Difference between revisions of "Truxton media get size"
Jump to navigation
Jump to search
(Created page with "This retrieves the number of bytes in the original media. This corresponds to the <code>Size</code> column of the <code>Media</code> table. The number of bytes in the media is...") |
|||
| (2 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
This retrieves the number of bytes in the original media. | This retrieves the number of bytes in the original media. | ||
| − | This corresponds to the <code>Size</code> column of the <code>Media</code> table. | + | This corresponds to the <code>[Size]</code> column of the <code><nowiki>[</nowiki>[[Media Table|Media]]<nowiki>]</nowiki></code> table. |
The number of bytes in the media is the best guess of the number of bytes that will be processed during exploitation. | The number of bytes in the media is the best guess of the number of bytes that will be processed during exploitation. | ||
| − | If the media being loaded is an E01 disk image, the uncompressed size is recorded. | + | If the media being loaded is an [https://en.wikipedia.org/wiki/EnCase#Expert_Witness_File_Format E01] disk image, the uncompressed size is recorded. |
=Syntax= | =Syntax= | ||
| − | < | + | <source lang="C"> |
uint64_t truxton_media_get_size( uint64_t media_handle ); | uint64_t truxton_media_get_size( uint64_t media_handle ); | ||
| − | </ | + | </source> |
=Parameters= | =Parameters= | ||
| Line 17: | Line 17: | ||
=Sample= | =Sample= | ||
| − | < | + | <source lang="C" highlight="3"> |
| − | void is_tiny(uint64_t media) | + | void is_tiny( uint64_t media ) |
{ | { | ||
uint64_t size = truxton_media_get_size( media ); | uint64_t size = truxton_media_get_size( media ); | ||
| Line 30: | Line 30: | ||
printf( "The media is not tiny\n" ); | printf( "The media is not tiny\n" ); | ||
} | } | ||
| − | }</ | + | }</source> |
Latest revision as of 07:40, 3 February 2024
This retrieves the number of bytes in the original media.
This corresponds to the [Size] column of the [Media] table.
The number of bytes in the media is the best guess of the number of bytes that will be processed during exploitation.
If the media being loaded is an E01 disk image, the uncompressed size is recorded.
Syntax
uint64_t truxton_media_get_size( uint64_t media_handle );
Parameters
media_handle
The handle created by the truxton_media_open_id or truxton_media_create call.
Return value
The number of bytes in the media.
Sample
void is_tiny( uint64_t media )
{
uint64_t size = truxton_media_get_size( media );
if ( size < (100 * 1024 * 1024) )
{
printf( "This tiny media is smaller than 100MB\n" );
}
else
{
printf( "The media is not tiny\n" );
}
}
