Classes
class	AppSQLiteDBFileBundle

Public Member Functions
AbstractFile	attachDatabase (DataSource dataSource, String dbName, String dbPath, String dbAlias) throws SQLException
void	close ()
boolean	columnExists (String tableName, String columnName) throws TskCoreException
void	detachDatabase (String dbAlias) throws SQLException
AbstractFile	getDBFile ()
ResultSet	runQuery (String queryStr) throws SQLException
boolean	tableExists (String tableName) throws TskCoreException

Static Public Member Functions
static Collection< AppSQLiteDB >	findAppDatabases (DataSource dataSource, String dbFileName, boolean matchExactName, String parentPathSubstr)

Private Member Functions
	AppSQLiteDB (AppSQLiteDBFileBundle appSQLiteDBFileBundle) throws ClassNotFoundException, SQLException

Static Private Member Functions
static Collection< AppSQLiteDBFileBundle >	findAndCopySQLiteDB (DataSource dataSource, String dbName, boolean matchExactName, String dbPath, boolean matchExactPath) throws TskCoreException
static void	findAndCopySQLiteMetaFile (AbstractFile sqliteFile, String metaFileName) throws NoCurrentCaseException, TskCoreException, IOException

Private Attributes
final Connection	connection
final AbstractFile	dbAbstractFile
final Logger	logger = Logger.getLogger(AppSQLiteDB.class.getName())
final Statement	statement

Detailed Description

An abstraction around an SQLite app DB found in a data source. This class makes a copy of it, along with any meta files (WAL, SHM), opens a SQLite connection to it, and runs queries on it.

Definition at line 48 of file AppSQLiteDB.java.

Constructor & Destructor Documentation

◆ AppSQLiteDB()

org.sleuthkit.autopsy.coreutils.AppSQLiteDB.AppSQLiteDB ( AppSQLiteDBFileBundle appSQLiteDBFileBundle ) throws ClassNotFoundException, SQLException

private

Definition at line 81 of file AppSQLiteDB.java.

References connection, and statement.

Referenced by attachDatabase(), findAndCopySQLiteDB(), and findAppDatabases().

Member Function Documentation

◆ attachDatabase()

AbstractFile org.sleuthkit.autopsy.coreutils.AppSQLiteDB.attachDatabase	(	DataSource	dataSource,
		String	dbName,
		String	dbPath,
		String	dbAlias ) throws SQLException

Attaches a database to the current connection.

Finds the specified database file in the specified folder. If found, makes copy of the database in the case folder and run ATTACH DATABASE sql.

Parameters

dataSource	data source in which to look file the db file
dbName	name of db file to look for
dbPath	path in which to look for the db file
dbAlias	alias name to attach the database as

Returns: abstract file for the matching db file. null if no match is found.

Exceptions

SQLException in case of an SQL error

Definition at line 150 of file AppSQLiteDB.java.

References AppSQLiteDB(), findAndCopySQLiteDB(), org.sleuthkit.autopsy.coreutils.Logger.getLogger(), and statement.

◆ close()

void org.sleuthkit.autopsy.coreutils.AppSQLiteDB.close ( )

Closes the DB connection.

Definition at line 278 of file AppSQLiteDB.java.

References connection, logger, and statement.

◆ columnExists()

boolean org.sleuthkit.autopsy.coreutils.AppSQLiteDB.columnExists	(	String	tableName,
		String	columnName ) throws TskCoreException

Checks if a column exists in a table.

Parameters

tableName	name of the table
columnName	column name to check

Returns: true if the column exists, false otherwise

Exceptions

TskCoreException

Definition at line 298 of file AppSQLiteDB.java.

References columnExists(), connection, and logger.

Referenced by columnExists().

◆ detachDatabase()

void org.sleuthkit.autopsy.coreutils.AppSQLiteDB.detachDatabase ( String dbAlias ) throws SQLException

Detaches the specified database from the connection

Parameters

dbAlias alias for database to detach

Exceptions

SQLException

Definition at line 250 of file AppSQLiteDB.java.

References statement.

◆ findAndCopySQLiteDB()

Collection< AppSQLiteDBFileBundle > org.sleuthkit.autopsy.coreutils.AppSQLiteDB.findAndCopySQLiteDB	(	DataSource	dataSource,
		String	dbName,
		boolean	matchExactName,
		String	dbPath,
		boolean	matchExactPath ) throws TskCoreException

staticprivate

Finds database file with the specified name, makes a copy of the file in the case directory, and returns the AbstractFile as well as the file copy.

Parameters

dataSource	data source to search in
dbName	db file name to search
matchExactName	whether to look for exact file name or a pattern match
dbPath	path to match
matchExactPath	whether to look for exact path name or a substring match

Returns: a collection of AppSQLiteDBFileBundle

Exceptions

TskCoreException

Definition at line 186 of file AppSQLiteDB.java.

References AppSQLiteDB(), findAndCopySQLiteMetaFile(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.coreutils.Logger.getLogger(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.casemodule.Case.getTempDirectory(), and org.sleuthkit.autopsy.datamodel.ContentUtils.writeToFile().

Referenced by attachDatabase(), and findAppDatabases().

◆ findAndCopySQLiteMetaFile()

void org.sleuthkit.autopsy.coreutils.AppSQLiteDB.findAndCopySQLiteMetaFile	(	AbstractFile	sqliteFile,
		String	metaFileName ) throws NoCurrentCaseException, TskCoreException, IOException

staticprivate

Searches for a meta file associated with the give SQLite database. If found, it copies this file into the temp directory of the current case.

Parameters

sqliteFile	file being processed
metaFileName	name of meta file to look for

Exceptions

NoCurrentCaseException	Case has been closed.
TskCoreException	fileManager cannot find AbstractFile files.
IOException	Issue during writing to file.

Definition at line 390 of file AppSQLiteDB.java.

References org.sleuthkit.autopsy.casemodule.services.FileManager.findFilesExactName(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.casemodule.services.Services.getFileManager(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.casemodule.Case.getTempDirectory(), and org.sleuthkit.autopsy.datamodel.ContentUtils.writeToFile().

Referenced by findAndCopySQLiteDB().

◆ findAppDatabases()

Collection< AppSQLiteDB > org.sleuthkit.autopsy.coreutils.AppSQLiteDB.findAppDatabases	(	DataSource	dataSource,
		String	dbFileName,
		boolean	matchExactName,
		String	parentPathSubstr )

static

Looks for application SQLite database files with a given name or name substring and a given parent path or parent path substring. For each database file found, a temporary copy is made and an open connection to the database in the form of an AppSQLiteDB object is created and returned.

Parameters

dataSource	The data source to be searched for the database files.
dbFileName	The database file name or file name substring for which to search.
matchExactName	Whether or not the database file name argument is the full database file name or a substring.
parentPathSubstr	The parent path substring, may pass the empty string to match any parent path.

Returns: A list, possibly empty, of AppSQLiteDB objects for the files that were found, copied, and connected to.

Definition at line 108 of file AppSQLiteDB.java.

References AppSQLiteDB(), findAndCopySQLiteDB(), and org.sleuthkit.autopsy.coreutils.Logger.getLogger().

◆ getDBFile()

AbstractFile org.sleuthkit.autopsy.coreutils.AppSQLiteDB.getDBFile ( )

Definition at line 129 of file AppSQLiteDB.java.

◆ runQuery()

ResultSet org.sleuthkit.autopsy.coreutils.AppSQLiteDB.runQuery ( String queryStr ) throws SQLException

Runs the given query on the database and returns result set.

Parameters

queryStr SQL string for the query to run

Returns: ResultSet from running the query.

Exceptions

SQLException in case of an error.

Definition at line 265 of file AppSQLiteDB.java.

References statement.

◆ tableExists()

boolean org.sleuthkit.autopsy.coreutils.AppSQLiteDB.tableExists ( String tableName ) throws TskCoreException

Checks if a table exists in the case database.

Parameters

tableName name of the table to check

Returns: true if the table exists, false otherwise

Exceptions

TskCoreException

Definition at line 342 of file AppSQLiteDB.java.

References connection, logger, and tableExists().

Referenced by tableExists().

Member Data Documentation

◆ connection

final Connection org.sleuthkit.autopsy.coreutils.AppSQLiteDB.connection

private

Definition at line 54 of file AppSQLiteDB.java.

Referenced by AppSQLiteDB(), close(), columnExists(), and tableExists().

◆ dbAbstractFile

final AbstractFile org.sleuthkit.autopsy.coreutils.AppSQLiteDB.dbAbstractFile

private

Definition at line 52 of file AppSQLiteDB.java.

◆ logger

final Logger org.sleuthkit.autopsy.coreutils.AppSQLiteDB.logger = Logger.getLogger(AppSQLiteDB.class.getName())

private

Definition at line 50 of file AppSQLiteDB.java.

Referenced by close(), columnExists(), and tableExists().

◆ statement

final Statement org.sleuthkit.autopsy.coreutils.AppSQLiteDB.statement

private

Definition at line 55 of file AppSQLiteDB.java.

Referenced by AppSQLiteDB(), attachDatabase(), close(), detachDatabase(), and runQuery().

The documentation for this class was generated from the following file:

/home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/coreutils/AppSQLiteDB.java

Classes

Public Member Functions

Static Public Member Functions

Private Member Functions

Static Private Member Functions

Private Attributes

Detailed Description

Constructor & Destructor Documentation

◆ AppSQLiteDB()

Member Function Documentation

◆ attachDatabase()

◆ close()

◆ columnExists()

◆ detachDatabase()

◆ findAndCopySQLiteDB()

◆ findAndCopySQLiteMetaFile()

◆ findAppDatabases()

◆ getDBFile()

◆ runQuery()

◆ tableExists()

Member Data Documentation

◆ connection

◆ dbAbstractFile

◆ logger

◆ statement