Main Page | Data Structures | Directories | File List | Data Fields | Globals

hfs.h

00001 /*
00002 ** The Sleuth Kit
00003 **
00004 ** This software is subject to the IBM Public License ver. 1.0,
00005 ** which was displayed prior to download and is included in the readme.txt
00006 ** file accompanying the Sleuth Kit files.  It may also be requested from:
00007 ** Crucial Security Inc.
00008 ** 14900 Conference Center Drive
00009 ** Chantilly, VA 20151
00010 **
00011 ** Wyatt Banks [wbanks@crucialsecurity.com]
00012 ** Copyright (c) 2005 Crucial Security Inc.  All rights reserved.
00013 **
00014 ** Brian Carrier [carrier@sleuthkit.org]
00015 ** Copyright (c) 2003-2005 Brian Carrier.  All rights reserved
00016 **
00017 ** Copyright (c) 1997,1998,1999, International Business Machines
00018 ** Corporation and others. All Rights Reserved.
00019 */
00020 
00021 /* TCT
00022  * LICENSE
00023  *      This software is distributed under the IBM Public License.
00024  * AUTHOR(S)
00025  *      Wietse Venema
00026  *      IBM T.J. Watson Research
00027  *      P.O. Box 704
00028  *      Yorktown Heights, NY 10598, USA
00029  --*/
00030 
00031 /*
00032 ** You may distribute the Sleuth Kit, or other software that incorporates
00033 ** part of all of the Sleuth Kit, in object code form under a license agreement,
00034 ** provided that:
00035 ** a) you comply with the terms and conditions of the IBM Public License
00036 **    ver 1.0; and
00037 ** b) the license agreement
00038 **     i) effectively disclaims on behalf of all Contributors all warranties
00039 **        and conditions, express and implied, including warranties or
00040 **        conditions of title and non-infringement, and implied warranties
00041 **        or conditions of merchantability and fitness for a particular
00042 **        purpose.
00043 **    ii) effectively excludes on behalf of all Contributors liability for
00044 **        damages, including direct, indirect, special, incidental and
00045 **        consequential damages such as lost profits.
00046 **   iii) states that any provisions which differ from IBM Public License
00047 **        ver. 1.0 are offered by that Contributor alone and not by any
00048 **        other party; and
00049 **    iv) states that the source code for the program is available from you,
00050 **        and informs licensees how to obtain it in a reasonable manner on or
00051 **        through a medium customarily used for software exchange.
00052 **
00053 ** When the Sleuth Kit or other software that incorporates part or all of
00054 ** the Sleuth Kit is made available in source code form:
00055 **     a) it must be made available under IBM Public License ver. 1.0; and
00056 **     b) a copy of the IBM Public License ver. 1.0 must be included with
00057 **        each copy of the program.
00058 */
00059 
00060 #ifndef _HFS_H
00061 #define _HFS_H
00062 
00063 
00064 /*
00065  * All structures created using technote 1150 from Apple.com
00066  * http://developer.apple.com/technotes/tn/tn1150.html
00067  */
00068 
00069 /*
00070  * Constants
00071  */
00072 
00073 #define HFS_MAGIC       0x4244  /* HX in big endian */
00074 #define HFSPLUS_MAGIC   0x482b  /* H+ in big endian */
00075 
00076 #define HFS_SBOFF       1024
00077 #define HFS_NDADDR      0001
00078 #define HFS_NIADDR      0001
00079 
00080 #define HFS_FIRST_USER_CNID     16
00081 
00082 /* b-tree kind types */
00083 #define HFS_BTREE_LEAF_NODE     -1
00084 #define HFS_BTREE_INDEX_NODE     0
00085 #define HFS_BTREE_HEADER_NODE    1
00086 #define HFS_BTREE_MAP_NODE       2
00087 
00088 #define HFS_MAXNAMLEN           255
00089 
00090 #define HFS_ROOT_INUM           2
00091 
00092 /* catalog file data types */
00093 #define HFS_FOLDER_RECORD       0x0001
00094 #define HFS_FILE_RECORD         0X0002
00095 #define HFS_FOLDER_THREAD       0x0003
00096 #define HFS_FILE_THREAD         0x0004
00097 
00098 /*
00099  * HFS uses its own time system, which is seconds since Jan 1 1904
00100  * instead of the typical Jan 1 1970.  This number is the seconds between
00101  * 1 Jan 1904 and 1 Jan 1970 which will make ctime(3) work instead of
00102  * re-writing the Apple library function to convert this time.
00103  */
00104 #define NSEC_BTWN_1904_1970     (uint32_t) 2082844800U
00105 
00106 #define HFS_BIT_VOLUME_UNMOUNTED        (uint32_t)(1 << 8)
00107 #define HFS_BIT_VOLUME_INCONSISTENT     (uint32_t)(1 << 11)
00108 #define HFS_BIT_VOLUME_JOURNALED        (uint32_t)(1 << 13)
00109 
00110 /*
00111  * HFS structures
00112  */
00113 
00114 /* File and Folder name struct */
00115 typedef struct {
00116     uint16_t length[2];
00117     uint16_t unicode[255];
00118 } hfs_uni_str;
00119 
00120 /* access permissions */
00121 typedef struct {
00122     uint8_t owner[4];           /* file owner */
00123     uint8_t group[4];           /* file group */
00124     uint8_t a_flags;            /* admin flags */
00125     uint8_t o_flags;            /* owner flags */
00126     uint8_t mode[2];            /* file mode */
00127     union {
00128         uint8_t inum[4];        /* inode number */
00129         uint8_t nlink[4];       /* link count */
00130         uint8_t raw[4];         /* raw device */
00131     } special;
00132 } hfs_access_perm;
00133 
00134 typedef struct {
00135     uint32_t uid;               /* owner id */
00136     uint32_t gid;               /* group id */
00137     uint32_t mode;              /* permissions */
00138     uint32_t dev;               /* special device */
00139 } hfs_file_perm;
00140 
00141 /* HFS extent descriptor */
00142 //typedef struct {
00143 struct hfs_ext_desc {
00144     uint8_t start_blk[4];       /* start block */
00145     uint8_t blk_cnt[4];         /* block count */
00146 };
00147 //} hfs_ext_desc;
00148 typedef struct hfs_ext_desc hfs_ext_desc;
00149 
00150 /* fork data structure */
00151 //typedef struct {
00152 struct hfs_fork {
00153     uint8_t logic_sz[8];        /* logical size */
00154     uint8_t clmp_sz[4];         /* clump size */
00155     uint8_t total_blk[4];       /* total blocks */
00156     hfs_ext_desc extents[8];
00157 };
00158 //} hfs_fork;
00159 typedef struct hfs_fork hfs_fork;
00160 
00161 /*
00162 ** Super Block
00163 */
00164 typedef struct {
00165     uint8_t signature[2];       /* "H+" for HFS+, "HX" for HFSX */
00166     uint8_t version[2];         /* 4 for HFS+, 5 for HFSX */
00167     uint8_t attr[4];            /* volume attributes */
00168     uint8_t last_mnt_ver[4];    /* last mounted version */
00169     uint8_t jinfo_blk[4];       /* journal info block */
00170     uint8_t c_date[4];          /* volume creation date */
00171     uint8_t m_date[4];          /* volume last modified date */
00172     uint8_t bkup_date[4];       /* volume last backup date */
00173     uint8_t chk_date[4];        /* date of last consistency check */
00174     uint8_t file_cnt[4];        /* number of files on volume */
00175     uint8_t fldr_cnt[4];        /* number of folders on volume */
00176     uint8_t blk_sz[4];          /* allocation block size */
00177     uint8_t blk_cnt[4];         /* number of blocks on disk */
00178     uint8_t free_blks[4];       /* unused block count */
00179     uint8_t next_alloc[4];      /* start of next allocation search */
00180     uint8_t rsrc_clmp_sz[4];    /* default clump size for resource forks */
00181     uint8_t data_clmp_sz[4];    /* default clump size for data forks */
00182     uint8_t next_cat_id[4];     /* next catalog id */
00183     uint8_t write_cnt[4];       /* write count */
00184     uint8_t enc_bmp[8];         /* encoding bitmap */
00185     uint8_t finder_info[32];
00186     hfs_fork alloc_file;        /* location and size of allocation file */
00187     hfs_fork ext_file;          /* location and size of extents file */
00188     hfs_fork cat_file;          /* location and size of catalog file */
00189     hfs_fork attr_file;         /* location and size of attributes file */
00190     hfs_fork start_file;        /* location and size of startup file */
00191 } hfs_sb;
00192 
00193 typedef struct {
00194     uint8_t key_len[2];
00195     uint8_t parent_cnid[4];
00196     uint8_t name[510];
00197 } hfs_cat_key;
00198 
00199 typedef struct {
00200     uint32_t inum;              /* inode number */
00201     uint32_t parent;            /* parent directoy number */
00202     uint32_t node;              /* btree leaf node */
00203     DADDR_T offs;               /* offset of beginning of inode */
00204 } htsk_fs_inode_mode_struct;
00205 
00206 typedef struct {
00207     uint8_t flink[4];           /* next node number */
00208     uint8_t blink[4];           /* previous node number */
00209     int8_t kind;                /* type of node */
00210     uint8_t height;             /* level in B-tree */
00211     uint8_t num_rec[2];         /* number of records this node */
00212     uint8_t res[2];             /* reserved */
00213 } hfs_btree_node;
00214 
00215 typedef struct {
00216     uint8_t depth[2];           /* current depth of btree */
00217     uint8_t root[4];            /* node number of root node */
00218     uint8_t leaf[4];            /* number of records in leaf nodes */
00219     uint8_t firstleaf[4];       /* number of first leaf node */
00220     uint8_t lastleaf[4];        /* number of last leaf node */
00221     uint8_t size[2];            /* byte size of leaf node (512..32768) */
00222     uint8_t max_len[2];         /* max key length in an index or leaf node */
00223     uint8_t total[4];           /* number of nodes in btree (free or in use) */
00224     uint8_t free[4];            /* unused nodes in btree */
00225     uint8_t res[2];             /* reserved */
00226     uint8_t clmp_sz[4];         /* clump size */
00227     uint8_t bt_type;            /* btree type */
00228     uint8_t k_type;             /* key compare type */
00229     uint8_t attr[4];            /* attributes */
00230     uint8_t res2[64];           /* reserved */
00231 } hfs_btree_header_record;
00232 
00233 typedef struct {
00234     int8_t v[2];
00235     int8_t h[2];
00236 } hfs_point;
00237 
00238 typedef struct {
00239     uint8_t file_type[4];       /* file type */
00240     uint8_t file_cr[4];         /* file creator */
00241     uint8_t flags[2];           /* finder flags */
00242     hfs_point loc;              /* location in the folder */
00243     uint8_t res[2];             /* reserved */
00244 } hfs_fileinfo;
00245 
00246 typedef struct {
00247     uint8_t res1[8];            /* reserved 1 */
00248     uint8_t extflags[2];        /* extended finder flags */
00249     uint8_t res2[2];            /* reserved 2 */
00250     uint8_t folderid[4];        /* putaway folder id */
00251 } hfs_extendedfileinfo;
00252 
00253 typedef struct {
00254     uint8_t rec_type[2];        /* record type */
00255     uint8_t flags[2];           /* flags - reserved */
00256     uint8_t valence[4];         /* valence - items in this folder */
00257     uint8_t cnid[4];            /* catalog node id */
00258     uint8_t ctime[4];           /* create date */
00259     uint8_t cmtime[4];          /* content mod date */
00260     uint8_t amtime[4];          /* attribute mod date */
00261     uint8_t atime[4];           /* access date */
00262     uint8_t bkup_time[4];       /* backup time */
00263     hfs_access_perm perm;       /* HFS permissions */
00264     hfs_fileinfo u_info;        /* user info */
00265     hfs_extendedfileinfo f_info;        /* finder info */
00266     uint8_t txt_enc[4];         /* text encoding */
00267     uint8_t res[4];             /* reserved */
00268 } hfs_folder;
00269 
00270 typedef struct {
00271     uint8_t rec_type[2];        /* record type */
00272     uint8_t flags[2];
00273     uint8_t res[4];             /* reserved */
00274     uint8_t cnid[4];            /* catalog node id */
00275     uint8_t ctime[4];           /* create date */
00276     uint8_t cmtime[4];          /* content modification date */
00277     uint8_t attr_mtime[4];      /* attribute mod date */
00278     uint8_t atime[4];           /* access date */
00279     uint8_t bkup_date[4];       /* backup date */
00280     hfs_access_perm perm;       /* permissions */
00281     hfs_fileinfo u_info;        /* user info */
00282     hfs_extendedfileinfo f_info;        /* finder info */
00283     uint8_t text_enc[4];        /* text encoding */
00284     uint8_t res2[4];            /* reserved 2 */
00285     hfs_fork data;              /* data fork */
00286     hfs_fork resource;          /* resource fork */
00287 } hfs_file;
00288 
00289 typedef struct {
00290     int16_t type;
00291     int16_t res;
00292     uint8_t cnid[4];
00293     char name[255];
00294 } hfs_thread;
00295 
00296 typedef struct {
00297     TSK_FS_INFO fs_info;        /* SUPER CLASS */
00298     hfs_sb *fs;                 /* cached superblock */
00299     TSK_FS_INODE *cat_inode;    /* contains the data entry for the cat */
00300 
00301     htsk_fs_inode_mode_struct *inodes;
00302     uint8_t *block_map;         /* cached block allocation bitmap */
00303     uint8_t *leaf_map;          /* bitmap of btree leaf nodes */
00304     uint8_t *del_map;           /* bitmap of btree deleted leaf nodes */
00305     hfs_file *cat;              /* cache for on-disk inode */
00306     int flags;                  /* flags for on-disk inode */
00307     INUM_T inum;                /* number of above cached cat */
00308 
00309     hfs_btree_header_record *hdr;       /* stored btree header node */
00310 
00311     OFF_T key;                  /* offset of key for cached inode */
00312 
00313 } HFS_INFO;
00314 
00315 /************** JOURNAL ******************/
00316 
00317 /* HFS Journal Info Block */
00318 typedef struct {
00319     uint8_t flags[4];
00320     uint8_t dev_sig[32];
00321     uint8_t offs[8];
00322     uint8_t size[8];
00323     uint8_t res[128];
00324 } hfs_journ_sb;
00325 
00326 /* 
00327  * Prototypes
00328  */
00329 extern uint8_t hfs_dent_walk(TSK_FS_INFO *, INUM_T, TSK_FS_DENT_FLAG_ENUM,
00330     TSK_FS_DENT_TYPE_WALK_CB, void *);
00331 extern uint8_t hfs_jopen(TSK_FS_INFO *, INUM_T);
00332 extern uint8_t hfs_jblk_walk(TSK_FS_INFO *, DADDR_T, DADDR_T, int,
00333     TSK_FS_JBLK_WALK_CB, void *);
00334 extern uint8_t hfs_jentry_walk(TSK_FS_INFO *, int, TSK_FS_JENTRY_WALK_CB,
00335     void *);
00336 #endif

Generated on Thu Apr 19 14:58:53 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.4.2