TskCaseDb Class Reference

Stores case-level information in a database on one or more disk images. More...

#include <tsk_case_db.h>

Public Member Functions
uint8_t	addImage (int numImg, const TSK_TCHAR *const imagePaths[], TSK_IMG_TYPE_ENUM imgType, unsigned int sSize)
	Add an image to the database. More...
void	clearLookupDatabases ()
TskAutoDb *	initAddImage ()
	Prepares the process to add an image to the database. More...
uint8_t	setKnownBadHashDb (TSK_TCHAR *const indexFile)
uint8_t	setNSRLHashDb (TSK_TCHAR *const indexFile)

Static Public Member Functions
static TskCaseDb *	newDb (const TSK_TCHAR *path)
	Creates a new single-user case with a new database and initializes its tables. More...
static TskCaseDb *	openDb (const TSK_TCHAR *path)
	Opens a single-user case from an existing database. More...

Public Attributes
unsigned int	m_tag

Detailed Description

Stores case-level information in a database on one or more disk images.

Member Function Documentation

uint8_t TskCaseDb::addImage	(	int	numImg,
		const TSK_TCHAR *const	imagePaths[],
		TSK_IMG_TYPE_ENUM	imgType,
		unsigned int	sSize
	)

Add an image to the database.

This method does not allow you to customize any of the settings for ingest (such as hash calculation, and block map population). Use TskCaseDb::initAddImage() to set these values.

Parameters

numImg	Number of images to add
imagePaths	Paths to the image splits to open.
imgType	TYpe of image format
sSize	Sector size of image

Returns

1 on error and 0 on success

References TskAutoDb::commitAddImage(), TskAutoDb::revertAddImage(), and TskAutoDb::startAddImage().

TskAutoDb * TskCaseDb::initAddImage

(

)

Prepares the process to add an image to the database.

This method allows the caller to specify options to be used during the ingest.

Returns

TskAutDb object that can be used to add the image.

TskCaseDb * TskCaseDb::newDb ( const TSK_TCHAR *  path )

static

Creates a new single-user case with a new database and initializes its tables.

Fails if there's already a file at the given path.

Parameters

path	Full path to create new database at.

Returns

Pointer to a new TskCaseDb object, NULL on error

References PRIttocTSK, tsk_error_reset(), tsk_error_set_errno(), and tsk_error_set_errstr().

TskCaseDb * TskCaseDb::openDb ( const TSK_TCHAR *  path )

static

Opens a single-user case from an existing database.

Parameters

path	Full path to open database from.

Returns

Pointer to a new TskCaseDb object, NULL on error

References PRIttocTSK, tsk_error_reset(), tsk_error_set_errno(), and tsk_error_set_errstr().

---

The documentation for this class was generated from the following files:

• tsk/auto/tsk_case_db.h
• tsk/auto/case_db.cpp