/src/sleuthkit/tsk/fs/rawfs.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | ** The Sleuth Kit |
3 | | ** |
4 | | ** Brian Carrier [carrier <at> sleuthkit [dot] org] |
5 | | ** Copyright (c) 2006-2011 Brian Carrier, Basis Technology. All Rights reserved |
6 | | ** Copyright (c) 2004-2005 Brian Carrier. All rights reserved |
7 | | ** |
8 | | ** |
9 | | ** This software is distributed under the Common Public License 1.0 |
10 | | ** |
11 | | */ |
12 | | |
13 | | #include "tsk_fs_i.h" |
14 | | |
15 | | |
16 | | /** |
17 | | *\file rawfs.c |
18 | | * Contains internal "raw" specific file system functions. The raw file system is used to process |
19 | | * an arbitrary chunk of data as 512-byte sectors that have no other structure. |
20 | | * This means that you can use the data-level tools, but that is it. Because raw and swapfs |
21 | | * are very similar implementations, they share many of the tsk_fs_nofs_XXX functions, such as |
22 | | * tsk_fs_nofs_close(); |
23 | | */ |
24 | | |
25 | | |
26 | | |
27 | | /** \internal |
28 | | * Open part of a disk image as a raw file system -- which basically means that it has no file system structure. |
29 | | * The data is considered to be in 512-byte sectors. |
30 | | * |
31 | | * @param img_info Disk image to analyze |
32 | | * @param offset Byte offset where "file system" starts |
33 | | * @returns NULL on error |
34 | | */ |
35 | | TSK_FS_INFO * |
36 | | rawfs_open(TSK_IMG_INFO * img_info, TSK_OFF_T offset) |
37 | 0 | { |
38 | 0 | TSK_OFF_T len; |
39 | 0 | TSK_FS_INFO *fs; |
40 | | |
41 | | // clean up any error messages that are lying around |
42 | 0 | tsk_error_reset(); |
43 | |
|
44 | 0 | if (img_info->sector_size == 0) { |
45 | 0 | tsk_error_reset(); |
46 | 0 | tsk_error_set_errno(TSK_ERR_FS_ARG); |
47 | 0 | tsk_error_set_errstr("rawfs_open: sector size is 0"); |
48 | 0 | return NULL; |
49 | 0 | } |
50 | | |
51 | 0 | fs = (TSK_FS_INFO *) tsk_fs_malloc(sizeof(TSK_FS_INFO)); |
52 | 0 | if (fs == NULL) |
53 | 0 | return NULL; |
54 | | |
55 | | |
56 | | /* All we need to set are the block sizes and max block size etc. */ |
57 | 0 | fs->img_info = img_info; |
58 | 0 | fs->offset = offset; |
59 | |
|
60 | 0 | fs->ftype = TSK_FS_TYPE_RAW; |
61 | 0 | fs->duname = "Sector"; |
62 | 0 | fs->flags = 0; |
63 | 0 | fs->tag = TSK_FS_INFO_TAG; |
64 | |
|
65 | 0 | fs->inum_count = 0; |
66 | 0 | fs->root_inum = 0; |
67 | 0 | fs->first_inum = 0; |
68 | 0 | fs->last_inum = 0; |
69 | |
|
70 | 0 | len = img_info->size; |
71 | 0 | fs->block_size = 512; |
72 | 0 | fs->block_count = len / fs->block_size; |
73 | 0 | if (len % fs->block_size) |
74 | 0 | fs->block_count++; |
75 | |
|
76 | 0 | fs->first_block = 0; |
77 | 0 | fs->last_block = fs->last_block_act = fs->block_count - 1; |
78 | 0 | fs->dev_bsize = img_info->sector_size; |
79 | | |
80 | | /* Pointer to functions */ |
81 | 0 | fs->close = tsk_fs_nofs_close; |
82 | 0 | fs->fsstat = tsk_fs_nofs_fsstat; |
83 | |
|
84 | 0 | fs->block_walk = tsk_fs_nofs_block_walk; |
85 | 0 | fs->block_getflags = tsk_fs_nofs_block_getflags; |
86 | |
|
87 | 0 | fs->inode_walk = tsk_fs_nofs_inode_walk; |
88 | 0 | fs->file_add_meta = tsk_fs_nofs_file_add_meta; |
89 | 0 | fs->istat = tsk_fs_nofs_istat; |
90 | |
|
91 | 0 | fs->get_default_attr_type = tsk_fs_nofs_get_default_attr_type; |
92 | 0 | fs->load_attrs = tsk_fs_nofs_make_data_run; |
93 | |
|
94 | 0 | fs->dir_open_meta = tsk_fs_nofs_dir_open_meta; |
95 | 0 | fs->name_cmp = tsk_fs_nofs_name_cmp; |
96 | |
|
97 | 0 | fs->jblk_walk = tsk_fs_nofs_jblk_walk; |
98 | 0 | fs->jentry_walk = tsk_fs_nofs_jentry_walk; |
99 | 0 | fs->jopen = tsk_fs_nofs_jopen; |
100 | 0 | fs->journ_inum = 0; |
101 | |
|
102 | 0 | return fs; |
103 | 0 | } |