ewf_data.h

sleuthit-2.09 一个磁盘的工具集

/*
 * EWF data section
 *
 * Copyright (c) 2006-2007, Joachim Metz <[e-mail]>,
 * Hoffmann Investigations. All rights reserved.
 *
 * Refer to AUTHORS for acknowledgements.
 *
 * Redistribution and use in source and binary forms, with or without modification,
 * are permitted provided that the following conditions are met:
 *
 * - Redistributions of source code must retain the above copyright notice,
 *   this list of conditions and the following disclaimer.
 * - Redistributions in binary form must reproduce the above copyright notice,
 *   this list of conditions and the following disclaimer in the documentation
 *   and/or other materials provided with the distribution.
 * - Neither the name of the creator, related organisations, nor the names of
 *   its contributors may be used to endorse or promote products derived from
 *   this software without specific prior written permission.
 * - All advertising materials mentioning features or use of this software
 *   must acknowledge the contribution by people stated in the acknowledgements.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER, COMPANY AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#ifndef _EWF_DATA_H
#define _EWF_DATA_H

#include "libewf_includes.h"

#ifdef __cplusplus
extern "C" {
#endif

#define EWF_DATA ewf_data_t
#define EWF_DATA_SIZE sizeof( EWF_DATA )

typedef struct ewf_data ewf_data_t;

struct ewf_data
{
	/* The media type
	 * consists of 1 byte
	 * EnCase uses 0x00 for remobable media
	 *             0x01 for fixed media
	 *             0x0e for LVF
	 * FTK Imager always uses 0x01
	 */
	uint8_t media_type;

	/* Unknown
	 * consists of 3 bytes
	 * contains 0x00
	 */
	uint8_t unknown1[ 3 ];

	/* The amount of chunks
	 * consists of 4 bytes (32 bits)
	 */
	uint8_t amount_of_chunks[ 4 ];

	/* The amount of sectors per chunks
	 * consists of 4 bytes (32 bits)
	 * value should be 64
	 */
	uint8_t sectors_per_chunk[ 4 ];

	/* The amount of bytes per chunks
	 * consists of 4 bytes (32 bits)
	 * value should be 512
	 */
	uint8_t bytes_per_sector[ 4 ];

	/* The amount of sectors
	 * consists of 4 bytes (32 bits)
	 */
	uint8_t amount_of_sectors[ 4 ];

	/* Unknown
	 * consists of 16 bytes
	 * contains 0x00
	 */
	uint8_t unknown2[ 16 ];

	/* Media flags
	 * consists of 1 byte
	 * byte 2 is physical (1) or non physical (0)
	 */
	uint8_t media_flags;

	/* Unknown
	 * consists of 3 bytes
	 * contains 0x00
	 */
	uint8_t unknown3[ 3 ];

	/* Unknown
	 * consists of 12 bytes
	 * contains 0x00
	 */
	uint8_t unknown4[ 12 ];

	/* Compression level (Encase 5 only)
	 * consists of 1 byte
	 * value is 0x00 for no compression, 0x01 for good compression, 0x02 for best compression
	 */
	uint8_t compression_level;

	/* Unknown
	 * consists of 3 bytes
	 * contains 0x00
	 */
	uint8_t unknown5[ 3 ];

	/* The amount sectors to use for error granularity
	 * consists of 4 bytes (32 bits)
	 */
	uint8_t error_granularity[ 4 ];

	/* Unknown
	 * consists of 4 bytes
	 * contains 0x00
	 */
	uint8_t unknown6[ 4 ];

	/* The GUID (Encase 5 only)
	 * consists of 16 bytes
	 */
	uint8_t guid[ 16 ];

	/* Unknown
	 * consists of 963 bytes
	 * contains 0x00
	 */
	uint8_t unknown7[ 963 ];

	/* Reserved (signature)
	 * consists of 5 bytes
	 */
	uint8_t signature[ 5 ];

	/* The section crc of all (previous) data section data
	 * consits of 4 bytes (32 bits)
	 * starts with offset 76
	 */
	uint8_t crc[ 4 ];
};

ssize_t ewf_data_read( EWF_DATA *data, int file_descriptor );
ssize_t ewf_data_write( EWF_DATA *data, int file_descriptor );

#ifdef __cplusplus
}
#endif

#endif