/usr/include/tsk3/img/tsk_img.h is in libtsk-dev 3.2.3-2ubuntu1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 | /*
* The Sleuth Kit
*
* Brian Carrier [carrier <at> sleuthkit [dot] org]
* Copyright (c) 2005-2008 Brian Carrier. All rights reserved
*
* This software is distributed under the Common Public License 1.0
*/
#ifndef _TSK_IMG_H
#define _TSK_IMG_H
/**
* \file tsk_img.h
* Contains the external library definitions for the disk image functions.
* Note that this file is not meant to be directly included.
* It is included by both libtsk.h and tsk_img_i.h.
*/
/**
* \defgroup imglib Disk Image Functions
*/
#ifdef __cplusplus
extern "C" {
#endif
/**
* \ingroup imglib
* Macro that takes a image type and returns 1 if the type
* is for a raw file format. */
#define TSK_IMG_TYPE_ISRAW(t) \
((((t) & TSK_IMG_TYPE_RAW_SING) || ((t) & TSK_IMG_TYPE_RAW_SPLIT))?1:0)
/**
* \ingroup imglib
* Macro that takes a image type and returns 1 if the type
* is for an AFF file format. */
#define TSK_IMG_TYPE_ISAFF(t) \
((((t) & TSK_IMG_TYPE_AFF_AFF) || ((t) & TSK_IMG_TYPE_AFF_AFD) || ((t) & TSK_IMG_TYPE_AFF_AFM) || \
((t) & TSK_IMG_TYPE_AFF_ANY))?1:0)
/**
* \ingroup imglib
* Macro that takes a image type and returns 1 if the type
* is for an EWF file format. */
#define TSK_IMG_TYPE_ISEWF(t) \
((((t) & TSK_IMG_TYPE_EWF_EWF))?1:0)
/**
* Flag values for the disk image format type. Each type has a
* bit associated with it. There are TSK_IMG_TYPE_ISXXX macros
* to determine the broad group of the type (raw vs aff etc.)
*/
typedef enum {
TSK_IMG_TYPE_DETECT = 0x0000, ///< Use autodetection methods
TSK_IMG_TYPE_RAW_SING = 0x0001, ///< Raw single disk image
TSK_IMG_TYPE_RAW_SPLIT = 0x0002, ///< Raw split image
TSK_IMG_TYPE_AFF_AFF = 0x0004, ///< AFF AFF Format
TSK_IMG_TYPE_AFF_AFD = 0x0008, ///< AFD AFF Format
TSK_IMG_TYPE_AFF_AFM = 0x0010, ///< AFM AFF Format
TSK_IMG_TYPE_AFF_ANY = 0x0020, ///< Any format supported by AFFLIB (including beta ones)
TSK_IMG_TYPE_EWF_EWF = 0x0040, ///< EWF version
TSK_IMG_TYPE_UNSUPP = 0xffff, ///< Unsupported disk image type
} TSK_IMG_TYPE_ENUM;
#define TSK_IMG_INFO_CACHE_NUM 4
#define TSK_IMG_INFO_CACHE_LEN 65536
typedef struct TSK_IMG_INFO TSK_IMG_INFO;
/**
* Created when a disk image has been opened and stores general information and handles.
*/
struct TSK_IMG_INFO {
TSK_IMG_TYPE_ENUM itype; ///< Type of disk image format
TSK_OFF_T size; ///< Total size of image in bytes
unsigned int sector_size; ///< sector size of device in bytes (typically 512)
char cache[TSK_IMG_INFO_CACHE_NUM][TSK_IMG_INFO_CACHE_LEN]; ///< read cache
TSK_OFF_T cache_off[TSK_IMG_INFO_CACHE_NUM]; ///< starting byte offset of corresponding cache entry
int cache_age[TSK_IMG_INFO_CACHE_NUM]; ///< "Age" of corresponding cache entry, higher means more recently used
size_t cache_len[TSK_IMG_INFO_CACHE_NUM]; ///< Length of cache entry used (0 if never used)
ssize_t(*read) (TSK_IMG_INFO * img, TSK_OFF_T off, char *buf, size_t len); ///< \internal External progs should call tsk_img_read()
void (*close) (TSK_IMG_INFO *); ///< \internal Progs should call tsk_img_close()
void (*imgstat) (TSK_IMG_INFO *, FILE *); ///< Pointer to file type specific function
};
// open and close functions
extern TSK_IMG_INFO *tsk_img_open_sing(const TSK_TCHAR * a_image,
TSK_IMG_TYPE_ENUM type, unsigned int a_ssize);
extern TSK_IMG_INFO *tsk_img_open(int,
const TSK_TCHAR * const images[], TSK_IMG_TYPE_ENUM,
unsigned int a_ssize);
extern TSK_IMG_INFO *tsk_img_open_utf8_sing(const char *a_image,
TSK_IMG_TYPE_ENUM type, unsigned int a_ssize);
extern TSK_IMG_INFO *tsk_img_open_utf8(int num_img,
const char *const images[], TSK_IMG_TYPE_ENUM type,
unsigned int a_ssize);
extern void tsk_img_close(TSK_IMG_INFO *);
// read functions
extern ssize_t tsk_img_read(TSK_IMG_INFO * img, TSK_OFF_T off,
char *buf, size_t len);
// type conversion functions
extern TSK_IMG_TYPE_ENUM tsk_img_type_toid(const TSK_TCHAR *);
extern const char *tsk_img_type_toname(TSK_IMG_TYPE_ENUM);
extern const char *tsk_img_type_todesc(TSK_IMG_TYPE_ENUM);
extern TSK_IMG_TYPE_ENUM tsk_img_type_supported();
extern void tsk_img_type_print(FILE *);
#ifdef __cplusplus
}
#endif
#endif
|