1 /*
2 ** fs_types
3 ** The Sleuth Kit
4 **
5 ** Identify the type of file system being used
6 **
7 ** Brian Carrier [carrier <at> sleuthkit [dot] org]
8 ** Copyright (c) 2006-2011 Brian Carrier, Basis Technology. All Rights reserved
9 ** Copyright (c) 2003-2005 Brian Carrier. All rights reserved
10 **
11 ** TASK
12 ** Copyright (c) 2002 Brian Carrier, @stake Inc. All rights reserved
13 **
14 ** This software is distributed under the Common Public License 1.0
15 **
16 */
17
18 /**
19 * \file fs_types.c
20 * Contains TSK functions that deal with parsing and printing file system type strings.
21 */
22
23 #include "tsk_fs_i.h"
24
25 /**
26 * \internal
27 */
28 typedef struct {
29 char *name;
30 TSK_FS_TYPE_ENUM code;
31 char *comment;
32 } FS_TYPES;
33
34 /** \internal
35 * The table used to parse input strings - supports
36 * legacy strings - in order of expected usage
37 */
38 static FS_TYPES fs_type_table[] = {
39 {"ntfs", TSK_FS_TYPE_NTFS_DETECT, "NTFS"},
40 {"fat", TSK_FS_TYPE_FAT_DETECT, "FAT (Auto Detection)"},
41 {"ext", TSK_FS_TYPE_EXT_DETECT, "ExtX (Auto Detection)"},
42 {"iso9660", TSK_FS_TYPE_ISO9660_DETECT, "ISO9660 CD"},
43 #if TSK_USE_HFS
44 {"hfs", TSK_FS_TYPE_HFS_DETECT, "HFS+"},
45 #endif
46 {"ufs", TSK_FS_TYPE_FFS_DETECT, "UFS (Auto Detection)"},
47 {"raw", TSK_FS_TYPE_RAW_DETECT, "Raw Data"},
48 {"swap", TSK_FS_TYPE_SWAP_DETECT, "Swap Space"},
49 {"fat12", TSK_FS_TYPE_FAT12, "FAT12"},
50 {"fat16", TSK_FS_TYPE_FAT16, "FAT16"},
51 {"fat32", TSK_FS_TYPE_FAT32, "FAT32"},
52 {"exfat", TSK_FS_TYPE_EXFAT, "exFAT"},
53 {"ext2", TSK_FS_TYPE_EXT2, "Ext2"},
54 {"ext3", TSK_FS_TYPE_EXT3, "Ext3"},
55 {"ext4", TSK_FS_TYPE_EXT4, "Ext4"},
56 {"ufs1", TSK_FS_TYPE_FFS1, "UFS1"},
57 {"ufs2", TSK_FS_TYPE_FFS2, "UFS2"},
58 {"yaffs2", TSK_FS_TYPE_YAFFS2, "YAFFS2"},
59 {0,0,""}
60 };
61
62 static FS_TYPES fs_legacy_type_table[] = {
63 // legacy CLI arg names
64 {"linux-ext", TSK_FS_TYPE_EXT_DETECT, "auto-detect Linux EXTxFS"},
65 {"linux-ext2", TSK_FS_TYPE_EXT2, "Linux TSK_FS_TYPE_EXT_2"},
66 {"linux-ext3", TSK_FS_TYPE_EXT3, "Linux TSK_FS_TYPE_EXT_3"},
67 {"linux-ext4", TSK_FS_TYPE_EXT4, "Linux TSK_FS_TYPE_EXT_4"},
68 {"bsdi", TSK_FS_TYPE_FFS1, "BSDi FFS"},
69 {"freebsd", TSK_FS_TYPE_FFS1, "FreeBSD FFS"},
70 {"netbsd", TSK_FS_TYPE_FFS1, "NetBSD FFS"},
71 {"openbsd", TSK_FS_TYPE_FFS1, "OpenBSD FFS"},
72 {"solaris", TSK_FS_TYPE_FFS1B, "Solaris FFS"},
73 {0,0,""}
74 };
75
76
77
78 /**
79 * \ingroup fslib
80 * Parse a string with the file system type and return its internal ID.
81 *
82 * @param str String to parse, always UTF-8.
83 * @returns ID of string (or unsupported if the name is unknown)
84 */
85 TSK_FS_TYPE_ENUM
tsk_fs_type_toid_utf8(const char * str)86 tsk_fs_type_toid_utf8(const char *str)
87 {
88 FS_TYPES *sp;
89
90 for (sp = fs_type_table; sp->name; sp++) {
91 if (strcmp(str, sp->name) == 0) {
92 return sp->code;
93 }
94 }
95 // look at the legacy names
96 for (sp = fs_legacy_type_table; sp->name; sp++) {
97 if (strcmp(str, sp->name) == 0) {
98 return sp->code;
99 }
100 }
101 return TSK_FS_TYPE_UNSUPP;
102 }
103
104
105 /**
106 * \ingroup fslib
107 * Parse a string with the file system type and return its internal ID.
108 *
109 * @param str String to parse.
110 * @returns ID of string (or unsupported if the name is unknown)
111 */
112 TSK_FS_TYPE_ENUM
tsk_fs_type_toid(const TSK_TCHAR * str)113 tsk_fs_type_toid(const TSK_TCHAR * str)
114 {
115 char tmp[16];
116 int i;
117
118 // convert to char
119 for (i = 0; i < 15 && str[i] != '\0'; i++) {
120 tmp[i] = (char) str[i];
121 }
122 tmp[i] = '\0';
123
124 return tsk_fs_type_toid_utf8(tmp);
125 }
126
127
128 /**
129 * \ingroup fslib
130 * Print the supported file system types to a file handle
131 * @param hFile File handle to print to
132 */
133 void
tsk_fs_type_print(FILE * hFile)134 tsk_fs_type_print(FILE * hFile)
135 {
136 FS_TYPES *sp;
137 tsk_fprintf(hFile, "Supported file system types:\n");
138 for (sp = fs_type_table; sp->name; sp++)
139 tsk_fprintf(hFile, "\t%s (%s)\n", sp->name, sp->comment);
140 }
141
142 /**
143 * \ingroup fslib
144 * Return the string name of a file system type id.
145 * @param ftype File system type id
146 * @returns Name or NULL on error
147 */
148 const char *
tsk_fs_type_toname(TSK_FS_TYPE_ENUM ftype)149 tsk_fs_type_toname(TSK_FS_TYPE_ENUM ftype)
150 {
151 FS_TYPES *sp;
152 for (sp = fs_type_table; sp->name; sp++)
153 if (sp->code == ftype)
154 return sp->name;
155
156 return NULL;
157 }
158
159 /**
160 * \ingroup fslib
161 * Return the supported file system types.
162 * @returns The bit in the return value is 1 if the type is supported.
163 */
164 TSK_FS_TYPE_ENUM
tsk_fs_type_supported()165 tsk_fs_type_supported()
166 {
167 TSK_FS_TYPE_ENUM sup_types = 0;
168 FS_TYPES *types;
169 for (types = fs_type_table; types->name; types++) {
170 sup_types |= types->code;
171 }
172 return sup_types;
173 }
174