/*
* Class: edu_uw_apl_commons_tsk4j_filesys_File
* Method: defaultAttribute
* Signature: (J)J
*/
JNIEXPORT jlong JNICALL
Java_edu_uw_apl_commons_tsk4j_filesys_File_defaultAttribute
(JNIEnv *env, jobject thiz, jlong nativePtr ) {
TSK_FS_FILE* info = (TSK_FS_FILE*)nativePtr;
const TSK_FS_ATTR* attr = tsk_fs_file_attr_get( info );
return (jlong)attr;
}
/**
* \ingroup fslib
* Read the contents of a specific attribute of a file using a typical read() type interface.
* 0s are returned for missing runs of files.
*
* @param a_fs_file The inode structure of the file to read.
* @param a_offset The byte offset to start reading from.
* @param a_buf The buffer to read the data into.
* @param a_len The number of bytes to read from the file.
* @param a_flags Flags to use while reading
* @returns The number of bytes read or -1 on error (incl if offset is past EOF).
*/
ssize_t
tsk_fs_file_read(TSK_FS_FILE * a_fs_file,
TSK_OFF_T a_offset, char *a_buf, size_t a_len,
TSK_FS_FILE_READ_FLAG_ENUM a_flags)
{
const TSK_FS_ATTR *fs_attr;
if ((a_fs_file == NULL) || (a_fs_file->fs_info == NULL)) {
tsk_error_set_errno(TSK_ERR_FS_ARG);
tsk_error_set_errstr("tsk_fs_file_read: fs_info is NULL");
return -1;
}
if ((fs_attr = tsk_fs_file_attr_get(a_fs_file)) == NULL) {
return -1;
}
return tsk_fs_attr_read(fs_attr, a_offset, a_buf, a_len, a_flags);
}
/**
* \ingroup fslib
* Process a file and call a callback function with the file contents. The callback will be
* called with chunks of data that are fs->block_size or less. The address given in the callback
* will be correct only for raw files (when the raw file contents were stored in the block). For
* compressed and sparse files, the address may be zero. If a file has multiple attributes,
* such as NTFS files, this function uses the default one ($DATA for files, $IDX_ROOT for directories).
* Use tsk_fs_file_walk_type to specify an attribute.
*
* @param a_fs_file File to process
* @param a_flags Flags to use while processing file
* @param a_action Callback action to call with content
* @param a_ptr Pointer that will passed to callback
* @returns 1 on error and 0 on success.
*/
uint8_t
tsk_fs_file_walk(TSK_FS_FILE * a_fs_file,
TSK_FS_FILE_WALK_FLAG_ENUM a_flags,
TSK_FS_FILE_WALK_CB a_action, void *a_ptr)
{
const TSK_FS_ATTR *fs_attr;
TSK_FS_INFO *fs;
// clean up any error messages that are lying around
tsk_error_reset();
// check the FS_INFO, FS_FILE structures
if ((a_fs_file == NULL) || (a_fs_file->meta == NULL)
|| (a_fs_file->fs_info == NULL)) {
tsk_errno = TSK_ERR_FS_ARG;
snprintf(tsk_errstr, TSK_ERRSTR_L,
"tsk_fs_file_walk: called with NULL pointers");
return 1;
}
else if ((a_fs_file->fs_info->tag != TSK_FS_INFO_TAG)
|| (a_fs_file->meta->tag != TSK_FS_META_TAG)) {
tsk_errno = TSK_ERR_FS_ARG;
snprintf(tsk_errstr, TSK_ERRSTR_L,
"tsk_fs_file_walk: called with unallocated structures");
return 1;
}
fs = a_fs_file->fs_info;
if (tsk_verbose)
tsk_fprintf(stderr,
"tsk_fs_file_walk: Processing file %" PRIuINUM "\n",
a_fs_file->meta->addr);
if ((fs_attr = tsk_fs_file_attr_get(a_fs_file)) == NULL)
return 1;
return tsk_fs_attr_walk(fs_attr, a_flags, a_action, a_ptr);
}