/** \internal
* Volume system walk callback function that will analyze
* each volume to find a file system.
*/
TSK_WALK_RET_ENUM
TskAuto::vsWalkCb(TSK_VS_INFO * a_vs_info,
const TSK_VS_PART_INFO * a_vs_part, void *a_ptr)
{
TskAuto *tsk = (TskAuto *) a_ptr;
if (tsk->m_tag != TSK_AUTO_TAG)
return TSK_WALK_STOP;
TSK_FILTER_ENUM retval1 = tsk->filterVol(a_vs_part);
if (retval1 == TSK_FILTER_SKIP)
return TSK_WALK_CONT;
else if (retval1 == TSK_FILTER_STOP)
return TSK_WALK_STOP;
TSK_RETVAL_ENUM retval2 =
tsk->findFilesInFsRet(a_vs_part->start *
a_vs_part->vs->block_size, TSK_FS_TYPE_DETECT);
if (retval2 == TSK_STOP) {
return TSK_WALK_STOP;
}
else if (retval2 != TSK_OK) {
// if we return ERROR here, then the walk will stop. But, the
// error could just be because we looked into an unallocated volume.
// do any special error handling / reporting here.
tsk_error_reset();
}
return TSK_WALK_CONT;
}
/** \internal
* file name walk callback. Walk the contents of each file
* that is found.
*
* Does not return ERROR because all errors have been registered
* and returning an error would indicate to TSK that errno and such are set.
*/
TSK_WALK_RET_ENUM
TskAuto::dirWalkCb(TSK_FS_FILE * a_fs_file, const char *a_path,
void *a_ptr)
{
TskAuto *tsk = (TskAuto *) a_ptr;
if (tsk->m_tag != TSK_AUTO_TAG) {
// we have no way to register an error...
return TSK_WALK_STOP;
}
TSK_RETVAL_ENUM retval = tsk->processFile(a_fs_file, a_path);
if ((retval == TSK_STOP) || (tsk->getStopProcessing()))
return TSK_WALK_STOP;
else
return TSK_WALK_CONT;
}
/** \internal
* file name walk callback. Walk the contents of each file
* that is found.
*/
TSK_WALK_RET_ENUM
TskAuto::dirWalkCb(TSK_FS_FILE * a_fs_file, const char *a_path,
void *a_ptr)
{
TskAuto *tsk = (TskAuto *) a_ptr;
if (tsk->m_tag != TSK_AUTO_TAG)
return TSK_WALK_STOP;
TSK_RETVAL_ENUM retval = tsk->processFile(a_fs_file, a_path);
if (retval != TSK_OK) {
if (retval == TSK_STOP)
return TSK_WALK_STOP;
else
return TSK_WALK_ERROR;
}
else
return TSK_WALK_CONT;
}
/** \internal
* Volume system walk callback function that will analyze
* each volume to find a file system.
* Does not return ERROR because all errors have been registered
* and returning an error would indicate to TSK that errno and such are set.
*/
TSK_WALK_RET_ENUM
TskAuto::vsWalkCb(TSK_VS_INFO * a_vs_info,
const TSK_VS_PART_INFO * a_vs_part, void *a_ptr)
{
TskAuto *tsk = (TskAuto *) a_ptr;
if (tsk->m_tag != TSK_AUTO_TAG) {
// we have no way to register an error...
return TSK_WALK_STOP;
}
//save the current volume description
tsk->setCurVsPart(a_vs_part);
// see if the super class wants to continue with this.
TSK_FILTER_ENUM retval1 = tsk->filterVol(a_vs_part);
if (retval1 == TSK_FILTER_SKIP)
return TSK_WALK_CONT;
else if ((retval1 == TSK_FILTER_STOP) || (tsk->getStopProcessing()))
return TSK_WALK_STOP;
// process it
TSK_RETVAL_ENUM retval2 =
tsk->findFilesInFsRet(a_vs_part->start *
a_vs_part->vs->block_size, TSK_FS_TYPE_DETECT);
if ((retval2 == TSK_STOP) || (tsk->getStopProcessing())) {
return TSK_WALK_STOP;
}
//all errors would have been registered
return TSK_WALK_CONT;
}
