Main Page | Data Structures | Directories | File List | Data Fields | Globals

mm_tools.h

Go to the documentation of this file.
00001 /*
00002  * The Sleuth Kit
00003  *
00004  * $Date: 2007/04/05 16:01:56 $
00005  *
00006  * Brian Carrier [carrier@sleuthkit.org]
00007  * Copyright (c) 2003-2005 Brian Carrier.  All rights reserved
00008  *
00009  */
00010 
00015 #ifndef _MM_TOOLS_H
00016 #define _MM_TOOLS_H
00017 
00018     /*
00019      * External interface.
00020      */
00021 #include "img_tools.h"
00022 #include <sys/types.h>
00023 
00024 
00025 
00026 #if defined(HAVE_UNISTD)
00027 #include <unistd.h>
00028 #endif
00029 #if !defined (TSK_WIN32)
00030 #include <sys/param.h>
00031 #endif
00032 
00033 #ifdef __cplusplus
00034 extern "C" {
00035 #endif
00036 
00037 
00038 
00039 /* Structures */
00040     typedef struct TSK_MM_INFO TSK_MM_INFO;
00041     typedef struct TSK_MM_PART TSK_MM_PART;
00042 
00043 /* walk action functions */
00044     typedef uint8_t(*TSK_MM_PART_WALK_CB) (TSK_MM_INFO *, PNUM_T,
00045         TSK_MM_PART *, int, void *);
00046 
00047 
00048 
00052     enum TSK_MM_INFO_TYPE_ENUM {
00053         TSK_MM_INFO_TYPE_UNSUPP = 0,    
00054         TSK_MM_INFO_TYPE_DOS = 1,       
00055         TSK_MM_INFO_TYPE_BSD = 2,       
00056         TSK_MM_INFO_TYPE_SUN = 3,       
00057         TSK_MM_INFO_TYPE_MAC = 4,       
00058         TSK_MM_INFO_TYPE_GPT = 5,       
00059     };
00060     typedef enum TSK_MM_INFO_TYPE_ENUM TSK_MM_INFO_TYPE_ENUM;
00061 
00062 
00063 /***************************************************************
00064  * TSK_MM_INFO: Allocated when a disk is opened
00065  */
00066     struct TSK_MM_INFO {
00067         TSK_IMG_INFO *img_info; 
00068         TSK_MM_INFO_TYPE_ENUM mmtype;   
00069         DADDR_T offset;         
00070         char *str_type;
00071         unsigned int block_size;
00072         unsigned int dev_bsize;
00073 
00074         /* endian ordering flag - values given in tsk_endian.h */
00075         uint8_t endian;
00076 
00077         TSK_MM_PART *part_list; /* linked list of partitions */
00078 
00079         PNUM_T first_part;      /* number of first partition */
00080         PNUM_T last_part;       /* number of last partition */
00081 
00082         /* media management type specific function pointers */
00083          uint8_t(*part_walk) (TSK_MM_INFO *, PNUM_T, PNUM_T, int,
00084             TSK_MM_PART_WALK_CB, void *);
00085         void (*close) (TSK_MM_INFO *);
00086     };
00087 
00088 
00089 
00090 
00091 /***************************************************************
00092  * Generic structures  for partitions / slices
00093  */
00094 
00098     enum TSK_MM_PART_TYPE_ENUM {
00099         TSK_MM_PART_TYPE_DESC = (1 << 0),       
00100         TSK_MM_PART_TYPE_VOL = (1 << 1) 
00101     };
00102     typedef enum TSK_MM_PART_TYPE_ENUM TSK_MM_PART_TYPE_ENUM;
00103 
00107     struct TSK_MM_PART {
00108         TSK_MM_PART *prev;      
00109         TSK_MM_PART *next;      
00110 
00111         DADDR_T start;          
00112         DADDR_T len;            
00113         char *desc;             
00114         int8_t table_num;       
00115         int8_t slot_num;        
00116         TSK_MM_PART_TYPE_ENUM type;     
00117     };
00118 
00119 
00120 
00121     extern uint8_t tsk_mm_part_unused(TSK_MM_INFO *);
00122     extern void tsk_mm_part_print(TSK_MM_INFO *);
00123     extern TSK_MM_PART *tsk_mm_part_add(TSK_MM_INFO *, DADDR_T, DADDR_T,
00124         TSK_MM_PART_TYPE_ENUM, char *, int8_t, int8_t);
00125     extern void tsk_mm_part_free(TSK_MM_INFO *);
00126 
00127     /***** TYPES *****/
00128     extern TSK_MM_INFO_TYPE_ENUM tsk_mm_parse_type(const TSK_TCHAR *);
00129     extern char *tsk_mm_get_type(TSK_MM_INFO_TYPE_ENUM);
00130 
00131 
00132 /**************************************************************8
00133  * Generic routines.
00134  */
00135     extern TSK_MM_INFO *tsk_mm_open(TSK_IMG_INFO *, DADDR_T,
00136         const TSK_TCHAR *);
00137     extern SSIZE_T tsk_mm_read_block_nobuf(TSK_MM_INFO *, char *, OFF_T,
00138         DADDR_T);
00139     extern void tsk_mm_print_types(FILE *);
00140 
00141     extern TSK_MM_INFO *tsk_mm_dos_open(TSK_IMG_INFO *, DADDR_T, uint8_t);
00142     extern TSK_MM_INFO *tsk_mm_mac_open(TSK_IMG_INFO *, DADDR_T);
00143     extern TSK_MM_INFO *tsk_mm_bsd_open(TSK_IMG_INFO *, DADDR_T);
00144     extern TSK_MM_INFO *tsk_mm_sun_open(TSK_IMG_INFO *, DADDR_T);
00145     extern TSK_MM_INFO *tsk_mm_gpt_open(TSK_IMG_INFO *, DADDR_T);
00146 
00147 
00148 // Endian macros - actual functions in misc/
00149 #define tsk_mm_guessu16(mm, x, mag)   \
00150         tsk_guess_end_u16(&(mm->endian), (x), (mag))
00151 
00152 #define tsk_mm_guessu32(mm, x, mag)   \
00153         tsk_guess_end_u32(&(mm->endian), (x), (mag))
00154 
00155 
00156 #ifdef __cplusplus
00157 }
00158 #endif
00159 #endif

Generated on Thu Apr 5 12:00:08 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.4.2