Page MenuHomePhabricator
Files F7689013

ewf_data.h
No OneTemporary
Actions

Size
3 KB
Referenced Files
None
Subscribers
None

ewf_data.h
View Options

/*
* EWF data section
*
* Copyright (c) 2006-2009, Joachim Metz <forensics@hoffmannbv.nl>,
* Hoffmann Investigations. All rights reserved.
*
* Refer to AUTHORS for acknowledgements.
*
* This software is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This software is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with this software. If not, see <http://www.gnu.org/licenses/>.
*/
#if !defined( _EWF_DATA_H )
#define _EWF_DATA_H
#include <common.h>
#include <types.h>
#if defined( __cplusplus )
extern "C" {
#endif
typedef struct ewf_data ewf_data_t;
struct ewf_data
{
/* The media type
* consists of 1 byte
* 0x00 => remobable disk
* 0x01 => fixed disk
* 0x03 => optical disk
* 0x0e => LVF
* 0x10 => memory (RAM/process)
*/
uint8_t media_type;
/* Unknown
* consists of 3 bytes
* contains 0x00
*/
uint8_t unknown1[ 3 ];
/* The amount of chunks
* consists of 4 bytes (32 bits)
*/
uint8_t amount_of_chunks[ 4 ];
/* The amount of sectors per chunks
* consists of 4 bytes (32 bits)
*/
uint8_t sectors_per_chunk[ 4 ];
/* The amount of bytes per chunks
* consists of 4 bytes (32 bits)
*/
uint8_t bytes_per_sector[ 4 ];
/* The amount of sectors
* consists of 8 bytes (64 bits)
*/
uint8_t amount_of_sectors[ 8 ];
/* C:H:S values
* consists of 12 bytes, 4 bytes per value
*/
uint8_t chs_cylinders[ 4 ];
uint8_t chs_heads[ 4 ];
uint8_t chs_sectors[ 4 ];
/* Media flags
* consists of 1 byte
* 0x01 => image (1) or device (0) ?
* 0x02 => physical (1)
* 0x04 => Fastblock Tableau write blocker (1)
* 0x08 => Tableau write blocker (1)
*/
uint8_t media_flags;
/* Unknown
* consists of 3 bytes
* contains 0x00
*/
uint8_t unknown2[ 3 ];
/* PALM volume start sector
* consists of 4 bytes
*/
uint8_t palm_volume_start_sector[ 4 ];
/* Unknown
* consists of 4 bytes
* contains 0x00
*/
uint8_t unknown3[ 4 ];
/* SMART logs start sector
* consists of 4 bytes
* contains 0x00
*/
uint8_t smart_logs_start_sector[ 4 ];
/* Compression level (Encase 5 or later)
* consists of 1 byte
* 0x00 => no compression,
* 0x01 => fast/good compression
* 0x02 => best compression
*/
uint8_t compression_level;
/* Unknown
* consists of 3 bytes
* contains 0x00
*/
uint8_t unknown4[ 3 ];
/* The amount sectors to use for error granularity
* consists of 4 bytes (32 bits)
*/
uint8_t error_granularity[ 4 ];
/* Unknown
* consists of 4 bytes
* contains 0x00
*/
uint8_t unknown5[ 4 ];
/* The GUID (Encase 5 or later)
* consists of 16 bytes
*/
uint8_t guid[ 16 ];
/* Unknown
* consists of 963 bytes
* contains 0x00
*/
uint8_t unknown6[ 963 ];
/* Reserved (signature)
* consists of 5 bytes
*/
uint8_t signature[ 5 ];
/* The section crc of all (previous) volume data
* consists of 4 bytes (32 bits)
* starts with offset 76
*/
uint8_t crc[ 4 ];
};
#if defined( __cplusplus )
}
#endif
#endif

File Metadata

Mime Type
text/x-c
Expires
Fri, Oct 31, 11:14 AM (1 d, 11 h)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1347926
Default Alt Text
ewf_data.h (3 KB)

Event Timeline