|
The Sleuth Kit
4.2
|
| C_TSK_DB_FILE_LAYOUT_RANGE | Structure wrapping a single file_layout db entry |
| C_TSK_DB_FS_INFO | Structure wrapping a single fs info db entry |
| C_TSK_DB_OBJECT | Structure wrapping a single tsk objects db entry |
| C_TSK_DB_VS_INFO | Structure wrapping a single vs info db entry |
| C_TSK_DB_VS_PART_INFO | |
| C_YaffsCacheChunk | |
| C_YaffsCacheChunkGroup | |
| C_YaffsCacheObject | |
| C_YaffsCacheVersion | |
| C_YaffsChunk | |
| Cbsd_disklabel | |
| Ccm_t | |
| Cdate_time | |
| CDECMPFS_DISK_HEADER | |
| Cdos_part | |
| Cdos_sect | |
| CEXFATFS_ACCESS_CTRL_TABLE_DIR_ENTRY | Access control table directory entry structure for exFAT file systems |
| CEXFATFS_ALLOC_BITMAP_DIR_ENTRY | Allocation bitmap directory entry structure for exFAT file systems |
| CEXFATFS_FILE_DIR_ENTRY | |
| CEXFATFS_FILE_NAME_DIR_ENTRY | File name directory entry structure for exFAT file systems |
| CEXFATFS_FILE_STREAM_DIR_ENTRY | Stream extension directory entry structure for exFAT file systems |
| CEXFATFS_MASTER_BOOT_REC | |
| CEXFATFS_TEXFAT_DIR_ENTRY | TexFAT (transactional exFAT) directory entry structure for exFAT file systems |
| CEXFATFS_UPCASE_TABLE_DIR_ENTRY | UP-Case table directory entry structure for exFAT file systems |
| CEXFATFS_VOL_GUID_DIR_ENTRY | Volume GUID directory entry structure for exFAT file systems |
| CEXFATFS_VOL_LABEL_DIR_ENTRY | Volume label directory entry structure for exFAT file systems |
| Cext2fs_dentry1 | |
| Cext2fs_dentry2 | |
| Cext2fs_ea_entry | |
| Cext2fs_ea_header | |
| Cext2fs_extent | |
| Cext2fs_extent_header | |
| Cext2fs_extent_idx | |
| Cext2fs_gd | |
| CEXT2FS_INFO | |
| Cext2fs_inode | |
| CEXT2FS_JINFO | |
| Cext2fs_journ_dentry | |
| Cext2fs_journ_head | |
| Cext2fs_journ_sb | |
| Cext2fs_pos_acl_entry_lo | |
| Cext2fs_pos_acl_entry_sh | |
| Cext2fs_pos_acl_head | |
| ►Cext2fs_sb | |
| Cext4fs_gd | |
| Cext4fs_journ_commit_head | |
| Cext_attr_rec | |
| CFATFS_DENTRY | Generic directory entry structure for FAT file systems |
| CFATFS_INFO | |
| CFATFS_MASTER_BOOT_RECORD | |
| CFATXXFS_DENTRY | |
| CFATXXFS_DENTRY_LFN | |
| CFATXXFS_FSINFO | |
| CFATXXFS_SB | |
| Cffs_cgd | |
| Cffs_cgd2 | |
| Cffs_csum1 | |
| Cffs_csum2 | |
| Cffs_dentry1 | |
| Cffs_dentry2 | |
| Cffs_extattr | |
| CFFS_INFO | |
| Cffs_inode | |
| Cffs_inode1 | |
| Cffs_inode1b | |
| Cffs_inode2 | |
| Cffs_sb1 | |
| Cffs_sb2 | |
| Cgpt_entry | |
| Cgpt_head | |
| Chfs_access_perm | |
| Chfs_attr_data | |
| Chfs_btree_header_record | |
| Chfs_btree_index_record | |
| Chfs_btree_key_attr | |
| Chfs_btree_key_cat | |
| Chfs_btree_key_ext | |
| Chfs_btree_node | |
| CHFS_ENTRY | |
| Chfs_ext_desc | |
| Chfs_extendedfileinfo | |
| Chfs_extents | |
| Chfs_file | |
| Chfs_file_fold_std | |
| Chfs_file_folder | |
| Chfs_fileinfo | |
| Chfs_folder | |
| Chfs_fork | |
| CHFS_INFO | |
| Chfs_journ_sb | |
| Chfs_mdb | |
| Chfs_plus_vh | |
| Chfs_point | |
| Chfs_resource | |
| Chfs_resource_fork_header | |
| Chfs_resource_fork_map_header | |
| Chfs_resource_refListItem | |
| Chfs_resource_type_list | |
| Chfs_resource_type_list_item | |
| Chfs_thread | |
| Chfs_uni_str | |
| CIMG_RAW_INFO | |
| CIMG_SPLIT_CACHE | |
| Ciso9660_dentry | |
| Ciso9660_gvd | |
| Ciso9660_inode | |
| Ciso9660_inode_node | |
| Ciso9660_pvd | |
| Ciso9660_pvd_node | |
| Ciso9660_root_dentry | |
| Ciso9660_rr_cl_entry | |
| Ciso9660_rr_nm_entry | |
| Ciso9660_rr_pn_entry | |
| Ciso9660_rr_px_entry | |
| Ciso9660_rr_re_entry | |
| Ciso9660_rr_sf_entry | |
| Ciso9660_rr_sl_entry | |
| Ciso9660_rr_tf_entry | |
| Ciso9660_susp_ce | |
| Ciso9660_susp_er | |
| Ciso9660_susp_head | |
| Ciso9660_susp_sp | |
| Ciso9660_svd | |
| Ciso9660_svd_node | |
| Ciso_bootrec | |
| CISO_INFO | |
| Cmac_part | |
| Cntfs_attr | |
| Cntfs_attr_fname | |
| Cntfs_attr_objid | |
| Cntfs_attr_sdh | |
| Cntfs_attr_sds | |
| Cntfs_attr_si | |
| Cntfs_attr_sii | |
| Cntfs_attr_vinfo | |
| Cntfs_attrdef | |
| Cntfs_attrlist | |
| Cntfs_idxelist | |
| Cntfs_idxentry | |
| Cntfs_idxrec | |
| Cntfs_idxroot | |
| CNTFS_INFO | |
| Cntfs_mft | |
| Cntfs_runlist | |
| Cntfs_sb | |
| Cntfs_self_relative_security_descriptor | |
| Cntfs_sid | |
| CNTFS_SXX_BUFFER | |
| Cntfs_upd | |
| Cpath_table_rec | |
| Crecord_data | |
| Crockridge_ext | |
| Crr_sys_use | |
| CSHA256_CTX | |
| CSHA512_CTX | |
| Csun_dlabel_i386 | |
| Csun_dlabel_sparc | |
| CTSK_ERROR_INFO | |
| CTSK_FS_ATTR | Holds information about the location of file content (or a file attribute) |
| CTSK_FS_ATTR_RUN | Holds information about a single data run, which has a starting address and length |
| CTSK_FS_ATTRLIST | Structure used as the head of an attribute list |
| CTSK_FS_BLOCK | Generic data structure to hold block data with metadata |
| CTSK_FS_BLOCK_WALK_CPP_DATA | |
| CTSK_FS_DIR | A handle to a directory so that its files can be individually accessed |
| CTSK_FS_DIR_WALK_CPP_DATA | |
| CTSK_FS_FILE | Generic structure used to refer to files in the file system |
| CTSK_FS_FILE_WALK_CPP_DATA | |
| CTSK_FS_HASH_RESULTS | |
| CTSK_FS_INFO | Stores state information for an open file system |
| CTSK_FS_JBLK_WALK_CPP_DATA | |
| CTSK_FS_JENTRY | |
| CTSK_FS_JENTRY_WALK_CPP_DATA | |
| CTSK_FS_LOAD_FILE | |
| CTSK_FS_META | TSK data structure to store general file and directory metadata |
| CTSK_FS_META_NAME_LIST | Relatively generic structure to hold file names that are stored with the file metadata |
| CTSK_FS_META_WALK_CPP_DATA | |
| CTSK_FS_NAME | Generic structure to store the file name information that is stored in a directory |
| CTSK_HDB_BINSRCH_INFO | Represents a text-format hash database (NSRL, EnCase, etc.) with the TSK binary search index |
| CTSK_HDB_INFO | Represents an open hash database |
| CTSK_IMG_INFO | Created when a disk image has been opened and stores general information and handles |
| CTSK_LIST | Linked list structure that holds a 'key' and optional 'length' |
| Ctsk_lock_t | |
| CTSK_MD5_CTX | |
| CTSK_SHA_CTX | |
| CTSK_SQLITE_HDB_INFO | Represents a TSK SQLite hash database (it doesn't need an external index) |
| CTSK_STACK | Basic stack structure to push and pop (used for finding loops in recursion) |
| CTSK_VS_INFO | Data structure used to store state and basic information for open volume systems |
| CTSK_VS_PART_INFO | Linked list entry that describes a volume in a generic way |
| CTSK_VS_PART_WALK_CPP_DATA | |
| ►CTskAuto | C++ class that automatically analyzes a disk image to extract files from it |
| CTskAutoDb | |
| CTskCaseDb | Stores case-level information in a database on one or more disk images |
| CTskDbSqlite | |
| CTskError | Allows access to most recent error message and code in the thread |
| CTskFsAttribute | Stores information about a file attribute |
| CTskFsAttrRun | Contains information about a single data run, which has a starting address and length |
| CTskFsBlock | Stores information about a file system block |
| CTskFsDir | Stores information about a directory in the file system |
| CTskFsFile | Class that represents an allocated or deleted file |
| CTskFsInfo | Stores information about an open file system |
| CTskFsJEntry | |
| CTskFsMeta | Stores metadata about a file |
| CTskFsMetaName | Stores information about names that are located in metadata structures |
| CTskFsName | Stores the file name information that is stored in a directory |
| CTskHashInfo | |
| CTskHdbInfo | Stores information about an open hash database |
| CTskImgInfo | Stores information about an image that is open and being analyzed |
| CTskVsInfo | Stores information about an open volume system |
| CTskVsPartInfo | Stores information about a volume / partition inside of an open volume system |
| CYAFFSFS_INFO | |
| CyaffsObj_header | |
| CyaffsObj_spare |
Copyright © 2007-2015 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.