Main Page | Data Structures | Directories | File List | Data Fields | Globals

hashdb_tools.h File Reference


Detailed Description

Header file that defines internal data structures and functions.

#include "aux_tools.h"
#include <string.h>
#include <ctype.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <locale.h>

Go to the source code of this file.

Defines

#define TSK_HDB_HTYPE_MD5_STR   "md5"
 String name for MD5 algorithm.
#define TSK_HDB_HTYPE_SHA1_STR   "sha1"
 String name for SHA1 algorithm.
#define TSK_HDB_HTYPE_SHA1_LEN   40
 Length of SHA1 hash.
#define TSK_HDB_HTYPE_MD5_LEN   32
 Length of MD5 hash.
#define TSK_HDB_HTYPE_CRC32_LEN   8
 Length of CRC hash.
#define TSK_HDB_HTYPE_STR(x)
 Return the name of the hash algorithm, given its ID.
#define TSK_HDB_HTYPE_LEN(x)
 Return the length of a hash, given its ID.
#define TSK_HDB_DBTYPE_NSRL_STR   "nsrl"
 NSRL String name.
#define TSK_HDB_DBTYPE_NSRL_MD5_STR   "nsrl-md5"
 NSRL md5 string name.
#define TSK_HDB_DBTYPE_NSRL_SHA1_STR   "nsrl-sha1"
 NSRL SHA1 string name.
#define TSK_HDB_DBTYPE_MD5SUM_STR   "md5sum"
 md5sum db string n ame
#define TSK_HDB_DBTYPE_HK_STR   "hk"
 hash keeper string name
#define TSK_HDB_DBTYPE_SUPPORT_STR   "nsrl-md5, nsrl-sha1, md5sum, hk"
 List of supported data base types.

Typedefs

typedef enum TSK_HDB_FLAG_ENUM TSK_HDB_FLAG_ENUM
typedef enum TSK_HDB_HTYPE_ENUM TSK_HDB_HTYPE_ENUM
typedef enum TSK_HDB_DBTYPE_ENUM TSK_HDB_DBTYPE_ENUM
typedef TSK_HDB_INFO TSK_HDB_INFO
typedef uint8_t(* TSK_HDB_LOOKUP_FN )(TSK_HDB_INFO *, char *hash, char *name, void *)
typedef enum TSK_HDB_OPEN_ENUM TSK_HDB_OPEN_ENUM

Enumerations

enum  TSK_HDB_FLAG_ENUM { TSK_HDB_FLAG_QUICK = 0x01, TSK_HDB_FLAG_EXT = 0x02 }
 Flags used for lookups. More...
enum  TSK_HDB_HTYPE_ENUM { TSK_HDB_HTYPE_MD5_ID = 1, TSK_HDB_HTYPE_SHA1_ID = 2 }
 Hash algorithm types. More...
enum  TSK_HDB_DBTYPE_ENUM { TSK_HDB_DBTYPE_NSRL_ID = 1, TSK_HDB_DBTYPE_MD5SUM_ID = 2, TSK_HDB_DBTYPE_HK_ID = 3, TSK_HDB_DBTYPE_IDXONLY_ID = 4 }
 Hash Database types. More...
enum  TSK_HDB_OPEN_ENUM { TSK_HDB_OPEN_NONE = 0, TSK_HDB_OPEN_IDXONLY = (0x1 << 0) }
 Options for opening a hash database. More...

Functions

TSK_HDB_INFOtsk_hdb_open (TSK_TCHAR *db_file, TSK_HDB_OPEN_ENUM flags)
 Open a hash database and index for lookup.
void tsk_hdb_close (TSK_HDB_INFO *hdb)
 Close the HDB_INFO structure and free the memory.
uint8_t tsk_hdb_hasindex (TSK_HDB_INFO *, uint8_t htype)
 Determine if the hash database that is open has an index that has been created.
int8_t tsk_hdb_lookup (TSK_HDB_INFO *, char *, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *)
 Perform the binary search in the index for the text/ASCII hash value.
int8_t tsk_hdb_lookup_raw (TSK_HDB_INFO *, uint8_t *hash, uint8_t len, TSK_HDB_FLAG_ENUM, TSK_HDB_LOOKUP_FN, void *)
 Perform the binary search in the index for a hash value given in a raw (non-text) format.


Define Documentation

#define TSK_HDB_HTYPE_LEN  ) 
 

Value:

Return the length of a hash, given its ID.

#define TSK_HDB_HTYPE_STR  ) 
 

Value:

Return the name of the hash algorithm, given its ID.


Enumeration Type Documentation

enum TSK_HDB_DBTYPE_ENUM
 

Hash Database types.

Enumeration values:
TSK_HDB_DBTYPE_NSRL_ID  NIST NSRL format.
TSK_HDB_DBTYPE_MD5SUM_ID  md5sum format
TSK_HDB_DBTYPE_HK_ID  hashkeeper format
TSK_HDB_DBTYPE_IDXONLY_ID  Only the database index was opened -- original dbtype is unknown.

enum TSK_HDB_FLAG_ENUM
 

Flags used for lookups.

Enumeration values:
TSK_HDB_FLAG_QUICK  Quickly return if hash is found (do not return file name etc.).
TSK_HDB_FLAG_EXT  Return other details besides only file name (not used.

enum TSK_HDB_HTYPE_ENUM
 

Hash algorithm types.

Enumeration values:
TSK_HDB_HTYPE_MD5_ID  MD5 Algorithm.
TSK_HDB_HTYPE_SHA1_ID  SHA1 Algorithm.

enum TSK_HDB_OPEN_ENUM
 

Options for opening a hash database.

Enumeration values:
TSK_HDB_OPEN_NONE  No special flags.
TSK_HDB_OPEN_IDXONLY  Open only the index -- do not look for the original DB.


Function Documentation

void tsk_hdb_close TSK_HDB_INFO hdb_info  ) 
 

Close the HDB_INFO structure and free the memory.

Parameters:
hdb_info Structure to free.

uint8_t tsk_hdb_hasindex TSK_HDB_INFO hdb_info,
uint8_t  htype
 

Determine if the hash database that is open has an index that has been created.

Parameters:
hdb_info Hash database to consider
htype Hash type that index should be of
Returns:
1 if index exists and 0 if not

int8_t tsk_hdb_lookup TSK_HDB_INFO hdb_info,
char *  hash,
TSK_HDB_FLAG_ENUM  flags,
TSK_HDB_LOOKUP_FN  action,
void *  ptr
 

Perform the binary search in the index for the text/ASCII hash value.

Parameters:
hdb_info Hash database state information
hash Hash value to search for
flags 
action Callback function to call for each hash db entry (not called if QUICK flag is given)
ptr Pointer to data to pass to each callback
Returns:
-1 on error, 0 if hash value not found, and 1 if value was found.

int8_t tsk_hdb_lookup_raw TSK_HDB_INFO hdb_info,
uint8_t *  hash,
uint8_t  len,
TSK_HDB_FLAG_ENUM  flags,
TSK_HDB_LOOKUP_FN  action,
void *  ptr
 

Perform the binary search in the index for a hash value given in a raw (non-text) format.

this is a wrapper around the normal lookup function.

Parameters:
hdb_info Hash database state information
hash Array with binary hash value to search for
len Number of bytes in binary hash value
flags 
action Callback function to call for each hash db entry (not called if QUICK flag is given)
ptr Pointer to data to pass to each callback
Returns:
-1 on error, 0 if hash value not found, and 1 if value was found.

TSK_HDB_INFO* tsk_hdb_open TSK_TCHAR *  db_file,
TSK_HDB_OPEN_ENUM  flags
 

Open a hash database and index for lookup.

Parameters:
db_file Path to database.
flags Flags for opening the database.
Returns:
Poiner to hash database state structure or NULL on error


Generated on Thu Apr 19 14:58:53 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.4.2