Autopsy  4.19.3
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule Class Reference

Inherits Serializable.

Classes

class  AbstractTextCondition
 
class  CaseInsensitiveMultiValueStringComparisionMatcher
 
class  CaseInsensitivePartialStringComparisionMatcher
 
class  CaseInsensitiveStringComparisionMatcher
 
class  DateCondition
 
class  ExtensionCondition
 
interface  FileAttributeCondition
 
interface  FileNameCondition
 
class  FileSizeCondition
 
class  FullNameCondition
 
class  MetaTypeCondition
 
class  MimeTypeCondition
 
class  ParentPathCondition
 
class  RegexMatcher
 
interface  TextCondition
 
interface  TextMatcher
 

Public Member Functions

 Rule (String ruleName, FileNameCondition fileNameCondition, MetaTypeCondition metaTypeCondition, ParentPathCondition pathCondition, MimeTypeCondition mimeTypeCondition, FileSizeCondition fileSizeCondition, DateCondition dateCondition, Boolean exclusive)
 
DateCondition getDateCondition ()
 
FileNameCondition getFileNameCondition ()
 
FileSizeCondition getFileSizeCondition ()
 
MetaTypeCondition getMetaTypeCondition ()
 
MimeTypeCondition getMimeTypeCondition ()
 
String getName ()
 
ParentPathCondition getPathCondition ()
 
String getUuid ()
 
boolean isExclusive ()
 
boolean isSatisfied (AbstractFile file)
 
String toString ()
 

Private Attributes

final List< FileAttributeCondition > conditions = new ArrayList<>()
 
final DateCondition dateCondition
 
final Boolean exclusive
 
final FileNameCondition fileNameCondition
 
final FileSizeCondition fileSizeCondition
 
final MetaTypeCondition metaTypeCondition
 
final MimeTypeCondition mimeTypeCondition
 
final ParentPathCondition pathCondition
 
final String ruleName
 
final String uuid
 

Static Private Attributes

static final long serialVersionUID = 1L
 

Detailed Description

A set membership rule for an interesting files set. The immutability of a rule object allows it to be safely published to multiple threads.

Definition at line 272 of file FilesSet.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.Rule ( String  ruleName,
FileNameCondition  fileNameCondition,
MetaTypeCondition  metaTypeCondition,
ParentPathCondition  pathCondition,
MimeTypeCondition  mimeTypeCondition,
FileSizeCondition  fileSizeCondition,
DateCondition  dateCondition,
Boolean  exclusive 
)

Construct an interesting files set membership rule.

Parameters
ruleNameThe name of the rule. Can be empty string.
fileNameConditionA file name condition, may be null.
metaTypeConditionA file meta-type condition.
pathConditionA file path condition, may be null.
mimeTypeConditionA file mime type condition, may be null.
fileSizeConditionA file size condition, may be null.
dateConditionA file date created or modified condition, may be null
exclusiveWhether or not the rule excludes items matching the rule otherwise including them.

Definition at line 300 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.dateCondition, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.exclusive, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.fileNameCondition, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.fileSizeCondition, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.metaTypeCondition, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.mimeTypeCondition, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.pathCondition, and org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.ruleName.

Member Function Documentation

DateCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getDateCondition ( )
FileNameCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getFileNameCondition ( )

Get the file name condition for the rule.

Returns
A file name condition. Can be null.

Definition at line 361 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.fileNameCondition.

FileSizeCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getFileSizeCondition ( )
Returns
the file size condition. Can be null.

Definition at line 454 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.fileSizeCondition.

MetaTypeCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getMetaTypeCondition ( )

Get the meta-type condition for the rule.

Returns
A meta-type condition. Can be null.

Definition at line 370 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.metaTypeCondition.

MimeTypeCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getMimeTypeCondition ( )
Returns
the mime type condition. Can be null.

Definition at line 447 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.mimeTypeCondition.

String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getName ( )

Get the name of the rule.

Returns
A name string.

Definition at line 352 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.ruleName.

ParentPathCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getPathCondition ( )

Get the path condition for the rule.

Returns
A path condition, may be null.

Definition at line 379 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.pathCondition.

String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getUuid ( )
Returns
the ruleUUID

Definition at line 440 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.uuid.

boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.isExclusive ( )
Returns
True if this rule should exclude certain files matching criteria, otherwise including files matching criteria if false.

Definition at line 392 of file FilesSet.java.

boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.isSatisfied ( AbstractFile  file)

Determines whether or not a file satisfies the rule.

Parameters
fileThe file to test.
Returns
True if the rule is satisfied, false otherwise.

Definition at line 403 of file FilesSet.java.

String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.toString ( )

Member Data Documentation

final List<FileAttributeCondition> org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.conditions = new ArrayList<>()
private

Definition at line 284 of file FilesSet.java.

final DateCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.dateCondition
private
final Boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.exclusive
private
final FileNameCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.fileNameCondition
private
final FileSizeCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.fileSizeCondition
private
final MetaTypeCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.metaTypeCondition
private
final MimeTypeCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.mimeTypeCondition
private
final ParentPathCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.pathCondition
private
final String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.ruleName
private
final long org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.serialVersionUID = 1L
staticprivate

Definition at line 274 of file FilesSet.java.

final String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.uuid
private

The documentation for this class was generated from the following file:

Copyright © 2012-2022 Basis Technology. Generated on: Wed Oct 5 2022
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.