The tsk_dirent struct contains the information gathered via TSK APIs.
The struct contains the following fields:
* tsk_inode: inode of a file
* tsk_type: type of file such as for dirwalk command
* tsk_size: file size in bytes
* tsk_name: path relative to its disk partition
* tsk_flags: bitfield containing extra information
Signed-off-by: Matteo Cafasso <noxdafox(a)gmail.com>
---
generator/structs.ml | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/generator/structs.ml b/generator/structs.ml
index 6017ba6..4abb576 100644
--- a/generator/structs.ml
+++ b/generator/structs.ml
@@ -442,8 +442,21 @@ let structs = [
"im_device", FString;
"im_volume", FString;
];
s_camel_name = "InternalMountable";
};
+
+ (* The Sleuth Kit directory entry information. *)
+ { defaults with
+ s_name = "tsk_dirent";
+ s_cols = [
+ "tsk_inode", FUInt64;
+ "tsk_type", FChar;
+ "tsk_size", FInt64;
+ "tsk_name", FString;
+ "tsk_flags", FUInt32;
+ ];
+ s_camel_name = "TSKDirent" };
+
] (* end of structs *)
let lookup_struct name =
--
2.8.0.rc3