org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree Class Reference

Classes
class	UnpackedNode

Private Member Functions
UnpackedNode	addNode (UnpackedNode parent, List< String > tokenPath, List< byte[]> tokenPathBytes)
String	bytesToString (byte[] bytes)
void	commitCurrentTransaction () throws TskCoreException
void	getAllFileObjectsRec (List< AbstractFile > list, UnpackedNode parent)
CaseDbTransaction	getCurrentTransaction () throws TskCoreException
void	rollbackCurrentTransaction ()
void	startTransaction () throws TskCoreException
void	updateOrAddFileToCaseRec (UnpackedNode node, FileManager fileManager, HashMap< String, ZipFileStatusWrapper > statusMap, String archiveFilePath, Archive parentAr, AbstractFile archiveFile, ConcurrentHashMap< Long, Archive > depthMap) throws TskCoreException

Private Attributes
CaseDbTransaction	currentTransaction = null
int	nodesProcessed = 0
long	transactionCounter = 0

Static Private Attributes
static final long	MAX_TRANSACTION_SIZE = 1000

Detailed Description

Representation of the files in the archive. Used to track of local tree file hierarchy, archive depth, and files created to easily and reliably get parent AbstractFile for unpacked file. So that we don't have to depend on type of traversal of unpacked files handed to us by 7zip unpacker.

Definition at line 1268 of file SevenZipExtractor.java.

Member Function Documentation

UnpackedNode org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.addNode ( UnpackedNode  parent, List< String >  tokenPath, List< byte[]>  tokenPathBytes  )

private

recursive method that traverses the path

Parameters

parent
tokenPath
tokenPathBytes

Returns

Definition at line 1376 of file SevenZipExtractor.java.

String org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.bytesToString ( byte[]  bytes )

private

Convert byte array to string representation.

Parameters

bytes

Byte array

Returns

Byte array as lower case hex string.

Definition at line 1359 of file SevenZipExtractor.java.

void org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.commitCurrentTransaction ( ) throws TskCoreException

private

Commit the current transaction.

Exceptions

TskCoreException

Definition at line 1585 of file SevenZipExtractor.java.

Referenced by org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.getCurrentTransaction().

void org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.getAllFileObjectsRec ( List< AbstractFile >  list, UnpackedNode  parent  )

private

Definition at line 1429 of file SevenZipExtractor.java.

CaseDbTransaction org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.getCurrentTransaction ( ) throws TskCoreException

private

Get the current transaction being used in updateOrAddFileToCaseRec(). If there is no transaction, one will be started. After the transaction has been used MAX_TRANSACTION_SIZE, it will be committed and a new transaction will be opened.

Returns

The open transaction.

Exceptions

TskCoreException

Definition at line 1551 of file SevenZipExtractor.java.

References org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.commitCurrentTransaction(), org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.currentTransaction, and org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.startTransaction().

Referenced by org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.updateOrAddFileToCaseRec().

void org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.rollbackCurrentTransaction ( )

private

Rollback the current transaction.

Definition at line 1595 of file SevenZipExtractor.java.

void org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.startTransaction ( ) throws TskCoreException

private

Open a transaction.

Exceptions

TskCoreException

Definition at line 1571 of file SevenZipExtractor.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.getCurrentTransaction().

void org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.updateOrAddFileToCaseRec ( UnpackedNode  node, FileManager  fileManager, HashMap< String, ZipFileStatusWrapper >  statusMap, String  archiveFilePath, Archive  parentAr, AbstractFile  archiveFile, ConcurrentHashMap< Long, Archive >  depthMap  ) throws TskCoreException

private

Add derived files to the case if they do not exist, update the derived file data if the new file contains more information than the existing one, and do nothing if the existing information is complete.

Parameters

node	- the UnpackedNode for the file which is being added or updated
fileManager	- the file manager to perform the adding or updating
statusMap	- the map of existing files and their status
archiveFilePath	- the archive file path for the unpacked node
parentAr	- the parent archive as an Archive object
archiveFile	- the parent archive as an AbstractFile
depthMap	- the depth map (to prevent zip bombs)

Exceptions

TskCoreException

Definition at line 1464 of file SevenZipExtractor.java.

References org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.ZipFileStatus.EXISTS, org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.getCurrentTransaction(), org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.ZipFileStatusWrapper.getFile(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.ZipFileStatusWrapper.getStatus(), org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.ZipFileStatusWrapper.setStatus(), org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.ZipFileStatus.SKIP, and org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.ZipFileStatus.UPDATE.

Member Data Documentation

CaseDbTransaction org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.currentTransaction = null

private

Definition at line 1278 of file SevenZipExtractor.java.

Referenced by org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.getCurrentTransaction().

final long org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.MAX_TRANSACTION_SIZE = 1000

staticprivate

Definition at line 1280 of file SevenZipExtractor.java.

int org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.nodesProcessed = 0

private

Definition at line 1271 of file SevenZipExtractor.java.

long org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.transactionCounter = 0

private

Definition at line 1279 of file SevenZipExtractor.java.

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/SevenZipExtractor.java