tsk_hfs.h

linux下开发的针对所有磁盘的数据恢复的源码

typedef struct {
    uint8_t signature[2];       /* "H+" for HFS+, "HX" for HFSX */
    uint8_t version[2];         /* 4 for HFS+, 5 for HFSX */
    uint8_t attr[4];            /* volume attributes */
    uint8_t last_mnt_ver[4];    /* last mounted version */
    uint8_t jinfo_blk[4];       /* journal info block */
    uint8_t c_date[4];          /* volume creation date */
    uint8_t m_date[4];          /* volume last modified date */
    uint8_t bkup_date[4];       /* volume last backup date */
    uint8_t chk_date[4];        /* date of last consistency check */
    uint8_t file_cnt[4];        /* number of files on volume */
    uint8_t fldr_cnt[4];        /* number of folders on volume */
    uint8_t blk_sz[4];          /* allocation block size */
    uint8_t blk_cnt[4];         /* number of blocks on disk */
    uint8_t free_blks[4];       /* unused block count */
    uint8_t next_alloc[4];      /* start of next allocation search */
    uint8_t rsrc_clmp_sz[4];    /* default clump size for resource forks */
    uint8_t data_clmp_sz[4];    /* default clump size for data forks */
    uint8_t next_cat_id[4];     /* next catalog id */
    uint8_t write_cnt[4];       /* write count */
    uint8_t enc_bmp[8];         /* encoding bitmap */
    uint8_t finder_info[32];
    hfs_fork alloc_file;        /* location and size of allocation file */
    hfs_fork ext_file;          /* location and size of extents file */
    hfs_fork cat_file;          /* location and size of catalog file */
    hfs_fork attr_file;         /* location and size of attributes file */
    hfs_fork start_file;        /* location and size of startup file */
} hfs_sb;

typedef struct {
    uint8_t key_len[2];
    uint8_t parent_cnid[4];
    hfs_uni_str name;
} hfs_cat_key;

typedef struct {
    uint8_t key_len[2];
    uint8_t fork_type[1];
    uint8_t pad[1];
    uint8_t file_id[4];
    uint8_t start_block[4];
} hfs_ext_key;

typedef struct {
    uint32_t inum;              /* inode number */
    uint32_t parent;            /* parent directory number */
    uint32_t node;              /* btree leaf node */
    TSK_DADDR_T offs;           /* offset of beginning of inode */
} htsk_fs_inode_mode_struct;

typedef struct {
    uint8_t flink[4];           /* next node number */
    uint8_t blink[4];           /* previous node number */
    int8_t kind;                /* type of node */
    uint8_t height;             /* level in B-tree */
    uint8_t num_rec[2];         /* number of records this node */
    uint8_t res[2];             /* reserved */
} hfs_btree_node;

typedef struct {
    uint8_t depth[2];           /* current depth of btree */
    uint8_t root[4];            /* node number of root node */
    uint8_t leaf[4];            /* number of records in leaf nodes */
    uint8_t firstleaf[4];       /* number of first leaf node */
    uint8_t lastleaf[4];        /* number of last leaf node */
    uint8_t nodesize[2];        /* byte size of leaf node (512..32768) */
    uint8_t max_len[2];         /* max key length in an index or leaf node */
    uint8_t total[4];           /* number of nodes in btree (free or in use) */
    uint8_t free[4];            /* unused nodes in btree */
    uint8_t res[2];             /* reserved */
    uint8_t clmp_sz[4];         /* clump size */
    uint8_t bt_type;            /* btree type */
    uint8_t k_type;             /* key compare type */
    uint8_t attr[4];            /* attributes */
    uint8_t res2[64];           /* reserved */
} hfs_btree_header_record;

typedef struct {
    int8_t v[2];
    int8_t h[2];
} hfs_point;

#define HFS_FINDER_FLAG_NAME_LOCKED  0x1000
#define HFS_FINDER_FLAG_HAS_BUNDLE   0x2000
#define HFS_FINDER_FLAG_IS_INVISIBLE 0x4000
#define HFS_FINDER_FLAG_IS_ALIAS     0x8000

typedef struct {
    uint8_t file_type[4];       /* file type */
    uint8_t file_cr[4];         /* file creator */
    uint8_t flags[2];           /* finder flags */
    hfs_point loc;              /* location in the folder */
    uint8_t res[2];             /* reserved */
} hfs_fileinfo;

typedef struct {
    uint8_t res1[8];            /* reserved 1 */
    uint8_t extflags[2];        /* extended finder flags */
    uint8_t res2[2];            /* reserved 2 */
    uint8_t folderid[4];        /* putaway folder id */
} hfs_extendedfileinfo;

#define HFS_FILE_FLAG_LOCKED 0x0001     /* file is locked */
#define HFS_FILE_FLAG_ATTR   0x0004     /* file has extended attributes */
#define HFS_FILE_FLAG_ACL    0x0008     /* file has security data (ACLs) */

typedef struct {
    uint8_t rec_type[2];        /* record type */
    uint8_t flags[2];           /* flags - reserved */
    uint8_t valence[4];         /* valence - items in this folder */
    uint8_t cnid[4];            /* catalog node id */
    uint8_t ctime[4];           /* create date */
    uint8_t cmtime[4];          /* content mod date */
    uint8_t amtime[4];          /* attribute mod date */
    uint8_t atime[4];           /* access date */
    uint8_t bkup_time[4];       /* backup time */
    hfs_access_perm perm;       /* HFS permissions */
    hfs_fileinfo u_info;        /* user info */
    hfs_extendedfileinfo f_info;        /* finder info */
    uint8_t txt_enc[4];         /* text encoding */
    uint8_t res[4];             /* reserved */
} hfs_folder;

typedef struct {
    uint8_t rec_type[2];        /* record type */
    uint8_t flags[2];
    uint8_t res[4];             /* reserved */
    uint8_t cnid[4];            /* catalog node id */
    uint8_t ctime[4];           /* create date */
    uint8_t cmtime[4];          /* content modification date */
    uint8_t attr_mtime[4];      /* attribute mod date */
    uint8_t atime[4];           /* access date */
    uint8_t bkup_date[4];       /* backup date */
    hfs_access_perm perm;       /* permissions */
    hfs_fileinfo u_info;        /* user info */
    hfs_extendedfileinfo f_info;        /* finder info */
    uint8_t text_enc[4];        /* text encoding */
    uint8_t res2[4];            /* reserved 2 */
    hfs_fork data;              /* data fork */
    hfs_fork resource;          /* resource fork */
} hfs_file;

typedef union {
    hfs_folder folder;
    hfs_file file;
} hfs_file_folder;

typedef struct {
    uint8_t record_type[2];     /* == kHFSPlusFolderThreadRecord or kHFSPlusFileThreadRecord */
    uint8_t reserved[2];        /* reserved - initialized as zero */
    uint8_t parent_cnid[4];     /* parent ID for this catalog node */
    hfs_uni_str name;           /* name of this catalog node (variable length) */
} hfs_thread;

typedef struct {
    TSK_FS_INFO fs_info;        /* SUPER CLASS */
    hfs_sb *fs;                 /* cached superblock */
    hfs_ext_desc *cat_extents;  /* full extents of the Catalog file */
    uint8_t *block_map;         /* cached block allocation bitmap */
    uint32_t block_map_size;
    hfs_btree_header_record *hdr;       /* stored catalog btree header node */
    char is_case_sensitive;
    TSK_FS_ATTR *catalog_attr;

    TSK_FS_ATTR *extents_attr;
    hfs_btree_header_record extents_header;

} HFS_INFO;

typedef struct {
    hfs_file cat;               /* on-disk catalog record (either hfs_file or hfs_folder) */
    int flags;                  /* flags for on-disk record */
    TSK_INUM_T inum;            /* cnid */
    hfs_thread thread;          /* thread record */
} HFS_ENTRY;

/************** JOURNAL ******************/

/* HFS Journal Info Block */
typedef struct {
    uint8_t flags[4];
    uint8_t dev_sig[32];
    uint8_t offs[8];
    uint8_t size[8];
    uint8_t res[128];
} hfs_journ_sb;

/*
 * Prototypes
 */
extern uint8_t hfs_checked_read_random(TSK_FS_INFO *, char *, size_t,
    TSK_OFF_T);
extern uint8_t hfs_uni2ascii(TSK_FS_INFO *, uint8_t *, int, char *, int);
extern int hfs_unicode_compare(HFS_INFO *, hfs_uni_str *, hfs_uni_str *);

extern TSK_RETVAL_ENUM
hfs_dir_open_meta(TSK_FS_INFO *, TSK_FS_DIR **, TSK_INUM_T);

extern uint8_t hfs_jopen(TSK_FS_INFO *, TSK_INUM_T);
extern uint8_t hfs_jblk_walk(TSK_FS_INFO *, TSK_DADDR_T, TSK_DADDR_T, int,
    TSK_FS_JBLK_WALK_CB, void *);
extern uint8_t hfs_jentry_walk(TSK_FS_INFO *, int, TSK_FS_JENTRY_WALK_CB,
    void *);

extern TSK_OFF_T hfs_cat_find_node_offset(HFS_INFO *, uint32_t);
extern TSK_OFF_T hfs_get_bt_rec_off(HFS_INFO *, TSK_OFF_T, uint16_t,
    uint16_t);
extern TSK_OFF_T hfs_read_key(HFS_INFO *, hfs_btree_header_record *,
    TSK_OFF_T, char *, int, uint8_t);
extern int hfs_compare_catalog_keys(HFS_INFO *, hfs_cat_key *,
    hfs_cat_key *);
extern uint8_t hfs_read_thread_record(HFS_INFO *, TSK_DADDR_T,
    hfs_thread *);
extern uint32_t hfs_cat_next_record(HFS_INFO *, uint16_t *, uint16_t *,
    hfs_btree_node *, uint32_t *, TSK_OFF_T *, hfs_btree_header_record *);
extern uint8_t hfs_read_file_folder_record(HFS_INFO *, TSK_OFF_T,
    hfs_file_folder *);
extern uint8_t hfs_dinode_copy(HFS_INFO * hfs, HFS_ENTRY * entry,
    TSK_FS_META * fs_inode);
extern uint8_t hfs_catalog_lookup(HFS_INFO *, TSK_INUM_T, HFS_ENTRY *);

#endif