Autopsy  4.21.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.modules.interestingitems.FilesSet Class Reference

Inherits Serializable.

Classes

class  Rule
 

Public Member Functions

 FilesSet (String name, String description, boolean ignoreKnownFiles, boolean ignoreUnallocatedSpace, Map< String, Rule > rules)
 
 FilesSet (String name, String description, boolean ignoreKnownFiles, boolean ignoreUnallocatedSpace, Map< String, Rule > rules, boolean standardSet, int versionNumber)
 
String fileIsMemberOf (AbstractFile file)
 
String getDescription ()
 
String getName ()
 
Map< String, RulegetRules ()
 
boolean ignoresKnownFiles ()
 
boolean ingoresUnallocatedSpace ()
 
String toString ()
 

Private Member Functions

void divideInclusiveExclusive ()
 

Private Attributes

final String description
 
Map< String, RuleexclusiveRules
 
final boolean ignoreKnownFiles
 
final boolean ignoreUnallocatedSpace
 
Map< String, RuleinclusiveRules
 
final String name
 
final Map< String, Rulerules
 
final boolean standardSet
 
final int versionNumber
 

Static Private Attributes

static final long serialVersionUID = 1L
 

Detailed Description

A collection of set membership rules that define an interesting files set. The rules are independent, i.e., if any rule is satisfied by a file, the file belongs to the set.

Interesting files set definition objects are immutable, so they may be safely published to multiple threads.

Definition at line 43 of file FilesSet.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.modules.interestingitems.FilesSet.FilesSet ( String  name,
String  description,
boolean  ignoreKnownFiles,
boolean  ignoreUnallocatedSpace,
Map< String, Rule rules 
)

Constructs an interesting files set.

Parameters
nameThe name of the set.
descriptionA description of the set, may be null.
ignoreKnownFilesWhether or not to exclude known files from the set.
ignoreUnallocatedSpaceWhether or not to exclude unallocated space from the set.
rulesThe rules that define the set. May be null, but a set with no rules is the empty set.

Definition at line 74 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.description, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreKnownFiles, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreUnallocatedSpace, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.name, and org.sleuthkit.autopsy.modules.interestingitems.FilesSet.rules.

org.sleuthkit.autopsy.modules.interestingitems.FilesSet.FilesSet ( String  name,
String  description,
boolean  ignoreKnownFiles,
boolean  ignoreUnallocatedSpace,
Map< String, Rule rules,
boolean  standardSet,
int  versionNumber 
)

Constructs an interesting files set.

Parameters
nameThe name of the set.
descriptionA description of the set, may be null.
ignoreKnownFilesWhether or not to exclude known files from the set.
ignoreUnallocatedSpaceWhether or not to exclude unallocated space from the set.
standardSetWhether or not the FilesSet is considered a standard interesting set file.
versionNumberThe versionNumber for the FilesSet so that older versions can be replaced with newer versions.
rulesThe rules that define the set. May be null, but a set with no rules is the empty set.

Definition at line 95 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.divideInclusiveExclusive(), org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreKnownFiles, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreUnallocatedSpace, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.name, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.rules, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.standardSet, and org.sleuthkit.autopsy.modules.interestingitems.FilesSet.versionNumber.

Member Function Documentation

void org.sleuthkit.autopsy.modules.interestingitems.FilesSet.divideInclusiveExclusive ( )
private
String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.fileIsMemberOf ( AbstractFile  file)

Determines whether a file is a member of this interesting files set.

Parameters
fileA file to test for set membership.
Returns
The name of the first set membership rule satisfied by the file, will be null if the file does not belong to the set.

Definition at line 214 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.divideInclusiveExclusive().

String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getDescription ( )
String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getName ( )
Map<String, Rule> org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getRules ( )
boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoresKnownFiles ( )

Returns whether or not this interesting files set ignores known files, i.e., files marked as known by a look up in a known files hash set such as the National Software Reference Library (NSRL). Note that the interesting files set does not do hash set look ups; it simply queries the known status of the files when testing them for set membership.

Returns
True if known files are ignored, false otherwise.

Definition at line 179 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreKnownFiles.

Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.replaceFilesSet(), and org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.SetsListSelectionListener.valueChanged().

boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ingoresUnallocatedSpace ( )
String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.toString ( )

Member Data Documentation

final String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.description
private
Map<String, Rule> org.sleuthkit.autopsy.modules.interestingitems.FilesSet.exclusiveRules
private
final boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreKnownFiles
private
final boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreUnallocatedSpace
private
Map<String, Rule> org.sleuthkit.autopsy.modules.interestingitems.FilesSet.inclusiveRules
private
final String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.name
private
final Map<String, Rule> org.sleuthkit.autopsy.modules.interestingitems.FilesSet.rules
private
final long org.sleuthkit.autopsy.modules.interestingitems.FilesSet.serialVersionUID = 1L
staticprivate

Definition at line 45 of file FilesSet.java.

final boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.standardSet
private
final int org.sleuthkit.autopsy.modules.interestingitems.FilesSet.versionNumber
private

The documentation for this class was generated from the following file:

Copyright © 2012-2022 Basis Technology. Generated on: Tue Feb 6 2024
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.