Inherits Closeable.

Classes
interface	FileAddProgressUpdater

Public Member Functions
	FileManager (SleuthkitCase caseDb)
LayoutFile	addCarvedFile (String fileName, long fileSize, long parentObjId, List< TskFileRange > layout) throws TskCoreException
List< LayoutFile >	addCarvedFiles (CarvingResult carvingResult) throws TskCoreException
List< LayoutFile >	addCarvedFiles (List< org.sleuthkit.datamodel.CarvedFileContainer > filesToAdd) throws TskCoreException
DerivedFile	addDerivedFile (String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails) throws TskCoreException
DerivedFile	addDerivedFile (String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType) throws TskCoreException
LocalFilesDataSource	addLocalFilesDataSource (String deviceId, String rootVirtualDirectoryName, String timeZone, Host host, List< String > localFilePaths, boolean createTimestamp, boolean accessTimestamp, boolean modifiedTimestamp, FileAddProgressUpdater progressUpdater) throws TskCoreException, TskDataException
LocalFilesDataSource	addLocalFilesDataSource (String deviceId, String rootVirtualDirectoryName, String timeZone, Host host, List< String > localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException, TskDataException
LocalFilesDataSource	addLocalFilesDataSource (String deviceId, String rootVirtualDirectoryName, String timeZone, List< String > localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException, TskDataException
VirtualDirectory	addLocalFilesDirs (List< String > localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException
void	close () throws IOException
List< AbstractFile >	findFiles (Content dataSource, String fileName) throws TskCoreException
List< AbstractFile >	findFiles (Content dataSource, String fileName, AbstractFile parent) throws TskCoreException
List< AbstractFile >	findFiles (Content dataSource, String fileName, String parentSubString) throws TskCoreException
List< AbstractFile >	findFiles (String fileName) throws TskCoreException
List< AbstractFile >	findFiles (String fileName, AbstractFile parent) throws TskCoreException
List< AbstractFile >	findFiles (String fileName, String parentSubString) throws TskCoreException
List< AbstractFile >	findFilesByMimeType (Collection< String > mimeTypes) throws TskCoreException
List< AbstractFile >	findFilesByMimeType (Content dataSource, Collection< String > mimeTypes) throws TskCoreException
List< AbstractFile >	findFilesByParentPath (long dataSourceObjectID, String parentPath) throws TskCoreException
List< AbstractFile >	findFilesExactName (long parentId, String name) throws TskCoreException
List< AbstractFile >	openFiles (Content dataSource, String filePath) throws TskCoreException
DerivedFile	updateDerivedFile (DerivedFile derivedFile, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, String mimeType, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType) throws TskCoreException

Private Member Functions
AbstractFile	addLocalFile (CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, boolean createTime, boolean accessTime, boolean modifiedTime, TskData.EncodingType encodingType, FileAddProgressUpdater progressUpdater) throws TskCoreException
AbstractFile	addLocalFile (CaseDbTransaction trans, SpecialDirectory parentDirectory, java.io.File localFile, FileAddProgressUpdater progressUpdater) throws TskCoreException
List< java.io.File >	getFilesAndDirectories (List< String > localFilePaths) throws TskDataException

Static Private Member Functions
static String	createFileTypeInCondition (Collection< String > mimeTypes)
static String	createParentPathCondition (long dataSourceObjectID, String parentPath)
static String	generateFilesDataSourceName (SleuthkitCase caseDb) throws TskCoreException

Private Attributes
final SleuthkitCase	caseDb

Static Private Attributes
static final Logger	LOGGER = Logger.getLogger(FileManager.class.getName())

Detailed Description

A manager that provides methods for retrieving files from the current case and for adding local files, carved files, and derived files to the current case.

Definition at line 62 of file FileManager.java.

Constructor & Destructor Documentation

◆ FileManager()

org.sleuthkit.autopsy.casemodule.services.FileManager.FileManager ( SleuthkitCase caseDb )

Constructs a manager that provides methods for retrieving files from the current case and for adding local files, carved files, and derived files to the current case.

Parameters

caseDb The case database.

Definition at line 74 of file FileManager.java.

References caseDb.

Member Function Documentation

◆ addCarvedFile()

LayoutFile org.sleuthkit.autopsy.casemodule.services.FileManager.addCarvedFile	(	String	fileName,
		long	fileSize,
		long	parentObjId,
		List< TskFileRange >	layout ) throws TskCoreException

Adds a carved file to the '$CarvedFiles' virtual directory of a data source, volume or file system.

Parameters

fileName	The name of the file.
fileSize	The size of the file.
parentObjId	The object id of the parent data source, volume or file system.
layout	A list of the offsets and sizes that gives the layout of the file within its parent.

Returns: A LayoutFile object representing the carved file.

Exceptions

TskCoreException if there is a problem adding the file to the case database.

Deprecated: Use List<LayoutFile> addCarvedFiles(CarvingResult carvingResult instead.

Definition at line 724 of file FileManager.java.

References caseDb.

◆ addCarvedFiles() [1/2]

List< LayoutFile > org.sleuthkit.autopsy.casemodule.services.FileManager.addCarvedFiles ( CarvingResult carvingResult ) throws TskCoreException

Adds a carving result to the case database.

Parameters

carvingResult The carving result (a set of carved files and their parent) to be added.

Returns: A list of LayoutFile representations of the carved files.

Exceptions

TskCoreException If there is a problem completing a case database operation.

Definition at line 382 of file FileManager.java.

References caseDb.

◆ addCarvedFiles() [2/2]

List< LayoutFile > org.sleuthkit.autopsy.casemodule.services.FileManager.addCarvedFiles ( List< org.sleuthkit.datamodel.CarvedFileContainer > filesToAdd ) throws TskCoreException

Adds a collection of carved files to the '$CarvedFiles' virtual directory of a data source, volume or file system.

Parameters

filesToAdd A collection of CarvedFileContainer objects, one per carved file, all of which must have the same parent object id.

Returns: A collection of LayoutFile object representing the carved files.

Exceptions

TskCoreException if there is a problem adding the files to the case database.

Deprecated: Use List<LayoutFile> addCarvedFiles(CarvingResult carvingResult instead.

Definition at line 748 of file FileManager.java.

References caseDb.

◆ addDerivedFile() [1/2]

DerivedFile org.sleuthkit.autopsy.casemodule.services.FileManager.addDerivedFile	(	String	fileName,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		boolean	isFile,
		AbstractFile	parentFile,
		String	rederiveDetails,
		String	toolName,
		String	toolVersion,
		String	otherDetails ) throws TskCoreException

Adds a derived file to the case.

Parameters

fileName	The name of the file.
localPath	The local path of the file, relative to the case folder and including the file name.
size	The size of the file in bytes.
ctime	The change time of the file.
crtime	The create time of the file
atime	The accessed time of the file.
mtime	The modified time of the file.
isFile	True if a file, false if a directory.
parentFile	The parent file from which the file was derived.
rederiveDetails	The details needed to re-derive file (will be specific to the derivation method), currently unused.
toolName	The name of the derivation method or tool, currently unused.
toolVersion	The version of the derivation method or tool, currently unused.
otherDetails	Other details of the derivation method or tool, currently unused.

Returns: A DerivedFile object representing the derived file.

Exceptions

TskCoreException if there is a problem adding the file to the case database.

Deprecated: Use the version with explicit EncodingType instead

Definition at line 783 of file FileManager.java.

References addDerivedFile().

◆ addDerivedFile() [2/2]

DerivedFile org.sleuthkit.autopsy.casemodule.services.FileManager.addDerivedFile	(	String	fileName,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		boolean	isFile,
		Content	parentObj,
		String	rederiveDetails,
		String	toolName,
		String	toolVersion,
		String	otherDetails,
		TskData.EncodingType	encodingType ) throws TskCoreException

Adds a derived file to the case.

Parameters

fileName	The name of the file.
localPath	The local path of the file, relative to the case folder and including the file name.
size	The size of the file in bytes.
ctime	The change time of the file.
crtime	The create time of the file
atime	The accessed time of the file.
mtime	The modified time of the file.
isFile	True if a file, false if a directory.
parentObj	The parent object from which the file was derived.
rederiveDetails	The details needed to re-derive file (will be specific to the derivation method), currently unused.
toolName	The name of the derivation method or tool, currently unused.
toolVersion	The version of the derivation method or tool, currently unused.
otherDetails	Other details of the derivation method or tool, currently unused.
encodingType	Type of encoding used on the file

Returns: A DerivedFile object representing the derived file.

Exceptions

TskCoreException if there is a problem adding the file to the case database.

Definition at line 317 of file FileManager.java.

References caseDb.

Referenced by addDerivedFile().

◆ addLocalFile() [1/2]

AbstractFile org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFile	(	CaseDbTransaction	trans,
		SpecialDirectory	parentDirectory,
		java.io.File	localFile,
		boolean	createTime,
		boolean	accessTime,
		boolean	modifiedTime,
		TskData.EncodingType	encodingType,
		FileAddProgressUpdater	progressUpdater ) throws TskCoreException

private

Adds a file or directory of logical/local files data source to the case database, recursively adding the contents of directories.

Parameters

trans	A case database transaction.
parentDirectory	The root virtual directory of the data source or the parent local directory.
localFile	The local/logical file or directory.
createTime	Boolean value to add the time the file was locally created
accessTime	Boolean value to add the time the file was locally modified
modifiedTime	Boolean value to add the time the file was last accessed
encodingType	Type of encoding used when storing the file
progressUpdater	Called after each file/directory is added to the case database.

Returns: An AbstractFile representation of the local/logical file.

Exceptions

TskCoreException If there is a problem completing a database operation.

Definition at line 616 of file FileManager.java.

References addLocalFile(), and caseDb.

Referenced by addLocalFile(), addLocalFile(), and addLocalFilesDataSource().

◆ addLocalFile() [2/2]

AbstractFile org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFile	(	CaseDbTransaction	trans,
		SpecialDirectory	parentDirectory,
		java.io.File	localFile,
		FileAddProgressUpdater	progressUpdater ) throws TskCoreException

private

Adds a file or directory of logical/local files data source to the case database, recursively adding the contents of directories.

Parameters

trans	A case database transaction.
parentDirectory	The root virtual directory of the data source or the parent local directory.
localFile	The local/logical file or directory.
progressUpdater	notifier to receive progress notifications on folders added, or null if not used. Called after each file/directory is added to the case database.

Returns: An AbstractFile representation of the local/logical file.

Exceptions

TskCoreException If there is a problem completing a database operation.

Deprecated: Use the version with explicit EncodingType instead

Definition at line 814 of file FileManager.java.

References addLocalFile().

◆ addLocalFilesDataSource() [1/3]

LocalFilesDataSource org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFilesDataSource	(	String	deviceId,
		String	rootVirtualDirectoryName,
		String	timeZone,
		Host	host,
		List< String >	localFilePaths,
		boolean	createTimestamp,
		boolean	accessTimestamp,
		boolean	modifiedTimestamp,
		FileAddProgressUpdater	progressUpdater ) throws TskCoreException, TskDataException

Adds a set of local/logical files and/or directories to the case database as data source.

Parameters

deviceId	An ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID).
rootVirtualDirectoryName	The name to give to the virtual directory that will serve as the root for the local/logical files and/or directories that compose the data source. Pass the empty string to get a default name of the form: LogicalFileSet[N]
timeZone	The time zone used to process the data source, may be the empty string.
host	The host for this data source (may be null).
localFilePaths	A list of local/logical file and/or directory localFilePaths.
createTime	Boolean value to add the time the file was locally created
accessTime	Boolean value to add the time the file was last accessed
modifiedTime	Boolean value to add the time the file was locally modified
progressUpdater	Called after each file/directory is added to the case database.

Returns: A local files data source object.

Exceptions

TskCoreException	If there is a problem completing a database operation.
TskDataException	if any of the local file paths is for a file or directory that does not exist or cannot be read.

Definition at line 496 of file FileManager.java.

References addLocalFile(), caseDb, org.sleuthkit.autopsy.ingest.IngestServices.fireModuleContentEvent(), generateFilesDataSourceName(), getFilesAndDirectories(), org.sleuthkit.autopsy.ingest.IngestServices.getInstance(), and LOGGER.

◆ addLocalFilesDataSource() [2/3]

LocalFilesDataSource org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFilesDataSource	(	String	deviceId,
		String	rootVirtualDirectoryName,
		String	timeZone,
		Host	host,
		List< String >	localFilePaths,
		FileAddProgressUpdater	progressUpdater ) throws TskCoreException, TskDataException

Adds a set of local/logical files and/or directories to the case database as data source.

Parameters

deviceId	An ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID).
rootVirtualDirectoryName	The name to give to the virtual directory that will serve as the root for the local/logical files and/or directories that compose the data source. Pass the empty string to get a default name of the form: LogicalFileSet[N]
timeZone	The time zone used to process the data source, may be the empty string.
host	The host for this data source (may be null).
localFilePaths	A list of local/logical file and/or directory localFilePaths.
progressUpdater	Called after each file/directory is added to the case database.

Returns: A local files data source object.

Exceptions

TskCoreException	If there is a problem completing a database operation.
TskDataException	if any of the local file paths is for a file or directory that does not exist or cannot be read.

Definition at line 460 of file FileManager.java.

References addLocalFilesDataSource().

◆ addLocalFilesDataSource() [3/3]

LocalFilesDataSource org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFilesDataSource	(	String	deviceId,
		String	rootVirtualDirectoryName,
		String	timeZone,
		List< String >	localFilePaths,
		FileAddProgressUpdater	progressUpdater ) throws TskCoreException, TskDataException

Adds a set of local/logical files and/or directories to the case database as data source.

Parameters

deviceId	An ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID).
rootVirtualDirectoryName	The name to give to the virtual directory that will serve as the root for the local/logical files and/or directories that compose the data source. Pass the empty string to get a default name of the form: LogicalFileSet[N]
timeZone	The time zone used to process the data source, may be the empty string.
localFilePaths	A list of local/logical file and/or directory localFilePaths.
progressUpdater	Called after each file/directory is added to the case database.

Returns: A local files data source object.

Exceptions

TskCoreException	If there is a problem completing a database operation.
TskDataException	if any of the local file paths is for a file or directory that does not exist or cannot be read.

Definition at line 428 of file FileManager.java.

References addLocalFilesDataSource().

Referenced by addLocalFilesDataSource(), addLocalFilesDataSource(), and addLocalFilesDirs().

◆ addLocalFilesDirs()

VirtualDirectory org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFilesDirs	(	List< String >	localFilePaths,
		FileAddProgressUpdater	progressUpdater ) throws TskCoreException

Adds a set of local/logical files and/or directories to the case database as data source.

Parameters

localFilePaths	A list of local/logical file and/or directory localFilePaths.
progressUpdater	Called after each file/directory is added to the case database.

Returns: The root virtual directory for the local/logical files data source.

Exceptions

TskCoreException If any of the local file paths is for a file or directory that does not exist or cannot be read, or there is a problem completing a database operation.

Deprecated: Use addLocalFilesDataSource instead.

Definition at line 697 of file FileManager.java.

References addLocalFilesDataSource().

◆ close()

void org.sleuthkit.autopsy.casemodule.services.FileManager.close ( ) throws IOException

Closes the file manager.

Exceptions

IOException If there is a problem closing the file manager.

Deprecated: Do not use.

Definition at line 671 of file FileManager.java.

◆ createFileTypeInCondition()

String org.sleuthkit.autopsy.casemodule.services.FileManager.createFileTypeInCondition ( Collection< String > mimeTypes )

staticprivate

Converts a list of MIME types into an SQL "mime_type IN" condition.

Parameters

mimeTypes The MIIME types.

Returns: The condition string.

Definition at line 145 of file FileManager.java.

Referenced by findFilesByMimeType(), and findFilesByMimeType().

◆ createParentPathCondition()

String org.sleuthkit.autopsy.casemodule.services.FileManager.createParentPathCondition	(	long	dataSourceObjectID,
		String	parentPath )

staticprivate

Converts a data source object id and a parent path into SQL data_source_obj_id = ? AND parent_path LIKE ?%

Parameters

dataSourceObjectID
parentPath

Returns

Definition at line 159 of file FileManager.java.

Referenced by findFilesByParentPath().

◆ findFiles() [1/6]

List< AbstractFile > org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles	(	Content	dataSource,
		String	fileName ) throws TskCoreException

Finds all files and directories with a given file name in a given data source (image, local/logical files set, etc.). The name search is for full or partial matches and is case insensitive (a case insensitive SQL LIKE clause is used to query the case database).

Parameters

dataSource	The data source.
fileName	The full name or a pattern to match on part of the name

Returns: The matching files and directories.

Exceptions

TskCoreException if there is a problem querying the case database.

Definition at line 241 of file FileManager.java.

References caseDb.

◆ findFiles() [2/6]

List< AbstractFile > org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles	(	Content	dataSource,
		String	fileName,
		AbstractFile	parent ) throws TskCoreException

Finds all files and directories with a given file name and given parent file or directory in a given data source (image, local/logical files set, etc.). The name search is for full or partial matches and is case insensitive (a case insensitive SQL LIKE clause is used to query the case database).

Parameters

dataSource	The data source.
fileName	The full name or a pattern to match on part of the name
parent	The parent file or directory.

Returns: The matching files and directories.

Exceptions

TskCoreException if there is a problem querying the case database.

Deprecated: Use version without the unnecessary dataSource argument

Definition at line 837 of file FileManager.java.

References findFiles().

◆ findFiles() [3/6]

List< AbstractFile > org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles	(	Content	dataSource,
		String	fileName,
		String	parentSubString ) throws TskCoreException

Finds all files and directories with a given file name and parent file or directory name in a given data source (image, local/logical files set, etc.). The name searches are for full or partial matches and are case insensitive (a case insensitive SQL LIKE clause is used to query the case database).

Parameters

dataSource	The data source.
fileName	The full name or a pattern to match on part of the name
parentSubString	Substring that must exist in parent path. Will be surrounded by % in LIKE query.

Returns: The matching files and directories.

Exceptions

TskCoreException if there is a problem querying the case database.

Definition at line 263 of file FileManager.java.

References caseDb.

◆ findFiles() [4/6]

List< AbstractFile > org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles ( String fileName ) throws TskCoreException

Finds all files and directories with a given file name. The name search is for full or partial matches and is case insensitive (a case insensitive SQL LIKE clause is used to query the case database).

Parameters

fileName The full name or a pattern to match on part of the name

Returns: The matching files and directories.

Exceptions

TskCoreException if there is a problem querying the case database.

Definition at line 175 of file FileManager.java.

References caseDb, and findFiles().

Referenced by org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.extractFilesFromDataSource(), org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.extractFilesFromDataSource(), org.sleuthkit.autopsy.modules.leappanalyzers.LeappFileProcessor.findAbstractFile(), findFiles(), findFiles(), findFiles(), org.sleuthkit.autopsy.modules.leappanalyzers.ALeappAnalyzerIngestModule.hasAndroidIndicatorFiles(), and org.sleuthkit.autopsy.modules.leappanalyzers.ILeappAnalyzerIngestModule.hasIOSIndicatorFiles().

◆ findFiles() [5/6]

List< AbstractFile > org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles	(	String	fileName,
		AbstractFile	parent ) throws TskCoreException

Finds all files and directories with a given file name and parent file or directory. The name search is for full or partial matches and is case insensitive (a case insensitive SQL LIKE clause is used to query the case database).

Parameters

fileName	The full name or a pattern to match on part of the name
parent	The parent file or directory.

Returns: The matching files and directories.

Exceptions

TskCoreException if there is a problem querying the case database.

Definition at line 223 of file FileManager.java.

References caseDb.

◆ findFiles() [6/6]

List< AbstractFile > org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles	(	String	fileName,
		String	parentSubString ) throws TskCoreException

Finds all files and directories with a given file name and parent file or directory name. The name searches are for full or partial matches and are case insensitive (a case insensitive SQL LIKE clause is used to query the case database).

Parameters

fileName	The full name or a pattern to match on part of the name
parentSubString	Substring that must exist in parent path. Will be surrounded by % in LIKE query.

Returns: The matching files and directories.

Exceptions

TskCoreException if there is a problem querying the case database.

Definition at line 200 of file FileManager.java.

References caseDb, and findFiles().

◆ findFilesByMimeType() [1/2]

List< AbstractFile > org.sleuthkit.autopsy.casemodule.services.FileManager.findFilesByMimeType ( Collection< String > mimeTypes ) throws TskCoreException

Finds all files with types that match one of a collection of MIME types.

Parameters

mimeTypes The MIME types.

Returns: The files.

Exceptions

TskCoreException If there is a problem querying the case database.

Definition at line 88 of file FileManager.java.

References caseDb, and createFileTypeInCondition().

◆ findFilesByMimeType() [2/2]

List< AbstractFile > org.sleuthkit.autopsy.casemodule.services.FileManager.findFilesByMimeType	(	Content	dataSource,
		Collection< String >	mimeTypes ) throws TskCoreException

Finds all files in a given data source (image, local/logical files set, etc.) with types that match one of a collection of MIME types.

Parameters

dataSource	The data source.
mimeTypes	The MIME types.

Returns: The files.

Exceptions

TskCoreException If there is a problem querying the case database.

Definition at line 120 of file FileManager.java.

References caseDb, and createFileTypeInCondition().

◆ findFilesByParentPath()

List< AbstractFile > org.sleuthkit.autopsy.casemodule.services.FileManager.findFilesByParentPath	(	long	dataSourceObjectID,
		String	parentPath ) throws TskCoreException

Finds all parent_paths that match the specified parentPath and are in the specified data source.

Parameters

dataSourceObjectID	- the id of the data source to get files from
parentPath	- the parent path that all files should be like

Returns: The list of files

Exceptions

TskCoreException If there is a problem querying the case database.

Definition at line 104 of file FileManager.java.

References caseDb, and createParentPathCondition().

◆ findFilesExactName()

List< AbstractFile > org.sleuthkit.autopsy.casemodule.services.FileManager.findFilesExactName	(	long	parentId,
		String	name ) throws TskCoreException

Find all files with the exact given name and parentId.

Parameters

parentId	Id of the parent folder to search.
name	Exact file name to match.

Returns: A list of matching files.

Exceptions

TskCoreException

Definition at line 134 of file FileManager.java.

References caseDb.

Referenced by org.sleuthkit.autopsy.coreutils.AppSQLiteDB.findAndCopySQLiteMetaFile(), and org.sleuthkit.autopsy.coreutils.SQLiteTableReader.findAndCopySQLiteMetaFile().

◆ generateFilesDataSourceName()

String org.sleuthkit.autopsy.casemodule.services.FileManager.generateFilesDataSourceName ( SleuthkitCase caseDb ) throws TskCoreException

staticprivate

Generates a name for the root virtual directory for the data source.

NOTE: Although this method is guarded by the file manager's monitor, there is currently a minimal chance of default name duplication for multi-user cases with multiple FileManagers running on different nodes.

Returns: A default name for a local/logical files data source of the form: LogicalFileSet[N].

Exceptions

TskCoreException If there is a problem querying the case database.

Definition at line 557 of file FileManager.java.

References caseDb, and org.sleuthkit.autopsy.datamodel.VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX.

Referenced by addLocalFilesDataSource().

◆ getFilesAndDirectories()

List< java.io.File > org.sleuthkit.autopsy.casemodule.services.FileManager.getFilesAndDirectories ( List< String > localFilePaths ) throws TskDataException

private

Converts a list of local/logical file and/or directory paths to a list of file objects.

Parameters

localFilePaths A list of local/logical file and/or directory paths.

Returns: A list of file objects.

Exceptions

TskDataException if any of the paths is for a file or directory that does not exist or cannot be read.

Definition at line 584 of file FileManager.java.

Referenced by addLocalFilesDataSource().

◆ openFiles()

List< AbstractFile > org.sleuthkit.autopsy.casemodule.services.FileManager.openFiles	(	Content	dataSource,
		String	filePath ) throws TskCoreException

Finds all files and directories with a given file name and path in a given data source (image, local/logical files set, etc.). The name search is for full or partial matches and is case insensitive (a case insensitive SQL LIKE clause is used to query the case database). Any path components at the volume level and above are removed for the search.

Parameters

dataSource	The data source.
filePath	The file path (path components volume at the volume level or above will be removed).

Returns: The matching files and directories.

Exceptions

TskCoreException if there is a problem querying the case database.

Definition at line 284 of file FileManager.java.

References caseDb.

◆ updateDerivedFile()

DerivedFile org.sleuthkit.autopsy.casemodule.services.FileManager.updateDerivedFile	(	DerivedFile	derivedFile,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		boolean	isFile,
		String	mimeType,
		String	rederiveDetails,
		String	toolName,
		String	toolVersion,
		String	otherDetails,
		TskData.EncodingType	encodingType ) throws TskCoreException

Update a derived file which already exists in the the case.

Parameters

derivedFile	The derived file you wish to update
localPath	The local path of the file, relative to the case folder and including the file name.
size	The size of the file in bytes.
ctime	The change time of the file.
crtime	The create time of the file
atime	The accessed time of the file.
mimeType	The MIME type the updated file should have, null to unset it
mtime	The modified time of the file.
isFile	True if a file, false if a directory.
rederiveDetails	The details needed to re-derive file (will be specific to the derivation method), currently unused.
toolName	The name of the derivation method or tool, currently unused.
toolVersion	The version of the derivation method or tool, currently unused.
otherDetails	Other details of the derivation method or tool, currently unused.
encodingType	Type of encoding used on the file

Returns: A DerivedFile object representing the derived file.

Exceptions

TskCoreException if there is a problem adding the file to the case database.

Definition at line 360 of file FileManager.java.

References caseDb.

Member Data Documentation

◆ caseDb

final SleuthkitCase org.sleuthkit.autopsy.casemodule.services.FileManager.caseDb

private

Definition at line 65 of file FileManager.java.

Referenced by FileManager(), addCarvedFile(), addCarvedFiles(), addCarvedFiles(), addDerivedFile(), addLocalFile(), addLocalFilesDataSource(), findFiles(), findFiles(), findFiles(), findFiles(), findFiles(), findFilesByMimeType(), findFilesByMimeType(), findFilesByParentPath(), findFilesExactName(), generateFilesDataSourceName(), openFiles(), and updateDerivedFile().

◆ LOGGER

final Logger org.sleuthkit.autopsy.casemodule.services.FileManager.LOGGER = Logger.getLogger(FileManager.class.getName())

staticprivate

Definition at line 64 of file FileManager.java.

Referenced by addLocalFilesDataSource().

The documentation for this class was generated from the following file:

/home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java

Classes

Public Member Functions

Private Member Functions

Static Private Member Functions

Private Attributes

Static Private Attributes

Detailed Description

Constructor & Destructor Documentation

◆ FileManager()

Member Function Documentation

◆ addCarvedFile()

◆ addCarvedFiles() [1/2]

◆ addCarvedFiles() [2/2]

◆ addDerivedFile() [1/2]

◆ addDerivedFile() [2/2]

◆ addLocalFile() [1/2]

◆ addLocalFile() [2/2]

◆ addLocalFilesDataSource() [1/3]

◆ addLocalFilesDataSource() [2/3]

◆ addLocalFilesDataSource() [3/3]

◆ addLocalFilesDirs()

◆ close()

◆ createFileTypeInCondition()

◆ createParentPathCondition()

◆ findFiles() [1/6]

◆ findFiles() [2/6]

◆ findFiles() [3/6]

◆ findFiles() [4/6]

◆ findFiles() [5/6]

◆ findFiles() [6/6]

◆ findFilesByMimeType() [1/2]

◆ findFilesByMimeType() [2/2]

◆ findFilesByParentPath()

◆ findFilesExactName()

◆ generateFilesDataSourceName()

◆ getFilesAndDirectories()

◆ openFiles()

◆ updateDerivedFile()

Member Data Documentation

◆ caseDb

◆ LOGGER