Classes
class	AppSQLiteDBFileBundle

Public Member Functions
AbstractFile	attachDatabase (DataSource dataSource, String dbName, String dbPath, String dbAlias) throws SQLException

void	close ()

boolean	columnExists (String tableName, String columnName) throws TskCoreException

void	detachDatabase (String dbAlias) throws SQLException

AbstractFile	getDBFile ()

ResultSet	runQuery (String queryStr) throws SQLException

boolean	tableExists (String tableName) throws TskCoreException

Static Public Member Functions
static Collection< AppSQLiteDB >	findAppDatabases (DataSource dataSource, String dbFileName, boolean matchExactName, String parentPathSubstr)

Private Member Functions
	AppSQLiteDB (AppSQLiteDBFileBundle appSQLiteDBFileBundle) throws ClassNotFoundException, SQLException

Static Private Member Functions
static Collection< AppSQLiteDBFileBundle >	findAndCopySQLiteDB (DataSource dataSource, String dbName, boolean matchExactName, String dbPath, boolean matchExactPath) throws TskCoreException

static void	findAndCopySQLiteMetaFile (AbstractFile sqliteFile, String metaFileName) throws NoCurrentCaseException, TskCoreException, IOException

Private Attributes
final Connection	connection

final AbstractFile	dbAbstractFile

final Logger	logger = Logger.getLogger(AppSQLiteDB.class.getName())

final Statement	statement

Detailed Description

An abstraction around an SQLite app DB found in a data source. This class makes a copy of it, along with any meta files (WAL, SHM), opens a SQLite connection to it, and runs queries on it.

Definition at line 48 of file AppSQLiteDB.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.coreutils.AppSQLiteDB.AppSQLiteDB ( AppSQLiteDBFileBundle appSQLiteDBFileBundle ) throws ClassNotFoundException, SQLException

private

Definition at line 81 of file AppSQLiteDB.java.

Referenced by org.sleuthkit.autopsy.coreutils.AppSQLiteDB.findAppDatabases().

Member Function Documentation

AbstractFile org.sleuthkit.autopsy.coreutils.AppSQLiteDB.attachDatabase	(	DataSource	dataSource,
		String	dbName,
		String	dbPath,
		String	dbAlias
	)		throws SQLException

Attaches a database to the current connection.

Finds the specified database file in the specified folder. If found, makes copy of the database in the case folder and run ATTACH DATABASE sql.

Parameters

dataSource	data source in which to look file the db file
dbName	name of db file to look for
dbPath	path in which to look for the db file
dbAlias	alias name to attach the database as

Returns: abstract file for the matching db file. null if no match is found.

Exceptions

SQLException in case of an SQL error

Definition at line 150 of file AppSQLiteDB.java.

References org.sleuthkit.autopsy.coreutils.AppSQLiteDB.findAndCopySQLiteDB(), and org.sleuthkit.autopsy.coreutils.Logger.getLogger().

void org.sleuthkit.autopsy.coreutils.AppSQLiteDB.close ( )

Closes the DB connection.

Definition at line 278 of file AppSQLiteDB.java.

boolean org.sleuthkit.autopsy.coreutils.AppSQLiteDB.columnExists	(	String	tableName,
		String	columnName
	)		throws TskCoreException

Checks if a column exists in a table.

Parameters

tableName	name of the table
columnName	column name to check

Returns: true if the column exists, false otherwise

Exceptions

TskCoreException

Definition at line 298 of file AppSQLiteDB.java.

void org.sleuthkit.autopsy.coreutils.AppSQLiteDB.detachDatabase ( String dbAlias ) throws SQLException

Detaches the specified database from the connection

Parameters

dbAlias alias for database to detach

Exceptions

SQLException

Definition at line 250 of file AppSQLiteDB.java.

static Collection<AppSQLiteDBFileBundle> org.sleuthkit.autopsy.coreutils.AppSQLiteDB.findAndCopySQLiteDB	(	DataSource	dataSource,
		String	dbName,
		boolean	matchExactName,
		String	dbPath,
		boolean	matchExactPath
	)		throws TskCoreException

staticprivate

Finds database file with the specified name, makes a copy of the file in the case directory, and returns the AbstractFile as well as the file copy.

Parameters

dataSource	data source to search in
dbName	db file name to search
matchExactName	whether to look for exact file name or a pattern match
dbPath	path to match
matchExactPath	whether to look for exact path name or a substring match

Returns: a collection of AppSQLiteDBFileBundle

Exceptions

TskCoreException

Definition at line 186 of file AppSQLiteDB.java.

References org::sleuthkit::datamodel::SleuthkitCase.escapeSingleQuotes(), org::sleuthkit::datamodel::SleuthkitCase.findAllFilesWhere(), org.sleuthkit.autopsy.coreutils.AppSQLiteDB.findAndCopySQLiteMetaFile(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.coreutils.Logger.getLogger(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.casemodule.Case.getTempDirectory(), and org.sleuthkit.autopsy.datamodel.ContentUtils.writeToFile().

Referenced by org.sleuthkit.autopsy.coreutils.AppSQLiteDB.attachDatabase(), and org.sleuthkit.autopsy.coreutils.AppSQLiteDB.findAppDatabases().

static void org.sleuthkit.autopsy.coreutils.AppSQLiteDB.findAndCopySQLiteMetaFile	(	AbstractFile	sqliteFile,
		String	metaFileName
	)		throws NoCurrentCaseException, TskCoreException, IOException

staticprivate

Searches for a meta file associated with the give SQLite database. If found, it copies this file into the temp directory of the current case.

Parameters

sqliteFile	file being processed
metaFileName	name of meta file to look for

Exceptions

NoCurrentCaseException	Case has been closed.
TskCoreException	fileManager cannot find AbstractFile files.
IOException	Issue during writing to file.

Definition at line 390 of file AppSQLiteDB.java.

References org.sleuthkit.autopsy.casemodule.services.FileManager.findFilesExactName(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.casemodule.services.Services.getFileManager(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.casemodule.Case.getTempDirectory(), and org.sleuthkit.autopsy.datamodel.ContentUtils.writeToFile().

Referenced by org.sleuthkit.autopsy.coreutils.AppSQLiteDB.findAndCopySQLiteDB().

static Collection<AppSQLiteDB> org.sleuthkit.autopsy.coreutils.AppSQLiteDB.findAppDatabases	(	DataSource	dataSource,
		String	dbFileName,
		boolean	matchExactName,
		String	parentPathSubstr
	)

static

Looks for application SQLite database files with a given name or name substring and a given parent path or parent path substring. For each database file found, a temporary copy is made and an open connection to the database in the form of an AppSQLiteDB object is created and returned.

Parameters

dataSource	The data source to be searched for the database files.
dbFileName	The database file name or file name substring for which to search.
matchExactName	Whether or not the database file name argument is the full database file name or a substring.
parentPathSubstr	The parent path substring, may pass the empty string to match any parent path.

Returns: A list, possibly empty, of AppSQLiteDB objects for the files that were found, copied, and connected to.

Definition at line 108 of file AppSQLiteDB.java.

References org.sleuthkit.autopsy.coreutils.AppSQLiteDB.AppSQLiteDB(), org.sleuthkit.autopsy.coreutils.AppSQLiteDB.findAndCopySQLiteDB(), and org.sleuthkit.autopsy.coreutils.Logger.getLogger().

AbstractFile org.sleuthkit.autopsy.coreutils.AppSQLiteDB.getDBFile ( )

Definition at line 129 of file AppSQLiteDB.java.

References org.sleuthkit.autopsy.coreutils.AppSQLiteDB.dbAbstractFile.

ResultSet org.sleuthkit.autopsy.coreutils.AppSQLiteDB.runQuery ( String queryStr ) throws SQLException

Runs the given query on the database and returns result set.

Parameters

queryStr SQL string for the query to run

Returns: ResultSet from running the query.

Exceptions

SQLException in case of an error.

Definition at line 265 of file AppSQLiteDB.java.

boolean org.sleuthkit.autopsy.coreutils.AppSQLiteDB.tableExists ( String tableName ) throws TskCoreException

Checks if a table exists in the case database.

Parameters

tableName name of the table to check

Returns: true if the table exists, false otherwise

Exceptions

TskCoreException

Definition at line 342 of file AppSQLiteDB.java.

Member Data Documentation

final Connection org.sleuthkit.autopsy.coreutils.AppSQLiteDB.connection

private

Definition at line 54 of file AppSQLiteDB.java.

final AbstractFile org.sleuthkit.autopsy.coreutils.AppSQLiteDB.dbAbstractFile

private

Definition at line 52 of file AppSQLiteDB.java.

Referenced by org.sleuthkit.autopsy.coreutils.AppSQLiteDB.getDBFile().

final Logger org.sleuthkit.autopsy.coreutils.AppSQLiteDB.logger = Logger.getLogger(AppSQLiteDB.class.getName())

private

Definition at line 50 of file AppSQLiteDB.java.

final Statement org.sleuthkit.autopsy.coreutils.AppSQLiteDB.statement

private

Definition at line 55 of file AppSQLiteDB.java.

The documentation for this class was generated from the following file:

/home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java

Classes

Public Member Functions

Static Public Member Functions

Private Member Functions

Static Private Member Functions

Private Attributes

Detailed Description

Constructor & Destructor Documentation

Member Function Documentation

Member Data Documentation