Main Page | Data Structures | Directories | File List | Data Fields | Globals

iso9660.h

00001 /*
00002 ** The Sleuth Kit
00003 **
00004 ** This software is subject to the IBM Public License ver. 1.0,
00005 ** which was displayed prior to download and is included in the readme.txt
00006 ** file accompanying the Sleuth Kit files.  It may also be requested from:
00007 ** Crucial Security Inc.
00008 ** 14900 Conference Center Drive
00009 ** Chantilly, VA 20151
00010 **
00011 ** Wyatt Banks [wbanks@crucialsecurity.com]
00012 ** Copyright (c) 2005 Crucial Security Inc.  All rights reserved.
00013 **
00014 ** Brian Carrier [carrier@sleuthkit.org]
00015 ** Copyright (c) 2003-2005 Brian Carrier.  All rights reserved
00016 **
00017 ** Copyright (c) 1997,1998,1999, International Business Machines
00018 ** Corporation and others. All Rights Reserved.
00019 */
00020 
00021 /* TCT
00022  * LICENSE
00023  *      This software is distributed under the IBM Public License.
00024  * AUTHOR(S)
00025  *      Wietse Venema
00026  *      IBM T.J. Watson Research
00027  *      P.O. Box 704
00028  *      Yorktown Heights, NY 10598, USA
00029  --*/
00030 
00031 /*
00032 ** You may distribute the Sleuth Kit, or other software that incorporates
00033 ** part of all of the Sleuth Kit, in object code form under a license agreement,
00034 ** provided that:
00035 ** a) you comply with the terms and conditions of the IBM Public License
00036 **    ver 1.0; and
00037 ** b) the license agreement
00038 **     i) effectively disclaims on behalf of all Contributors all warranties
00039 **        and conditions, express and implied, including warranties or
00040 **        conditions of title and non-infringement, and implied warranties
00041 **        or conditions of merchantability and fitness for a particular
00042 **        purpose.
00043 **    ii) effectively excludes on behalf of all Contributors liability for
00044 **        damages, including direct, indirect, special, incidental and
00045 **        consequential damages such as lost profits.
00046 **   iii) states that any provisions which differ from IBM Public License
00047 **        ver. 1.0 are offered by that Contributor alone and not by any
00048 **        other party; and
00049 **    iv) states that the source code for the program is available from you,
00050 **        and informs licensees how to obtain it in a reasonable manner on or
00051 **        through a medium customarily used for software exchange.
00052 **
00053 ** When the Sleuth Kit or other software that incorporates part or all of
00054 ** the Sleuth Kit is made available in source code form:
00055 **     a) it must be made available under IBM Public License ver. 1.0; and
00056 **     b) a copy of the IBM Public License ver. 1.0 must be included with
00057 **        each copy of the program.
00058 */
00059 
00060 /* refernece documents used:
00061  * IEEE P1281 - System Use Sharing Protocol, version 1.12
00062  * IEEE P1282 - Rock Ridge Interchange Protocol, version 1.12
00063  * ECMA-119 - Volume and File Structure of CDROM for Information Interchange,
00064  * 2nd Edition
00065  */
00066 
00067 #ifndef _iso9660_h
00068 #define _iso9660_h
00069 
00070 /* This part borrowed from the bsd386 isofs */
00071 #define ISODCL(from, to) (to - from + 1)
00072 
00073 /*
00074  * Constants
00075  */
00076 #define ISO9660_FIRSTINO        0
00077 #define ISO9660_ROOTINO         0
00078 #define ISO9660_NIADDR          0       /* iso9660 doesnt have indirect blocks */
00079 #define ISO9660_NDADDR          1       /* just a single data "block" */
00080 #define ISO9660_SBOFF           32768
00081 #define ISO9660_SSIZE_B         2048
00082 #define ISO9660_MIN_BLOCK_SIZE  512
00083 #define ISO9660_MAX_BLOCK_SIZE  2048
00084 #define ISO9660_MAGIC           "CD001"
00085 
00086 /* values used in volume descriptor type */
00087 #define ISO9660_BOOT_RECORD             0       /* boot record */
00088 #define ISO9660_PRIM_VOL_DESC           1       /* primary volume descriptor */
00089 #define ISO9660_SUPP_VOL_DESC           2       /* supplementary volume descriptor */
00090 #define ISO9660_VOL_PART_DESC           3       /* volume partition descriptor */
00091 #define ISO9660_RESERVE_FLOOR           4       /* 4-254 are reserved */
00092 #define ISO9660_RESERVE_CEIL            254
00093 #define ISO9660_VOL_DESC_SET_TERM       255     /* volume descriptor set terminator */
00094 
00095 #define ISO9660_MAXNAMLEN       103     /* joliet max name length */
00096 
00097 /* Bits in permissions used in extended attribute records.  */
00098 #define ISO9660_BIT_UR  0x0010
00099 #define ISO9660_BIT_UX  0x0040
00100 #define ISO9660_BIT_GR  0x0100
00101 #define ISO9660_BIT_GX  0x0400
00102 #define ISO9660_BIT_AR  0x1000
00103 #define ISO9660_BIT_AX  0x4000
00104 
00105 /* directory descriptor flags */
00106 #define ISO9660_FLAG_HIDE       0x01    /* Hide file -- called EXISTENCE */
00107 #define ISO9660_FLAG_DIR        0x02    /* Directory */
00108 #define ISO9660_FLAG_ASSOC      0x04    /* File is associated */
00109 #define ISO9660_FLAG_RECORD     0X08    /* Record format in extended attr */
00110 #define ISO9660_FLAG_PROT       0X10    /* No read / exec perm in ext attr */
00111 #define ISO9660_FLAG_RES1       0X20    /* reserved */
00112 #define ISO9660_FLAG_RES2       0x40    /* reserved */
00113 #define ISO9660_FLAG_MULT       0X80    /* not final entry of mult ext file */
00114 
00115 /* POSIX modes used in ISO9660 not already defined */
00116 #define MODE_IFSOCK 0140000     /* socket */
00117 #define MODE_IFLNK  0120000     /* symbolic link */
00118 #define MODE_IFDIR  0040000     /* directory */
00119 #define MODE_IFIFO  0010000     /* pipe or fifo */
00120 #define MODE_IFBLK  0060000     /* block special */
00121 #define MODE_IFCHR  0020000     /* character special */
00122 
00123 /* used to determine if get directory entry function needs to handle Joliet */
00124 #define ISO9660_TYPE_PVD        0
00125 #define ISO9660_TYPE_SVD        1
00126 
00127 /* macros to get numbers.  numbers in ISO9660 are stored in both byte orders.
00128  * These will grab the one we are using.
00129  */
00130 #define parseu16(foo, x) \
00131     (uint16_t)( (foo->endian & TSK_LIT_ENDIAN)  ? \
00132     ((uint16_t) \
00133         ((uint16_t)((uint8_t *)(x))[0] << 0) + \
00134         ((uint16_t)((uint8_t *)(x))[1] << 8)) \
00135         : \
00136     ((uint16_t) \
00137         ((uint16_t)((uint8_t *)(x))[2] << 8) + \
00138         ((uint16_t)((uint8_t *)(x))[3] << 0)) )
00139 
00140 #define parseu32(foo, x) \
00141     (uint32_t)( (foo->endian & TSK_LIT_ENDIAN)  ? \
00142     ((uint32_t) \
00143         ((uint32_t)((uint8_t *)(x))[0] << 0) + \
00144         ((uint32_t)((uint8_t *)(x))[1] << 8) + \
00145         ((uint32_t)((uint8_t *)(x))[2] << 16) + \
00146         ((uint32_t)((uint8_t *)(x))[3] << 24)) \
00147         : \
00148     ((uint32_t) \
00149         ((uint32_t)((uint8_t *)(x))[7] << 0) + \
00150         ((uint32_t)((uint8_t *)(x))[6] << 8) + \
00151         ((uint32_t)((uint8_t *)(x))[5] << 16) + \
00152         ((uint32_t)((uint8_t *)(x))[4] << 24)) )
00153 
00154 
00155 /* recording date and time */
00156 typedef struct {
00157     uint8_t year;               /* years since 1900 */
00158     uint8_t month;              /* 1-12 */
00159     uint8_t day;                /* 1-31 */
00160     uint8_t hour;               /* 0-23 */
00161     uint8_t min;                /* 0-59 */
00162     uint8_t sec;                /* 0-59 */
00163     uint8_t gmt_off;            /* greenwich mean time offset */
00164 } record_data;
00165 
00166 /* data and time format
00167  * all are stored as "digits" according to specifications for iso9660
00168  */
00169 typedef struct {
00170     uint8_t year[4];            /* 1 to 9999 */
00171     uint8_t month[2];           /* 1 to 12 */
00172     uint8_t day[2];             /* 1 to 31 */
00173     uint8_t hour[2];            /* 0 to 23 */
00174     uint8_t min[2];             /* 0 to 59 */
00175     uint8_t sec[2];             /* 0 to 59 */
00176     uint8_t hun[2];             /* hundredths of a second */
00177     uint8_t gmt_off;            /* GMT offset */
00178 } date_time;
00179 
00180 /* iso 9660 directory record */
00181 typedef struct {
00182     uint8_t length;             /* length of directory record */
00183     uint8_t ext_len;            /* extended attribute record length */
00184     uint8_t ext_loc[8];         /* location of extent (2|32) */
00185     uint8_t data_len[8];        /* data length (2|32) */
00186     record_data rec;            /* recording date and time */
00187     int8_t flags;               /* file flags */
00188     uint8_t unit_sz;            /* file unit size */
00189     uint8_t gap_sz;             /* interleave gap size */
00190     uint8_t seq[4];             /* volume sequence number (2|16) */
00191     uint8_t len;                /* length of file identifier */
00192 } iso9660_dentry;
00193 
00194 /* This is a dummy struct used to make reading an entire PVD easier,
00195  * due to the fact that the root directory has a 1 byte name that
00196  * wouldn't be worth adding to the regular struct.
00197  */
00198 typedef struct {
00199     uint8_t length;             /* length of directory record */
00200     uint8_t ext_len;            /* extended attribute record length */
00201     uint8_t ext_loc[8];         /* location of extent (2|32) */
00202     uint8_t data_len[8];        /* data length (2|32) */
00203     record_data rec;            /* recording date and time */
00204     int8_t flags;               /* file flags */
00205     uint8_t unit_sz;            /* file unit size */
00206     uint8_t gap_sz;             /* interleave gap size */
00207     uint8_t seq[4];             /* volume sequence number (2|16) */
00208     uint8_t len;                /* length of file identifier */
00209     char name;
00210 } iso9660_root_dentry;
00211 
00212 /* generic volume descriptor */
00213 typedef struct {
00214     uint8_t type;               /* volume descriptor type */
00215     char magic[ISODCL(2, 6)];   /* magic number. CD001 */
00216     char ver[ISODCL(7, 7)];     /* volume descriptor version */
00217 } iso_vd;
00218 
00219 /* primary volume descriptor */
00220 typedef struct {
00221     char unused1[ISODCL(8, 8)]; /* should be 0.  unused. */
00222     char sys_id[ISODCL(9, 40)]; /* system identifier */
00223     char vol_id[ISODCL(41, 72)];        /* volume identifier */
00224     char unused2[ISODCL(73, 80)];       /* should be 0.  unused. */
00225     uint8_t vol_spc[ISODCL(81, 88)];    /* volume space size (2|32) */
00226     char unused3[ISODCL(89, 120)];      /* should be 0.  unused. */
00227     uint8_t vol_set[ISODCL(121, 124)];  /* volume set size (2|16) */
00228     uint8_t vol_seq[ISODCL(125, 128)];  /* volume sequence number (2|16) */
00229     uint8_t blk_sz[ISODCL(129, 132)];   /* logical block size (2|16) */
00230     uint8_t path_size[ISODCL(133, 140)];        /* path table size (2|32) */
00231     uint8_t loc_l[ISODCL(141, 144)];    /* locat of occur of type L path tbl. */
00232     uint8_t opt_loc_l[ISODCL(145, 148)];        /* locat of optional occurence */
00233     uint8_t loc_m[ISODCL(149, 152)];    /* locat of occur of type M path tbl. */
00234     uint8_t opt_loc_m[ISODCL(153, 156)];        /* locat of optional occurence */
00235     iso9660_root_dentry dir_rec;        /* directory record for root dir */
00236     char vol_setid[ISODCL(191, 318)];   /* volume set identifier */
00237     unsigned char pub_id[ISODCL(319, 446)];     /* publisher identifier */
00238     unsigned char prep_id[ISODCL(447, 574)];    /* data preparer identifier */
00239     unsigned char app_id[ISODCL(575, 702)];     /* application identifier */
00240     unsigned char copy_id[ISODCL(703, 739)];    /* copyright file identifier */
00241     unsigned char abs_id[ISODCL(740, 776)];     /* abstract file identifier */
00242     unsigned char bib_id[ISODCL(777, 813)];     /* bibliographic file identifier */
00243     date_time make_date;        /* volume creation date/time */
00244     date_time mod_date;         /* volume modification date/time */
00245     date_time exp_date;         /* volume expiration date/time */
00246     date_time ef_date;          /* volume effective date/time */
00247     uint8_t fs_ver;             /* file structure version */
00248     char res[ISODCL(883, 883)]; /* reserved */
00249     char app_use[ISODCL(884, 1395)];    /* application use */
00250     char reserv[ISODCL(1396, 2048)];    /* reserved */
00251 } iso_pvd;
00252 
00253 /* supplementary volume descriptor */
00254 typedef struct {
00255     uint8_t flags[ISODCL(8, 8)];        /* volume flags */
00256     char sys_id[ISODCL(9, 40)]; /* system identifier */
00257     char vol_id[ISODCL(41, 72)];        /* volume identifier */
00258     char unused2[ISODCL(73, 80)];       /* should be 0.  unused. */
00259     uint8_t vol_spc[ISODCL(81, 88)];    /* volume space size (2|32) */
00260     uint8_t esc_seq[ISODCL(89, 120)];   /* escape sequences */
00261     uint8_t vol_set[ISODCL(121, 124)];  /* volume set size (2|16) */
00262     uint8_t vol_seq[ISODCL(125, 128)];  /* volume sequence number (2|16) */
00263     uint8_t blk_sz[ISODCL(129, 132)];   /* logical block size (2|16) */
00264     uint8_t path_size[ISODCL(133, 140)];        /* path table size (2|32) */
00265     uint8_t loc_l[ISODCL(141, 144)];    /* locat of occur of type L path tbl. */
00266     uint8_t opt_loc_l[ISODCL(145, 148)];        /* locat of optional occurence */
00267     uint8_t loc_m[ISODCL(149, 152)];    /* locat of occur of type M path tbl. */
00268     uint8_t opt_loc_m[ISODCL(153, 156)];        /* locat of optional occurence */
00269     iso9660_root_dentry dir_rec;        /* directory record for root dir */
00270     char vol_setid[ISODCL(191, 318)];   /* volume set identifier */
00271     unsigned char pub_id[ISODCL(319, 446)];     /* publisher identifier */
00272     unsigned char prep_id[ISODCL(447, 574)];    /* data preparer identifier */
00273     unsigned char app_id[ISODCL(575, 702)];     /* application identifier */
00274     unsigned char copy_id[ISODCL(703, 739)];    /* copyright file identifier */
00275     unsigned char abs_id[ISODCL(740, 776)];     /* abstract file identifier */
00276     unsigned char bib_id[ISODCL(777, 813)];     /* bibliographic file identifier */
00277     date_time make_date;        /* volume creation date/time */
00278     date_time mod_date;         /* volume modification date/time */
00279     date_time exp_date;         /* volume expiration date/time */
00280     date_time ef_date;          /* volume effective date/time */
00281     char fs_ver[ISODCL(882, 882)];      /* file structure version */
00282     char res[ISODCL(883, 883)]; /* reserved */
00283     char app_use[ISODCL(884, 1395)];    /* application use */
00284     char reserv[ISODCL(1396, 2048)];    /* reserved */
00285 } iso_svd;
00286 
00287 /* iso 9660 boot record */
00288 typedef struct {
00289     char boot_sys_id[ISODCL(8, 39)];    /* boot system identifier */
00290     char boot_id[ISODCL(40, 71)];       /* boot identifier */
00291     char system_use[ISODCL(72, 2048)];  /* system use */
00292 } iso_bootrec;
00293 
00294 /* path table record */
00295 typedef struct {
00296     uint8_t len_di;             /* length of directory identifier */
00297     uint8_t attr_len;           /* extended attribute record length */
00298     uint8_t ext_loc[4];         /* location of extent */
00299     uint8_t par_dir[2];         /* parent directory number */
00300 } path_table_rec;
00301 
00302 /* extended attribute record */
00303 typedef struct {
00304     uint8_t uid[ISODCL(1, 4)];  /* owner identification */
00305     uint8_t gid[ISODCL(5, 8)];  /* group identification */
00306     uint8_t mode[ISODCL(9, 10)];        /* permissions */
00307     uint8_t cre[ISODCL(11, 27)];        /* file creation date/time */
00308     uint8_t mod[ISODCL(28, 44)];        /* file modification d/t */
00309     uint8_t exp[ISODCL(45, 61)];        /* file expiration d/t */
00310     uint8_t eff[ISODCL(62, 78)];        /* file effective d/t */
00311     uint8_t fmt[ISODCL(79, 79)];        /* record format */
00312     uint8_t attr[ISODCL(80, 80)];       /* record attributes */
00313     uint8_t len[ISODCL(81, 84)];        /* record length */
00314     uint8_t sys_id[ISODCL(85, 116)];    /* system identifier */
00315     uint8_t uns[ISODCL(117, 180)];      /* system use, not specified */
00316     uint8_t e_ver[ISODCL(181, 181)];    /* extended attribute record version */
00317     uint8_t len_esc[ISODCL(182, 182)];  /* length of escape sequences */
00318 } ext_attr_rec;
00319 
00320 /* primary volume descriptor linked list node */
00321 typedef struct pvd_node {
00322     iso_pvd pvd;
00323     struct pvd_node *next;
00324 } pvd_node;
00325 
00326 /* supplementary volume descriptor linked list node */
00327 typedef struct svd_node {
00328     iso_svd svd;
00329     struct svd_node *next;
00330 } svd_node;
00331 
00332 /* RockRidge extension info */
00333 typedef struct {
00334     uid_t uid /* owner */ ;
00335     gid_t gid;                  /* group */
00336     uint16_t mode;              /* posix file mode */
00337     uint32_t nlink;             /* number of links */
00338     char fn[ISO9660_MAXNAMLEN]; /* alternate filename */
00339 } rockridge_ext;
00340 
00341 /*
00342  * Inode
00343  */
00344 typedef struct {
00345     iso9660_dentry dr;          /* directory record */
00346     ext_attr_rec *ea;           /* extended attribute record */
00347     char fn[ISO9660_MAXNAMLEN]; /* file name */
00348     rockridge_ext *rr;          /* RockRidge Extensions */
00349     int version;
00350 } iso9660_inode;
00351 
00352 /* inode linked list node */
00353 typedef struct in_node {
00354     iso9660_inode inode;
00355     OFF_T offset;               /* byte offset of inode into disk */
00356     INUM_T inum;                /* identifier of inode */
00357     int size;                   /* kludge: used to flag fifos, etc */
00358     struct in_node *next;
00359 } in_node;
00360 
00361 /* The all important ISO_INFO struct */
00362 typedef struct {
00363     TSK_FS_INFO fs_info;        /* SUPER CLASS */
00364     INUM_T dinum;               /* cached inode number */
00365     iso9660_inode *dinode;      /* cached disk inode */
00366     uint32_t path_tab_addr;     /* address of path table */
00367     uint32_t root_addr;         /* address of root dir extent */
00368     pvd_node *pvd;              /* primary volume descriptors */
00369     svd_node *svd;              /* secondary volume descriptors */
00370     in_node *in;                /* list of inodes */
00371     uint8_t rr_found;           /* 1 if rockridge found */
00372 } ISO_INFO;
00373 
00374 extern uint8_t iso9660_dent_walk(TSK_FS_INFO * fs, INUM_T inode,
00375     TSK_FS_DENT_FLAG_ENUM flags, TSK_FS_DENT_TYPE_WALK_CB action,
00376     void *ptr);
00377 
00378 extern uint8_t iso9660_dinode_load(ISO_INFO * iso, INUM_T inum);
00379 
00380 /**********************************************************
00381  *
00382  * RockRidge Extensions
00383  *
00384  **********************************************************/
00385 
00386 /* System use sharing protocol CE entry */
00387 typedef struct {
00388     char sig[ISODCL(1, 2)];     /* signature, should be "CE" */
00389     uint8_t len[ISODCL(3, 3)];  /* length of system use entry */
00390     uint8_t ver[ISODCL(4, 4)];  /* system use entry version */
00391     uint8_t blk_loc[ISODCL(5, 12)];     /* block location */
00392     uint8_t offs[ISODCL(13, 20)];       /* offset */
00393     uint8_t len_c[ISODCL(21, 28)];      /* length of cont area */
00394 
00395 } ce_sys_use;
00396 
00397 /* System use  sharing protocol SP entry */
00398 typedef struct {
00399     char sig[ISODCL(1, 2)];     /* signature, should be "SP" */
00400     uint8_t len[ISODCL(3, 3)];  /* length of system use entry */
00401     uint8_t ver[ISODCL(4, 4)];  /* system use entry version */
00402     uint8_t check[ISODCL(5, 6)];        /* check bytes 0xbeef */
00403     uint8_t skip[ISODCL(7, 7)]; /* bytes skipped */
00404 } sp_sys_use;
00405 
00406 /* Rockridge ISO9660 system use field entry */
00407 typedef struct {
00408     char sig[ISODCL(1, 2)];     /* signature, should be "RR" */
00409     uint8_t len[ISODCL(3, 3)];  /* length of system use entry */
00410     uint8_t ver[ISODCL(4, 4)];  /* system use entry version */
00411     uint8_t foo[ISODCL(5, 5)];  /* foo */
00412 } rr_sys_use;
00413 
00414 /* Rockridge PX entry */
00415 typedef struct {
00416     char sig[ISODCL(1, 2)];     /* signature, should be "PX" */
00417     uint8_t len[ISODCL(3, 3)];  /* length, should be 44 */
00418     uint8_t ver[ISODCL(4, 4)];  /* system use entry version (1) */
00419     uint8_t mode[ISODCL(5, 12)];        /* POSIX file mode */
00420     uint8_t links[ISODCL(13, 20)];      /* POSIX file links */
00421     uint8_t uid[ISODCL(21, 28)];        /* POSIX user id */
00422     uint8_t gid[ISODCL(29, 36)];        /* POSIX group id */
00423     /* rockridge docs say this is here, k3b disagrees... hmmmm */
00424     //      uint8_t serial[ISODCL(37,44)];  /* POSIX file serial number */
00425 } rr_px_entry;
00426 
00427 /* Rockridge PN entry */
00428 typedef struct {
00429     char sig[ISODCL(1, 2)];     /* signature, should be "PN" */
00430     uint8_t len[ISODCL(3, 3)];  /* length, should be 20 */
00431     uint8_t ver[ISODCL(4, 4)];  /* system use entry version (1) */
00432     uint8_t devt_h[ISODCL(5, 12)];      /* top 32 bits of device # */
00433     uint8_t devt_l[ISODCL(13, 20)];     /* low 32 bits of device # */
00434 } rr_pn_entry;
00435 
00436 /* Rockridge SL entry */
00437 typedef struct {
00438     char sig[ISODCL(1, 2)];     /* signature, should be "SL" */
00439     uint8_t len[ISODCL(3, 3)];  /* length */
00440     uint8_t ver[ISODCL(4, 4)];  /* system use entry version (1) */
00441     uint8_t flags[ISODCL(5, 5)];        /* flags */
00442 } rr_sl_entry;
00443 
00444 /* Rockridge NM entry */
00445 typedef struct {
00446     char sig[ISODCL(1, 2)];     /* signature, should be "NM" */
00447     uint8_t len[ISODCL(3, 3)];  /* length of alternate name */
00448     uint8_t ver[ISODCL(4, 4)];  /* system use entry version (1) */
00449     uint8_t flags[ISODCL(5, 5)];        /* flags */
00450 } rr_nm_entry;
00451 
00452 /* Rockridge CL entry */
00453 typedef struct {
00454     char sig[ISODCL(1, 2)];     /* signature, should be "CL" */
00455     uint8_t len[ISODCL(3, 3)];  /* length, should be 12 */
00456     uint8_t ver[ISODCL(4, 4)];  /* system use entry version (1) */
00457     uint8_t par_loc[ISODCL(5, 12)];     /* location of parent directory */
00458 } rr_cl_entry;
00459 
00460 /* Rockridge RE entry */
00461 typedef struct {
00462     char sig[ISODCL(1, 2)];     /* signature, should be "RE" */
00463     uint8_t len[ISODCL(3, 3)];  /* length, should be 4 */
00464     uint8_t ver[ISODCL(4, 4)];  /* system use entry version (1) */
00465 } rr_re_entry;
00466 
00467 /* Rockridge TF entry */
00468 typedef struct {
00469     char sig[ISODCL(1, 2)];     /* signature, should be "TF" */
00470     uint8_t len[ISODCL(3, 3)];  /* length of TF entry */
00471     uint8_t ver[ISODCL(4, 4)];  /* system use entry version (1) */
00472     uint8_t flags[ISODCL(5, 5)];        /* flags */
00473 } rr_tf_entry;
00474 
00475 /* Rockridge SF entry */
00476 typedef struct {
00477     char sig[ISODCL(1, 2)];     /* signature, should be "SF" */
00478     uint8_t len[ISODCL(3, 3)];  /* length, should be 21 */
00479     uint8_t ver[ISODCL(4, 4)];  /* system use entry version (1) */
00480     uint8_t vfs_h[ISODCL(5, 12)];       /* virtual file size high */
00481     uint8_t vfs_l[ISODCL(13, 20)];      /* virtual file size low */
00482     uint8_t depth[ISODCL(21, 21)];      /* table depth */
00483 } rr_sf_entry;
00484 
00485 #endif

Generated on Thu Apr 5 12:00:08 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.4.2