Autopsy  4.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Static Public Member Functions | Private Member Functions | Static Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager Class Reference

Inherits PropertyChangeListener.

Classes

class  HashDb
 
class  HashDbIndexer
 
class  HashDbManagerException
 
enum  SetEvt
 

Public Member Functions

HashDb addExistingHashDatabase (String hashSetName, String path, boolean searchDuringIngest, boolean sendIngestMessages, HashDb.KnownFilesType knownFilesType) throws HashDbManagerException
 
HashDb addNewHashDatabase (String hashSetName, String path, boolean searchDuringIngest, boolean sendIngestMessages, HashDb.KnownFilesType knownFilesType) throws HashDbManagerException
 
synchronized void addPropertyChangeListener (PropertyChangeListener listener)
 
synchronized List< HashDbgetAllHashSets ()
 
synchronized List< HashDbgetKnownBadFileHashSets ()
 
synchronized List< HashDbgetKnownFileHashSets ()
 
synchronized List< HashDbgetUpdateableHashSets ()
 
synchronized void loadLastSavedConfiguration ()
 
void propertyChange (PropertyChangeEvent event)
 
synchronized void removeHashDatabase (HashDb hashDb) throws HashDbManagerException
 

Static Public Member Functions

static synchronized HashDbManager getInstance ()
 

Private Member Functions

 HashDbManager ()
 
HashDb addHashDatabase (int handle, String hashSetName, boolean searchDuringIngest, boolean sendIngestMessages, HashDb.KnownFilesType knownFilesType) throws TskCoreException
 
void closeHashDatabases (List< HashDb > hashDatabases)
 
List< HashDbgetUpdateableHashSets (List< HashDb > hashDbs)
 
String getValidFilePath (String hashSetName, String configuredPath)
 
boolean hashSetsConfigurationFileExists ()
 
boolean readHashSetsConfigurationFromDisk ()
 
String searchForFile ()
 
boolean writeHashSetConfigurationToDisk ()
 

Static Private Member Functions

static void writeHashDbsToDisk (Document doc, Element rootEl, List< HashDb > hashDbs)
 

Private Attributes

final String configFilePath = PlatformUtil.getUserConfigDirectory() + File.separator + CONFIG_FILE_NAME
 
Set< String > hashSetNames = new HashSet<>()
 
Set< String > hashSetPaths = new HashSet<>()
 
List< HashDbknownBadHashSets = new ArrayList<>()
 
List< HashDbknownHashSets = new ArrayList<>()
 

Static Private Attributes

static final String CONFIG_FILE_NAME = "hashsets.xml"
 
static final String ENCODING = "UTF-8"
 
static final String HASH_DATABASE_FILE_EXTENSON = "kdb"
 
static HashDbManager instance = null
 
static final String LEGACY_PATH_NUMBER_ATTRIBUTE = "number"
 
static final Logger logger = Logger.getLogger(HashDbManager.class.getName())
 
static final String PATH_ELEMENT = "hash_set_path"
 
static final String ROOT_ELEMENT = "hash_sets"
 
static final String SEARCH_DURING_INGEST_ATTRIBUTE = "use_for_ingest"
 
static final String SEND_INGEST_MESSAGES_ATTRIBUTE = "show_inbox_messages"
 
static final String SET_ELEMENT = "hash_set"
 
static final String SET_NAME_ATTRIBUTE = "name"
 
static final String SET_TYPE_ATTRIBUTE = "type"
 
static final String XSD_FILE_NAME = "HashsetsSchema.xsd"
 

Detailed Description

This class implements a singleton that manages the set of hash databases used to classify files as unknown, known or known bad.

Definition at line 64 of file HashDbManager.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.HashDbManager ( )
private

Member Function Documentation

HashDb org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.addExistingHashDatabase ( String  hashSetName,
String  path,
boolean  searchDuringIngest,
boolean  sendIngestMessages,
HashDb.KnownFilesType  knownFilesType 
) throws HashDbManagerException

Adds an existing hash database to the set of hash databases used to classify files as known or known bad and saves the configuration.

Parameters
hashSetNameName used to represent the hash database in user interface components.
pathFull path to either a hash database file or a hash database index file.
searchDuringIngestA flag indicating whether or not the hash database should be searched during ingest.
sendIngestMessagesA flag indicating whether hash set hit messages should be sent as ingest messages.
knownFilesTypeThe classification to apply to files whose hashes are found in the hash database.
Returns
A HashDb representing the hash database.
Exceptions
HashDbManagerException

Definition at line 152 of file HashDbManager.java.

HashDb org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.addHashDatabase ( int  handle,
String  hashSetName,
boolean  searchDuringIngest,
boolean  sendIngestMessages,
HashDb.KnownFilesType  knownFilesType 
) throws TskCoreException
private
HashDb org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.addNewHashDatabase ( String  hashSetName,
String  path,
boolean  searchDuringIngest,
boolean  sendIngestMessages,
HashDb.KnownFilesType  knownFilesType 
) throws HashDbManagerException

Adds a new hash database to the set of hash databases used to classify files as known or known bad and saves the configuration.

Parameters
hashSetNameHash set name used to represent the hash database in user interface components.
pathFull path to the database file to be created.
searchDuringIngestA flag indicating whether or not the hash database should be searched during ingest.
sendIngestMessagesA flag indicating whether hash set hit messages should be sent as ingest messages.
knownFilesTypeThe classification to apply to files whose hashes are found in the hash database.
Returns
A HashDb representing the hash database.
Exceptions
HashDbManagerException

Definition at line 223 of file HashDbManager.java.

synchronized void org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.addPropertyChangeListener ( PropertyChangeListener  listener)
void org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.closeHashDatabases ( List< HashDb hashDatabases)
private
synchronized List<HashDb> org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getAllHashSets ( )

Gets all of the hash databases used to classify files as known or known bad.

Returns
A list, possibly empty, of hash databases.

Definition at line 419 of file HashDbManager.java.

Referenced by org.sleuthkit.autopsy.modules.hashdatabase.HashLookupSettingsPanel.saveSettings().

static synchronized HashDbManager org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getInstance ( )
static
synchronized List<HashDb> org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getKnownBadFileHashSets ( )
synchronized List<HashDb> org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getKnownFileHashSets ( )
synchronized List<HashDb> org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getUpdateableHashSets ( )

Gets all of the hash databases that accept updates.

Returns
A list, possibly empty, of hash databases.

Definition at line 453 of file HashDbManager.java.

List<HashDb> org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getUpdateableHashSets ( List< HashDb hashDbs)
private
String org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getValidFilePath ( String  hashSetName,
String  configuredPath 
)
private
boolean org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.hashSetsConfigurationFileExists ( )
private
synchronized void org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.loadLastSavedConfiguration ( )
void org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.propertyChange ( PropertyChangeEvent  event)
boolean org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.readHashSetsConfigurationFromDisk ( )
private
synchronized void org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.removeHashDatabase ( HashDb  hashDb) throws HashDbManagerException

Removes a hash database from the set of hash databases used to classify files as known or known bad and saves the configuration.

Parameters
hashDb
Exceptions
HashDbManagerException

Definition at line 352 of file HashDbManager.java.

References org.sleuthkit.autopsy.ingest.IngestManager.getInstance(), and org.sleuthkit.autopsy.ingest.IngestManager.isIngestRunning().

String org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.searchForFile ( )
private
static void org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.writeHashDbsToDisk ( Document  doc,
Element  rootEl,
List< HashDb hashDbs 
)
staticprivate
boolean org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.writeHashSetConfigurationToDisk ( )
private

Member Data Documentation

final String org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.CONFIG_FILE_NAME = "hashsets.xml"
staticprivate

Definition at line 74 of file HashDbManager.java.

final String org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.configFilePath = PlatformUtil.getUserConfigDirectory() + File.separator + CONFIG_FILE_NAME
private

Definition at line 79 of file HashDbManager.java.

final String org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.ENCODING = "UTF-8"
staticprivate

Definition at line 76 of file HashDbManager.java.

final String org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.HASH_DATABASE_FILE_EXTENSON = "kdb"
staticprivate

Definition at line 77 of file HashDbManager.java.

Set<String> org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.hashSetNames = new HashSet<>()
private

Definition at line 82 of file HashDbManager.java.

Set<String> org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.hashSetPaths = new HashSet<>()
private

Definition at line 83 of file HashDbManager.java.

HashDbManager org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.instance = null
staticprivate
List<HashDb> org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.knownBadHashSets = new ArrayList<>()
private

Definition at line 81 of file HashDbManager.java.

List<HashDb> org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.knownHashSets = new ArrayList<>()
private

Definition at line 80 of file HashDbManager.java.

final String org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.LEGACY_PATH_NUMBER_ATTRIBUTE = "number"
staticprivate

Definition at line 73 of file HashDbManager.java.

final Logger org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.logger = Logger.getLogger(HashDbManager.class.getName())
staticprivate

Definition at line 85 of file HashDbManager.java.

final String org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.PATH_ELEMENT = "hash_set_path"
staticprivate

Definition at line 72 of file HashDbManager.java.

final String org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.ROOT_ELEMENT = "hash_sets"
staticprivate

Definition at line 66 of file HashDbManager.java.

final String org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.SEARCH_DURING_INGEST_ATTRIBUTE = "use_for_ingest"
staticprivate

Definition at line 70 of file HashDbManager.java.

final String org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.SEND_INGEST_MESSAGES_ATTRIBUTE = "show_inbox_messages"
staticprivate

Definition at line 71 of file HashDbManager.java.

final String org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.SET_ELEMENT = "hash_set"
staticprivate

Definition at line 67 of file HashDbManager.java.

final String org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.SET_NAME_ATTRIBUTE = "name"
staticprivate

Definition at line 68 of file HashDbManager.java.

final String org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.SET_TYPE_ATTRIBUTE = "type"
staticprivate

Definition at line 69 of file HashDbManager.java.

final String org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.XSD_FILE_NAME = "HashsetsSchema.xsd"
staticprivate

Definition at line 75 of file HashDbManager.java.


The documentation for this class was generated from the following file:

Copyright © 2012-2015 Basis Technology. Generated on: Wed Apr 6 2016
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.