# These need to be updated as The Sleuth Kit supports more file systems
#
# addr_unit contains the addressable unit per filesystem type
# first_inode contains the first usable inode on a system 
# root_inode is the inode for the root directory (diff than
# first on ntfs)

$addr_unit{'dls'} = 'Unit';
$first_addr{'dls'} = 0;

# BSDI
$first_inode{'bsdi'} =
$root_inode{'bsdi'} = 2;
$first_addr{'bsdi'} = 0;
$addr_unit{'bsdi'} = 'Fragment';
$ctime_str{'bsdi'} = "Changed";
$mtime_str{'bsdi'} = "Modified";
$meta_str{'bsdi'} = "Inode";

# FreeBSD
$first_inode{'freebsd'} =
$root_inode{'freebsd'} = 2;
$first_addr{'freebsd'} = 0;
$addr_unit{'freebsd'} = 'Fragment';
$ctime_str{'freebsd'} = "Changed";
$mtime_str{'freebsd'} = "Modified";
$meta_str{'freebsd'} = "Inode";

# OpenBSD
$first_inode{'openbsd'} =
$root_inode{'openbsd'} = 2;
$first_addr{'openbsd'} = 0;
$addr_unit{'openbsd'} = 'Fragment';
$ctime_str{'openbsd'} = "Changed";
$mtime_str{'openbsd'} = "Modified";
$meta_str{'openbsd'} = "Inode";


# Solaris
$first_inode{'solaris'} =
$root_inode{'solaris'} = 2;
$first_addr{'solaris'} = 0;
$addr_unit{'solaris'} = 'Fragment';
$ctime_str{'solaris'} = "Changed";
$mtime_str{'solaris'} = "Modified";
$meta_str{'solaris'} = "Inode";



# Linux
$first_inode{'linux-ext2'} =
$root_inode{'linux-ext2'} = 2;
$first_addr{'linux-ext2'} = 0;
$addr_unit{'linux-ext2'} = 'Fragment';
$ctime_str{'linux-ext2'} = "Changed";
$mtime_str{'linux-ext2'} = "Modified";
$meta_str{'linux-ext2'} = "Inode";

$first_inode{'linux-ext3'} =
$root_inode{'linux-ext3'} = 2;
$first_addr{'linux-ext3'} = 0;
$addr_unit{'linux-ext3'} = 'Fragment';
$ctime_str{'linux-ext3'} = "Changed";
$mtime_str{'linux-ext3'} = "Modified";
$meta_str{'linux-ext3'} = "Inode";



# FAT
$first_inode{'fat'} =
$root_inode{'fat'} =
$first_inode{'fat12'} =
$root_inode{'fat12'} =
$first_inode{'fat16'} =
$root_inode{'fat16'} =
$first_inode{'fat32'} =
$root_inode{'fat32'} = 2;
$first_addr{'fat'} = 
$first_addr{'fat12'} = 
$first_addr{'fat16'} = 
$first_addr{'fat32'} = 0;
$addr_unit{'fat'} =
$addr_unit{'fat12'} =
$addr_unit{'fat16'} =
$addr_unit{'fat32'} = 'Sector';
$ctime_str{'fat'} = 
$ctime_str{'fat12'} = 
$ctime_str{'fat16'} = 
$ctime_str{'fat32'} = "Created";
$mtime_str{'fat'} = 
$mtime_str{'fat12'} = 
$mtime_str{'fat16'} = 
$mtime_str{'fat32'} = "Written";
$meta_str{'fat'} = 
$meta_str{'fat12'} = 
$meta_str{'fat16'} = 
$meta_str{'fat32'} = "Dir Entry";

# NTFS
$first_inode{'ntfs'} = 0;
$root_inode{'ntfs'} = 5;
$first_addr{'ntfs'} = 0;
$addr_unit{'ntfs'} = 'Cluster';
$ctime_str{'ntfs'} = "Changed";
$mtime_str{'ntfs'} = "Written";
$meta_str{'ntfs'} = "MFT Entry";
