TskImgInfo Class Reference

Stores information about an image that is open and being analyzed. More...

#include <tsk_img.h>

Public Member Functions
unsigned int	getSectorSize () const
	Returns the sector size of the disk. More...
TSK_OFF_T	getSize () const
	Returns the size of the image. More...
TSK_IMG_TYPE_ENUM	getType () const
	returns the image format type. More...
uint8_t	open (const TSK_TCHAR *a_image, TSK_IMG_TYPE_ENUM a_type, unsigned int a_ssize)
	Opens a single (non-split) disk image file so that it can be read. More...
uint8_t	open (int a_num_img, const TSK_TCHAR *const a_images[], TSK_IMG_TYPE_ENUM a_type, unsigned int a_ssize)
	Opens one or more disk image files so that they can be read. More...
ssize_t	read (TSK_OFF_T a_off, char *a_buf, size_t a_len)
	Reads data from an open disk image. More...
	TskImgInfo (TSK_IMG_INFO *a_imgInfo)

Static Public Member Functions
static void	typePrint (FILE *a_file)
	Prints the name and description of the supported image types to a handle. More...
static TSK_IMG_TYPE_ENUM	typeSupported ()
	Returns the supported file format types. More...
static const char *	typeToDesc (TSK_IMG_TYPE_ENUM a_type)
	Returns the description of an image format type, given its type ID. More...
static TSK_IMG_TYPE_ENUM	typeToId (const TSK_TCHAR *a_str)
	Parses a string that specifies an image format to determine the associated type ID. More...
static const char *	typeToName (TSK_IMG_TYPE_ENUM a_type)
	Returns the name of an image format type, given its type ID. More...

Friends
class	TskFsInfo
class	TskVsInfo

Detailed Description

Stores information about an image that is open and being analyzed.

To use this object, open() should be called first. Otherwise, the get() methods will return undefined values.

Member Function Documentation

unsigned int TskImgInfo::getSectorSize ( ) const

inline

Returns the sector size of the disk.

Returns

sector size of original device in bytes

References TSK_IMG_INFO::sector_size.

TSK_OFF_T TskImgInfo::getSize ( ) const

inline

Returns the size of the image.

Returns

total size of image in bytes

References TSK_IMG_INFO::size.

TSK_IMG_TYPE_ENUM TskImgInfo::getType ( ) const

inline

returns the image format type.

Returns

image format type

References TSK_IMG_INFO::itype.

uint8_t TskImgInfo::open ( const TSK_TCHAR *  a_image, TSK_IMG_TYPE_ENUM  a_type, unsigned int  a_ssize  )

inline

Opens a single (non-split) disk image file so that it can be read.

See tsk_img_open_sing() for more details.

Parameters

a_image	The path to the image file
a_type	The disk image type (can be autodetection)
a_ssize	Size of device sector in bytes (or 0 for default)

Returns

1 on error and 0 on success

References tsk_img_open_sing().

uint8_t TskImgInfo::open ( int  a_num_img, const TSK_TCHAR *const  a_images[], TSK_IMG_TYPE_ENUM  a_type, unsigned int  a_ssize  )

inline

Opens one or more disk image files so that they can be read.

e UTF8, then consider See tsk_img_open() for more details.

Parameters

a_num_img	The number of images to open (will be > 1 for split images).
a_images	The path to the image files (the number of files must be equal to num_img and they must be in a sorted order)
a_type	The disk image type (can be autodetection)
a_ssize	Size of device sector in bytes (or 0 for default)

Returns

1 on error and 0 on success

References tsk_img_open().

ssize_t TskImgInfo::read ( TSK_OFF_T  a_off, char *  a_buf, size_t  a_len  )

inline

Reads data from an open disk image.

Parameters

a_off	Byte offset to start reading from
a_buf	Buffer to read into
a_len	Number of bytes to read into buffer

Returns

number of bytes read or -1 on error

References tsk_img_read().

static void TskImgInfo::typePrint ( FILE *  a_file )

inlinestatic

Prints the name and description of the supported image types to a handle.

This is used by the TSK command line tools to print the supported types to the console.

Parameters

a_file

Handle to print names and descriptions to.

References tsk_img_type_print().

static TSK_IMG_TYPE_ENUM TskImgInfo::typeSupported ( )

inlinestatic

Returns the supported file format types.

Returns

A bit in the return value is set to 1 if the type is supported.

References tsk_img_type_supported().

static const char* TskImgInfo::typeToDesc ( TSK_IMG_TYPE_ENUM  a_type )

inlinestatic

Returns the description of an image format type, given its type ID.

Parameters

a_type

ID of image type

Returns

Pointer to string of the description

References tsk_img_type_todesc().

static TSK_IMG_TYPE_ENUM TskImgInfo::typeToId ( const TSK_TCHAR *  a_str )

inlinestatic

Parses a string that specifies an image format to determine the associated type ID.

This is used by the TSK command line tools to parse the type given on the command line.

Parameters

a_str

String of image format type

Returns

ID of image type

References tsk_img_type_toid().

static const char* TskImgInfo::typeToName ( TSK_IMG_TYPE_ENUM  a_type )

inlinestatic

Returns the name of an image format type, given its type ID.

Parameters

a_type

ID of image type

Returns

Pointer to string of the name.

References tsk_img_type_toname().

---

The documentation for this class was generated from the following file:

• tsk/img/tsk_img.h