NAME¶

libscca.h — Library to access the Windows Prefetch File (PF) format

SYNOPSIS¶

#include <libscca.h>

Support functions
const char *
libscca_get_version(void);

int
libscca_get_access_flags_read(void);

int
libscca_get_codepage(int *codepage, libscca_error_t **error);

int
libscca_set_codepage(int codepage, libscca_error_t **error);

int
libscca_check_file_signature(const char *filename, libscca_error_t **error);

Available when compiled with wide character string support:
int
libscca_check_file_signature_wide(const wchar_t *filename, libscca_error_t **error);

Available when compiled with libbfio support:
int
libscca_check_file_signature_file_io_handle(libbfio_handle_t *file_io_handle, libscca_error_t **error);

Notify functions
void
libscca_notify_set_verbose(int verbose);

int
libscca_notify_set_stream(FILE *stream, libscca_error_t **error);

int
libscca_notify_stream_open(const char *filename, libscca_error_t **error);

int
libscca_notify_stream_close(libscca_error_t **error);

Error functions
void
libscca_error_free(libscca_error_t **error);

int
libscca_error_fprint(libscca_error_t *error, FILE *stream);

int
libscca_error_sprint(libscca_error_t *error, char *string, size_t size);

int
libscca_error_backtrace_fprint(libscca_error_t *error, FILE *stream);

int
libscca_error_backtrace_sprint(libscca_error_t *error, char *string, size_t size);

File functions
int
libscca_file_initialize(libscca_file_t **file, libscca_error_t **error);

int
libscca_file_free(libscca_file_t **file, libscca_error_t **error);

int
libscca_file_signal_abort(libscca_file_t *file, libscca_error_t **error);

int
libscca_file_open(libscca_file_t *file, const char *filename, int access_flags, libscca_error_t **error);

int
libscca_file_close(libscca_file_t *file, libscca_error_t **error);

int
libscca_file_get_format_version(libscca_file_t *file, uint32_t *format_version, libscca_error_t **error);

int
libscca_file_get_utf8_executable_filename_size(libscca_file_t *file, size_t *utf8_string_size, libscca_error_t **error);

int
libscca_file_get_utf8_executable_filename(libscca_file_t *file, uint8_t *utf8_string, size_t utf8_string_size, libscca_error_t **error);

int
libscca_file_get_utf16_executable_filename_size(libscca_file_t *file, size_t *utf16_string_size, libscca_error_t **error);

int
libscca_file_get_utf16_executable_filename(libscca_file_t *file, uint16_t *utf16_string, size_t utf16_string_size, libscca_error_t **error);

int
libscca_file_get_prefetch_hash(libscca_file_t *file, uint32_t *prefetch_hash, libscca_error_t **error);

int
libscca_file_get_last_run_time(libscca_file_t *file, int last_run_time_index, uint64_t *filetime, libscca_error_t **error);

int
libscca_file_get_run_count(libscca_file_t *file, uint32_t *run_count, libscca_error_t **error);

int
libscca_file_get_number_of_file_metrics_entries(libscca_file_t *file, int *number_of_entries, libscca_error_t **error);

int
libscca_file_get_file_metrics_entry(libscca_file_t *file, int entry_index, libscca_file_metrics_t **file_metrics, libscca_error_t **error);

int
libscca_file_get_number_of_filenames(libscca_file_t *file, int *number_of_filenames, libscca_error_t **error);

int
libscca_file_get_utf8_filename_size(libscca_file_t *file, int filename_index, size_t *utf8_string_size, libscca_error_t **error);

int
libscca_file_get_utf8_filename(libscca_file_t *file, int filename_index, uint8_t *utf8_string, size_t utf8_string_size, libscca_error_t **error);

int
libscca_file_get_utf16_filename_size(libscca_file_t *file, int filename_index, size_t *utf16_string_size, libscca_error_t **error);

int
libscca_file_get_utf16_filename(libscca_file_t *file, int filename_index, uint16_t *utf16_string, size_t utf16_string_size, libscca_error_t **error);

int
libscca_file_get_number_of_volumes(libscca_file_t *file, int *number_of_volumes, libscca_error_t **error);

int
libscca_file_get_volume_information(libscca_file_t *file, int volume_index, libscca_volume_information_t **volume_information, libscca_error_t **error);

Available when compiled with wide character string support:
int
libscca_file_open_wide(libscca_file_t *file, const wchar_t *filename, int access_flags, libscca_error_t **error);

Available when compiled with libbfio support:
int
libscca_file_open_file_io_handle(libscca_file_t *file, libbfio_handle_t *file_io_handle, int access_flags, libscca_error_t **error);

File metrics functions
int
libscca_file_metrics_free(libscca_file_metrics_t **file_metrics, libscca_error_t **error);

int
libscca_file_metrics_get_utf8_filename_size(libscca_file_metrics_t *file_metrics, size_t *utf8_string_size, libscca_error_t **error);

int
libscca_file_metrics_get_utf8_filename(libscca_file_metrics_t *file_metrics, uint8_t *utf8_string, size_t utf8_string_size, libscca_error_t **error);

int
libscca_file_metrics_get_utf16_filename_size(libscca_file_metrics_t *file_metrics, size_t *utf16_string_size, libscca_error_t **error);

int
libscca_file_metrics_get_utf16_filename(libscca_file_metrics_t *file_metrics, uint16_t *utf16_string, size_t utf16_string_size, libscca_error_t **error);

int
libscca_file_metrics_get_file_reference(libscca_file_metrics_t *file_metrics, uint64_t *file_reference, libscca_error_t **error);

Volume information functions
int
libscca_volume_information_free(libscca_volume_information_t **volume_information, libscca_error_t **error);

int
libscca_volume_information_get_creation_time(libscca_volume_information_t *volume_information, uint64_t *filetime, libscca_error_t **error);

int
libscca_volume_information_get_serial_number(libscca_volume_information_t *volume_information, uint32_t *serial_number, libscca_error_t **error);

int
libscca_volume_information_get_utf8_device_path_size(libscca_volume_information_t *volume_information, size_t *utf8_string_size, libscca_error_t **error);

int
libscca_volume_information_get_utf8_device_path(libscca_volume_information_t *volume_information, uint8_t *utf8_string, size_t utf8_string_size, libscca_error_t **error);

int
libscca_volume_information_get_utf16_device_path_size(libscca_volume_information_t *volume_information, size_t *utf16_string_size, libscca_error_t **error);

int
libscca_volume_information_get_utf16_device_path(libscca_volume_information_t *volume_information, uint16_t *utf16_string, size_t utf16_string_size, libscca_error_t **error);

DESCRIPTION¶

The libscca_get_version() function is used to retrieve the library version.

RETURN VALUES¶

Most of the functions return NULL or -1 on error, dependent on the return type. For the actual return values see "libscca.h".

ENVIRONMENT¶

None

FILES¶

None

NOTES¶

libscca can be compiled with wide character support (wchar_t).

To compile libscca with wide character support use: ./configure --enable-wide-character-type=yes
or define: _UNICODE
or UNICODE
during compilation.

LIBSCCA_WIDE_CHARACTER_TYPE
in libscca/features.h can be used to determine if libscca was compiled with wide character support.

BUGS¶

Please report bugs of any kind on the project issue tracker: https://github.com/libyal/libscca/issues

AUTHOR¶

These man pages are generated from "libscca.h".

COPYRIGHT¶

Copyright (C) 2011-2020, Joachim Metz <joachim.metz@gmail.com>.

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

SEE ALSO¶

the libscca.h include file