Main Page | Data Structures | Directories | File List | Data Fields | Globals

fs_io.c File Reference


Detailed Description

Contains functions to read data from a disk image and wrapper functions to read file content.

#include <errno.h>
#include "fs_tools_i.h"
#include "ntfs.h"

Defines

#define FS_READ_FILE_CACHE_SZ   8 * 1024

Functions

SSIZE_T tsk_fs_read_block (TSK_FS_INFO *fs, TSK_DATA_BUF *buf, OFF_T len, DADDR_T addr)
 Read a file system block into a TSK_DATA_BUF structure.
SSIZE_T tsk_fs_read_block_nobuf (TSK_FS_INFO *fs, char *buf, OFF_T len, DADDR_T addr)
 Read a file system block into a char* buffer.
char * tsk_fs_load_file (TSK_FS_INFO *fs, TSK_FS_INODE *fsi, uint32_t type, uint16_t id, int flags)
 Load the contents of a file into a buffer.
SSIZE_T tsk_fs_read_file_noid (TSK_FS_INFO *fs, TSK_FS_INODE *fsi, SSIZE_T offset, SSIZE_T size, char *buf)
 Read the contents of a file using a typical read() type interface.
SSIZE_T tsk_fs_read_file (TSK_FS_INFO *fs, TSK_FS_INODE *fsi, uint32_t type, uint16_t id, SSIZE_T offset, SSIZE_T size, char *buf)
 Read the contents of a specific attribute of a file using a typical read() type interface.


Function Documentation

char* tsk_fs_load_file TSK_FS_INFO fs,
TSK_FS_INODE fsi,
uint32_t  type,
uint16_t  id,
int  flags
 

Load the contents of a file into a buffer.

Parameters:
fs The file system structure.
fsi The inode structure of the file to read.
type The type of attribute to load (ignored if TSK_FS_FILE_FLAG_NOID is given)
id The id of attribute to load (ignored if TSK_FS_FILE_FLAG_NOID is given)
flags Flag values of type TSK_FS_FILE_FLAG_*
Returns:
The buffer with the file content (must be freed by caller)

SSIZE_T tsk_fs_read_block TSK_FS_INFO fs,
TSK_DATA_BUF *  buf,
OFF_T  len,
DADDR_T  addr
 

Read a file system block into a TSK_DATA_BUF structure.

This is actually a wrapper around the fs_read_random function, but it allows the starting location to be specified as a block address.

Parameters:
fs The file system structure.
buf The buffer to store the block in.
len The number of bytes to read (must be a multiple of the device block size)
addr The starting block file system address.
Returns:
The number of bytes read or -1 on error.

SSIZE_T tsk_fs_read_block_nobuf TSK_FS_INFO fs,
char *  buf,
OFF_T  len,
DADDR_T  addr
 

Read a file system block into a char* buffer.

This is actually a wrapper around the fs_read_random function, but it allows the starting location to be specified as a block address.

Parameters:
fs The file system structure.
buf The char * buffer to store the block in.
len The number of bytes to read (must be a multiple of the device block size)
addr The starting block file system address.
Returns:
The number of bytes read or -1 on error.

SSIZE_T tsk_fs_read_file TSK_FS_INFO fs,
TSK_FS_INODE fsi,
uint32_t  type,
uint16_t  id,
SSIZE_T  offset,
SSIZE_T  size,
char *  buf
 

Read the contents of a specific attribute of a file using a typical read() type interface.

Parameters:
fs The file system structure.
fsi The inode structure of the file to read.
type The type of attribute to load
id The id of attribute to load
offset The byte offset to start reading from.
size The number of bytes to read from the file.
buf The buffer to read the data into.
Returns:
The number of bytes read or -1 on error.

SSIZE_T tsk_fs_read_file_noid TSK_FS_INFO fs,
TSK_FS_INODE fsi,
SSIZE_T  offset,
SSIZE_T  size,
char *  buf
 

Read the contents of a file using a typical read() type interface.

Parameters:
fs The file system structure.
fsi The inode structure of the file to read.
offset The byte offset to start reading from.
size The number of bytes to read from the file.
buf The buffer to read the data into.
Returns:
The number of bytes read or -1 on error.


Generated on Thu Apr 5 12:00:08 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.4.2