The Sleuth Kit
4.2
|
Holds information about a single data run, which has a starting address and length. More...
#include <tsk_fs.h>
Public Attributes | |
TSK_DADDR_T | addr |
Starting block address (in file system) of run. | |
TSK_FS_ATTR_RUN_FLAG_ENUM | flags |
Flags for run. | |
TSK_DADDR_T | len |
Number of blocks in run (0 when entry is not in use) | |
TSK_FS_ATTR_RUN * | next |
Pointer to the next run in the attribute (or NULL) | |
TSK_DADDR_T | offset |
Offset (in blocks) of this run in the file. | |
Holds information about a single data run, which has a starting address and length.
A run describes a consecutive list of blocks that have been allocated to a file. A file may have many such runs and they are stringed together in a linked list. The entries in the list must be stored in sequential order (based on offset in file).
Copyright © 2007-2015 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.