libewf_internal_handle.h

sleuthit-2.09 一个磁盘的工具集

/*
 * libewf handle
 *
 * Copyright (c) 2006-2007, Joachim Metz <[e-mail]>,
 * Hoffmann Investigations. All rights reserved.
 *
 * Refer to AUTHORS for acknowledgements.
 *
 * Redistribution and use in source and binary forms, with or without modification,
 * are permitted provided that the following conditions are met:
 *
 * - Redistributions of source code must retain the above copyright notice,
 *   this list of conditions and the following disclaimer.
 * - Redistributions in binary form must reproduce the above copyright notice,
 *   this list of conditions and the following disclaimer in the documentation
 *   and/or other materials provided with the distribution.
 * - Neither the name of the creator, related organisations, nor the names of
 *   its contributors may be used to endorse or promote products derived from
 *   this software without specific prior written permission.
 * - All advertising materials mentioning features or use of this software
 *   must acknowledge the contribution by people stated in the acknowledgements.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER, COMPANY AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#ifndef _LIBEWF_INTERNAL_HANDLE_H
#define _LIBEWF_INTERNAL_HANDLE_H

#include "libewf_includes.h"
#include "libewf_char.h"
#include "libewf_chunk_cache.h"
#include "libewf_error_sector.h"
#include "libewf_hash_values.h"
#include "libewf_header_values.h"
#include "libewf_md5.h"
#include "libewf_offset_table.h"
#include "libewf_segment_table.h"

#include "ewf_digest_hash.h"
#include "ewf_error2.h"
#include "ewf_header.h"
#include "ewf_header2.h"
#include "ewf_table.h"

#ifdef __cplusplus
extern "C" {
#endif

#define LIBEWF_INTERNAL_HANDLE libewf_internal_handle_t
#define LIBEWF_INTERNAL_HANDLE_SIZE sizeof( LIBEWF_INTERNAL_HANDLE )

#define LIBEWF_INTERNAL_HANDLE_MEDIA libewf_internal_handle_media_t
#define LIBEWF_INTERNAL_HANDLE_MEDIA_SIZE sizeof( LIBEWF_INTERNAL_HANDLE_MEDIA )

#define LIBEWF_INTERNAL_HANDLE_READ libewf_internal_handle_read_t
#define LIBEWF_INTERNAL_HANDLE_READ_SIZE sizeof( LIBEWF_INTERNAL_HANDLE_READ )

#define LIBEWF_INTERNAL_HANDLE_WRITE libewf_internal_handle_write_t
#define LIBEWF_INTERNAL_HANDLE_WRITE_SIZE sizeof( LIBEWF_INTERNAL_HANDLE_WRITE )

typedef struct libewf_internal_handle libewf_internal_handle_t;
typedef struct libewf_internal_handle_media libewf_internal_handle_media_t;
typedef struct libewf_internal_handle_read libewf_internal_handle_read_t;
typedef struct libewf_internal_handle_write libewf_internal_handle_write_t;

struct libewf_internal_handle
{
	/* A specific subhandle for media specific values
	 */
	libewf_internal_handle_media_t *media;

	/* A specific subhandle for read specific values
	 */
	libewf_internal_handle_read_t *read;

	/* A specific subhandle for write specific values
	 */
	libewf_internal_handle_write_t *write;

	/* The list of segment files
	 */
	LIBEWF_SEGMENT_TABLE *segment_table;

	/* The list of offsets within the segment files within the table sections
	 */
	LIBEWF_OFFSET_TABLE *offset_table;

	/* The list of offsets within the segment files within the table2 sections
	 */
	LIBEWF_OFFSET_TABLE *secondary_offset_table;

	/* A simple cache is implemented here to avoid having to read and decompress the
	 * same chunk while reading the data.
	 */
	LIBEWF_CHUNK_CACHE *chunk_cache;

	/* The stored header
	 */
	EWF_HEADER *header;

	/* The size of the stored header
	 */
	size_t header_size;

	/* The stored header2
	 */
	EWF_HEADER2 *header2;

	/* The size of the stored header2
	 */
	size_t header2_size;

	/* The stored xheader
	 */
	EWF_HEADER *xheader;

	/* The size of the stored xheader
	 */
	size_t xheader_size;

	/* The stored xhash
	 */
	EWF_HEADER *xhash;

	/* The size of the stored xhash
	 */
	size_t xhash_size;

	/* The header values
	 */
	LIBEWF_HEADER_VALUES *header_values;

	/* The hash values
	 */
	LIBEWF_HASH_VALUES *hash_values;

	/* The MD5 digest context
	 */
	LIBEWF_MD5_CONTEXT md5_context;

	/* The stored MD5 hash of the data
	 */
	EWF_DIGEST_HASH *stored_md5_hash;

	/* The calculated MD5 hash of the data
	 */
	EWF_DIGEST_HASH *calculated_md5_hash;

	/* The sectors with acquiry read errors
	 */
	LIBEWF_ERROR_SECTOR *acquiry_error_sectors;

	/* The amount of the acquiry read error sectors
	 */
	uint32_t acquiry_amount_of_errors;

	/* The current chunk
	 */
	uint32_t current_chunk;

	/* The current chunk offset
	 */
	uint32_t current_chunk_offset;

	/* Value to indicate if a pair of bytes should be swapped
	 * this allows to convert little endian into big endian data and vice versa
	 * this is only applicable to the actual media data within the EWF file
	 */
	uint8_t swap_byte_pairs;

	/* value to indicate the compression level used
	 */
	int8_t compression_level;

	/* value to indicate how much header sections were found
	 */
	uint8_t amount_of_header_sections;

	/* value to indicate which file format is used
	 */
	uint8_t format;

	/* value to indicate which ewf format is used
	 */
	uint8_t ewf_format;

	/* value to indicate if the index has been build
	 */
	uint8_t index_build;

	/* value to indicate the level of error tollerance
	 */
	uint8_t error_tollerance;

	/* The GUID of the acquiry system
	 */
	uint8_t guid[ 16 ];
};

/* Additional subhandle for media specific parameters
 */
struct libewf_internal_handle_media
{
	/* The media size
	 */
	uint64_t media_size;

	/* The size of an individual chunk
	 */
	uint32_t chunk_size;

	/* The amount of sectors per chunk
	 */
	uint32_t sectors_per_chunk;

	/* The amount of bytes per sector
	 */
	uint32_t bytes_per_sector;

        /* The amount of chunks
         */
        uint32_t amount_of_chunks;

        /* The amount of sectors
         */
        uint32_t amount_of_sectors;

        /* The amount of sectors to use as error granularity
         */
        uint32_t error_granularity;

	/* The media type
	 */