1 /* 2 * The Sleuth Kit 3 * 4 * Brian Carrier [carrier <at> sleuthkit [dot] org] 5 * Copyright (c) 2005-2011 Brian Carrier. All rights reserved 6 * 7 * This software is distributed under the Common Public License 1.0 8 */ 9 10 /* 11 * Contains the single raw data file-specific functions and structures. 12 */ 13 14 #ifndef _IMG_WRITER_H 15 #define _IMG_WRITER_H 16 17 #include "tsk/base/tsk_base.h" 18 19 #ifdef __cplusplus 20 extern "C" { 21 #endif 22 TSK_RETVAL_ENUM tsk_img_writer_create(TSK_IMG_INFO *img_info, const TSK_TCHAR * outputFileName); 23 TSK_RETVAL_ENUM tsk_img_writer_finish(TSK_IMG_INFO *img_info); 24 25 enum IMG_WRITER_BLOCK_STATUS_ENUM { 26 IMG_WRITER_BLOCK_STATUS_UNALLOC = 0, 27 IMG_WRITER_BLOCK_STATUS_ALLOC = 1, 28 IMG_WRITER_BLOCK_STATUS_FINISHED = 2 29 }; 30 typedef enum IMG_WRITER_BLOCK_STATUS_ENUM IMG_WRITER_BLOCK_STATUS_ENUM; 31 32 typedef struct TSK_IMG_WRITER TSK_IMG_WRITER; 33 struct TSK_IMG_WRITER { 34 TSK_IMG_INFO * img_info; 35 int is_finished; // set to 1 if finalize image is finished 36 int finishProgress; // finalize image progress indicator (0-100) 37 int cancelFinish; // set to 1 if finalize image is cancelled 38 int inFinalizeImageWriter; // set to 1 if we are in finalize image 39 int hadErrorExtending; // set to 1 if there is a WriteFile error in addNewBlock 40 41 TSK_TCHAR* fileName; 42 #ifdef TSK_WIN32 43 HANDLE outputFileHandle; 44 #else 45 int outputFileHandle; 46 #endif 47 48 unsigned char* footer; 49 50 uint32_t blockSize; 51 TSK_OFF_T imageSize; 52 uint32_t totalBlocks; 53 uint32_t sectorBitmapLength; 54 uint32_t sectorBitmapArrayLength; 55 uint32_t sectorsPerBlock; 56 TSK_OFF_T batOffset; 57 TSK_OFF_T nextDataOffset; 58 59 IMG_WRITER_BLOCK_STATUS_ENUM* blockStatus; 60 uint32_t* blockToSectorNumber; 61 unsigned char ** blockToSectorBitmap; 62 63 TSK_RETVAL_ENUM(*add)(TSK_IMG_WRITER* img_writer, TSK_OFF_T addr, char *buffer, size_t len); 64 TSK_RETVAL_ENUM(*close)(TSK_IMG_WRITER* img_writer); 65 TSK_RETVAL_ENUM(*finish_image)(TSK_IMG_WRITER* img_writer); 66 }; 67 68 #ifdef __cplusplus 69 } 70 #endif 71 #endif 72