libewf_definitions.h.in 11.5 KB
Newer Older
1 2 3
/*
 * The internal definitions
 *
4
 * Copyright (C) 2006-2017, Joachim Metz <joachim.metz@gmail.com>
5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
 *
 * Refer to AUTHORS for acknowledgements.
 *
 * This software is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this software.  If not, see <http://www.gnu.org/licenses/>.
 */

#if !defined( _LIBEWF_INTERNAL_DEFINITIONS_H )
#define _LIBEWF_INTERNAL_DEFINITIONS_H

#include <common.h>
26
#include <byte_stream.h>
27

28
#include "libewf_libfdata.h"
29 30 31 32 33 34 35

/* Define HAVE_LOCAL_LIBEWF for local use of libewf
 */
#if !defined( HAVE_LOCAL_LIBEWF )
#include <libewf/definitions.h>

#else
36
#define LIBEWF_VERSION						@VERSION@
37

38
/* The version string
39
 */
40
#define LIBEWF_VERSION_STRING					"@VERSION@"
41

42
/* The access flags definitions
43 44 45 46 47 48
 * bit 1	set to 1 for read access
 * bit 2	set to 1 for write access
 * bit 3-4	not used
 * bit 5        set to 1 to resume write
 * bit 6-8	not used
 */
49 50
enum LIBEWF_ACCESS_FLAGS
{
51 52
	LIBEWF_ACCESS_FLAG_READ					= 0x01,
	LIBEWF_ACCESS_FLAG_WRITE				= 0x02,
53

54
	LIBEWF_ACCESS_FLAG_RESUME				= 0x10
55
};
56

57
/* The file access macros
58
 */
59 60 61
#define LIBEWF_OPEN_READ					( LIBEWF_ACCESS_FLAG_READ )
#define LIBEWF_OPEN_WRITE					( LIBEWF_ACCESS_FLAG_WRITE )
#define LIBEWF_OPEN_WRITE_RESUME				( LIBEWF_ACCESS_FLAG_WRITE | LIBEWF_ACCESS_FLAG_RESUME )
62 63 64 65 66

/* The file formats
 */
enum LIBEWF_FORMAT
{
67 68 69 70 71 72 73
	LIBEWF_FORMAT_UNKNOWN					= 0x00,
	LIBEWF_FORMAT_ENCASE1					= 0x01,
	LIBEWF_FORMAT_ENCASE2					= 0x02,
	LIBEWF_FORMAT_ENCASE3					= 0x03,
	LIBEWF_FORMAT_ENCASE4					= 0x04,
	LIBEWF_FORMAT_ENCASE5					= 0x05,
	LIBEWF_FORMAT_ENCASE6					= 0x06,
74 75
	LIBEWF_FORMAT_ENCASE7					= 0x07,

76
	LIBEWF_FORMAT_SMART					= 0x0e,
77 78 79 80 81 82
	LIBEWF_FORMAT_FTK_IMAGER				= 0x0f,

	LIBEWF_FORMAT_LOGICAL_ENCASE5				= 0x10,
	LIBEWF_FORMAT_LOGICAL_ENCASE6				= 0x11,
	LIBEWF_FORMAT_LOGICAL_ENCASE7				= 0x12,

83 84
	LIBEWF_FORMAT_LINEN5					= 0x25,
	LIBEWF_FORMAT_LINEN6					= 0x26,
85
	LIBEWF_FORMAT_LINEN7					= 0x27,
86

87 88 89 90
	LIBEWF_FORMAT_V2_ENCASE7				= 0x37,

	LIBEWF_FORMAT_V2_LOGICAL_ENCASE7			= 0x47,

91 92
	/* The format as specified by Andrew Rosen
	 */
93
	LIBEWF_FORMAT_EWF					= 0x70,
94 95 96

	/* Libewf eXtended EWF format
	 */
97
	LIBEWF_FORMAT_EWFX					= 0x71
98 99 100 101
};

/* The default segment file size
 */
102
#define LIBEWF_DEFAULT_SEGMENT_FILE_SIZE			( 1500 * 1024 * 1024 )
103

104 105 106 107 108 109 110 111 112
/* The compression methods definitions
 */
enum LIBEWF_COMPRESSION_METHODS
{
	LIBEWF_COMPRESSION_METHOD_NONE				= 0,
	LIBEWF_COMPRESSION_METHOD_DEFLATE			= 1,
	LIBEWF_COMPRESSION_METHOD_BZIP2				= 2,
};

113 114 115 116
/* The compression level definitions
 */
enum LIBEWF_COMPRESSION_LEVELS
{
117
/* TODO rename to compression level */
118
	LIBEWF_COMPRESSION_DEFAULT                              = -1,
119 120 121
	LIBEWF_COMPRESSION_NONE					= 0,
	LIBEWF_COMPRESSION_FAST					= 1,
	LIBEWF_COMPRESSION_BEST					= 2,
122 123
};

124
/* The compression flags
125
 * bit 1	set to 1 for empty block compression
126 127
 *              detects empty blocks and stored them compressed, the compression
 *              is only done once
128 129
 * bit 2	set to 1 for pattern fill compression
 *              this implies empty block compression using the pattern fill method
130
 *              used internally only
131
 * bit 3-8	not used
132
 */
133 134 135
enum LIBEWF_COMPRESSION_FLAGS
{
	LIBEWF_COMPRESS_FLAG_USE_EMPTY_BLOCK_COMPRESSION	= (uint8_t) 0x01,
136
	LIBEWF_COMPRESS_FLAG_USE_PATTERN_FILL_COMPRESSION	= (uint8_t) 0x10,
137 138
};

139 140 141 142
/* The media type definitions
 */
enum LIBEWF_MEDIA_TYPES
{
143 144 145 146 147
	LIBEWF_MEDIA_TYPE_REMOVABLE				= 0x00,
	LIBEWF_MEDIA_TYPE_FIXED					= 0x01,
	LIBEWF_MEDIA_TYPE_OPTICAL				= 0x03,
	LIBEWF_MEDIA_TYPE_SINGLE_FILES				= 0x0e,
	LIBEWF_MEDIA_TYPE_MEMORY				= 0x10
148 149 150 151 152 153
};

/* The media flags definitions
 */
enum LIBEWF_MEDIA_FLAGS
{
154 155 156
	LIBEWF_MEDIA_FLAG_PHYSICAL				= 0x02,
	LIBEWF_MEDIA_FLAG_FASTBLOC				= 0x04,
	LIBEWF_MEDIA_FLAG_TABLEAU				= 0x08
157 158 159 160 161 162
};

/* The date representation formats
 */
enum LIBEWF_DATE_FORMATS
{
163 164 165 166
	LIBEWF_DATE_FORMAT_DAYMONTH				= 0x01,
	LIBEWF_DATE_FORMAT_MONTHDAY				= 0x02,
	LIBEWF_DATE_FORMAT_ISO8601				= 0x03,
	LIBEWF_DATE_FORMAT_CTIME				= 0x04
167 168
};

169
/* The header value compression levels definitions
170
 */
171 172 173 174
#define LIBEWF_HEADER_VALUE_COMPRESSION_LEVEL_NONE		"n"
#define LIBEWF_HEADER_VALUE_COMPRESSION_LEVEL_FAST		"f"
#define LIBEWF_HEADER_VALUE_COMPRESSION_LEVEL_BEST		"b"

175 176 177 178
/* The segment file type definitions
 */
enum LIBEWF_SEGMENT_FILE_TYPES
{
179 180 181 182
	LIBEWF_SEGMENT_FILE_TYPE_UNDEFINED			= 0,
	LIBEWF_SEGMENT_FILE_TYPE_EWF1				= 1,
	LIBEWF_SEGMENT_FILE_TYPE_EWF1_SMART			= 2,
	LIBEWF_SEGMENT_FILE_TYPE_EWF1_LOGICAL			= 3,
183 184
	LIBEWF_SEGMENT_FILE_TYPE_EWF2				= 4,
	LIBEWF_SEGMENT_FILE_TYPE_EWF2_LOGICAL			= 5
185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214
};

/* The chunk IO (read/write) flags
 */
enum LIBEWF_CHUNK_IO_FLAGS
{
	/* Indicates the checksum should be read or written
	 */
	LIBEWF_CHUNK_IO_FLAG_CHECKSUM_SET			= 0x01,

	/* Indicates the padding should be read or written
	 */
	LIBEWF_CHUNK_IO_FLAG_PADDING_SET			= 0x02,

	/* Indicates the chunk is packed
	 */
	LIBEWF_CHUNK_IO_FLAG_IS_PACKED				= 0x04,
};

/* The chunk data item flags definitions
 */
enum LIBEWF_CHUNK_DATA_ITEM_FLAGS
{
        /* The data is not managed by the chunk data item
	 */
	LIBEWF_CHUNK_DATA_ITEM_FLAG_NON_MANAGED_DATA		= 0x00,

        /* The data is managed by the chunk data item
	 */
	LIBEWF_CHUNK_DATA_ITEM_FLAG_MANAGED_DATA		= 0x01
215 216
};

217 218 219 220
/* The (single) file entry types
 */
enum LIBEWF_FILE_ENTRY_TYPES
{
221 222
	LIBEWF_FILE_ENTRY_TYPE_DIRECTORY			= (uint8_t) 'd',
	LIBEWF_FILE_ENTRY_TYPE_FILE				= (uint8_t) 'f'
223 224
};

225
#define LIBEWF_FILE_ENTRY_TYPE_FOLDER				LIBEWF_FILE_ENTRY_TYPE_DIRECTORY
226

227 228 229 230
/* The (single) file entry flags
 */
enum LIBEWF_FILE_ENTRY_FLAGS
{
231 232 233
	LIBEWF_FILE_ENTRY_FLAG_ARCHIVE				= 0x00000008UL,

	LIBEWF_FILE_ENTRY_FLAG_SPARSE_DATA			= 0x04000000UL,
234 235
};

236 237 238 239
/* The (single) file entry name separator
 */
#define LIBEWF_SEPARATOR					'\\'

240 241
#endif /* !defined( HAVE_LOCAL_LIBEWF ) */

242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280
/* The section type definitions
 */
enum LIBEWF_SECTION_TYPES
{
	LIBEWF_SECTION_TYPE_DEVICE_INFORMATION			= 0x00000001UL,
	LIBEWF_SECTION_TYPE_CASE_DATA				= 0x00000002UL,
	LIBEWF_SECTION_TYPE_SECTOR_DATA				= 0x00000003UL,
	LIBEWF_SECTION_TYPE_SECTOR_TABLE			= 0x00000004UL,
	LIBEWF_SECTION_TYPE_ERROR_TABLE				= 0x00000005UL,
	LIBEWF_SECTION_TYPE_SESSION_TABLE			= 0x00000006UL,
	LIBEWF_SECTION_TYPE_INCREMENT_DATA			= 0x00000007UL,
	LIBEWF_SECTION_TYPE_MD5_HASH				= 0x00000008UL,
	LIBEWF_SECTION_TYPE_SHA1_HASH				= 0x00000009UL,
	LIBEWF_SECTION_TYPE_RESTART_DATA			= 0x0000000aUL,
	LIBEWF_SECTION_TYPE_ENCRYPTION_KEYS			= 0x0000000bUL,
	LIBEWF_SECTION_TYPE_MEMORY_EXTENTS_TABLE		= 0x0000000cUL,
	LIBEWF_SECTION_TYPE_NEXT				= 0x0000000dUL,
	LIBEWF_SECTION_TYPE_FINAL_INFORMATION			= 0x0000000eUL,
	LIBEWF_SECTION_TYPE_DONE				= 0x0000000fUL,
	LIBEWF_SECTION_TYPE_ANALYTICAL_DATA			= 0x00000010UL,

	LIBEWF_SECTION_TYPE_SINGLE_FILES_DATA			= 0x00000020UL
};

/* The section data flags definitions
 */
enum LIBEWF_SECTION_DATA_FLAGS
{
	LIBEWF_SECTION_DATA_FLAGS_HAS_INTEGRITY_HASH		= 0x00000001UL,
	LIBEWF_SECTION_DATA_FLAGS_IS_ENCRYPTED			= 0x00000002UL,
};

/* The session (table) entry flags definitions
 */
enum LIBEWF_SESSION_ENTRY_FLAGS
{
	LIBEWF_SESSION_ENTRY_FLAGS_IS_AUDIO_TRACK		= 0x00000001UL,
};

281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299
/* The item flags definitions
 */
enum LIBEWF_ITEM_FLAGS
{
        /* The file entry tree node is not managed by the item
	 */
	LIBEWF_ITEM_FLAG_NON_MANAGED_FILE_ENTRY_TREE_NODE	= 0x00,

        /* The file entry tree node is managed by the item
	 */
	LIBEWF_ITEM_FLAG_MANAGED_FILE_ENTRY_TREE_NODE		= 0x01
};

/* The segment table flags definitions
 */
enum LIBEWF_SEGMENT_TABLE_FLAGS
{
	/* The segment table is corrupted
	 */
300
	LIBEWF_SEGMENT_TABLE_FLAG_IS_CORRUPTED			= 0x04
301 302 303 304 305 306
};

/* The segment file flags definitions
 */
enum LIBEWF_SEGMENT_FILE_FLAGS
{
307 308 309 310 311 312 313 314
	/* The segment file is the last in the set
	 */
	LIBEWF_SEGMENT_FILE_FLAG_IS_LAST			= 0x01,

	/* The segment file is encrypted
	 */
	LIBEWF_SEGMENT_FILE_FLAG_IS_ENCRYPTED			= 0x02,

315 316
	/* The segment file is corrupted
	 */
317
	LIBEWF_SEGMENT_FILE_FLAG_IS_CORRUPTED			= 0x04,
318 319 320

	/* The segment file is open for writing
	 */
321
	LIBEWF_SEGMENT_FILE_FLAG_WRITE_OPEN			= 0x80
322 323
};

324 325 326 327 328 329 330
/* The chunk data flag definitions
 */
enum LIBEWF_CHUNK_DATA_FLAGS
{
	/* The chunk data is compressed
	 */
	LIBEWF_CHUNK_DATA_FLAG_IS_COMPRESSED			= 0x00000001UL,
331

332 333 334
	/* The chunk data has a checksum
	 */
	LIBEWF_CHUNK_DATA_FLAG_HAS_CHECKSUM			= 0x00000002UL,
335

336 337 338 339 340 341
	/* The chunk data uses pattern fill
	 */
	LIBEWF_CHUNK_DATA_FLAG_USES_PATTERN_FILL		= 0x00000004UL
};

/* The chunk data range is sparse
342
 */
343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359
#define LIBEWF_RANGE_FLAG_IS_SPARSE				LIBFDATA_RANGE_FLAG_IS_SPARSE

/* The chunk data range is compressed
 */
#define LIBEWF_RANGE_FLAG_IS_COMPRESSED				LIBFDATA_RANGE_FLAG_IS_COMPRESSED

/* The chunk data range included the checksum
 */
#define LIBEWF_RANGE_FLAG_HAS_CHECKSUM				LIBFDATA_RANGE_FLAG_USER_DEFINED_1

/* The chunk data range uses a pattern fill
 */
#define LIBEWF_RANGE_FLAG_USES_PATTERN_FILL			LIBFDATA_RANGE_FLAG_USER_DEFINED_2

/* The chunk data range refers to a packed (unprocessed) chunk
 */
#define LIBEWF_RANGE_FLAG_IS_PACKED				LIBFDATA_RANGE_FLAG_USER_DEFINED_3
360 361 362

/* The chunk data range is tainted (possibly corrupted)
 */
363
#define LIBEWF_RANGE_FLAG_IS_TAINTED				LIBFDATA_RANGE_FLAG_USER_DEFINED_4
364 365 366

/* The chunk data range is corrupted
 */
367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399
#define LIBEWF_RANGE_FLAG_IS_CORRUPTED				LIBFDATA_RANGE_FLAG_USER_DEFINED_5

/* The chunk data range is encrypted
 */
#define LIBEWF_RANGE_FLAG_IS_ENCRYPTED				LIBFDATA_RANGE_FLAG_USER_DEFINED_6

/* Chunk data pack flag definitions
 */
enum LIBEWF_PACK_FLAGS
{
	/* Force compression when packing (processing) the chunk data
	 * used for EWF-S01, empty-block and pattern fill compression
	 */
	LIBEWF_PACK_FLAG_FORCE_COMPRESSION			= 0x01,

	/* Use the empty-block compression
	 * For EWF2, if set, the fill pattern compression is preferred over the empty-block compression
	 */
	LIBEWF_PACK_FLAG_USE_EMPTY_BLOCK_COMPRESSION		= 0x02,

	/* Use the pattern fill compression
	 */
	LIBEWF_PACK_FLAG_USE_PATTERN_FILL_COMPRESSION		= 0x04,

	/* Calculate and add a checksum when packing (processing) the chunk data
	 */
	LIBEWF_PACK_FLAG_CALCULATE_CHECKSUM			= 0x08,

	/* Adds 16-byte alignment padding when packing (processing) the chunk data
	 */
	LIBEWF_PACK_FLAG_ADD_ALIGNMENT_PADDING			= 0x10
};

400
/* The minimum chunk size is 32 KiB or ( 64 sectors x 512 bytes )
401 402 403 404 405 406 407 408 409 410 411 412 413 414 415
 */
#define LIBEWF_MINIMUM_CHUNK_SIZE				32768

/* The maximum number of table entries for the EWF format
 */
#define LIBEWF_MAXIMUM_TABLE_ENTRIES_EWF			16375

/* The maximum number of table entries for the EWF format as of EnCase 6
 * For a 32k chunk this would be approximately 32 KiB x 16 KiB = 2 GiB
 */
#define LIBEWF_MAXIMUM_TABLE_ENTRIES_ENCASE6			65534

/* The maximum number of table entries allowed by the library (2 MiB / 4)
 * For a 32k chunk this would be 32 KiB x (2 MiB / 4) = 16 GiB
 */
416
#define LIBEWF_MAXIMUM_TABLE_ENTRIES				( ( 2 * 1024 * 1024 ) / 4 )
417 418

#if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x0560 )
419
#define LIBEWF_2_TIB						0x20000000000UL
420
#else
421
#define LIBEWF_2_TIB						0x20000000000ULL
422 423
#endif

424 425 426 427 428
#define LIBEWF_MAXIMUM_CACHE_ENTRIES_SEGMENT_FILES		64
#define LIBEWF_MAXIMUM_CACHE_ENTRIES_CHUNK_GROUPS		16
#define LIBEWF_MAXIMUM_CACHE_ENTRIES_CHUNKS			8
#define LIBEWF_MAXIMUM_CACHE_ENTRIES_SECTIONS			4

429 430 431 432 433 434 435 436
enum LIBEWF_HASH_VALUES_INDEXES
{
	/* Value to indicate the number of hash values
	 */
	LIBEWF_HASH_VALUES_DEFAULT_NUMBER
};

#endif /* !defined( _LIBEWF_INTERNAL_DEFINITIONS_H ) */
437