libscca(3)

💅 libscca, the manual page

okay so bestie, welcome to libscca — section 3 of the manual, the library functions corner. this is the whole thing, every function, every flag, nothing skipped, no cap. grab a snack 🍓

---

✨ NAME ✨

libscca.h — the library that lets you access the Windows Prefetch File (PF) format. yep. that's the vibe. it's giving forensic icon behavior 👑

---

🌸 SYNOPSIS 🌸

first things first, you gotta pull it in:

#include <libscca.h>

then it's function city. let's go section by section 💖

🫶 Support functions

const char *
libscca_get_version(void);

int
libscca_get_access_flags_read(void);

int
libscca_get_codepage(int *codepage, libscca_error_t **error);

int
libscca_set_codepage(int codepage, libscca_error_t **error);

int
libscca_check_file_signature(const char *filename,
    libscca_error_t **error);

these ones only exist when you compiled with wide character string support:

int
libscca_check_file_signature_wide(const wchar_t *filename,
    libscca_error_t **error);

and these ones only exist when you compiled with libbfio support:

int
libscca_check_file_signature_file_io_handle(libbfio_handle_t *file_io_handle,
    libscca_error_t **error);

🎀 Notify functions

void
libscca_notify_set_verbose(int verbose);

int
libscca_notify_set_stream(FILE *stream, libscca_error_t **error);

int
libscca_notify_stream_open(const char *filename,
    libscca_error_t **error);

int
libscca_notify_stream_close(libscca_error_t **error);

💀 Error functions

void
libscca_error_free(libscca_error_t **error);

int
libscca_error_fprint(libscca_error_t *error, FILE *stream);

int
libscca_error_sprint(libscca_error_t *error, char *string, size_t size);

int
libscca_error_backtrace_fprint(libscca_error_t *error, FILE *stream);

int
libscca_error_backtrace_sprint(libscca_error_t *error, char *string,
    size_t size);

🦋 File functions

int
libscca_file_initialize(libscca_file_t **file, libscca_error_t **error);

int
libscca_file_free(libscca_file_t **file, libscca_error_t **error);

int
libscca_file_signal_abort(libscca_file_t *file,
    libscca_error_t **error);

int
libscca_file_open(libscca_file_t *file, const char *filename,
    int access_flags, libscca_error_t **error);

int
libscca_file_close(libscca_file_t *file, libscca_error_t **error);

int
libscca_file_get_format_version(libscca_file_t *file,
    uint32_t *format_version, libscca_error_t **error);

int
libscca_file_get_utf8_executable_filename_size(libscca_file_t *file,
    size_t *utf8_string_size, libscca_error_t **error);

int
libscca_file_get_utf8_executable_filename(libscca_file_t *file,
    uint8_t *utf8_string, size_t utf8_string_size,
    libscca_error_t **error);

int
libscca_file_get_utf16_executable_filename_size(libscca_file_t *file,
    size_t *utf16_string_size, libscca_error_t **error);

int
libscca_file_get_utf16_executable_filename(libscca_file_t *file,
    uint16_t *utf16_string, size_t utf16_string_size,
    libscca_error_t **error);

int
libscca_file_get_prefetch_hash(libscca_file_t *file,
    uint32_t *prefetch_hash, libscca_error_t **error);

int
libscca_file_get_last_run_time(libscca_file_t *file,
    int last_run_time_index, uint64_t *filetime,
    libscca_error_t **error);

int
libscca_file_get_run_count(libscca_file_t *file, uint32_t *run_count,
    libscca_error_t **error);

int
libscca_file_get_number_of_file_metrics_entries(libscca_file_t *file,
    int *number_of_entries, libscca_error_t **error);

int
libscca_file_get_file_metrics_entry(libscca_file_t *file,
    int entry_index, libscca_file_metrics_t **file_metrics,
    libscca_error_t **error);

int
libscca_file_get_number_of_filenames(libscca_file_t *file,
    int *number_of_filenames, libscca_error_t **error);

int
libscca_file_get_utf8_filename_size(libscca_file_t *file,
    int filename_index, size_t *utf8_string_size,
    libscca_error_t **error);

int
libscca_file_get_utf8_filename(libscca_file_t *file, int filename_index,
    uint8_t *utf8_string, size_t utf8_string_size,
    libscca_error_t **error);

int
libscca_file_get_utf16_filename_size(libscca_file_t *file,
    int filename_index, size_t *utf16_string_size,
    libscca_error_t **error);

int
libscca_file_get_utf16_filename(libscca_file_t *file,
    int filename_index, uint16_t *utf16_string,
    size_t utf16_string_size, libscca_error_t **error);

int
libscca_file_get_number_of_volumes(libscca_file_t *file,
    int *number_of_volumes, libscca_error_t **error);

int
libscca_file_get_volume_information(libscca_file_t *file,
    int volume_index, libscca_volume_information_t **volume_information,
    libscca_error_t **error);

these two? only when compiled with wide character string support:

int
libscca_file_open_wide(libscca_file_t *file, const wchar_t *filename,
    int access_flags, libscca_error_t **error);

and this one? only when compiled with libbfio support:

int
libscca_file_open_file_io_handle(libscca_file_t *file,
    libbfio_handle_t *file_io_handle, int access_flags,
    libscca_error_t **error);

🧚 File metrics functions

int
libscca_file_metrics_free(libscca_file_metrics_t **file_metrics,
    libscca_error_t **error);

int
libscca_file_metrics_get_utf8_filename_size(libscca_file_metrics_t *file_metrics,
    size_t *utf8_string_size, libscca_error_t **error);

int
libscca_file_metrics_get_utf8_filename(libscca_file_metrics_t *file_metrics,
    uint8_t *utf8_string, size_t utf8_string_size,
    libscca_error_t **error);

int
libscca_file_metrics_get_utf16_filename_size(libscca_file_metrics_t *file_metrics,
    size_t *utf16_string_size, libscca_error_t **error);

int
libscca_file_metrics_get_utf16_filename(libscca_file_metrics_t *file_metrics,
    uint16_t *utf16_string, size_t utf16_string_size,
    libscca_error_t **error);

int
libscca_file_metrics_get_file_reference(libscca_file_metrics_t *file_metrics,
    uint64_t *file_reference, libscca_error_t **error);

🌈 Volume information functions

int
libscca_volume_information_free(libscca_volume_information_t **volume_information,
    libscca_error_t **error);

int
libscca_volume_information_get_creation_time(libscca_volume_information_t *volume_information,
    uint64_t *filetime, libscca_error_t **error);

int
libscca_volume_information_get_serial_number(libscca_volume_information_t *volume_information,
    uint32_t *serial_number, libscca_error_t **error);

int
libscca_volume_information_get_utf8_device_path_size(libscca_volume_information_t *volume_information,
    size_t *utf8_string_size, libscca_error_t **error);

int
libscca_volume_information_get_utf8_device_path(libscca_volume_information_t *volume_information,
    uint8_t *utf8_string, size_t utf8_string_size,
    libscca_error_t **error);

int
libscca_volume_information_get_utf16_device_path_size(libscca_volume_information_t *volume_information,
    size_t *utf16_string_size, libscca_error_t **error);

int
libscca_volume_information_get_utf16_device_path(libscca_volume_information_t *volume_information,
    uint16_t *utf16_string, size_t utf16_string_size,
    libscca_error_t **error);

---

💜 DESCRIPTION 💜

the libscca_get_version() function is the one you call when you just wanna know what version of the library you're working with. that's literally its whole job and it ate 💅

---

⭐ RETURN VALUES ⭐

most of these functions hand you back NULL or -1 when something goes wrong — which one depends on the return type, iykyk. for the actual, exact return values you gotta go read "libscca.h" itself, bestie. no shortcuts, the header is the source of truth 👑

---

🍓 ENVIRONMENT 🍓

None — nothing. empty. a whole lotta nothing. it's giving minimalism ✨

---

🎀 FILES 🎀

None — also nothing. same energy. 💖

---

👑 NOTES 👑

libscca can be compiled with wide character support (wchar_t). yes bestie, the fancy wide chars. here's how you make that happen:

to compile libscca with wide character support, use:

./configure --enable-wide-character-type=yes

or define:

_UNICODE

or:

UNICODE

during compilation. pick your fighter 🌸

LIBSCCA_WIDE_CHARACTER_TYPE in libscca/features.h is the little flag you check to figure out whether libscca was compiled with wide character support in the first place. vibe check for your build ✨

---

💀 BUGS 💀

found a bug? any kind of bug? please, please report it on the project issue tracker, we wanna know:

https://github.com/libyal/libscca/issues

do not suffer in silence, that's not the move 🙈

---

🧚 AUTHOR 🧚

these man pages are generated from "libscca.h". the header writes the lore, we just transcribe it 💅

---

💖 COPYRIGHT 💖

Copyright (C) 2011-2020, Joachim Metz <joachim.metz@gmail.com>.

this is free software; see the source for copying conditions. there is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

read that again bestie. NO WARRANTY. not even the implied ones. it's free, it's yours, but it does not come with promises. periodt 💀

---

🌈 SEE ALSO 🌈

• the libscca.h include file — go read it, it's the whole truth, no cap

---

and that's the page, bestie. this was the libscca manual, page libscca(3), and the date on it is March 14, 2019. slay, go read some prefetch files 🦋💖✨