1 #ifndef _AFFLIB_H_
2 #define _AFFLIB_H_
3 
4 /*
5  * afflib.h:
6  *
7  * This file describes the public AFFLIB interface.
8  * The interface to reading AFF files and  Raw files.
9  *
10  * Copyright (c) 2005-2006
11  *	Simson L. Garfinkel and Basis Technology, Inc.
12  *      All rights reserved.
13  *
14  * This code is derrived from software contributed by
15  * Simson L. Garfinkel
16  *
17  * Redistribution and use in source and binary forms, with or without
18  * modification, are permitted provided that the following conditions
19  * are met:
20  * 1. Redistributions of source code must retain the above copyright
21  *    notice, this list of conditions and the following disclaimer.
22  * 2. Redistributions in binary form must reproduce the above copyright
23  *    notice, this list of conditions and the following disclaimer in the
24  *    documentation and/or other materials provided with the distribution.
25  * 3. All advertising materials mentioning features or use of this software
26  *    must display the following acknowledgement:
27  *    This product includes software developed by Simson L. Garfinkel
28  *    and Basis Technology Corp.
29  * 4. Neither the name of Simson Garfinkel, Basis Technology, or other
30  *    contributors to this program may be used to endorse or promote
31  *    products derived from this software without specific prior written
32  *    permission.
33  *
34  * THIS SOFTWARE IS PROVIDED BY SIMSON GARFINKEL, BASIS TECHNOLOGY,
35  * AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
36  * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
37  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
38  * DISCLAIMED.  IN NO EVENT SHALL SIMSON GARFINKEL, BAIS TECHNOLOGy,
39  * OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
40  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
41  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
42  * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
43  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
44  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
45  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
46  * SUCH DAMAGE.
47  */
48 
49 /* Figure out what kind of OS we are running on */
50 
51 /* These are both needed; no need to bother with affconfig.h #defines */
52 #include <stdio.h>
53 #ifdef HAVE_STDINT_H
54 #include <stdint.h>
55 #else
56 #ifdef _MSC_VER
57 typedef signed char int8_t;
58 typedef short int16_t;
59 typedef int int32_t;
60 typedef unsigned char uint8_t;
61 typedef unsigned short uint16_t;
62 typedef unsigned int uint32_t;
63 #endif
64 #endif
65 #include <sys/types.h>
66 
67 #ifdef HAVE_SYS_CDEFS_H
68 #include <sys/cdefs.h>
69 #endif
70 
71 #ifdef linux
72 /* Horrible lossage stuff for largefile support under Linux */
73 #define _LARGEFILE_SOURCE 1
74 #define _FILE_OFFSET_BITS 64
75 #endif
76 
77 #ifdef HAVE_INTTYPES_H
78 #ifndef __STDC_FORMAT_MACROS
79 #define __STDC_FORMAT_MACROS
80 #endif
81 #include <inttypes.h>
82 #else
83 #ifdef _MSC_VER
84 #define PRIu32 "I32u"
85 #endif
86 #endif
87 
88 /** WIN32 is defined by the NMAKE makefile for Visual C++ under Windows and by mingw **/
89 #ifdef WIN32
90 #include <basetsd.h>
91 #include <io.h>				// gets isatty
92 
93 /* These aren't needed for mingw */
94 #if !defined(__MINGW_H)
95 #ifndef _UINT64_T_DECLARED
96 typedef unsigned __int64 uint64_t;	/* 64-bit types Types */
97 #define _UINT64_T_DECLARED
98 #endif
99 
100 #ifndef _INT64_T_DECLARED
101 typedef __int64 int64_t;
102 #define _INT64_T_DECLARED
103 #endif
104 #endif
105 
106 #ifndef PRId64
107 #define PRId64 "I64d"
108 #endif
109 
110 #ifndef PRIi64
111 #define PRIi64 "I64i"
112 #endif
113 
114 #ifndef PRIu64
115 #define PRIu64 "I64u"
116 #endif
117 
118 #endif
119 /** END OF WIN32 DEFINES **/
120 
121 #define I64d PRIi64
122 #define I64u PRIu64
123 
124 /* If our types still aren't defined, give some kind of error
125  */
126 struct affcallback_info;
127 struct aff_pagebuf {
128     int64_t       pagenum;		// -1 means no page loaded
129     unsigned char *pagebuf;		// where the data is; size is image_pagesize
130     size_t        pagebuf_bytes;        // number of bytes in the pagebuf that are valid.
131     uint32_t  pagenum_valid:1;	// buffer contains data
132     uint32_t  pagebuf_valid:1;	// buffer contains data
133     uint32_t  pagebuf_dirty:1;	// data was modified
134     int		  last;			// when the page was last visited
135 };
136 
137 struct af_vnode_info {
138     uint64_t imagesize;			// size of this image
139     int   pagesize;			// what is the natural page size?
140     uint32_t supports_compression:1; // supports writing compressed segments
141     uint32_t has_pages:1;		 // does system support page segments?
142     uint32_t supports_metadata:1;		// does it support metadata?
143     uint32_t is_raw:1;			// file is raw
144     uint32_t use_eof:1;			// should we use the EOF flag?
145     uint32_t at_eof:1;			// are we at the EOF?
146     uint32_t changable_pagesize:1;	// pagesize can be changed at any time
147     uint32_t changable_sectorsize:1; // sectorsize can be changed at any time
148     uint32_t cannot_decrypt:1; // encrypted pages cannot be decrypted becuase passphrase is invalid
149     uint32_t segment_count_total;
150     uint32_t page_count_total;
151     uint32_t segment_count_signed;
152     uint32_t segment_count_encrypted;
153     uint32_t page_count_encrypted;
154 };					//
155 
156 
157 /* All of this stuff should be hidden inside a single private structure... */
158 typedef struct _AFFILE AFFILE;
159 
160 /* The information that is provided in the aff callback */
161 struct affcallback_info {
162     int info_version;			// version number for this segment
163     AFFILE *af;				// v1: the AFFILE responsibile for the callback
164     int phase;				// v1: 1 = before compress; 2 = after compressing;
165 					//     3 = before writing; 4 = after writing
166     int64_t pagenum;			// v1: page number being written
167     int bytes_to_write;			// v1: >0 if we are going to write bytes
168     int bytes_written;			// v1: >0 if bytes were written
169     int compressed;			// v1: >0 if bytes were/will be compressed
170     int compression_alg;		// v1: compression algorithm
171     int compression_level;		// v1: compression level
172 };
173 
174 /* Utility Functions */
175 
176 #ifdef __cplusplus
177 extern "C" {
178 #endif
179 #ifdef __never_defined__
180 }
181 #endif
182 
183 /****************************************************************
184  ***
185  *** Intended user AFF interface
186  ***
187  ****************************************************************/
188 
189 const char * af_version(void);		// returns AFF Version Number
190 
191 /* af_file stream functions */
192 AFFILE *af_open(const char *filename,int flags,int mode);
193 AFFILE *af_freopen(FILE *file);		// reopen a raw file as an AFFILE
194 AFFILE *af_popen(const char *command,const char *type);	// no need to use pclose(); af_close() is fine
195 int	af_close(AFFILE *af);
196 void	af_set_error_reporter(AFFILE *af,void (*reporter)(const char *fmt,...));
197 void	af_stats(AFFILE *af,FILE *f);	// print stats to f
198 void	af_set_cachesize(AFFILE *af,int max); // how much memory can the cache use?
199 int     af_vstat(AFFILE *af,struct af_vnode_info *vni); // does the stat
200 void	af_perror(const char *fname);				// print the error string to stderr
201 void	af_err(int code,const char *fname,...);	// like err(), but will also print AFF-specific errors
202 
203 
204 
205 /* Generic set/get option routines; this replaces individual options in previous implementations.
206  * af==0 to set global options. Return the previous value.
207  */
208 int	af_set_option(AFFILE *af,int option,int value);
209 
210 #define AF_OPTION_AUTO_ENCRYPT     1	// 1 = auto-encrypt
211 #define AF_OPTION_AUTO_DECRYPT     2	// 1 = auto-decrypt
212 // The following are not implemented yet
213 #define AF_OPTION_PIECEWISE_MD5    3	// 1 = automatically write pagen_md5 segments
214 #define AF_OPTION_PIECEWISE_SHA1   4	// 1 = automatically write pagen_md5 segments
215 #define AF_OPTION_PIECEWISE_SHA256 5	// 1 = automatically write pagen_md5 segments
216 #define AF_OPTION_DISABLE_RDLOCK   6    // 1 = do not read lock, but report that it should have locked.
217 
218 
219 /* Special AFOPEN flags for af_open_with */
220 #define AF_OPEN_PRIMITIVE (1<<31)	// only open primtive, not compound files
221 #define AF_BADBLOCK_FILL  (1<<30)	// fill unallocated (sparse) with BADBLOCK flag
222 #define AF_HALF_OPEN      (1<<29)       // return af before calling af->v->open;
223 #define AF_NO_CRYPTO      (1<<28)       // disable encryption layer
224 
225 /* navigating within the data segments as if they were a single file */
226 #ifdef _WIN32
227 SSIZE_T   af_read(AFFILE *af,unsigned char *buf,SSIZE_T count);
228 #else
229 ssize_t   af_read(AFFILE *af,unsigned char *buf,ssize_t count);
230 #endif
231 uint64_t  af_seek(AFFILE *af,int64_t pos,int whence); // returns new position
232 uint64_t  af_tell(AFFILE *af);
233 int	  af_eof(AFFILE *af);		// is the virtual file at the end?
234 
235 /* Additional routines for writing */
236 int	af_set_maxsize(AFFILE *af,int64_t size); // sets maximum AFF file size
237 void	af_set_callback(AFFILE *af, void (*cb)(struct affcallback_info *acbi));
238 void	af_enable_compression(AFFILE *af,int type,int level); // set/gunset compression for writing
239 int	af_compression_type(AFFILE *af);
240 int	af_write(AFFILE *af,unsigned char *buf,size_t count);
241 const unsigned char *af_badflag(AFFILE *af); // return the pattern used to identify bad sectors
242 int	af_is_badsector(AFFILE *af,const unsigned char *buf); // 0 if not, 1 if it is, -1 if error
243 
244 
245 /* Misc. Functions */
246 const char *af_ext(const char *filename);	// return the extension of str including the dot
247 int	    af_ext_is(const char *filename,const char *ext);
248 const char *af_filename(AFFILE *af);	// returns the filename of an open stream.
249 int	    af_identify(AFFILE *af);	// returns type of AFFILE pointer
250 
251 /* AFF implementation types returned by af_identify() and af_identify_file_type() */
252 
253 #define AF_IDENTIFY_RAW 0		// file is a raw file
254 #define AF_IDENTIFY_AFF 1		// file is an AFF file
255 #define AF_IDENTIFY_AFD 2		// file is a directory of AFF files
256 #define AF_IDENTIFY_EVF 3		// file is an EnCase file
257 #define AF_IDENTIFY_EVD 4		// file is a .E01 file when there are more files following
258 #define AF_IDENTIFY_SPLIT_RAW 5		// file is a split raw file
259 #define AF_IDENTIFY_AFM 6               // file is raw file with metadata
260 #define AF_IDENTIFY_EWF 7		// libewf; deprecated
261 #define AF_IDENTIFY_S3  8		// is an s3:/// file
262 #define AF_IDENTIFY_VMDK 9		// QEMU support for VMDK format
263 #define AF_IDENTIFY_DMG 10		// QEMU support for Apple DMG format
264 #define AF_IDENTIFY_SPARSEIMAGE 11	// QEMU support for Apple SPARSEIMAGE format
265 
266 #define AF_IDENTIFY_ERR -1		// error encountered on identify
267 #define AF_IDENTIFY_NOEXIST -2		// file does not exist
268 
269 
270 /* Accessor Functions */
271 int64_t af_get_imagesize(AFFILE *af);	// byte # of last mapped byte in image, or size of device;
272 					// returns -1 if error
273 int	af_get_pagesize(AFFILE *af);	// returns page size, or -1
274 int	af_set_acquisition_date(AFFILE *af,time_t t); // sets AF_ACQUISITION_DATE
275 
276 #define af_imagesize(af) af_get_imagesize(af) // backwards compatiability
277 int	    af_get_segq(AFFILE *af,const char *name,int64_t *quad);/* Get/set 8-byte values */
278 int	    af_update_segq(AFFILE *af,const char *name,int64_t quad);
279 
280 
281 /****************************************************************
282  * Functions for manipulating the AFFILE as if it were a name/value database.
283  ****************************************************************/
284 
285 /* get functions:
286  * get the named segment.
287  * If arg!=0, set *arg to be the segment's flag.
288  * if data==0, don't return it.
289  * if datalen && *datalen==0, return the size of the data segment.
290  *** Returns 0 on success,
291  *** -1 on end of file. (AF_ERROR_EOF)
292  *** -2 if *data is not large enough to hold the segment (AF_ERROR_DATASMALL)
293  *** -3 file is corrupt or other internal error. (AF_ERROR_CORRUPT)
294  */
295 
296 int	af_get_seg(AFFILE *af,const char *name,uint32_t *arg,
297 		   unsigned char *data,size_t *datalen);
298 int	af_get_next_seg(AFFILE *af,char *segname,size_t segname_len,
299 			uint32_t *arg, unsigned char *data, size_t *datalen);
300 
301 int	af_rewind_seg(AFFILE *af); // rewind seg pointer to beginning
302 
303 /*
304  * af_update_seg() should be your primary routine for writing new values.
305  */
306 
307 /* Writing arbitrary name/value pairs */
308 int	af_update_seg(AFFILE *af,const char *segname,uint32_t arg,
309 		      const unsigned char *value,uint32_t vallen);
310 #ifdef HAVE_OPENSSL_BIO_H
311 /* Write a memory bio to a segment */
312 #include <openssl/bio.h>
313 int	af_update_seg_frombio(AFFILE *af,const char *segname,uint32_t arg,BIO *bio);
314 #endif
315 
316 
317 /* Delete functions */
318 
319 int	af_del_seg(AFFILE *af,const char *name); // complete delete of first name
320                                                  // returns 0 if success, -1 if seg not found
321 
322 /* Segname parse functions.
323  * af_segname_page_number:
324  *   - Returns page number if segment name is a page #, and -1 if it is not
325  * af_segname_hash_page_number:
326  *   - Returns page number if segment name is a page hash, sets hash function
327  *     to be the function used.
328  */
329 int64_t	af_segname_page_number(const char *name); // return -1 if it is not a page number
330 int64_t	af_segname_hash_page_number(const char *name,char *hash,int hashlen); // return -1 if it is not a hash page #
331 
332 int af_display_as_quad(const char *segname); // afflib recommends displaying this segment as an 8-byte quad
333 int af_display_as_hex(const char *segname); // afflib recommends displaying this segment as a hex-string
334 
335 /****************************************************************/
336 
337 /* Crypto */
338 /* AFF Base Encryption */
339 int  af_SHA256(const unsigned char *buf,size_t buflen,unsigned char md[32]); // return 0 if success, -1 if no cipher
340 int  af_set_aes_key(AFFILE *af,const unsigned char *userKey,const int bits);
341 int  af_cannot_decrypt(AFFILE *af);	// encrypted pages are present which cannot be decrypted
342 int  af_has_encrypted_segments(AFFILE *af);
343 int  af_is_encrypted_segment(const char *segname);
344 
345 /* AFF Passphrase Encryption */
346 int  af_establish_aes_passphrase(AFFILE *af,const char *passphrase);
347 int  af_change_aes_passphrase(AFFILE *af,const char *oldphrase,const char *newphrase);
348 int  af_use_aes_passphrase(AFFILE *af,const char *passphrase);
349 int  af_save_aes_key_with_passphrase(AFFILE *af,const char *passphrase, const unsigned char affkey[32]);
350 int  af_get_aes_key_from_passphrase(AFFILE *af,const char *passphrase, unsigned char affkey[32]);
351 
352 
353 /* PKI Signing */
354 int  af_set_sign_files(AFFILE *af,const char *keyfile,const char *certfile);
355 int  af_sign_seg3(AFFILE *af,const char *segname, uint32_t arg,
356 		  const unsigned char *data,uint32_t datalen,uint32_t signmode);
357 int  af_sign_seg(AFFILE *af,const char *segname);
358 int  af_sign_all_unsigned_segments(AFFILE *af);	//
359 int  af_sig_verify_seg(AFFILE *af,const char *segname);	// see below for return codes
360 
361 int  af_is_signature_segment(const char *segname);
362 
363 /* PKI sealing */
364 int  af_set_seal_certificates(AFFILE *af,const char *certfiles[],int numcertfiles);
365 int  af_seal_affkey_using_certificates(AFFILE *af,const char *certfiles[],int numcertfiles, unsigned char affkey[32]);//
366 int  af_set_unseal_keybuffer(AFFILE *af,const char *key); // take key from a buffer
367 int  af_set_unseal_keyfile(AFFILE *af,const char *keyfile); // take key from a file
368 int  af_get_affkey_using_keyfile(AFFILE *af, const char *private_keyfile,unsigned char affkey[32]);
369 
370 
371 
372 #ifdef HAVE_OPENSSL_EVP_H
373 #include <openssl/evp.h>
374 int  af_sig_verify_seg2(AFFILE *af,const char *segname,EVP_PKEY *pubkey,unsigned char *sigbuf,
375 			size_t sigbuf_len,int sigmode);
376 int af_hash_verify_seg2(AFFILE *af,const char *segname,unsigned char *sigbuf_,size_t sigbuf_len_,int sigmode);
377 #define AF_HASH_VERIFIES 0
378 
379 #endif
380 #define AF_SIGNATURE_MODE0 0x0000 // signature is for segname, arg, data in segment
381 #define AF_SIGNATURE_MODE1 0x0001 // signature is for segname, 0 arg, uncompressed data in segment
382 #define AF_SIGNATURE_DELETE 0xFFFF // signature is invalid; delete segment
383 
384 /* Metadata access */
385 
386 /* Compression amounts */
387 
388 #define AF_COMPRESSION_MIN  1
389 #define AF_COMPRESSION_DEFAULT -1
390 #define AF_COMPRESSION_MAX 9
391 #define AF_COMPRESSION_MIN 1
392 
393 
394 /****************************************************************
395  *** AF segment names that you might be interested in...
396  ****************************************************************/
397 
398 #define AF_IGNORE       ""		// ignore segments with 0-length name
399 #define AF_DIRECTORY    "dir"		// the directory
400 #define AF_RAW_IMAGE_FILE_EXTENSION "raw_image_file_extension"
401 #define AF_PAGES_PER_RAW_IMAGE_FILE "pages_per_raw_image_file"
402 
403 #define AF_PAGESIZE	"pagesize"	// page data size, in bytes, stored in arg
404 #define AF_IMAGESIZE	"imagesize"	// last logical byte in image, stored as a 64-bit number
405 #define AF_BADSECTORS	"badsectors"	// number of bad sectors
406 #define AF_SECTORSIZE	"sectorsize"	// in bytes, stored in arg
407 #define AF_DEVICE_SECTORS "devicesectors"// stored as a 64-bit number
408 #define AF_BADFLAG      "badflag"	// data used to mark a bad sector
409 #define AF_PAGE		"page%" I64d	// segment flag indicates compression (replaces seg%d)
410 #define AF_PAGE_MD5	AF_PAGE"_md5"	// md5 hash of page
411 #define AF_PAGE_SHA1	AF_PAGE"_sha1"	// sha1 hash of page
412 #define AF_PAGE_SHA256	AF_PAGE"_sha256"// sha256 hash of page
413 #define AF_PARITY0      "parity0"	// parity page of all bytes
414 #define AF_BATCH_NAME		"batch_name"
415 #define AF_BATCH_ITEM_NAME	"batch_item_name"
416 
417 #define AF_BLANKSECTORS "blanksectors"	// all NULs; 8-bytes
418 #define AF_AFF_FILE_TYPE "aff_file_type" // contents should be "AFF", "AFM" or "AFD"
419 
420 #define AF_AFFKEY	 "affkey_aes256" // segment for AES256 session key encrypted with sha of the passphrase
421 #define AF_AFFKEY_EVP    "affkey_evp%d"  // segment for encrypted affkey
422 #define AF_AES256_SUFFIX "/aes256"	// suffix for encrypted segments
423 #define AF_SIG256_SUFFIX "/sha256"	// suffix for signature segments
424 #define AF_SIGN256_CERT  "cert-sha256"   // segment name for image creator's public key
425 #define AF_PARITY0_SIG   "parity0/sha256"   // signature for parity segment
426 
427 /* Chain of custody segments */
428 #define AF_BOM_SEG "affbom%d"
429 
430 /* Deprecated terminology; pages were originally called data segments */
431 #define AF_SEG_D        "seg%" I64d	// segment flag indicates compression (deprecated)
432 #define AF_SEGSIZE_D	"segsize"	// segment data size (deprecated)
433 
434 /* Bill of Materials */
435 #define AF_XML_AFFBOM "affbom"
436 #define AF_XML_DATE "date"
437 #define AF_XML_SIGNING_CER	"signingcert"
438 #define AF_XML_SEGMENT_HASH	"segmenthash"
439 
440 
441 /* AFF Flags */
442 /* Flags for 8-byte segments */
443 #define AF_SEG_QUADWORD        0x0002
444 
445 /* Flags for selecting compression algorithm to try */
446 #define AF_COMPRESSION_ALG_NONE 0	// don't compress
447 #define AF_COMPRESSION_ALG_ZLIB 1	// try to compress with zlib
448 #define AF_COMPRESSION_ALG_LZMA 2	// try to compress with LZMA
449 
450 /* Arg Flags for data pages; this is stored in 'flag' of data segment */
451 #define AF_PAGE_COMPRESSED      0x0001
452 #define AF_PAGE_COMP_MAX        0x0002	// compressed at maximum; nice to know
453 #define AF_PAGE_COMP_ALG_MASK   0x00F0	// up to 16 compression algorithms may be used
454 #define AF_PAGE_COMP_ALG_ZLIB   0x0000
455 #define AF_PAGE_COMP_ALG_BZIP   0x0010	// not implemented; why bother?
456 #define AF_PAGE_COMP_ALG_LZMA   0x0020	// high compression but pretty slow
457 #define AF_PAGE_COMP_ALG_ZERO   0x0030  // Data segment is a 4-byte value of # of NULLs.
458 
459 #define AF_MD5    "md5"			// stores image md5
460 #define AF_SHA1   "sha1"			// stores image sha1
461 #define AF_SHA256 "sha256"		// stores image sha256
462 
463 #define AF_CREATOR	"creator"	// progname of the program that created the AFF file
464 
465 /* segment names: imaging */
466 #define AF_CASE_NUM			"case_num"      // case number
467 #define AF_IMAGE_GID			"image_gid"      // 128-bit unique number
468 #define AF_ACQUISITION_ISO_COUNTRY  "acquisition_iso_country" // ISO country code
469 #define AF_ACQUISITION_COMMAND_LINE "acquisition_commandline" // actual command line used to create the image
470 #define AF_ACQUISITION_DATE	    "acquisition_date" // YYYY-MM-DD HH:MM:SS TZT
471 #define AF_ACQUISITION_NOTES	    "acquisition_notes" // notes made while imaging
472 #define AF_ACQUISITION_DEVICE	    "acquisition_device" // device used to do the imaging
473 #define AF_ACQUISITION_SECONDS      "acquisition_seconds" // stored in arg
474 #define AF_ACQUISITION_TECHNICIAN   "acquisition_tecnician"
475 #define AF_ACQUISITION_MACADDR      "acquisition_macaddr"
476 #define AF_ACQUISITION_DMESG	    "acquisition_dmesg"
477 
478 
479 //  mac addresses are store in ASCII as a list of lines that end with \n,
480 //  for example, "00:03:93:14:c5:04\n"
481 //  It is all the mac addresses that were on the acquisition system
482 
483 // DMESG is the output from the "dmesg" command at the time of acquisition
484 
485 
486 /* segment names: device hardware */
487 
488 #define AF_AFFLIB_VERSION	"afflib_version" // version of AFFLIB that made this file
489 #define AF_DEVICE_MANUFACTURER  "device_manufacturer"
490 #define AF_DEVICE_MODEL		"device_model"  // string for ident from drive
491 #define AF_DEVICE_SN		"device_sn"     // string of drive capabilities
492 #define AF_DEVICE_FIRMWARE	"device_firmware"	// string of drive capabilities
493 #define AF_DEVICE_SOURCE        "device_source" // string
494 #define AF_CYLINDERS		"cylinders"     // quad with # cylinders
495 #define AF_HEADS		"heads"	        // quad with # heads
496 #define AF_SECTORS_PER_TRACK	"sectors_per_track"// quad with # sectors/track
497 #define AF_LBA_SIZE		"lbasize"
498 #define AF_HPA_PRESENT          "hpa_present"   // flag = 1 or 0
499 #define AF_DCO_PRESENT          "dco_present"   // flag = 1 or 0
500 #define AF_LOCATION_IN_COMPUTER "location_in_computer" // text, where it was found
501 #define AF_DEVICE_CAPABILITIES	"device_capabilities" // string; human-readable
502 
503 #define AF_MAX_NAME_LEN 64	// segment names should not be larger than this
504 
505 /* AFF error codes */
506 #define AF_ERROR_NO_ERROR 0
507 #define AF_ERROR_EOF -1
508 #define AF_ERROR_DATASMALL -2
509 #define AF_ERROR_TAIL  -3		// no tail, or error reading tail
510 #define AF_ERROR_SEGH  -4		// no head, or error reading head
511 #define AF_ERROR_NAME  -5		// segment name invalid
512 #define AF_ERROR_INVALID_ARG -6		// argument invalid
513 #define AF_ERROR_NO_AES -7		// AES support is not compiled in
514 #define AF_ERROR_AES_TOO_SMALL -8	// and AES-encrypted segment was too small
515 #define AF_ERROR_KEY_SET -9		// a key was already set
516 #define AF_ERROR_AFFKEY_EXISTS -10	// a key already exists in file an attempt was made to establish
517 #define AF_ERROR_AFFKEY_NOT_EXIST -11	// a key does not exist and an attempt was made to use it.
518 #define AF_ERROR_AFFKEY_WRONG_VERSION -12
519 #define AF_ERROR_WRONG_PASSPHRASE -13
520 #define AF_ERROR_RNG_FAIL -13
521 #define AF_ERROR_HASH_FAIL -14
522 #define AF_ERROR_NO_SHA256 -15
523 
524 #define AF_SIG_GOOD 0
525 #define AF_ERROR_SIG_BAD   -15
526 #define AF_ERROR_SIG_NO_CERT -16
527 #define AF_ERROR_SIG_CANNOT_READ_PUBLIC_KEY -17
528 #define AF_ERROR_SIG_DATAREAD_ERROR -18
529 #define AF_ERROR_SIG_MALLOC -19
530 #define AF_ERROR_SIG_READ_ERROR -20
531 #define AF_ERROR_SIG_SIG_SEG  -21	// can't verify the signature on a signature segment
532 #define AF_ERROR_SIG_NOT_COMPILED -22	// afflib compiled without signature support
533 
534 
535 /* AFF environment variables */
536 #define AFFLIB_CACHE_STATS      "AFFLIB_CACHE_STATS" // make non-zero to dump stats to STDERR at end
537 #define AFFLIB_CACHE_DEBUG      "AFFLIB_CACHE_DEBUG" // make "1" to dump a trace of cache events to stderr
538 #define AFFLIB_CACHE_PAGES      "AFFLIB_CACHE_PAGES" // Size of the page cache
539 #define AFFLIB_CACHE_PAGES_DEFAULT 32	// default number of cache pages
540 #define AFFLIB_BIGTMP           "AFFLIB_BIGTMP" // default directory to put very big files for test programs
541 #define AFFLIB_TRACEFILE        "AFFLIB_TRACEFILE" // If set, send a record of all activity to the location
542 /* passphrases for single-key cryptography */
543 #define AFFLIB_PASSPHRASE	"AFFLIB_PASSPHRASE"
544 #define AFFLIB_PASSPHRASE_FILE  "AFFLIB_PASSPHRASE_FILE"
545 #define AFFLIB_PASSPHRASE_FD    "AFFLIB_PASSPHRASE_FD"
546 
547 /* passphrases for signing keys */
548 #define AFFLIB_PEM_SIGNING_PASSPHRASE "AFFLIB_PEM_SIGNING_PASSPHRASE"
549 
550 /* passphrases for sealing keys */
551 
552 #define AFFLIB_DECRYPTING_PRIVATE_KEYFILE "AFFLIB_DECRYPTING_PRIVATE_KEYFILE"
553 
554 extern FILE *af_trace;		// fd to trace to
555 
556 /****************************************************************
557  *** Not AFF functions at all, but placed here for convenience.
558  ****************************************************************/
559 const char *af_hexbuf(char *dst,int dst_len,const unsigned char *bin,int bytes,int format_flag);
560 
561 /* af_hexbuf formats: */
562 #define AF_HEXBUF_NO_SPACES 0
563 #define AF_HEXBUF_SPACE2    0x0001	// space every 2 characters
564 #define AF_HEXBUF_SPACE4    0x0002	// space every 4 characters
565 #define AF_HEXBUF_UPPERCASE 0x1000	// uppercase
566 #define AF_HEXBUF_LINEBREAK 0x2000	// break every 80 cols
567 
568 
569 /****************************************************************
570  *** Internal implementation details below.
571  ****************************************************************/
572 
573 
574 #ifdef __never_defined__
575 {
576 #endif
577 #ifdef __cplusplus
578 }
579 #endif
580 #endif
581 
582 
583