Stores metadata about a file. More...

#include <tsk_fs.h>

Public Member Functions
TSK_INUM_T	getAddr () const
	get address of the meta data structure for this file More...

time_t	getATime () const
	get last file content accessed time (stored in number of seconds since Jan 1, 1970 UTC) More...

uint32_t	getATimeNano () const
	get nano-second resolution of accessed time More...

time_t	getBackUpTime () const
	get HFS+ backup time More...

uint32_t	getBackUpTimeNano () const
	get nano-second resolution of HFS+ backup time More...

time_t	getCrTime () const
	get created time (stored in number of seconds since Jan 1, 1970 UTC) More...

uint32_t	getCrTimeNano () const
	get nano-second resolution of created time More...

time_t	getCTime () const
	get last file / metadata status change time (stored in number of seconds since Jan 1, 1970 UTC) More...

uint32_t	getCTimeNano () const
	get nano-second resolution of change time More...

time_t	getDTime () const
	get linux deletion time More...

uint32_t	getDTimeNano () const
	get nano-second resolution of deletion time More...

TSK_FS_META_FLAG_ENUM	getFlags () const
	get flags for this file for its allocation status etc. More...

TSK_GID_T	getGid () const
	get group id More...

const char *	getLink () const
	get name of target file if this is a symbolic link More...

uint8_t	getLs (char *a_buf, size_t a_len) const
	Makes the "ls -l" permissions string for a file. More...

TSK_FS_META_MODE_ENUM	getMode () const
	get Unix-style permissions More...

time_t	getMTime () const
	get last file content modification time (stored in number of seconds since Jan 1, 1970 UTC) More...

uint32_t	getMTimeNano () const
	get nano-second resolution of modification time More...

const TskFsMetaName *	getName2 (int a_idx) const
	Return a name that is stored in the metadata. More...

int	getName2Count () const
	Return the number of names that are stored in the metadata. More...

int	getNLink () const
	get link count (number of file names pointing to this) More...

uint32_t	getSeq () const
	get sequence number for file (NTFS only, is incremented when entry is reallocated) More...

TSK_OFF_T	getSize () const
	get file size (in bytes) More...

TSK_FS_META_TYPE_ENUM	getType () const
	get file type More...

TSK_UID_T	getUid () const
	get owner id More...

	TskFsMeta (TSK_FS_META *a_fsMeta)
	construct a TskFsMeta object. More...

Detailed Description

Stores metadata about a file.

See TSK_FS_META for more details.

Constructor & Destructor Documentation

TskFsMeta::TskFsMeta ( TSK_FS_META * a_fsMeta )

inline

construct a TskFsMeta object.

If NULL is passed as an argument, the getX() behavior is not defined.

Parameters

a_fsMeta a pointer of TSK_FS_META

References TSK_FS_META::name2, and TSK_FS_META_NAME_LIST::next.

Member Function Documentation

TSK_INUM_T TskFsMeta::getAddr ( ) const

inline

get address of the meta data structure for this file

Returns: address of the meta data structure for this file

time_t TskFsMeta::getATime ( ) const

inline

get last file content accessed time (stored in number of seconds since Jan 1, 1970 UTC)

Returns: last file content accessed time

References TSK_FS_META::atime.

uint32_t TskFsMeta::getATimeNano ( ) const

inline

get nano-second resolution of accessed time

Returns: nano-second resolution of accessed time

References TSK_FS_META::atime_nano.

time_t TskFsMeta::getBackUpTime ( ) const

inline

get HFS+ backup time

Returns: HFS+ backup time

uint32_t TskFsMeta::getBackUpTimeNano ( ) const

inline

get nano-second resolution of HFS+ backup time

Returns: nano-second resolution of HFS+ backup time

time_t TskFsMeta::getCrTime ( ) const

inline

get created time (stored in number of seconds since Jan 1, 1970 UTC)

Returns: created time

References TSK_FS_META::crtime.

uint32_t TskFsMeta::getCrTimeNano ( ) const

inline

get nano-second resolution of created time

Returns: nano-second resolution of created time

References TSK_FS_META::crtime_nano.

time_t TskFsMeta::getCTime ( ) const

inline

get last file / metadata status change time (stored in number of seconds since Jan 1, 1970 UTC)

Returns: last file / metadata status change time

References TSK_FS_META::ctime.

uint32_t TskFsMeta::getCTimeNano ( ) const

inline

get nano-second resolution of change time

Returns: nano-second resolution of change time

References TSK_FS_META::ctime_nano.

time_t TskFsMeta::getDTime ( ) const

inline

get linux deletion time

Returns: linux deletion time

uint32_t TskFsMeta::getDTimeNano ( ) const

inline

get nano-second resolution of deletion time

Returns: nano-second resolution of deletion time

TSK_FS_META_FLAG_ENUM TskFsMeta::getFlags ( ) const

inline

get flags for this file for its allocation status etc.

Returns: flags for this file

References TSK_FS_META::flags.

TSK_GID_T TskFsMeta::getGid ( ) const

inline

get group id

Returns: group id

References TSK_FS_META::gid.

const char* TskFsMeta::getLink ( ) const

inline

get name of target file if this is a symbolic link

Returns: name of target file if this is a symbolic link

References TSK_FS_META::link.

uint8_t TskFsMeta::getLs	(	char *	a_buf,
		size_t	a_len
	)		const

inline

Makes the "ls -l" permissions string for a file.

See tsk_fs_meta_make_ls() for details

Parameters

a_buf	[out] Buffer to write results to (must be 12 bytes or longer)
a_len	Length of buffer

References tsk_fs_meta_make_ls().

TSK_FS_META_MODE_ENUM TskFsMeta::getMode ( ) const

inline

get Unix-style permissions

Returns: Unix-style permissions mode

References TSK_FS_META::mode.

time_t TskFsMeta::getMTime ( ) const

inline

get last file content modification time (stored in number of seconds since Jan 1, 1970 UTC)

Returns: last file content modification time

References TSK_FS_META::mtime.

uint32_t TskFsMeta::getMTimeNano ( ) const

inline

get nano-second resolution of modification time

Returns: nano-second resolution of modification time

References TSK_FS_META::mtime_nano.

const TskFsMetaName* TskFsMeta::getName2 ( int a_idx ) const

inline

Return a name that is stored in the metadata.

Parameters

a_idx Index of the name to return

Returns: NULL on error. Caller must free this memory.

References TSK_FS_META::name2, and TSK_FS_META_NAME_LIST::next.

int TskFsMeta::getName2Count ( ) const

inline

Return the number of names that are stored in the metadata.

Returns: number of names.

References TSK_FS_META::name2, and TSK_FS_META_NAME_LIST::next.

int TskFsMeta::getNLink ( ) const

inline

get link count (number of file names pointing to this)

Returns: link count

References TSK_FS_META::nlink.

uint32_t TskFsMeta::getSeq ( ) const

inline

get sequence number for file (NTFS only, is incremented when entry is reallocated)

Returns: sequence number for file, or 0xFFFF on error.

References TSK_FS_META::seq.

TSK_OFF_T TskFsMeta::getSize ( ) const

inline

get file size (in bytes)

Returns: file size

References TSK_FS_META::size.

TSK_FS_META_TYPE_ENUM TskFsMeta::getType ( ) const

inline

get file type

Returns: file type

References TSK_FS_META::type.

TSK_UID_T TskFsMeta::getUid ( ) const

inline

get owner id

Returns: owner id

References TSK_FS_META::uid.

The documentation for this class was generated from the following file:

tsk/fs/tsk_fs.h

Public Member Functions

Detailed Description

Constructor & Destructor Documentation

Member Function Documentation