Main Page | Data Structures | Directories | File List | Data Fields | Globals

tm_lookup.c File Reference


Detailed Description

Contains the generic hash database creation and lookup code.

#include "hashdb_tools_i.h"

Defines

#define base_addr(off, len)   ((len) * ( ( ( (off) + (len) - 1) / (len) ) - 1 ) )
 Determine the starting address of the line in the index that contains the offset.

Functions

uint8_t tsk_hdb_idxinitialize (TSK_HDB_INFO *hdb_info, TSK_TCHAR *htype)
 Initialize the TSK hash DB index file.
uint8_t tsk_hdb_idxaddentry (TSK_HDB_INFO *hdb_info, char *hvalue, OFF_T offset)
 Add an entry to the intermediate index file.
uint8_t tsk_hdb_idxfinalize (TSK_HDB_INFO *hdb_info)
 Finalize index creation process by sorting the index and removing the intermediate temp file.
int8_t tsk_hdb_lookup (TSK_HDB_INFO *hdb_info, char *hash, TSK_HDB_FLAG_ENUM flags, TSK_HDB_LOOKUP_FN action, void *ptr)
 Perform the binary search in the index for the text/ASCII hash value.
int8_t tsk_hdb_lookup_raw (TSK_HDB_INFO *hdb_info, uint8_t *hash, uint8_t len, TSK_HDB_FLAG_ENUM flags, TSK_HDB_LOOKUP_FN action, void *ptr)
 Perform the binary search in the index for a hash value given in a raw (non-text) format.
uint8_t tsk_hdb_hasindex (TSK_HDB_INFO *hdb_info, uint8_t htype)
 Determine if the hash database that is open has an index that has been created.
TSK_HDB_INFOtsk_hdb_open (TSK_TCHAR *db_file, TSK_HDB_OPEN_ENUM flags)
 Open a hash database and index for lookup.
void tsk_hdb_close (TSK_HDB_INFO *hdb_info)
 Close the HDB_INFO structure and free the memory.


Define Documentation

#define base_addr off,
len   )     ((len) * ( ( ( (off) + (len) - 1) / (len) ) - 1 ) )
 

Determine the starting address of the line in the index that contains the offset.

Parameters:
off Byte offset to find start of
len Byte length of each line in index
Returns:
Byte offset to start of corresponding line


Function Documentation

void tsk_hdb_close TSK_HDB_INFO hdb_info  ) 
 

Close the HDB_INFO structure and free the memory.

Parameters:
hdb_info Structure to free.

uint8_t tsk_hdb_hasindex TSK_HDB_INFO hdb_info,
uint8_t  htype
 

Determine if the hash database that is open has an index that has been created.

Parameters:
hdb_info Hash database to consider
htype Hash type that index should be of
Returns:
1 if index exists and 0 if not

uint8_t tsk_hdb_idxaddentry TSK_HDB_INFO hdb_info,
char *  hvalue,
OFF_T  offset
 

Add an entry to the intermediate index file.

Parameters:
hdb_info Hash database state info
hvalue Hash value to add
offset Byte offset of hash entry in original database.
Returns:
1 on error and 0 on success

uint8_t tsk_hdb_idxfinalize TSK_HDB_INFO hdb_info  ) 
 

Finalize index creation process by sorting the index and removing the intermediate temp file.

Parameters:
hdb_info Hash database state info structure.
Returns:
1 on error and 0 on success

uint8_t tsk_hdb_idxinitialize TSK_HDB_INFO hdb_info,
TSK_TCHAR *  htype
 

Initialize the TSK hash DB index file.

This creates the intermediate file, which will have entries added to it. This file must be sorted before the process is finished.

Parameters:
hdb_info Hash database state structure
htype String of index type to create
Returns:
1 on error and 0 on success

int8_t tsk_hdb_lookup TSK_HDB_INFO hdb_info,
char *  hash,
TSK_HDB_FLAG_ENUM  flags,
TSK_HDB_LOOKUP_FN  action,
void *  ptr
 

Perform the binary search in the index for the text/ASCII hash value.

Parameters:
hdb_info Hash database state information
hash Hash value to search for
flags 
action Callback function to call for each hash db entry (not called if QUICK flag is given)
ptr Pointer to data to pass to each callback
Returns:
-1 on error, 0 if hash value not found, and 1 if value was found.

int8_t tsk_hdb_lookup_raw TSK_HDB_INFO hdb_info,
uint8_t *  hash,
uint8_t  len,
TSK_HDB_FLAG_ENUM  flags,
TSK_HDB_LOOKUP_FN  action,
void *  ptr
 

Perform the binary search in the index for a hash value given in a raw (non-text) format.

this is a wrapper around the normal lookup function.

Parameters:
hdb_info Hash database state information
hash Array with binary hash value to search for
len Number of bytes in binary hash value
flags 
action Callback function to call for each hash db entry (not called if QUICK flag is given)
ptr Pointer to data to pass to each callback
Returns:
-1 on error, 0 if hash value not found, and 1 if value was found.

TSK_HDB_INFO* tsk_hdb_open TSK_TCHAR *  db_file,
TSK_HDB_OPEN_ENUM  flags
 

Open a hash database and index for lookup.

Parameters:
db_file Path to database.
flags Flags for opening the database.
Returns:
Poiner to hash database state structure or NULL on error


Generated on Thu Apr 5 12:00:08 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.4.2