Autopsy  3.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
Public Member Functions | Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.coreutils.JLnkParser Class Reference

Public Member Functions

 JLnkParser (InputStream is, int length)
 
JLNK parse () throws JLnkParserException
 

Private Member Functions

String readStringData (ByteBuffer bb)
 
String parseString (int offset, boolean unicode, int maxlen)
 
String parseCommonPathSuffix (int offset, boolean unicode)
 
String parseLocalBasePath (int offset, boolean unicode)
 
String parseNetName (int offset, boolean unicode)
 
String parseDeviceName (int offset, boolean unicode)
 
List< String > parseLinkTargetIdList (List< byte[]> idList)
 
List< String > parsePathElements (List< byte[]> idList)
 
String get0xC (ByteBuffer bb)
 
String getStringAt (ByteBuffer bb, int offset, boolean unicode)
 

Private Attributes

byte[] content
 

Static Private Attributes

static final Logger logger = Logger.getLogger(JLnkParser.class.getName())
 

Detailed Description

Author
dfickling Parse lnk files using documentation from http://msdn.microsoft.com/en-us/library/dd871305(v=prot.13).aspx http://msdn.microsoft.com/en-us/library/windows/desktop/cc144090(v=vs.85).aspx#unknown_74413 http://blog.0x01000000.org/2010/08/10/lnk-parsing-youre-doing-it-wrong-i/

Definition at line 41 of file JLnkParser.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.coreutils.JLnkParser.JLnkParser ( InputStream  is,
int  length 
)

Member Function Documentation

String org.sleuthkit.autopsy.coreutils.JLnkParser.get0xC ( ByteBuffer  bb)
private
String org.sleuthkit.autopsy.coreutils.JLnkParser.getStringAt ( ByteBuffer  bb,
int  offset,
boolean  unicode 
)
private
JLNK org.sleuthkit.autopsy.coreutils.JLnkParser.parse ( ) throws JLnkParserException
String org.sleuthkit.autopsy.coreutils.JLnkParser.parseCommonPathSuffix ( int  offset,
boolean  unicode 
)
private
String org.sleuthkit.autopsy.coreutils.JLnkParser.parseDeviceName ( int  offset,
boolean  unicode 
)
private
List<String> org.sleuthkit.autopsy.coreutils.JLnkParser.parseLinkTargetIdList ( List< byte[]>  idList)
private
String org.sleuthkit.autopsy.coreutils.JLnkParser.parseLocalBasePath ( int  offset,
boolean  unicode 
)
private
String org.sleuthkit.autopsy.coreutils.JLnkParser.parseNetName ( int  offset,
boolean  unicode 
)
private
List<String> org.sleuthkit.autopsy.coreutils.JLnkParser.parsePathElements ( List< byte[]>  idList)
private
String org.sleuthkit.autopsy.coreutils.JLnkParser.parseString ( int  offset,
boolean  unicode,
int  maxlen 
)
private
String org.sleuthkit.autopsy.coreutils.JLnkParser.readStringData ( ByteBuffer  bb)
private

Definition at line 219 of file JLnkParser.java.

Referenced by org.sleuthkit.autopsy.coreutils.JLnkParser.parse().

Member Data Documentation

byte [] org.sleuthkit.autopsy.coreutils.JLnkParser.content
private

Definition at line 43 of file JLnkParser.java.

final Logger org.sleuthkit.autopsy.coreutils.JLnkParser.logger = Logger.getLogger(JLnkParser.class.getName())
staticprivate

Definition at line 44 of file JLnkParser.java.


The documentation for this class was generated from the following file:

Copyright © 2012-2015 Basis Technology. Generated on: Mon Oct 19 2015
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.