Пример #1
0
 /// <summary>
 /// ctor for filesystem that comes from within a volume
 /// </summary>
 /// <param name="volume"></param>
 /// <param name="fstype"></param>
 internal FileSystem(Volume volume, FileSystemType fstype)
 {
     this._image  = volume.VolumeSystem.DiskImage;
     this._volume = volume;
     this._handle = NativeMethods.tsk_fs_open_vol(volume._ptr_volinfo, fstype);
     this._struct = _handle.GetStruct();
 }
Пример #2
0
 /// <summary>
 /// ctor for when there is no volume system (like thumb drives, floppies, etc. things with no MBR.. they just start with the filesystem)
 /// </summary>
 /// <param name="diskImage"></param>
 /// <param name="type"></param>
 /// <param name="offset"></param>
 internal FileSystem(DiskImage diskImage, FileSystemType type, long offset)
 {
     this._image  = diskImage;
     this._volume = null; //no luck on this, no volume system!
     this._handle = diskImage._handle.OpenFileSystemHandle(type, offset);
     this._struct = _handle.GetStruct();
 }
Пример #3
0
 internal static extern FileSystemBlockHandle tsk_fs_block_get(FileSystemHandle fsinfo, IntPtr should_be_zero, long address);
Пример #4
0
 internal static extern byte tsk_fs_meta_walk(FileSystemHandle fs, long start_address, long end_address, MetadataFlags walk_flags, MetaWalkDelegate callback, IntPtr a_ptr);
Пример #5
0
 internal static extern byte tsk_fs_dir_walk_ptr(FileSystemHandle fs, long directory_address, DirWalkFlags walk_flags, DirWalkPtrDelegate callback, IntPtr a_ptr);
Пример #6
0
 internal static extern DirectoryHandle tsk_fs_dir_open_meta(FileSystemHandle file, long metadata_address);
Пример #7
0
 internal static extern DirectoryHandle tsk_fs_dir_open(FileSystemHandle file, string path);
Пример #8
0
 internal static extern FileHandle tsk_fs_file_open_meta(FileSystemHandle fs, [In] IntPtr should_be_zero, [In] long metadata_address);
Пример #9
0
 internal static extern FileHandle tsk_fs_file_open(FileSystemHandle fs, [In] IntPtr should_be_zero, [In] string utf8path);