1 /* 2 * Input/Output (IO) handle functions 3 * 4 * Copyright (C) 2011-2021, Joachim Metz <joachim.metz@gmail.com> 5 * 6 * Refer to AUTHORS for acknowledgements. 7 * 8 * This program is free software: you can redistribute it and/or modify 9 * it under the terms of the GNU Lesser General Public License as published by 10 * the Free Software Foundation, either version 3 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU Lesser General Public License 19 * along with this program. If not, see <https://www.gnu.org/licenses/>. 20 */ 21 22 #if !defined( _LIBEVTX_IO_HANDLE_H ) 23 #define _LIBEVTX_IO_HANDLE_H 24 25 #include <common.h> 26 #include <types.h> 27 28 #include "libevtx_libbfio.h" 29 #include "libevtx_libcerror.h" 30 #include "libevtx_libfdata.h" 31 32 #if defined( __cplusplus ) 33 extern "C" { 34 #endif 35 36 extern const uint8_t *evtx_file_signature; 37 38 typedef struct libevtx_io_handle libevtx_io_handle_t; 39 40 struct libevtx_io_handle 41 { 42 /* The major version 43 */ 44 uint16_t major_version; 45 46 /* The minor version 47 */ 48 uint16_t minor_version; 49 50 /* The number of chunks 51 */ 52 uint16_t number_of_chunks; 53 54 /* The chunks data offset 55 */ 56 off64_t chunks_data_offset; 57 58 /* The chunks data size 59 */ 60 size64_t chunks_data_size; 61 62 /* The file flags 63 */ 64 uint32_t file_flags; 65 66 /* The chunk size 67 */ 68 uint32_t chunk_size; 69 70 /* Various flags 71 */ 72 uint8_t flags; 73 74 /* The first record identifier 75 */ 76 uint64_t first_record_identifier; 77 78 /* The last record identifier 79 */ 80 uint64_t last_record_identifier; 81 82 /* The codepage of the ASCII strings 83 */ 84 int ascii_codepage; 85 86 /* Value to indicate if abort was signalled 87 */ 88 int abort; 89 }; 90 91 int libevtx_io_handle_initialize( 92 libevtx_io_handle_t **io_handle, 93 libcerror_error_t **error ); 94 95 int libevtx_io_handle_free( 96 libevtx_io_handle_t **io_handle, 97 libcerror_error_t **error ); 98 99 int libevtx_io_handle_clear( 100 libevtx_io_handle_t *io_handle, 101 libcerror_error_t **error ); 102 103 int libevtx_io_handle_read_file_header( 104 libevtx_io_handle_t *io_handle, 105 libbfio_handle_t *file_io_handle, 106 off64_t file_offset, 107 libcerror_error_t **error ); 108 109 int libevtx_io_handle_read_chunk( 110 libevtx_io_handle_t *io_handle, 111 libbfio_handle_t *file_io_handle, 112 libfdata_vector_t *vector, 113 libfdata_cache_t *cache, 114 int element_index, 115 int element_data_file_index, 116 off64_t element_data_offset, 117 size64_t element_data_size, 118 uint32_t element_data_flags, 119 uint8_t read_flags, 120 libcerror_error_t **error ); 121 122 #if defined( __cplusplus ) 123 } 124 #endif 125 126 #endif /* !defined( _LIBEVTX_IO_HANDLE_H ) */ 127 128