本文整理汇总了C++中TSK_FS_INFO类的典型用法代码示例。如果您正苦于以下问题：C++ TSK_FS_INFO类的具体用法？C++ TSK_FS_INFO怎么用？C++ TSK_FS_INFO使用的例子？那么恭喜您, 这里精选的类代码示例或许可以为您提供帮助。
在下文中一共展示了TSK_FS_INFO类的17个代码示例，这些例子默认根据受欢迎程度排序。您可以为喜欢或者感觉有用的代码点赞，您的评价将有助于我们的系统推荐出更棒的C++代码示例。
示例1: do_internal_find_inode
int
do_internal_find_inode (const mountable_t *mountable, int64_t inode)
{
int ret = -1;
TSK_FS_INFO *fs = NULL;
TSK_IMG_INFO *img = NULL; /* Used internally by tsk_fs_dir_walk */
const int flags =
TSK_FS_DIR_WALK_FLAG_ALLOC | TSK_FS_DIR_WALK_FLAG_UNALLOC |
TSK_FS_DIR_WALK_FLAG_RECURSE | TSK_FS_DIR_WALK_FLAG_NOORPHAN;
ret = open_filesystem (mountable->device, &img, &fs);
if (ret < 0)
return ret;
reply (NULL, NULL); /* Reply message. */
ret = tsk_fs_dir_walk (fs, fs->root_inum, flags,
findino_callback, (void *) &inode);
if (ret == 0)
ret = send_file_end (0); /* File transfer end. */
else
send_file_end (1); /* Cancel file transfer. */
fs->close (fs);
img->close (img);
return ret;
}
开发者ID:noxdafox，项目名称:libguestfs，代码行数:28，代码来源:tsk.c
示例2: tsk_fs_file_attr_check
/** \internal
* Check the arguments for the tsk_fs_file_attr_XXX functions
* and load the attributes if needed.
* @param a_fs_file File argument to check.
* @param a_func Name of function that this is checking for (for error messages)
* @returns 1 on error
*/
static int
tsk_fs_file_attr_check(TSK_FS_FILE * a_fs_file, char *a_func)
{
TSK_FS_INFO *fs;
// check the FS_INFO, FS_FILE structures
if ((a_fs_file == NULL) || (a_fs_file->meta == NULL)
|| (a_fs_file->fs_info == NULL)) {
tsk_error_set_errno(TSK_ERR_FS_ARG);
tsk_error_set_errstr("%s: called with NULL pointers", a_func);
return 1;
}
else if (a_fs_file->meta->tag != TSK_FS_META_TAG) {
tsk_error_set_errno(TSK_ERR_FS_ARG);
tsk_error_set_errstr("%s: called with unallocated structures",
a_func);
return 1;
}
fs = a_fs_file->fs_info;
// If the attributes haven't been loaded, then load them.
if (a_fs_file->meta->attr_state == TSK_FS_META_ATTR_ERROR) {
tsk_error_set_errno(TSK_ERR_FS_INODE_COR);
tsk_error_set_errstr("%s: called for file with corrupt data",
a_func);
return 1;
}
else if ((a_fs_file->meta->attr_state != TSK_FS_META_ATTR_STUDIED)
|| (a_fs_file->meta->attr == NULL)) {
if (fs->load_attrs(a_fs_file)) {
return 1;
}
}
return 0;
}
开发者ID:0xNF，项目名称:sleuthkit，代码行数:41，代码来源:fs_file.c
示例3: tsk_fs_file_attr_get
/** \ingroup fslib
* Return the default attribute for the file
* @param a_fs_file File to get data from
* @returns NULL on error
*/
const TSK_FS_ATTR *
tsk_fs_file_attr_get(TSK_FS_FILE * a_fs_file)
{
TSK_FS_ATTR_TYPE_ENUM type;
TSK_FS_INFO *fs;
if (tsk_fs_file_attr_check(a_fs_file, "tsk_fs_file_attr_get"))
return NULL;
// since they did not give us a type, get the default for the file
fs = a_fs_file->fs_info;
type = fs->get_default_attr_type(a_fs_file);
return tsk_fs_attrlist_get(a_fs_file->meta->attr, type);
}
开发者ID:0xNF，项目名称:sleuthkit，代码行数:20，代码来源:fs_file.c
示例4: tsk_fs_attr_walk_nonres
/** \internal
* Processes a non-resident TSK_FS_ATTR structure and calls the callback with the associated
* data.
*
* @param fs_attr Resident data structure to be walked
* @param a_flags Flags for walking
* @param a_action Callback action
* @param a_ptr Pointer to data that is passed to callback
* @returns 1 on error or 0 on success
*/
static uint8_t
tsk_fs_attr_walk_nonres(const TSK_FS_ATTR * fs_attr,
TSK_FS_FILE_WALK_FLAG_ENUM a_flags, TSK_FS_FILE_WALK_CB a_action,
void *a_ptr)
{
char *buf = NULL;
TSK_OFF_T tot_size;
TSK_OFF_T off = 0;
TSK_FS_ATTR_RUN *fs_attr_run;
int retval;
uint32_t skip_remain;
TSK_FS_INFO *fs = fs_attr->fs_file->fs_info;
uint8_t stop_loop = 0;
if ((fs_attr->flags & TSK_FS_ATTR_NONRES) == 0) {
tsk_error_set_errno(TSK_ERR_FS_ARG);
tsk_error_set_errstr
("tsk_fs_file_walk_nonres: called with non-non-resident data");
return 1;
}
/* if we want the slack space too, then use the allocsize */
if (a_flags & TSK_FS_FILE_WALK_FLAG_SLACK)
tot_size = fs_attr->nrd.allocsize;
else
tot_size = fs_attr->size;
skip_remain = fs_attr->nrd.skiplen;
if ((a_flags & TSK_FS_FILE_WALK_FLAG_AONLY) == 0) {
if ((buf = (char *) tsk_malloc(fs->block_size)) == NULL) {
return 1;
}
}
/* cycle through the number of runs we have */
retval = TSK_WALK_CONT;
for (fs_attr_run = fs_attr->nrd.run; fs_attr_run;
fs_attr_run = fs_attr_run->next) {
TSK_DADDR_T addr, len_idx;
addr = fs_attr_run->addr;
/* cycle through each block in the run */
for (len_idx = 0; len_idx < fs_attr_run->len; len_idx++) {
TSK_FS_BLOCK_FLAG_ENUM myflags;
/* If the address is too large then give an error */
if (addr + len_idx > fs->last_block) {
if (fs_attr->fs_file->meta->
flags & TSK_FS_META_FLAG_UNALLOC)
tsk_error_set_errno(TSK_ERR_FS_RECOVER);
else
tsk_error_set_errno(TSK_ERR_FS_BLK_NUM);
tsk_error_set_errstr
("Invalid address in run (too large): %" PRIuDADDR "",
addr + len_idx);
return 1;
}
// load the buffer if they want more than just the address
if ((a_flags & TSK_FS_FILE_WALK_FLAG_AONLY) == 0) {
/* sparse files just get 0s */
if (fs_attr_run->flags & TSK_FS_ATTR_RUN_FLAG_SPARSE) {
memset(buf, 0, fs->block_size);
}
/* FILLER entries exist when the source file system can store run
* info out of order and we did not get all of the run info. We
* return 0s if data is read from this type of run. */
else if (fs_attr_run->flags & TSK_FS_ATTR_RUN_FLAG_FILLER) {
memset(buf, 0, fs->block_size);
if (tsk_verbose)
fprintf(stderr,
"tsk_fs_attr_walk_nonres: File %" PRIuINUM
" has FILLER entry, using 0s\n",
fs_attr->fs_file->meta->addr);
}
// we return 0s for reads past the initsize
else if ((off >= fs_attr->nrd.initsize)
&& ((a_flags & TSK_FS_FILE_READ_FLAG_SLACK) == 0)) {
memset(buf, 0, fs->block_size);
}
else {
ssize_t cnt;
cnt = tsk_fs_read_block
//.........这里部分代码省略.........
开发者ID:judsonp，项目名称:sleuthkit，代码行数:101，代码来源:fs_attr.c
示例5: ext2fs_dent_copy
/*
*
* NoTe that this does not set the flag value.
*
* return 1 on error and 0 on success */
static uint8_t
ext2fs_dent_copy(EXT2FS_INFO * ext2fs, EXT2FS_DINFO * dinfo,
char *ext2_dent, TSK_FS_DENT * fs_dent)
{
TSK_FS_INFO *fs = &(ext2fs->fs_info);
int i;
if (ext2fs->deentry_type == EXT2_DE_V1) {
ext2fs_dentry1 *dir = (ext2fs_dentry1 *) ext2_dent;
fs_dent->inode = tsk_getu32(fs->endian, dir->inode);
/* ext2 does not null terminate */
if (tsk_getu16(fs->endian, dir->name_len) >= fs_dent->name_max) {
tsk_error_reset();
tsk_errno = TSK_ERR_FS_ARG;
snprintf(tsk_errstr, TSK_ERRSTR_L,
"ext2fs_dent_copy: Name Space too Small %d %lu",
tsk_getu16(fs->endian, dir->name_len), fs_dent->name_max);
return 1;
}
/* Copy and Null Terminate */
strncpy(fs_dent->name, dir->name, tsk_getu16(fs->endian,
dir->name_len));
fs_dent->name[tsk_getu16(fs->endian, dir->name_len)] = '\0';
fs_dent->ent_type = TSK_FS_DENT_TYPE_UNDEF;
}
else {
ext2fs_dentry2 *dir = (ext2fs_dentry2 *) ext2_dent;
fs_dent->inode = tsk_getu32(fs->endian, dir->inode);
/* ext2 does not null terminate */
if (dir->name_len >= fs_dent->name_max) {
tsk_error_reset();
tsk_errno = TSK_ERR_FS_ARG;
snprintf(tsk_errstr, TSK_ERRSTR_L,
"ext2_dent_copy: Name Space too Small %d %lu",
dir->name_len, fs_dent->name_max);
return 1;
}
/* Copy and Null Terminate */
strncpy(fs_dent->name, dir->name, dir->name_len);
fs_dent->name[dir->name_len] = '\0';
switch (dir->type) {
case EXT2_DE_REG_FILE:
fs_dent->ent_type = TSK_FS_DENT_TYPE_REG;
break;
case EXT2_DE_DIR:
fs_dent->ent_type = TSK_FS_DENT_TYPE_DIR;
break;
case EXT2_DE_CHRDEV:
fs_dent->ent_type = TSK_FS_DENT_TYPE_CHR;
break;
case EXT2_DE_BLKDEV:
fs_dent->ent_type = TSK_FS_DENT_TYPE_BLK;
break;
case EXT2_DE_FIFO:
fs_dent->ent_type = TSK_FS_DENT_TYPE_FIFO;
break;
case EXT2_DE_SOCK:
fs_dent->ent_type = TSK_FS_DENT_TYPE_SOCK;
break;
case EXT2_DE_SYMLINK:
fs_dent->ent_type = TSK_FS_DENT_TYPE_LNK;
break;
case EXT2_DE_UNKNOWN:
default:
fs_dent->ent_type = TSK_FS_DENT_TYPE_UNDEF;
break;
}
}
/* Clean up name */
i = 0;
while (fs_dent->name[i] != '\0') {
if (TSK_IS_CNTRL(fs_dent->name[i]))
fs_dent->name[i] = '^';
i++;
}
fs_dent->path = dinfo->dirs;
fs_dent->pathdepth = dinfo->depth;
if ((fs != NULL) && (fs_dent->inode)
&& (fs_dent->inode <= fs->last_inum)) {
/* Get inode */
if (fs_dent->fsi)
tsk_fs_inode_free(fs_dent->fsi);
if ((fs_dent->fsi = fs->inode_lookup(fs, fs_dent->inode)) == NULL) {
//.........这里部分代码省略.........
开发者ID:anarchivist，项目名称:pyflag，代码行数:101，代码来源:ext2fs_dent.c
示例6: main
int
main(int argc, char **argv1)
{
TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT;
TSK_IMG_INFO *img;
TSK_OFF_T imgaddr = 0;
TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT;
TSK_FS_INFO *fs;
int ch;
TSK_TCHAR *cp;
uint8_t type = 0;
int set = 0;
TSK_DADDR_T count = 0;
TSK_TCHAR **argv;
unsigned int ssize = 0;
#ifdef TSK_WIN32
// On Windows, get the wide arguments (mingw doesn't support wmain)
argv = CommandLineToArgvW(GetCommandLineW(), &argc);
if (argv == NULL) {
fprintf(stderr, "Error getting wide arguments\n");
exit(1);
}
#else
argv = (TSK_TCHAR **) argv1;
#endif
progname = argv[0];
setlocale(LC_ALL, "");
while ((ch = GETOPT(argc, argv, _TSK_T("b:d:f:i:o:s:u:vV"))) > 0) {
switch (ch) {
case _TSK_T('?'):
default:
TFPRINTF(stderr, _TSK_T("Invalid argument: %s\n"),
argv[OPTIND]);
usage();
case _TSK_T('b'):
ssize = (unsigned int) TSTRTOUL(OPTARG, &cp, 0);
if (*cp || *cp == *OPTARG || ssize < 1) {
TFPRINTF(stderr,
_TSK_T
("invalid argument: sector size must be positive: %s\n"),
OPTARG);
usage();
}
break;
case _TSK_T('d'):
type |= TSK_FS_BLKCALC_DD;
count = TSTRTOULL(OPTARG, &cp, 0);
if (*cp || *cp == *OPTARG) {
TFPRINTF(stderr, _TSK_T("Invalid address: %s\n"), OPTARG);
usage();
}
set = 1;
break;
case _TSK_T('f'):
if (TSTRCMP(OPTARG, _TSK_T("list")) == 0) {
tsk_fs_type_print(stderr);
exit(1);
}
fstype = tsk_fs_type_toid(OPTARG);
if (fstype == TSK_FS_TYPE_UNSUPP) {
TFPRINTF(stderr,
_TSK_T("Unsupported file system type: %s\n"), OPTARG);
usage();
}
break;
case _TSK_T('i'):
if (TSTRCMP(OPTARG, _TSK_T("list")) == 0) {
tsk_img_type_print(stderr);
exit(1);
}
imgtype = tsk_img_type_toid(OPTARG);
if (imgtype == TSK_IMG_TYPE_UNSUPP) {
TFPRINTF(stderr, _TSK_T("Unsupported image type: %s\n"),
OPTARG);
usage();
}
break;
case _TSK_T('o'):
if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) {
tsk_error_print(stderr);
exit(1);
}
break;
case _TSK_T('s'):
type |= TSK_FS_BLKCALC_SLACK;
count = TSTRTOULL(OPTARG, &cp, 0);
if (*cp || *cp == *OPTARG) {
//.........这里部分代码省略.........
开发者ID:0xNF，项目名称:sleuthkit，代码行数:101，代码来源:blkcalc.cpp
示例7: MAIN
int
MAIN(int argc, TSK_TCHAR ** argv)
{
TSK_FS_INFO *fs;
TSK_IMG_INFO *img;
TSK_TCHAR *fstype = NULL;
TSK_TCHAR *imgtype = NULL;
int ch;
uint8_t type = 0;
SSIZE_T imgoff = 0;
progname = argv[0];
setlocale(LC_ALL, "");
while ((ch = getopt(argc, argv, _TSK_T("f:i:o:tvV"))) > 0) {
switch (ch) {
case _TSK_T('?'):
default:
TFPRINTF(stderr, _TSK_T("Invalid argument: %s\n"),
argv[optind]);
usage();
case _TSK_T('f'):
fstype = optarg;
if (TSTRCMP(fstype, _TSK_T("list")) == 0) {
tsk_fs_print_types(stderr);
exit(1);
}
break;
case _TSK_T('i'):
imgtype = optarg;
if (TSTRCMP(imgtype, _TSK_T("list")) == 0) {
tsk_img_print_types(stderr);
exit(1);
}
break;
case _TSK_T('o'):
if ((imgoff = tsk_parse_offset(optarg)) == -1) {
tsk_error_print(stderr);
exit(1);
}
break;
case _TSK_T('t'):
type = 1;
break;
case _TSK_T('v'):
tsk_verbose++;
break;
case _TSK_T('V'):
tsk_print_version(stdout);
exit(0);
}
}
/* We need at least one more argument */
if (optind >= argc) {
tsk_fprintf(stderr, "Missing image name\n");
usage();
}
if ((img =
tsk_img_open(imgtype, argc - optind,
(const TSK_TCHAR **) &argv[optind])) == NULL) {
tsk_error_print(stderr);
exit(1);
}
if ((fs = tsk_fs_open(img, imgoff, fstype)) == NULL) {
tsk_error_print(stderr);
if (tsk_errno == TSK_ERR_FS_UNSUPTYPE)
tsk_fs_print_types(stderr);
img->close(img);
exit(1);
}
if (type) {
char *str = tsk_fs_get_type(fs->ftype);
tsk_printf("%s\n", str);
}
else {
if (fs->fsstat(fs, stdout)) {
tsk_error_print(stderr);
fs->close(fs);
img->close(img);
exit(1);
}
}
fs->close(fs);
img->close(img);
exit(0);
}
开发者ID:anarchivist，项目名称:pyflag，代码行数:97，代码来源:fsstat.c
示例8: main
int
main(int argc, char **argv)
{
TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT;
TSK_IMG_INFO *img;
TSK_OFF_T imgaddr = 0;
TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT;
TSK_FS_INFO *fs;
int ch;
TSK_TCHAR **argv;
unsigned int ssize = 0;
TSK_TCHAR *cp;
#ifdef TSK_WIN32
// On Windows, get the wide arguments (mingw doesn't support wmain)
argv = CommandLineToArgvW(GetCommandLineW(), &argc);
if (argv == NULL) {
fprintf(stderr, "Error getting wide arguments\n");
exit(1);
}
#else
argv = (TSK_TCHAR **) argv1;
#endif
progname = argv[0];
while ((ch = GETOPT(argc, argv, "b:f:i:o:vV")) > 0) {
switch (ch) {
case '?':
default:
fprintf(stderr, "Invalid argument: %s\n", argv[OPTIND]);
usage();
case _TSK_T('b'):
ssize = (unsigned int) TSTRTOUL(OPTARG, &cp, 0);
if (*cp || *cp == *OPTARG || ssize < 1) {
TFPRINTF(stderr,
_TSK_T
("invalid argument: sector size must be positive: %s\n"),
OPTARG);
usage();
}
break;
case 'f':
if (TSTRCMP(OPTARG, _TSK_T("list")) == 0) {
tsk_fs_type_print(stderr);
exit(1);
}
fstype = tsk_fs_type_toid(OPTARG);
if (fstype == TSK_FS_TYPE_UNSUPP) {
TFPRINTF(stderr,
_TSK_T("Unsupported file system type: %s\n"), OPTARG);
usage();
}
break;
case 'i':
if (TSTRCMP(OPTARG, _TSK_T("list")) == 0) {
tsk_img_type_print(stderr);
exit(1);
}
imgtype = tsk_img_type_toid(OPTARG);
if (imgtype == TSK_IMG_TYPE_UNSUPP) {
TFPRINTF(stderr, _TSK_T("Unsupported image type: %s\n"),
OPTARG);
usage();
}
break;
case 'o':
if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) {
tsk_error_print(stderr);
exit(1);
}
break;
case 'v':
verbose++;
break;
case 'V':
print_version(stdout);
exit(0);
}
}
/* We need at least one more argument */
if (OPTIND >= argc) {
fprintf(stderr, "Missing image name\n");
usage();
}
img =
img_open(imgoff, argc - OPTIND,
(const char **) &argv[OPTIND], imgtype, ssize);
if (img == NULL) {
tsk_error_print(stderr);
exit(1);
//.........这里部分代码省略.........
开发者ID:TheLoneRanger14，项目名称:vmxray，代码行数:101，代码来源:fscheck.cpp
示例9: main
int
main(int argc, char **argv1)
{
TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT;
TSK_IMG_INFO *img;
TSK_OFF_T imgaddr = 0;
TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT;
TSK_FS_INFO *fs;
TSK_INUM_T inum;
int ch;
TSK_TCHAR **argv;
unsigned int ssize = 0;
TSK_TCHAR *cp;
#ifdef TSK_WIN32
// On Windows, get the wide arguments (mingw doesn't support wmain)
argv = CommandLineToArgvW(GetCommandLineW(), &argc);
if (argv == NULL) {
fprintf(stderr, "Error getting wide arguments\n");
exit(1);
}
#else
argv = (TSK_TCHAR **) argv1;
#endif
progname = argv[0];
setlocale(LC_ALL, "");
while ((ch = GETOPT(argc, argv, _TSK_T("b:f:i:o:vV"))) > 0) {
switch (ch) {
case _TSK_T('?'):
default:
TFPRINTF(stderr, _TSK_T("Invalid argument: %s\n"),
argv[OPTIND]);
usage();
case _TSK_T('b'):
ssize = (unsigned int) TSTRTOUL(OPTARG, &cp, 0);
if (*cp || *cp == *OPTARG || ssize < 1) {
TFPRINTF(stderr,
_TSK_T
("invalid argument: sector size must be positive: %s\n"),
OPTARG);
usage();
}
break;
case _TSK_T('f'):
if (TSTRCMP(OPTARG, _TSK_T("list")) == 0) {
tsk_fs_type_print(stderr);
exit(1);
}
fstype = tsk_fs_type_toid(OPTARG);
if (fstype == TSK_FS_TYPE_UNSUPP) {
TFPRINTF(stderr,
_TSK_T("Unsupported file system type: %s\n"), OPTARG);
usage();
}
break;
case _TSK_T('i'):
if (TSTRCMP(OPTARG, _TSK_T("list")) == 0) {
tsk_img_type_print(stderr);
exit(1);
}
imgtype = tsk_img_type_toid(OPTARG);
if (imgtype == TSK_IMG_TYPE_UNSUPP) {
TFPRINTF(stderr, _TSK_T("Unsupported image type: %s\n"),
OPTARG);
usage();
}
break;
case _TSK_T('o'):
if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) {
tsk_error_print(stderr);
exit(1);
}
break;
case _TSK_T('v'):
tsk_verbose++;
break;
case _TSK_T('V'):
tsk_version_print(stdout);
exit(0);
}
}
/* We need at least one more argument */
if (OPTIND >= argc) {
tsk_fprintf(stderr, "Missing image name and/or address\n");
usage();
}
/* open image - there is an optional inode address at the end of args
*
* Check the final argument and see if it is a number
*/
if (tsk_fs_parse_inum(argv[argc - 1], &inum, NULL, NULL, NULL, NULL)) {
/* Not an inode at the end */
if ((img =
//.........这里部分代码省略.........
开发者ID:0xkasun，项目名称:OpenDF，代码行数:101，代码来源:jls.cpp
示例10: main
int
main(int argc, char **argv1)
{
TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT;
TSK_IMG_INFO *img;
TSK_OFF_T imgaddr = 0;
TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT;
TSK_FS_INFO *fs;
TSK_DADDR_T addr = 0;
TSK_TCHAR *cp;
TSK_DADDR_T read_num_units; /* Number of data units */
int usize = 0; /* Length of each data unit */
int ch;
char format = 0;
extern int OPTIND;
TSK_TCHAR **argv;
unsigned int ssize = 0;
#ifdef TSK_WIN32
// On Windows, get the wide arguments (mingw doesn't support wmain)
argv = CommandLineToArgvW(GetCommandLineW(), &argc);
if (argv == NULL) {
fprintf(stderr, "Error getting wide arguments\n");
exit(1);
}
#else
argv = (TSK_TCHAR **) argv1;
#endif
progname = argv[0];
setlocale(LC_ALL, "");
while ((ch = GETOPT(argc, argv, _TSK_T("ab:f:hi:o:su:vVw"))) > 0) {
switch (ch) {
case _TSK_T('a'):
format |= TSK_FS_BLKCAT_ASCII;
break;
case _TSK_T('b'):
ssize = (unsigned int) TSTRTOUL(OPTARG, &cp, 0);
if (*cp || *cp == *OPTARG || ssize < 1) {
TFPRINTF(stderr,
_TSK_T
("invalid argument: sector size must be positive: %s\n"),
OPTARG);
usage();
}
break;
case _TSK_T('f'):
if (TSTRCMP(OPTARG, BLKLS_TYPE) == 0) {
fstype = TSK_FS_TYPE_RAW;
}
else if (TSTRCMP(OPTARG, _TSK_T("list")) == 0) {
tsk_fprintf(stderr,
"\t%" PRIttocTSK " (Unallocated Space)\n", BLKLS_TYPE);
tsk_fs_type_print(stderr);
exit(1);
}
else {
fstype = tsk_fs_type_toid(OPTARG);
}
if (fstype == TSK_FS_TYPE_UNSUPP) {
TFPRINTF(stderr,
_TSK_T("Unsupported file system type: %s\n"), OPTARG);
usage();
}
break;
case _TSK_T('h'):
format |= TSK_FS_BLKCAT_HEX;
break;
case _TSK_T('i'):
if (TSTRCMP(OPTARG, _TSK_T("list")) == 0) {
tsk_img_type_print(stderr);
exit(1);
}
imgtype = tsk_img_type_toid(OPTARG);
if (imgtype == TSK_IMG_TYPE_UNSUPP) {
TFPRINTF(stderr, _TSK_T("Unsupported image type: %s\n"),
OPTARG);
usage();
}
break;
case _TSK_T('o'):
if ((imgaddr = tsk_parse_offset(OPTARG)) == -1) {
tsk_error_print(stderr);
exit(1);
}
break;
case _TSK_T('s'):
format |= TSK_FS_BLKCAT_STAT;
break;
case _TSK_T('u'):
usize = TSTRTOUL(OPTARG, &cp, 0);
if (*cp || cp == OPTARG) {
TFPRINTF(stderr, _TSK_T("Invalid block size: %s\n"),
OPTARG);
usage();
}
//.........这里部分代码省略.........
开发者ID:TheLoneRanger14，项目名称:vmxray，代码行数:101，代码来源:blkcat.cpp
示例11: MAIN
int
MAIN(int argc, TSK_TCHAR ** argv)
{
TSK_TCHAR *imgtype = NULL;
TSK_TCHAR *fstype = NULL;
TSK_FS_INFO *fs;
TSK_IMG_INFO *img;
int ch;
TSK_TCHAR *cp;
extern int optind;
DADDR_T block = 0; /* the block to find */
INUM_T parinode = 0;
TSK_TCHAR *path = NULL;
SSIZE_T imgoff = 0;
progname = argv[0];
setlocale(LC_ALL, "");
localflags = 0;
while ((ch = getopt(argc, argv, _TSK_T("ad:f:i:ln:o:p:vVz:"))) > 0) {
switch (ch) {
case _TSK_T('a'):
localflags |= TSK_FS_IFIND_ALL;
break;
case _TSK_T('d'):
if (localflags & (TSK_FS_IFIND_PAR | TSK_FS_IFIND_PATH)) {
tsk_fprintf(stderr,
"error: only one address type can be given\n");
usage();
}
localflags |= TSK_FS_IFIND_DATA;
block = TSTRTOULL(optarg, &cp, 0);
if (*cp || *cp == *optarg) {
TFPRINTF(stderr, _TSK_T("Invalid block address: %s\n"),
optarg);
usage();
}
break;
case _TSK_T('f'):
fstype = optarg;
if (TSTRCMP(fstype, _TSK_T("list")) == 0) {
tsk_fs_print_types(stderr);
exit(1);
}
break;
case _TSK_T('i'):
imgtype = optarg;
if (TSTRCMP(imgtype, _TSK_T("list")) == 0) {
tsk_img_print_types(stderr);
exit(1);
}
break;
case _TSK_T('l'):
localflags |= TSK_FS_IFIND_PAR_LONG;
break;
case _TSK_T('n'):
{
size_t len;
if (localflags & (TSK_FS_IFIND_PAR | TSK_FS_IFIND_DATA)) {
tsk_fprintf(stderr,
"error: only one address type can be given\n");
usage();
}
localflags |= TSK_FS_IFIND_PATH;
len = (TSTRLEN(optarg) + 1) * sizeof(TSK_TCHAR);
if ((path = (TSK_TCHAR *) tsk_malloc(len)) == NULL) {
tsk_error_print(stderr);
exit(1);
}
TSTRNCPY(path, optarg, TSTRLEN(optarg) + 1);
break;
}
case 'o':
if ((imgoff = tsk_parse_offset(optarg)) == -1) {
tsk_error_print(stderr);
exit(1);
}
break;
case 'p':
if (localflags & (TSK_FS_IFIND_PATH | TSK_FS_IFIND_DATA)) {
tsk_fprintf(stderr,
"error: only one address type can be given\n");
usage();
}
localflags |= TSK_FS_IFIND_PAR;
if (tsk_parse_inum(optarg, &parinode, NULL, NULL, NULL)) {
TFPRINTF(stderr, _TSK_T("Invalid inode address: %s\n"),
optarg);
usage();
}
break;
case 'v':
tsk_verbose++;
break;
case 'V':
tsk_print_version(stdout);
exit(0);
case 'z':
{
//.........这里部分代码省略.........
开发者ID:anarchivist，项目名称:pyflag，代码行数:101，代码来源:ifind.c
示例12: MAIN
int
MAIN(int argc, TSK_TCHAR ** argv)
{
TSK_TCHAR *imgtype = NULL;
TSK_TCHAR *fstype = NULL;
TSK_IMG_INFO *img;
TSK_FS_INFO *fs;
INUM_T inum;
int ch;
TSK_TCHAR *cp;
int32_t sec_skew = 0;
SSIZE_T imgoff = 0;
/* When > 0 this is the number of blocks to print, used for -b arg */
DADDR_T numblock = 0;
progname = argv[0];
setlocale(LC_ALL, "");
while ((ch = getopt(argc, argv, _TSK_T("b:f:i:o:s:vVz:"))) > 0) {
switch (ch) {
case _TSK_T('?'):
default:
TFPRINTF(stderr, _TSK_T("Invalid argument: %s\n"),
argv[optind]);
usage();
case _TSK_T('b'):
numblock = TSTRTOULL(optarg, &cp, 0);
if (*cp || *cp == *optarg || numblock < 1) {
TFPRINTF(stderr,
_TSK_T
("invalid argument: block count must be positive: %s\n"),
optarg);
usage();
}
break;
case _TSK_T('f'):
fstype = optarg;
if (TSTRCMP(fstype, _TSK_T("list")) == 0) {
tsk_fs_print_types(stderr);
exit(1);
}
break;
case _TSK_T('i'):
imgtype = optarg;
if (TSTRCMP(imgtype, _TSK_T("list")) == 0) {
tsk_img_print_types(stderr);
exit(1);
}
break;
case _TSK_T('o'):
if ((imgoff = tsk_parse_offset(optarg)) == -1) {
tsk_error_print(stderr);
exit(1);
}
break;
case _TSK_T('s'):
sec_skew = TATOI(optarg);
break;
case _TSK_T('v'):
tsk_verbose++;
break;
case _TSK_T('V'):
tsk_print_version(stdout);
exit(0);
case _TSK_T('z'):
{
TSK_TCHAR envstr[32];
TSNPRINTF(envstr, 32, _TSK_T("TZ=%s"), optarg);
if (0 != PUTENV(envstr)) {
tsk_fprintf(stderr, "error setting environment");
exit(1);
}
TZSET();
}
break;
}
}
/* We need at least two more argument */
if (optind + 1 >= argc) {
tsk_fprintf(stderr, "Missing image name and/or address\n");
usage();
}
/* if we are given the inode in the inode-type-id form, then ignore
* the other stuff w/out giving an error
*
* This will make scripting easier
*/
if (tsk_parse_inum(argv[argc - 1], &inum, NULL, NULL, NULL)) {
TFPRINTF(stderr, _TSK_T("Invalid inode number: %s"),
argv[argc - 1]);
usage();
}
/*
* Open the file system.
*/
if ((img =
//.........这里部分代码省略.........
开发者ID:anarchivist，项目名称:pyflag，代码行数:101，代码来源:istat.c
示例13: ntfs_dent_copy
/*
* copy the index (directory) entry into the generic structure
*
* uses the global variables 'dirs' and 'depth'
*
* Returns 1 on eror and 0 on success
*/
static uint8_t
ntfs_dent_copy(NTFS_INFO * ntfs, NTFS_DINFO * dinfo, ntfs_idxentry * idxe,
TSK_FS_DENT * fs_dent)
{
ntfs_attr_fname *fname = (ntfs_attr_fname *) & idxe->stream;
TSK_FS_INFO *fs = (TSK_FS_INFO *) & ntfs->fs_info;
UTF16 *name16;
UTF8 *name8;
int retVal;
int i;
fs_dent->inode = tsk_getu48(fs->endian, idxe->file_ref);
name16 = (UTF16 *) & fname->name;
name8 = (UTF8 *) fs_dent->name;
retVal = tsk_UTF16toUTF8(fs->endian, (const UTF16 **) &name16,
(UTF16 *) ((uintptr_t) name16 +
fname->nlen * 2), &name8,
(UTF8 *) ((uintptr_t) name8 +
fs_dent->name_max), TSKlenientConversion);
if (retVal != TSKconversionOK) {
*name8 = '\0';
if (tsk_verbose)
tsk_fprintf(stderr,
"Error converting NTFS name to UTF8: %d %" PRIuINUM,
retVal, fs_dent->inode);
}
/* Make sure it is NULL Terminated */
if ((uintptr_t) name8 > (uintptr_t) fs_dent->name + fs_dent->name_max)
fs_dent->name[fs_dent->name_max] = '\0';
else
*name8 = '\0';
/* Clean up name */
i = 0;
while (fs_dent->name[i] != '\0') {
if (TSK_IS_CNTRL(fs_dent->name[i]))
fs_dent->name[i] = '^';
i++;
}
/* copy the path data */
fs_dent->path = dinfo->dirs;
fs_dent->pathdepth = dinfo->depth;
/* Get the actual inode */
if (fs_dent->fsi != NULL)
tsk_fs_inode_free(fs_dent->fsi);
if (NULL == (fs_dent->fsi = fs->inode_lookup(fs, fs_dent->inode))) {
if (tsk_verbose) {
tsk_fprintf(stderr,
"ntfs_dent_copy: error looking up inode: %" PRIuINUM "\n",
fs_dent->inode);
tsk_error_print(stderr);
tsk_error_reset();
}
}
if (tsk_getu64(fs->endian, fname->flags) & NTFS_FNAME_FLAGS_DIR)
fs_dent->ent_type = TSK_FS_DENT_TYPE_DIR;
else
fs_dent->ent_type = TSK_FS_DENT_TYPE_REG;
fs_dent->flags = 0;
return 0;
}
开发者ID:backupManager，项目名称:pyflag，代码行数:78，代码来源:ntfs_dent.c
示例14: MAIN
int
MAIN(int argc, TSK_TCHAR ** argv)
{
TSK_FS_INFO *fs = NULL;
TSK_IMG_INFO *img;
DADDR_T addr = 0;
TSK_TCHAR *fstype = NULL;
TSK_TCHAR *cp, *imgtype = NULL;
DADDR_T read_num_units; /* Number of data units */
int usize = 0; /* Length of each data unit */
int ch;
char format = 0;
extern int optind;
SSIZE_T imgoff = 0;
progname = argv[0];
setlocale(LC_ALL, "");
while ((ch = getopt(argc, argv, _TSK_T("af:hi:o:su:vVw"))) > 0) {
switch (ch) {
case _TSK_T('a'):
format |= TSK_FS_DCAT_ASCII;
break;
case _TSK_T('f'):
fstype = optarg;
if (TSTRCMP(fstype, _TSK_T(DLS_TYPE)) == 0)
fstype = _TSK_T(RAW_STR);
if (TSTRCMP(fstype, _TSK_T("list")) == 0) {
tsk_fprintf(stderr, "\t%s (Unallocated Space)\n",
DLS_TYPE);
tsk_fs_print_types(stderr);
exit(1);
}
break;
case _TSK_T('h'):
format |= TSK_FS_DCAT_HEX;
break;
case _TSK_T('i'):
imgtype = optarg;
if (TSTRCMP(imgtype, _TSK_T("list")) == 0) {
tsk_img_print_types(stderr);
exit(1);
}
break;
case _TSK_T('o'):
if ((imgoff = tsk_parse_offset(optarg)) == -1) {
tsk_error_print(stderr);
exit(1);
}
break;
case _TSK_T('s'):
format |= TSK_FS_DCAT_STAT;
break;
case _TSK_T('u'):
usize = TSTRTOUL(optarg, &cp, 0);
if (*cp || cp == optarg) {
TFPRINTF(stderr, _TSK_T("Invalid block size: %s\n"),
optarg);
usage();
}
break;
case _TSK_T('v'):
tsk_verbose++;
break;
case _TSK_T('V'):
tsk_print_version(stdout);
exit(0);
break;
case _TSK_T('w'):
format |= TSK_FS_DCAT_HTML;
break;
case _TSK_T('?'):
default:
TFPRINTF(stderr, _TSK_T("Invalid argument: %s\n"),
argv[optind]);
usage();
}
}
if (format & TSK_FS_DCAT_STAT) {
if (optind == argc)
usage();
if (format & (TSK_FS_DCAT_HTML | TSK_FS_DCAT_ASCII |
TSK_FS_DCAT_HEX)) {
tsk_fprintf(stderr,
"NOTE: Additional flags will be ignored\n");
}
}
/* We need at least two more arguments */
else if (optind + 1 >= argc) {
tsk_fprintf(stderr, "Missing image name and/or address\n");
usage();
}
if ((format & TSK_FS_DCAT_ASCII) && (format & TSK_FS_DCAT_HEX)) {
tsk_fprintf(stderr,
"Ascii and Hex flags can not be used together\n");
usage();
}
//.........这里部分代码省略.........
开发者ID:anarchivist，项目名称:pyflag，代码行数:101，代码来源:dcat.c
示例15: MAIN
/* main - open file system, list inode info */
int
MAIN(int argc, TSK_TCHAR ** argv)
{
TSK_TCHAR *fstype = NULL;
TSK_TCHAR *imgtype = NULL, *cp, *dash;
TSK_IMG_INFO *img;
TSK_FS_INFO *fs;
INUM_T istart = 0, ilast = 0;
int ch;
int flags = TSK_FS_INODE_FLAG_UNALLOC | TSK_FS_INODE_FLAG_USED;
int argflags = 0;
SSIZE_T imgoff = 0;
int set_range = 1;
TSK_TCHAR *image = NULL;
int32_t sec_skew = 0;
progname = argv[0];
setlocale(LC_ALL, "");
/*
* Provide convenience options for the most commonly selected feature
* combinations.
*/
while ((ch = getopt(argc, argv, _TSK_T("aAef:i:lLmo:Oprs:vVzZ"))) > 0) {
switch (ch) {
case _TSK_T('?'):
default:
TFPRINTF(stderr, _TSK_T("Invalid argument: %s\n"),
argv[optind]);
usage();
case _TSK_T('f'):
fstype = optarg;
if (TSTRCMP(fstype, _TSK_T("list")) == 0) {
tsk_fs_print_types(stderr);
exit(1);
}
break;
case _TSK_T('i'):
imgtype = optarg;
if (TSTRCMP(imgtype, _TSK_T("list")) == 0) {
tsk_img_print_types(stderr);
exit(1);
}
break;
case _TSK_T('e'):
flags |= (TSK_FS_INODE_FLAG_ALLOC | TSK_FS_INODE_FLAG_UNALLOC);
flags &= ~TSK_FS_INODE_FLAG_USED;
break;
case _TSK_T('m'):
argflags |= TSK_FS_ILS_MAC;
break;
case _TSK_T('o'):
if ((imgoff = tsk_parse_offset(optarg)) == -1) {
tsk_error_print(stderr);
exit(1);
}
break;
case _TSK_T('O'):
flags |= TSK_FS_INODE_FLAG_UNALLOC;
flags &= ~TSK_FS_INODE_FLAG_ALLOC;
argflags |= TSK_FS_ILS_OPEN;
break;
case _TSK_T('p'):
flags |=
(TSK_FS_INODE_FLAG_ORPHAN | TSK_FS_INODE_FLAG_UNALLOC);
flags &= ~TSK_FS_INODE_FLAG_ALLOC;
break;
case _TSK_T('r'):
flags |= (TSK_FS_INODE_FLAG_UNALLOC | TSK_FS_INODE_FLAG_USED);
flags &= ~TSK_FS_INODE_FLAG_ALLOC;
break;
case _TSK_T('s'):
sec_skew = TATOI(optarg);
break;
case _TSK_T('v'):
tsk_verbose++;
break;
case _TSK_T('V'):
tsk_print_version(stdout);
exit(0);
/*
* Provide fine controls to tweak one feature at a time.
*/
case _TSK_T('a'):
flags |= TSK_FS_INODE_FLAG_ALLOC;
break;
case _TSK_T('A'):
flags |= TSK_FS_INODE_FLAG_UNALLOC;
break;
case _TSK_T('l'):
argflags |= TSK_FS_ILS_LINK;
break;
case _TSK_T('L'):
argflags |= TSK_FS_ILS_UNLINK;
break;
case _TSK_T('z'):
flags |= TSK_FS_INODE_FLAG_UNUSED;
break;
//.........这里部分代码省略.........
开发者ID:anarchivist，项目名称:pyflag，代码行数:101，代码来源:ils.c
示例16: main
/* main - open file system, list inode info */
int
main(int argc, char **argv1)
{
TSK_IMG_TYPE_ENUM imgtype = TSK_IMG_TYPE_DETECT;
TSK_IMG_INFO *img;
TSK_OFF_T imgaddr = 0;
TSK_FS_TYPE_ENUM fstype = TSK_FS_TYPE_DETECT;
TSK_FS_INFO *fs;
TSK_TCHAR *cp, *dash;
TSK_INUM_T istart = 0, ilast = 0;
int ch;
int flags = TSK_FS_META_FLAG_UNALLOC | TSK_FS_META_FLAG_USED;
int ils_flags = 0;
int set_range = 1;
TSK_TCHAR *image = NULL;
int32_t sec_skew = 0;
TSK_TCHAR **argv;
unsigned int ssize = 0;
#ifdef TSK_WIN32
// On Windows, get the wide arguments (mingw doesn't support wmain)
argv = CommandLineToArgvW(GetCommandLineW(), &argc);
if (argv == NULL) {
fprintf(stderr, "Error getting wide arguments\n");
exit(1);
}
#else
argv = (TSK_TCHAR **) argv1;
#endif
progname = argv[0];
setlocale(LC_ALL, "");
/*
* Provide convenience options for the most commonly selected feature
* combinations.
*/
while ((ch =
GETOPT(argc, argv, _TSK_T("aAb:ef:i:lLmo:Oprs:vVzZ"))) > 0) {
switch (ch) {
case _TSK_T('?'):
default:
TFPRINTF(stderr, _TSK_T("Invalid argument: %s\n"),
argv[OPTIND]);
usage();
case _TSK_T('b'):
ssize = (unsigned int) TSTRTOUL(OPTARG, &cp, 0);
if (*cp || *cp == *OPTARG || ssize < 1) {
TFPRINTF(stderr,
_TSK_T
("invalid argument: sector size must be positive: %s\n"),
OPTARG);
usage();
}
break;
case _TSK_T('f'):
if (TSTRCMP(OPTARG, _TSK_T("list")) == 0) {
tsk_fs_type_print(stderr);
exit(1);
}
fstype = tsk_fs_type_toid(OPTARG);
if (fstype == TSK_FS_TYPE_UNSUPP) {
TFPRINTF(stderr,
_TSK_T("Unsupported file system type: %s\n"), OPTARG);
usage();
}
break;
case _TSK_T('i'):
if (TSTRCMP(OPTARG, _TSK_T("list")) == 0) {
tsk_img_type_print(stderr);
exit(1);
}
imgtype = tsk_img_type_toid(OPTARG);
if (imgtype == TSK_IMG_TYPE_UNSUPP) {
TFPRINTF(stderr, _TSK_T("Unsupported image type: %s\n"
|
客服电话
APP下载
官方微信
请发表评论