00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022
00023
00024
00025
00026
00027
00028
00029
00030
00031
00032
00033
00034
00035
00036
00037
00038
00039
00040
00041
00042
00043
00044
00045
00046
00047
00048
00049
00050
00051
00052
00053
00054
00055
00056
00057
00058
00059
00060 #ifndef _HFS_H
00061 #define _HFS_H
00062
00063
00064
00065
00066
00067
00068
00069
00070
00071
00072
00073 #define HFS_MAGIC 0x4244
00074 #define HFSPLUS_MAGIC 0x482b
00075
00076 #define HFS_SBOFF 1024
00077 #define HFS_NDADDR 0001
00078 #define HFS_NIADDR 0001
00079
00080 #define HFS_FIRST_USER_CNID 16
00081
00082
00083 #define HFS_BTREE_LEAF_NODE -1
00084 #define HFS_BTREE_INDEX_NODE 0
00085 #define HFS_BTREE_HEADER_NODE 1
00086 #define HFS_BTREE_MAP_NODE 2
00087
00088 #define HFS_MAXNAMLEN 255
00089
00090 #define HFS_ROOT_INUM 2
00091
00092
00093 #define HFS_FOLDER_RECORD 0x0001
00094 #define HFS_FILE_RECORD 0X0002
00095 #define HFS_FOLDER_THREAD 0x0003
00096 #define HFS_FILE_THREAD 0x0004
00097
00098
00099
00100
00101
00102
00103
00104 #define NSEC_BTWN_1904_1970 (uint32_t) 2082844800U
00105
00106 #define HFS_BIT_VOLUME_UNMOUNTED (uint32_t)(1 << 8)
00107 #define HFS_BIT_VOLUME_INCONSISTENT (uint32_t)(1 << 11)
00108 #define HFS_BIT_VOLUME_JOURNALED (uint32_t)(1 << 13)
00109
00110
00111
00112
00113
00114
00115 typedef struct {
00116 uint16_t length[2];
00117 uint16_t unicode[255];
00118 } hfs_uni_str;
00119
00120
00121 typedef struct {
00122 uint8_t owner[4];
00123 uint8_t group[4];
00124 uint8_t a_flags;
00125 uint8_t o_flags;
00126 uint8_t mode[2];
00127 union {
00128 uint8_t inum[4];
00129 uint8_t nlink[4];
00130 uint8_t raw[4];
00131 } special;
00132 } hfs_access_perm;
00133
00134 typedef struct {
00135 uint32_t uid;
00136 uint32_t gid;
00137 uint32_t mode;
00138 uint32_t dev;
00139 } hfs_file_perm;
00140
00141
00142
00143 struct hfs_ext_desc {
00144 uint8_t start_blk[4];
00145 uint8_t blk_cnt[4];
00146 };
00147
00148 typedef struct hfs_ext_desc hfs_ext_desc;
00149
00150
00151
00152 struct hfs_fork {
00153 uint8_t logic_sz[8];
00154 uint8_t clmp_sz[4];
00155 uint8_t total_blk[4];
00156 hfs_ext_desc extents[8];
00157 };
00158
00159 typedef struct hfs_fork hfs_fork;
00160
00161
00162
00163
00164 typedef struct {
00165 uint8_t signature[2];
00166 uint8_t version[2];
00167 uint8_t attr[4];
00168 uint8_t last_mnt_ver[4];
00169 uint8_t jinfo_blk[4];
00170 uint8_t c_date[4];
00171 uint8_t m_date[4];
00172 uint8_t bkup_date[4];
00173 uint8_t chk_date[4];
00174 uint8_t file_cnt[4];
00175 uint8_t fldr_cnt[4];
00176 uint8_t blk_sz[4];
00177 uint8_t blk_cnt[4];
00178 uint8_t free_blks[4];
00179 uint8_t next_alloc[4];
00180 uint8_t rsrc_clmp_sz[4];
00181 uint8_t data_clmp_sz[4];
00182 uint8_t next_cat_id[4];
00183 uint8_t write_cnt[4];
00184 uint8_t enc_bmp[8];
00185 uint8_t finder_info[32];
00186 hfs_fork alloc_file;
00187 hfs_fork ext_file;
00188 hfs_fork cat_file;
00189 hfs_fork attr_file;
00190 hfs_fork start_file;
00191 } hfs_sb;
00192
00193 typedef struct {
00194 uint8_t key_len[2];
00195 uint8_t parent_cnid[4];
00196 uint8_t name[510];
00197 } hfs_cat_key;
00198
00199 typedef struct {
00200 uint32_t inum;
00201 uint32_t parent;
00202 uint32_t node;
00203 DADDR_T offs;
00204 } htsk_fs_inode_mode_struct;
00205
00206 typedef struct {
00207 uint8_t flink[4];
00208 uint8_t blink[4];
00209 int8_t kind;
00210 uint8_t height;
00211 uint8_t num_rec[2];
00212 uint8_t res[2];
00213 } hfs_btree_node;
00214
00215 typedef struct {
00216 uint8_t depth[2];
00217 uint8_t root[4];
00218 uint8_t leaf[4];
00219 uint8_t firstleaf[4];
00220 uint8_t lastleaf[4];
00221 uint8_t size[2];
00222 uint8_t max_len[2];
00223 uint8_t total[4];
00224 uint8_t free[4];
00225 uint8_t res[2];
00226 uint8_t clmp_sz[4];
00227 uint8_t bt_type;
00228 uint8_t k_type;
00229 uint8_t attr[4];
00230 uint8_t res2[64];
00231 } hfs_btree_header_record;
00232
00233 typedef struct {
00234 int8_t v[2];
00235 int8_t h[2];
00236 } hfs_point;
00237
00238 typedef struct {
00239 uint8_t file_type[4];
00240 uint8_t file_cr[4];
00241 uint8_t flags[2];
00242 hfs_point loc;
00243 uint8_t res[2];
00244 } hfs_fileinfo;
00245
00246 typedef struct {
00247 uint8_t res1[8];
00248 uint8_t extflags[2];
00249 uint8_t res2[2];
00250 uint8_t folderid[4];
00251 } hfs_extendedfileinfo;
00252
00253 typedef struct {
00254 uint8_t rec_type[2];
00255 uint8_t flags[2];
00256 uint8_t valence[4];
00257 uint8_t cnid[4];
00258 uint8_t ctime[4];
00259 uint8_t cmtime[4];
00260 uint8_t amtime[4];
00261 uint8_t atime[4];
00262 uint8_t bkup_time[4];
00263 hfs_access_perm perm;
00264 hfs_fileinfo u_info;
00265 hfs_extendedfileinfo f_info;
00266 uint8_t txt_enc[4];
00267 uint8_t res[4];
00268 } hfs_folder;
00269
00270 typedef struct {
00271 uint8_t rec_type[2];
00272 uint8_t flags[2];
00273 uint8_t res[4];
00274 uint8_t cnid[4];
00275 uint8_t ctime[4];
00276 uint8_t cmtime[4];
00277 uint8_t attr_mtime[4];
00278 uint8_t atime[4];
00279 uint8_t bkup_date[4];
00280 hfs_access_perm perm;
00281 hfs_fileinfo u_info;
00282 hfs_extendedfileinfo f_info;
00283 uint8_t text_enc[4];
00284 uint8_t res2[4];
00285 hfs_fork data;
00286 hfs_fork resource;
00287 } hfs_file;
00288
00289 typedef struct {
00290 int16_t type;
00291 int16_t res;
00292 uint8_t cnid[4];
00293 char name[255];
00294 } hfs_thread;
00295
00296 typedef struct {
00297 TSK_FS_INFO fs_info;
00298 hfs_sb *fs;
00299 TSK_FS_INODE *cat_inode;
00300
00301 htsk_fs_inode_mode_struct *inodes;
00302 uint8_t *block_map;
00303 uint8_t *leaf_map;
00304 uint8_t *del_map;
00305 hfs_file *cat;
00306 int flags;
00307 INUM_T inum;
00308
00309 hfs_btree_header_record *hdr;
00310
00311 OFF_T key;
00312
00313 } HFS_INFO;
00314
00315
00316
00317
00318 typedef struct {
00319 uint8_t flags[4];
00320 uint8_t dev_sig[32];
00321 uint8_t offs[8];
00322 uint8_t size[8];
00323 uint8_t res[128];
00324 } hfs_journ_sb;
00325
00326
00327
00328
00329 extern uint8_t hfs_dent_walk(TSK_FS_INFO *, INUM_T, TSK_FS_DENT_FLAG_ENUM,
00330 TSK_FS_DENT_TYPE_WALK_CB, void *);
00331 extern uint8_t hfs_jopen(TSK_FS_INFO *, INUM_T);
00332 extern uint8_t hfs_jblk_walk(TSK_FS_INFO *, DADDR_T, DADDR_T, int,
00333 TSK_FS_JBLK_WALK_CB, void *);
00334 extern uint8_t hfs_jentry_walk(TSK_FS_INFO *, int, TSK_FS_JENTRY_WALK_CB,
00335 void *);
00336 #endif