/src/sleuthkit/tsk/fs/swapfs.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | ** The Sleuth Kit |
3 | | ** |
4 | | ** Brian Carrier [carrier <at> sleuthkit [dot] org] |
5 | | ** Copyright (c) 2006-2011 Brian Carrier, Basis Technology. All Rights reserved |
6 | | ** Copyright (c) 2004-2005 Brian Carrier. All rights reserved |
7 | | ** |
8 | | ** |
9 | | ** This software is distributed under the Common Public License 1.0 |
10 | | ** |
11 | | */ |
12 | | |
13 | | #include "tsk_fs_i.h" |
14 | | |
15 | | /** |
16 | | *\file swapfs.c |
17 | | * Contains the internal "swapfs" specific functions. The "swap" file system is used to process |
18 | | * an arbitrary chunk of data as 4096-byte pages that have no other structure. |
19 | | * This means that you can use the data-level tools, but that is it. This is similar to |
20 | | * the rawfs code, but a different block size. This is primarily intended for Unix systems |
21 | | * that have a swap space partition. Much of the code for swap and rawfs are similar and therefore |
22 | | * share tsk_fs_nofs_XXXX functions, such as tsk_fs_nofs_close() |
23 | | */ |
24 | | |
25 | | |
26 | | /** \internal |
27 | | * Open part of a disk image as "swap" space. This assumes no structure exists. |
28 | | * Data are organized into 4096-byte pages. |
29 | | * |
30 | | * @param img_info Disk image to analyze |
31 | | * @param offset Byte offset where swap space starts. |
32 | | * @returns NULL on error |
33 | | */ |
34 | | TSK_FS_INFO * |
35 | | swapfs_open(TSK_IMG_INFO * img_info, TSK_OFF_T offset) |
36 | 0 | { |
37 | 0 | TSK_OFF_T len; |
38 | 0 | TSK_FS_INFO *fs; |
39 | | |
40 | | // clean up any error messages that are lying around |
41 | 0 | tsk_error_reset(); |
42 | |
|
43 | 0 | if (img_info->sector_size == 0) { |
44 | 0 | tsk_error_reset(); |
45 | 0 | tsk_error_set_errno(TSK_ERR_FS_ARG); |
46 | 0 | tsk_error_set_errstr("swapfs_open: sector size is 0"); |
47 | 0 | return NULL; |
48 | 0 | } |
49 | | |
50 | 0 | fs = (TSK_FS_INFO *) tsk_fs_malloc(sizeof(*fs)); |
51 | 0 | if (fs == NULL) |
52 | 0 | return NULL; |
53 | | |
54 | | |
55 | | /* All we need to set are the block sizes and max bloc size etc. */ |
56 | 0 | fs->img_info = img_info; |
57 | 0 | fs->offset = offset; |
58 | 0 | fs->ftype = TSK_FS_TYPE_SWAP; |
59 | 0 | fs->duname = "Page"; |
60 | 0 | fs->flags = 0; |
61 | 0 | fs->tag = TSK_FS_INFO_TAG; |
62 | |
|
63 | 0 | fs->inum_count = 0; |
64 | 0 | fs->root_inum = 0; |
65 | 0 | fs->first_inum = 0; |
66 | 0 | fs->last_inum = 0; |
67 | |
|
68 | 0 | len = img_info->size; |
69 | 0 | fs->block_count = len / 4096; |
70 | 0 | if (len % 4096) |
71 | 0 | fs->block_count++; |
72 | |
|
73 | 0 | fs->first_block = 0; |
74 | 0 | fs->last_block = fs->last_block_act = fs->block_count - 1; |
75 | 0 | fs->block_size = 4096; |
76 | 0 | fs->dev_bsize = img_info->sector_size; |
77 | | |
78 | | /* Pointers to functions */ |
79 | 0 | fs->close = tsk_fs_nofs_close; |
80 | 0 | fs->fsstat = tsk_fs_nofs_fsstat; |
81 | |
|
82 | 0 | fs->block_walk = tsk_fs_nofs_block_walk; |
83 | 0 | fs->block_getflags = tsk_fs_nofs_block_getflags; |
84 | |
|
85 | 0 | fs->inode_walk = tsk_fs_nofs_inode_walk; |
86 | 0 | fs->istat = tsk_fs_nofs_istat; |
87 | 0 | fs->file_add_meta = tsk_fs_nofs_file_add_meta; |
88 | |
|
89 | 0 | fs->get_default_attr_type = tsk_fs_nofs_get_default_attr_type; |
90 | 0 | fs->load_attrs = tsk_fs_nofs_make_data_run; |
91 | |
|
92 | 0 | fs->dir_open_meta = tsk_fs_nofs_dir_open_meta; |
93 | 0 | fs->name_cmp = tsk_fs_nofs_name_cmp; |
94 | |
|
95 | 0 | fs->jblk_walk = tsk_fs_nofs_jblk_walk; |
96 | 0 | fs->jentry_walk = tsk_fs_nofs_jentry_walk; |
97 | 0 | fs->jopen = tsk_fs_nofs_jopen; |
98 | 0 | fs->journ_inum = 0; |
99 | |
|
100 | 0 | return fs; |
101 | 0 | } |