FEX Core SDK
  • Documentation
  • C# Reference
Search Results for

    Show / Hide Table of Contents
    • FexViewer
      • FexApi
      • FexCoreException
      • FileRecord
      • ImageMetadata
    • FexViewer.Models
      • Manifest
      • PathBuilder
      • StatusFlags

    Class FexApi

    Managed-friendly wrappers around the raw FexViewer.NativeMethods P/Invoke surface. Each method handles UTF-8 marshalling, buffer cleanup, and translates non-zero result codes into FexCoreException.

    Inheritance
    object
    FexApi
    Inherited Members
    object.Equals(object)
    object.Equals(object, object)
    object.GetHashCode()
    object.GetType()
    object.MemberwiseClone()
    object.ReferenceEquals(object, object)
    object.ToString()
    Namespace: FexViewer
    Assembly: FexViewer.dll
    Syntax
    public static class FexApi
    Remarks

    Use these helpers as the canonical pattern when integrating FEX.Core.dll from C#. Each method consumes a single V2 buffer and frees it in a finally block — see the memory-management page in the SDK docs for the full ownership rules.

    Methods

    CloseImage(int)

    Closes an image session.

    Declaration
    public static void CloseImage(int imageId)
    Parameters
    Type Name Description
    int imageId

    ID returned by OpenImageWithOptions(string, string?).

    Exceptions
    Type Condition
    FexCoreException

    Thrown if the close call returns a non-OK code.

    GetFileList(int)

    Reads the filesystem and returns every record as managed FileRecord objects. The DLL's record array and every contained pointer are released before this method returns.

    Declaration
    public static List<FileRecord> GetFileList(int imageId)
    Parameters
    Type Name Description
    int imageId

    Open image-session ID.

    Returns
    Type Description
    List<FileRecord>

    List of records, possibly empty.

    Exceptions
    Type Condition
    FexCoreException

    Any DLL-level failure.

    GetFileSize(int, int)

    Returns the physical (cluster-rounded) size of a single file.

    Declaration
    public static ulong GetFileSize(int imageId, int fileIndex)
    Parameters
    Type Name Description
    int imageId

    Open image-session ID.

    int fileIndex

    Record index.

    Returns
    Type Description
    ulong

    Physical size in bytes.

    Exceptions
    Type Condition
    FexCoreException

    Any DLL-level failure.

    GetImageInfoRaw(string, string?)

    Returns the raw, unmodified image-info JSON the DLL produced. Use this when you need format-specific fields (e.g. EnCase encaseInformation, source, subject) that the strongly-typed ImageMetadata doesn't model.

    Declaration
    public static string GetImageInfoRaw(string filename, string? optionsJson = null)
    Parameters
    Type Name Description
    string filename

    Absolute path to the first image segment.

    string optionsJson

    Optional options JSON; see GetImageMetadata(string, string?).

    Returns
    Type Description
    string

    UTF-8 JSON document string.

    Exceptions
    Type Condition
    FexCoreException

    Any DLL-level failure.

    GetImageMetadata(string, string?)

    Returns parsed image metadata for a forensic image on disk.

    Declaration
    public static ImageMetadata GetImageMetadata(string filename, string? optionsJson = null)
    Parameters
    Type Name Description
    string filename

    Absolute path to the first image segment.

    string optionsJson

    Optional JSON options (e.g. {"passwords":["…"]}) for encrypted volumes. When supplied, this method opens a transient session to surface password-protected metadata, then closes it.

    Returns
    Type Description
    ImageMetadata

    Deserialised ImageMetadata.

    Exceptions
    Type Condition
    ArgumentException

    Filename is null or empty.

    FileNotFoundException

    Image file does not exist.

    FexCoreException

    Any DLL-level failure.

    GetVersion()

    Returns the DLL version as a UTF-8 JSON string. Calls GetVersionAsJSON(out nint, out uint) and frees the buffer before returning.

    Declaration
    public static string? GetVersion()
    Returns
    Type Description
    string

    The JSON document, or null if the DLL returned an empty buffer.

    Exceptions
    Type Condition
    DllNotFoundException

    Thrown if FEX.Core.dll cannot be loaded.

    FexCoreException

    Thrown for any non-OK result code.

    OpenImageWithOptions(string, string?)

    Opens a forensic image and returns the positive image-session ID.

    Declaration
    public static int OpenImageWithOptions(string imagePath, string? optionsJson = null)
    Parameters
    Type Name Description
    string imagePath

    Absolute path to the first image segment.

    string optionsJson

    Optional UTF-8 options JSON for encrypted volumes.

    Returns
    Type Description
    int

    Positive image-session ID.

    Exceptions
    Type Condition
    FexCoreException

    Wraps any negative return code, including FexViewer.NativeMethods.RESULT_PASSWORD_REQUIRED and FexViewer.NativeMethods.RESULT_PASSWORD_INCORRECT — caller can inspect ErrorCode to recover.

    ReadFileDataChunked(int, int, long, byte[], int, int)

    Reads a chunk of file data into a caller-managed byte array. Pairs AllocHGlobal(int) with FreeHGlobal(nint) internally; the destination buffer is yours.

    Declaration
    public static int ReadFileDataChunked(int imageId, int fileIndex, long offset, byte[] destination, int destinationOffset, int length)
    Parameters
    Type Name Description
    int imageId

    Open image-session ID.

    int fileIndex

    Record index.

    long offset

    Byte offset within the file.

    byte[] destination

    Managed buffer to receive the bytes.

    int destinationOffset

    Offset within destination.

    int length

    Number of bytes to read.

    Returns
    Type Description
    int

    Bytes actually read; may be less than length near EOF.

    Exceptions
    Type Condition
    ArgumentNullException

    destination is null.

    ArgumentOutOfRangeException

    Offset / length out of bounds.

    FexCoreException

    Any DLL-level read failure.

    In this article
    Back to top © GetData Forensics