | |
const char * | getDesc () const |
Return UTF-8 description of partition (volume system type-specific) More... | |
TSK_VS_PART_FLAG_ENUM | getFlags () const |
Return flags for partition. More... | |
TSK_DADDR_T | getLen () const |
Return number of sectors in partition. More... | |
int8_t | getSlotNum () const |
Return entry in the table that describes this partition. More... | |
TSK_DADDR_T | getStart () const |
Return sector offset of start of partition. More... | |
int8_t | getTableNum () const |
Return table address that describes this partition. More... | |
ssize_t | read (TSK_OFF_T a_off, char *a_buf, size_t a_len) |
Reads data starting at a byte address relative to the start of a VOLUME in a volume system. More... | |
ssize_t | readBlock (TSK_DADDR_T a_addr, char *a_buf, size_t a_len) |
Reads one or more blocks of data with an address relative to the start of a VOLUME in a volume system. More... | |
TskVsPartInfo (TSK_VS_PART_INFO *a_vsPartInfo) | |
Create an object from its C struct. More... | |
Friends | |
class | TskFsInfo |
Stores information about a volume / partition inside of an open volume system.
|
inline |
Create an object from its C struct.
a_vsPartInfo | Pointer to C struct for partition. If NULL, the remaining getX() methods will be undefined. |
|
inline |
Return address of this partition.
References TSK_VS_PART_INFO::addr.
|
inline |
Return UTF-8 description of partition (volume system type-specific)
References TSK_VS_PART_INFO::desc.
|
inline |
|
inline |
Return number of sectors in partition.
References TSK_VS_PART_INFO::len.
|
inline |
Return entry in the table that describes this partition.
References TSK_VS_PART_INFO::slot_num.
|
inline |
Return sector offset of start of partition.
References TSK_VS_PART_INFO::start.
|
inline |
Return table address that describes this partition.
References TSK_VS_PART_INFO::table_num.
|
inline |
Reads data starting at a byte address relative to the start of a VOLUME in a volume system.
See tsk_vs_part_read() for details.
a_off | Byte offset to read from, relative to start of VOLUME in volume system. |
a_buf | Buffer to store data in |
a_len | Amount of data to read (in bytes) |
References tsk_vs_part_read().
|
inline |
Reads one or more blocks of data with an address relative to the start of a VOLUME in a volume system.
See tsk_vs_part_read_block() for details.
a_addr | Block address to start reading from, relative to start of VOLUME in volume system. |
a_buf | Buffer to store data in |
a_len | Amount of data to read (in bytes - must be a multiple of block_size) |
References tsk_vs_part_read_block().
Copyright © 2007-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.