C Disk Image Functions

Macros
#define	TSK_IMG_TYPE_ISAFF(t)
	Macro that takes a image type and returns 1 if the type is for an AFF file format. More...
#define	TSK_IMG_TYPE_ISDIR(t)   ((((t) & TSK_IMG_TYPE_LOGICAL))?1:0)
	Macro that takes a image type and returns 1 if the type is for a logical directory file format. More...
#define	TSK_IMG_TYPE_ISEWF(t)   ((((t) & TSK_IMG_TYPE_EWF_EWF))?1:0)
	Macro that takes a image type and returns 1 if the type is for an EWF file format. More...
#define	TSK_IMG_TYPE_ISRAW(t)   ((((t) & TSK_IMG_TYPE_RAW))?1:0)
	Macro that takes a image type and returns 1 if the type is for a raw file format. More...

Functions
void	tsk_img_close (TSK_IMG_INFO *a_img_info)
	Closes an open disk image. More...
TSK_IMG_INFO *	tsk_img_open (int num_img, const TSK_TCHAR *const images[], TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)
	Opens one or more disk image files so that they can be read. More...
TSK_IMG_INFO *	tsk_img_open_external (void *ext_img_info, TSK_OFF_T size, unsigned int sector_size, ssize_t(*read)(TSK_IMG_INFO *img, TSK_OFF_T off, char *buf, size_t len), void(*close)(TSK_IMG_INFO *), void(*imgstat)(TSK_IMG_INFO *, FILE *))
	Opens an an image of type TSK_IMG_TYPE_EXTERNAL. More...
TSK_IMG_INFO *	tsk_img_open_sing (const TSK_TCHAR *a_image, TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)
	Opens a single (non-split) disk image file so that it can be read. More...
TSK_IMG_INFO *	tsk_img_open_utf8 (int num_img, const char *const images[], TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)
	Opens one or more disk image files so that they can be read. More...
TSK_IMG_INFO *	tsk_img_open_utf8_sing (const char *a_image, TSK_IMG_TYPE_ENUM type, unsigned int a_ssize)
	Opens a single (non-split) disk image file so that it can be read. More...
ssize_t	tsk_img_read (TSK_IMG_INFO *a_img_info, TSK_OFF_T a_off, char *a_buf, size_t a_len)
	Reads data from an open disk image. More...
void	tsk_img_type_print (FILE *hFile)
	Prints the name and description of the supported image types to a handle. More...
TSK_IMG_TYPE_ENUM	tsk_img_type_supported ()
	Returns the supported file format types. More...
const char *	tsk_img_type_todesc (TSK_IMG_TYPE_ENUM type)
	Returns the description of an image format type, given its type ID. More...
TSK_IMG_TYPE_ENUM	tsk_img_type_toid (const TSK_TCHAR *str)
	Parses a string that specifies an image format to determine the associated type ID. More...
TSK_IMG_TYPE_ENUM	tsk_img_type_toid_utf8 (const char *str)
	Parses a string that specifies an image format to determine the associated type ID. More...
const char *	tsk_img_type_toname (TSK_IMG_TYPE_ENUM type)
	Returns the name of an image format type, given its type ID. More...

Detailed Description

Macro Definition Documentation

#define TSK_IMG_TYPE_ISAFF

(

t

)

Value:

((((t) & TSK_IMG_TYPE_AFF_AFF) || ((t) & TSK_IMG_TYPE_AFF_AFD)  || ((t) & TSK_IMG_TYPE_AFF_AFM) || \
    ((t) & TSK_IMG_TYPE_AFF_ANY))?1:0)

Macro that takes a image type and returns 1 if the type is for an AFF file format.

#define TSK_IMG_TYPE_ISDIR

(

t

)

((((t) & TSK_IMG_TYPE_LOGICAL))?1:0)

Macro that takes a image type and returns 1 if the type is for a logical directory file format.

#define TSK_IMG_TYPE_ISEWF

(

t

)

((((t) & TSK_IMG_TYPE_EWF_EWF))?1:0)

Macro that takes a image type and returns 1 if the type is for an EWF file format.

#define TSK_IMG_TYPE_ISRAW

(

t

)

((((t) & TSK_IMG_TYPE_RAW))?1:0)

Macro that takes a image type and returns 1 if the type is for a raw file format.

Function Documentation

void tsk_img_close

(

TSK_IMG_INFO *

a_img_info

)

Closes an open disk image.

Parameters

a_img_info

Pointer to the open disk image structure.

References TSK_IMG_INFO::cache_lock.

Referenced by TskAuto::closeImage(), and TskAuto::findFilesInPool().

TSK_IMG_INFO* tsk_img_open	(	int	num_img,
		const TSK_TCHAR *const	images[],
		TSK_IMG_TYPE_ENUM	type,
		unsigned int	a_ssize
	)

Opens one or more disk image files so that they can be read.

If a file format type is specified, this function will call the specific routine to open the file. Otherwise, it will detect the type (it will default to raw if no specific type can be detected). This function must be called before a disk image can be read from. Note that the data type used to store the image paths is a TSK_TCHAR, which changes depending on a Unix or Windows build. If you will always have UTF8, then consider using tsk_img_open_utf8().

Parameters

num_img	The number of images to open (will be > 1 for split images).
images	The path to the image files (the number of files must be equal to num_img and they must be in a sorted order)
type	The disk image type (can be autodetection)
a_ssize	Size of device sector in bytes (or 0 for default)

Returns

Pointer to TSK_IMG_INFO or NULL on error

References TSK_IMG_INFO::cache_lock, TSK_IMG_INFO::itype, PRIttocTSK, tsk_error_get_errno(), tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), TSK_IMG_TYPE_AFF_AFD, TSK_IMG_TYPE_AFF_AFF, TSK_IMG_TYPE_AFF_AFM, TSK_IMG_TYPE_AFF_ANY, TSK_IMG_TYPE_DETECT, TSK_IMG_TYPE_EWF_EWF, TSK_IMG_TYPE_LOGICAL, TSK_IMG_TYPE_RAW, TSK_IMG_TYPE_VHD_VHD, TSK_IMG_TYPE_VMDK_VMDK, and tsk_verbose.

Referenced by TskImgInfo::open(), TskAuto::openImage(), tsk_img_open_sing(), and tsk_img_open_utf8().

TSK_IMG_INFO* tsk_img_open_external	(	void *	ext_img_info,
		TSK_OFF_T	size,
		unsigned int	sector_size,
		ssize_t(*)(TSK_IMG_INFO *img, TSK_OFF_T off, char *buf, size_t len)	read,
		void(*)(TSK_IMG_INFO *)	close,
		void(*)(TSK_IMG_INFO *, FILE *)	imgstat
	)

Opens an an image of type TSK_IMG_TYPE_EXTERNAL.

The void pointer parameter must be castable to a TSK_IMG_INFO pointer. It is up to the caller to set the tag value in ext_img_info. This method will initialize the cache lock.

Parameters

ext_img_info	Pointer to the partially initialized disk image structure, having a TSK_IMG_INFO as its first member
size	Total size of image in bytes
sector_size	Sector size of device in bytes
read	Pointer to user-supplied read function
close	Pointer to user-supplied close function
imgstat	Pointer to user-supplied imgstat function

Returns

Pointer to TSK_IMG_INFO or NULL on error

References TSK_IMG_INFO::cache_lock, TSK_IMG_INFO::imgstat, TSK_IMG_INFO::itype, TSK_IMG_INFO::sector_size, TSK_IMG_INFO::size, TSK_IMG_INFO::tag, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), and TSK_IMG_TYPE_EXTERNAL.

TSK_IMG_INFO* tsk_img_open_sing	(	const TSK_TCHAR *	a_image,
		TSK_IMG_TYPE_ENUM	type,
		unsigned int	a_ssize
	)

Opens a single (non-split) disk image file so that it can be read.

This is a wrapper around tsk_img_open(). See it for more details on detection etc. See tsk_img_open_sing_utf8() for a version of this function that always takes UTF-8 as input.

Parameters

a_image	The path to the image file
type	The disk image type (can be autodetection)
a_ssize	Size of device sector in bytes (or 0 for default)

Returns

Pointer to TSK_IMG_INFO or NULL on error

References tsk_img_open().

Referenced by TskImgInfo::open().

TSK_IMG_INFO* tsk_img_open_utf8	(	int	num_img,
		const char *const	images[],
		TSK_IMG_TYPE_ENUM	type,
		unsigned int	a_ssize
	)

Opens one or more disk image files so that they can be read.

This is a wrapper around tsk_img_open() and this version always takes a UTF-8 encoding of the image files. See its description for more details.

Parameters

num_img	The number of images to open (will be > 1 for split images).
images	The path to the UTF-8 encoded image files (the number of files must be equal to num_img and they must be in a sorted order)
type	The disk image type (can be autodetection)
a_ssize	Size of device sector in bytes (or 0 for default)

Returns

Pointer to TSK_IMG_INFO or NULL on error

References TSK_IMG_INFO::cache_lock, tsk_error_set_errno(), tsk_error_set_errstr(), tsk_img_open(), tsk_UTF8toUTF16(), TSKconversionOK, and TSKlenientConversion.

Referenced by TskAuto::openImageUtf8(), and tsk_img_open_utf8_sing().

TSK_IMG_INFO* tsk_img_open_utf8_sing	(	const char *	a_image,
		TSK_IMG_TYPE_ENUM	type,
		unsigned int	a_ssize
	)

Opens a single (non-split) disk image file so that it can be read.

This version always takes a UTF-8 encoding of the disk image. See tsk_img_open_sing() for a version that takes a wchar_t or char depending on the platform. This is a wrapper around tsk_img_open(). See it for more details on detection etc.

Parameters

a_image	The UTF-8 path to the image file
type	The disk image type (can be autodetection)
a_ssize	Size of device sector in bytes (or 0 for default)

Returns

Pointer to TSK_IMG_INFO or NULL on error

References tsk_img_open_utf8().

ssize_t tsk_img_read	(	TSK_IMG_INFO *	a_img_info,
		TSK_OFF_T	a_off,
		char *	a_buf,
		size_t	a_len
	)

Reads data from an open disk image.

Parameters

a_img_info	Disk image to read from
a_off	Byte offset to start reading from
a_buf	Buffer to read into
a_len	Number of bytes to read into buffer

Returns

-1 on error or number of bytes read

References TSK_IMG_INFO::cache, TSK_IMG_INFO::cache_age, TSK_IMG_INFO::cache_len, TSK_IMG_INFO::cache_lock, TSK_IMG_INFO::cache_off, TSK_IMG_INFO::size, tsk_error_reset(), tsk_error_set_errno(), and tsk_error_set_errstr().

Referenced by TskImgInfo::read(), tsk_fs_block_get_flag(), tsk_fs_read_block_decrypt(), tsk_fs_read_decrypt(), tsk_vs_part_read(), tsk_vs_part_read_block(), and tsk_vs_read_block().

void tsk_img_type_print

(

FILE *

hFile

)

Prints the name and description of the supported image types to a handle.

This is used by the TSK command line tools to print the supported types to the console.

Parameters

hFile

Handle to print names and descriptions to.

References tsk_fprintf().

Referenced by TskImgInfo::typePrint().

TSK_IMG_TYPE_ENUM tsk_img_type_supported

(

)

Returns the supported file format types.

Returns

A bit in the return value is set to 1 if the type is supported.

Referenced by TskImgInfo::typeSupported().

const char* tsk_img_type_todesc

(

TSK_IMG_TYPE_ENUM

type

)

Returns the description of an image format type, given its type ID.

Parameters

type	ID of image type

Returns

Pointer to string of the description

Referenced by TskImgInfo::typeToDesc().

TSK_IMG_TYPE_ENUM tsk_img_type_toid

(

const TSK_TCHAR *

str

)

Parses a string that specifies an image format to determine the associated type ID.

This is used by the TSK command line tools to parse the type given on the command line.

Parameters

str	String of image format type

Returns

ID of image type

References tsk_img_type_toid_utf8().

Referenced by TskImgInfo::typeToId().

TSK_IMG_TYPE_ENUM tsk_img_type_toid_utf8

(

const char *

str

)

Parses a string that specifies an image format to determine the associated type ID.

This is used by the TSK command line tools to parse the type given on the command line.

Parameters

str	String of image format type, always UTF-8

Returns

ID of image type

References TSK_IMG_TYPE_UNSUPP.

Referenced by tsk_img_type_toid().

const char* tsk_img_type_toname

(

TSK_IMG_TYPE_ENUM

type

)

Returns the name of an image format type, given its type ID.

Parameters

type	ID of image type

Returns

Pointer to string of the name.

Referenced by TskImgInfo::typeToName().