Main Page | Data Structures | Directories | File List | Data Fields | Globals

hashdb_tools_i.h File Reference


Detailed Description

Header file that defines internal data structures and functions that are not exported for library use.

#include "hashdb_tools.h"

Go to the source code of this file.

Defines

#define TSK_HDB_MAXLEN   512
 Default buffer size used in many places.
#define TSK_HDB_OFF_LEN   16
 Number of digits used in offset field in index.
#define TSK_HDB_IDX_LEN(x)   ( TSK_HDB_HTYPE_LEN(x) + TSK_HDB_OFF_LEN + 2)
 Get the length of an index file line - 2 for comma and newline.
#define TSK_HDB_IDX_HEAD_STR   "00000000000000000000000000000000000000000"
 String used in index header.

Functions

uint8_t tsk_hdb_idxinitialize (TSK_HDB_INFO *, TSK_TCHAR *dbname)
 Initialize the TSK hash DB index file.
uint8_t tsk_hdb_idxaddentry (TSK_HDB_INFO *, char *hvalue, OFF_T offset)
 Add an entry to the intermediate index file.
uint8_t tsk_hdb_idxfinalize (TSK_HDB_INFO *)
 Finalize index creation process by sorting the index and removing the intermediate temp file.
uint8_t nsrl_test (FILE *)
 Test the file to see if it is an NSRL database.
uint8_t nsrl_makeindex (TSK_HDB_INFO *, TSK_TCHAR *htype)
 Process the database to create a sorted index of it.
uint8_t nsrl_getentry (TSK_HDB_INFO *, char *, OFF_T, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *)
 Find the corresponding name at a given offset.
uint8_t md5sum_test (FILE *)
 Test the file to see if it is a md5sum database.
uint8_t md5sum_makeindex (TSK_HDB_INFO *, TSK_TCHAR *htype)
 Process the database to create a sorted index of it.
uint8_t md5sum_getentry (TSK_HDB_INFO *, char *, OFF_T, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *)
 Find the corresponding name at a given offset.
uint8_t hk_test (FILE *)
 Test the file to see if it is a hashkeeper database.
uint8_t hk_makeindex (TSK_HDB_INFO *, TSK_TCHAR *htype)
 Process the database to create a sorted index of it.
uint8_t hk_getentry (TSK_HDB_INFO *, char *, OFF_T, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *)
 Find the corresponding name at the given offset.
uint8_t idxonly_makeindex (TSK_HDB_INFO *, TSK_TCHAR *htype)
 This function should process the database to create a sorted index of it, but in this case we do not have a database, so just make an error.
uint8_t idxonly_getentry (TSK_HDB_INFO *, char *, OFF_T, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *)
 This function should find the corresponding name at a given offset.


Define Documentation

#define TSK_HDB_IDX_HEAD_STR   "00000000000000000000000000000000000000000"
 

String used in index header.

It is one longer than a sha-1 hash - so that it always sorts to the top


Function Documentation

uint8_t hk_getentry TSK_HDB_INFO hdb_info,
char *  hash,
OFF_T  offset,
TSK_HDB_FLAG_ENUM  flags,
TSK_HDB_LOOKUP_FN  action,
void *  cb_ptr
 

Find the corresponding name at the given offset.

The offset was likely determined from the index. The entries in the DB following the one specified are also processed if they have the same hash value and their name is different. The callback is called for each entry.

Parameters:
hdb_info Data base to get data from.
hash MD5 hash value that was searched for
offset Byte offset where hash value should be located in db_file
flags 
action Callback used for each entry found in lookup
cb_ptr Pointer to data passed to callback
Returns:
1 on error and 0 on success

uint8_t hk_makeindex TSK_HDB_INFO hdb_info,
TSK_TCHAR *  dbtype
 

Process the database to create a sorted index of it.

Consecutive entries with the same hash value are not added to the index, but will be found during lookup.

Parameters:
hdb_info Hash database to make index of
dbtype Text of type of database (should always be TSK_HDB_DBTYPE_HK_STR)
Returns:
1 on error and 0 on success.

uint8_t hk_test FILE *  hFile  ) 
 

Test the file to see if it is a hashkeeper database.

Parameters:
hFile File handle to hash database
Returns:
1 if hk and 0 if not

uint8_t idxonly_getentry TSK_HDB_INFO hdb_info,
char *  hash,
OFF_T  offset,
TSK_HDB_FLAG_ENUM  flags,
TSK_HDB_LOOKUP_FN  action,
void *  cb_ptr
 

This function should find the corresponding name at a given offset.

In this case though, we do not have the original database, so just make an error...

Parameters:
hdb_info Hash database to get data from
hash MD5 hash value that was searched for
offset Byte offset where hash value should be located in db_file
flags (not used)
action Callback used for each entry found in lookup
cb_ptr Pointer to data passed to callback
Returns:
1 on error and 0 on succuss

uint8_t idxonly_makeindex TSK_HDB_INFO hdb_info,
TSK_TCHAR *  dbtype
 

This function should process the database to create a sorted index of it, but in this case we do not have a database, so just make an error.

..

Parameters:
hdb_info Hash database to make index of.
dbtype Type of hash database
Returns:
1 on error and 0 on success.

uint8_t md5sum_getentry TSK_HDB_INFO hdb_info,
char *  hash,
OFF_T  offset,
TSK_HDB_FLAG_ENUM  flags,
TSK_HDB_LOOKUP_FN  action,
void *  cb_ptr
 

Find the corresponding name at a given offset.

The offset was likely determined from the index. The entries in the DB following the one specified are also processed if they have the same hash value and their name is different. The callback is called for each entry.

Parameters:
hdb_info Hash database to get data from
hash MD5 hash value that was searched for
offset Byte offset where hash value should be located in db_file
flags (not used)
action Callback used for each entry found in lookup
cb_ptr Pointer to data passed to callback
Returns:
1 on error and 0 on succuss

uint8_t md5sum_makeindex TSK_HDB_INFO hdb_info,
TSK_TCHAR *  dbtype
 

Process the database to create a sorted index of it.

Consecutive entries with the same hash value are not added to the index, but will be found during lookup.

Parameters:
hdb_info Hash database to make index of.
dbtype Type of hash database (should always be TSK_HDB_DBTYPE_MD5SUM_STR)
Returns:
1 on error and 0 on success.

uint8_t md5sum_test FILE *  hFile  ) 
 

Test the file to see if it is a md5sum database.

Parameters:
hFile File handle to hash database
Returns:
1 if md5sum and 0 if not

uint8_t nsrl_getentry TSK_HDB_INFO hdb_info,
char *  hash,
OFF_T  offset,
TSK_HDB_FLAG_ENUM  flags,
TSK_HDB_LOOKUP_FN  action,
void *  cb_ptr
 

Find the corresponding name at a given offset.

The offset was likely determined from the index. The entries in the DB following the one specified are also processed if they have the same hash value and their name is different. The callback is called for each entry.

Parameters:
hdb_info Database to get data from.
hash MD5/SHA-1 hash value that was searched for
offset Byte offset where hash value should be located in db_file
flags (not used)
action Callback used for each entry found in lookup
cb_ptr Pointer to data passed to callback
Returns:
1 on error and 0 on success

uint8_t nsrl_makeindex TSK_HDB_INFO hdb_info,
TSK_TCHAR *  dbtype
 

Process the database to create a sorted index of it.

Consecutive entries with the same hash value are not added to the index, but will be found during lookup.

Parameters:
hdb_info Hash database to make index of.
dbtype Type of database
Returns:
1 on error and 0 on success.

uint8_t nsrl_test FILE *  hFile  ) 
 

Test the file to see if it is an NSRL database.

Parameters:
hFile File handle to hash database
Returns:
1 if NSRL and 0 if not

uint8_t tsk_hdb_idxaddentry TSK_HDB_INFO hdb_info,
char *  hvalue,
OFF_T  offset
 

Add an entry to the intermediate index file.

Parameters:
hdb_info Hash database state info
hvalue Hash value to add
offset Byte offset of hash entry in original database.
Returns:
1 on error and 0 on success

uint8_t tsk_hdb_idxfinalize TSK_HDB_INFO hdb_info  ) 
 

Finalize index creation process by sorting the index and removing the intermediate temp file.

Parameters:
hdb_info Hash database state info structure.
Returns:
1 on error and 0 on success

uint8_t tsk_hdb_idxinitialize TSK_HDB_INFO hdb_info,
TSK_TCHAR *  htype
 

Initialize the TSK hash DB index file.

This creates the intermediate file, which will have entries added to it. This file must be sorted before the process is finished.

Parameters:
hdb_info Hash database state structure
htype String of index type to create
Returns:
1 on error and 0 on success


Generated on Thu Apr 5 12:00:08 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.4.2