|
The Sleuth Kit Framework
4.1
|
| Abstract base interface class for container extractor classes | |
| Interface for class that will carve an unallocated sectors image file | |
| Interface for class that prepares for later carving | |
| Logging class to enable the framework, apps that use it, and modules to log error and warning messages | |
| Interface for class that will handle scheduling of tasks | |
| Describes a single task to be scheduled or perform | |
| Stores a list of runs (which have a starting sector and length) | |
| Contains data about the mapping of data in the unallocated chunks back to their original location in the disk image | |
| Class used to store the pair of type and display names of artifacts | |
| Class used to store the pair of type and display names of attributes | |
| Implements TskAuto and is used to analyze the data in a disk image and populate TskImgDB with the results | |
| An interface for setting and retrieving name/value pairs to the blackboard | |
| Class that represents a blackboard artifact object | |
| Class that represents a blackboard attribute object | |
| Contains data for a blackboard entry for a given file and artifact ID | |
| Contains data derived from joining carved file records from multiple tables in the image database | |
| Implements the CarveExtract interface to carve unallocated sectors image files using Scalpel | |
| Implements the CarvePrep abstract interface | |
| An implementation of TskBlackboard that stores the name / value pairs in the TskImgDB | |
| Framework exception class | |
| Supports launching a process via an executable file to perform some analysis on a TskFile object in a TskPipeline | |
| An interface that is used to represent a file | |
| Controls the processing of a file analysis pipeline | |
| Supports the loading of custom dynamic libraries to perform analysis on a single TskFile | |
| Responsible for managing TskFile objects in the system | |
| This nested class should be used to hold a FilePtrList object returned by methods such as findFilesByName() so that the file objects will be automatically freed | |
| An implementation of the TskFileManager interface that stores files in a directory named 'files' based on their file ids | |
| Contains data from a file record in the database | |
| TskFileTsk is a Sleuthkit and Poco based implementation of the TskFile interface | |
| Contains data from a file system record in the database | |
| An interface to a class that allows file system and low-level access to a disk image | |
| A Sleuth Kit implementation of the TskImageFile interface | |
| Interface for class that implments database storage for an image | |
| Framework data access layer the uses PostgreSQL as the back end | |
| Implementation of TskImgDB that uses SQLite to store the data | |
| Interface for classes that represent different types of modules in the pipeline | |
| Contains data about a module | |
| Contains data about the module return status for a given file (as recorded in the database) | |
| The Pipeline class controls the processing of data through an ordered list of dynamic library or executable modules | |
| Responsible for creation and destruction of of TskPipeline objects | |
| Supports the loading of a custom dynamic library to perform analysis in either a TskPipeline or TskReportPipeline | |
| Controls a series of reporting modules that are run after all of the file-specific analysis modules are run | |
| Supports the use of custom dynamic libraries to perform reporting and post-processing in a TskReportPipeline | |
| Implementation of the Scheduler interface that keeps a local queue of tasks to run | |
| Provides singleton access to many framework services | |
| A base class for setting and retrieving system-wide name/value pairs | |
| An implementation of TskSystemProperties that uses Poco AbstractConfiguration class to set and retrieve name/value pairs from an XML file | |
| Contains data about the current status for an unallocated chunk of data | |
| Data about the 'unused sectors', which did not have carvable data | |
| Contains commonly needed utility methods | |
| Contains data from a volume/partition record in the database | |
| Stores information that can map a region in the original disk image to a region in one of the chunks of unallocated space (as created by the CarvePrep implementation |
Copyright © 2011-2013 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.