[ CCode ( array_length = false , array_null_terminated = true ) ]
[ Version ( since = "1.33.39" ) ]
public TSKDirent[] filesystem_walk (string device, Cancellable? cancellable = null) throws Error
walk through the filesystem content
Walk through the internal structures of a disk partition (eg. /dev/sda1) in order to return a list of all the files and directories stored within.
It is not necessary to mount the disk partition to run this command.
All entries in the filesystem are returned. This function can list deleted or unaccessible files. The entries are *not* sorted.
The tsk_dirent structure contains the following fields.
tsk_inode Filesystem reference number of the node. It might be @0 if the node has been deleted.
tsk_type Basic file type information. See below for a detailed list of values.
tsk_size File size in bytes. It might be @-1 if the node has been deleted.
tsk_name The file path relative to its directory.
tsk_flags Bitfield containing extra information regarding the entry. It contains the logical OR of the following values:
0x0001 If set to @1, the file is allocated and visible within the filesystem. Otherwise, the file has been deleted. Under certain
circumstances, the function download_inode can be used to recover deleted files.
0x0002 Filesystem such as NTFS and Ext2 or greater, separate the file name from the metadata structure. The bit is set to @1 when the file name is in an unallocated state and the metadata structure is in an allocated one. This generally implies the metadata has been reallocated to a new file. Therefore, information such as file type, file size, timestamps, number of links and symlink target might not correspond with the ones of the original deleted entry.
0x0004 The bit is set to @1 when the file is compressed using filesystem native compression support (NTFS). The API is not able to detect application level compression.
tsk_atime_sec tsk_atime_nsec tsk_mtime_sec tsk_mtime_nsec tsk_ctime_sec
tsk_ctime_nsec tsk_crtime_sec tsk_crtime_nsec Respectively, access, modification, last status
change and creation time in Unix format in seconds and nanoseconds.
tsk_nlink Number of file names pointing to this entry.
tsk_link If the entry is a symbolic link, this field will contain the path to the target file.
The tsk_type field will contain one of the following characters:
'b' Block special
'c' Char special
'd' Directory
'f' FIFO (named pipe)
'l' Symbolic link
'r' Regular file
's' Socket
'h' Shadow inode (Solaris)
'w' Whiteout inode (BSD)
'u' Unknown file type
This function depends on the feature "libtsk". See also feature_available .
| this |
A GuestfsSession object |
| cancellable |
A GCancellable object |
|
an array of TSKDirent objects, or NULL on error |