Main Page | Data Structures | Directories | File List | Data Fields | Globals

ntfs.c File Reference


Detailed Description

Contains the general NTFS processing code.

#include "fs_tools_i.h"
#include "ntfs.h"
#include <ctype.h>

Defines

#define NSEC_BTWN_1601_1970   (uint64_t)(116444736000000000ULL)
#define NTFS_PRINT_WIDTH   8

Functions

uint32_t nt2unixtime (uint64_t ntdate)
uint8_t ntfs_data_walk (NTFS_INFO *ntfs, INUM_T inum, TSK_FS_DATA *fs_data, int flags, TSK_FS_FILE_WALK_CB action, void *ptr)
uint8_t ntfs_dinode_load (NTFS_INFO *ntfs, INUM_T mftnum)
uint8_t ntfs_attrname_lookup (TSK_FS_INFO *fs, uint16_t type, char *name, int len)
uint8_t ntfs_load_sxx_buffer (TSK_FS_INFO *fs, DADDR_T addr, char *buf, size_t size, TSK_FS_BLOCK_FLAG_ENUM flags, void *ptr)
uint8_t ntfs_file_walk (TSK_FS_INFO *fs, TSK_FS_INODE *fs_inode, uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB action, void *ptr)
 Walk the contents of a file and use the callback for each cluster.
uint8_t ntfs_block_walk (TSK_FS_INFO *fs, DADDR_T start_blk, DADDR_T end_blk, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB action, void *ptr)
uint8_t ntfs_inode_walk (TSK_FS_INFO *fs, INUM_T start_inum, INUM_T end_inum, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB action, void *ptr)
char * ntfs_get_sid_as_string (TSK_FS_INFO *fs, uint32_t security_id)
uint8_t ntfs_jopen (TSK_FS_INFO *fs, INUM_T inum)
uint8_t ntfs_jentry_walk (TSK_FS_INFO *fs, int flags, TSK_FS_JENTRY_WALK_CB action, void *ptr)
uint8_t ntfs_jblk_walk (TSK_FS_INFO *fs, DADDR_T start, DADDR_T end, int flags, TSK_FS_JBLK_WALK_CB action, void *ptr)
TSK_FS_INFOntfs_open (TSK_IMG_INFO *img_info, SSIZE_T offset, TSK_FS_INFO_TYPE_ENUM ftype, uint8_t test)


Function Documentation

uint8_t ntfs_file_walk TSK_FS_INFO fs,
TSK_FS_INODE fs_inode,
uint32_t  type,
uint16_t  id,
TSK_FS_FILE_FLAG_ENUM  flags,
TSK_FS_FILE_WALK_CB  action,
void *  ptr
 

Walk the contents of a file and use the callback for each cluster.

This actually just finds the specific attribute and then calls data_walk.

If TSK_FS_FILE_FLAG_RECOVER is set, then error codes are set to _RECOVER so that errors can be more easily suppressed. No special recovery logic exists in this code.

action uses: TSK_FS_BLOCK_FLAG_CONT

No notion of meta with NTFS

Parameters:
fs File system to analyze
fs_inode Inode of file to analyze
type Type id of attribute in file to walk (use 0 to use default for files and directories -- if default is not found then no error is generated!).
id Id of attribute in file to walk (use flag of _NOID if this value is 0 because it is not specified -- in which case first entry is used).
flags Flags to determine how walk should occur. Uses (TSK_FS_FILE_FLAG_AONLY, TSK_FS_FILE_FLAG_SLACK, TSK_FS_FILE_FLAG_NOSPARSE TSK_FS_FILE_FLAG_NOID, TSK_FS_FILE_FLAG_RECOVER).
action Callback that is called for each cluster
ptr Pointer to data that will be passed to callback.
Returns:
0 on success and 1 on error


Generated on Thu Apr 19 14:58:53 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.4.2