TskModule Class Reference

Interface for classes that represent different types of modules in the pipeline. More...

#include <TskModule.h>

Inheritance diagram for TskModule:

Public Types
enum	Status { OK = 0, FAIL, STOP }
	Standard values that module methods can return. More...

Public Member Functions
std::string	getArguments () const
	Get the arguments.
std::string	getDescription () const
	Get the module description.
int	getModuleId () const
	Get the module id.
std::string	getName () const
	Get the module name.
virtual std::string	getPath () const
	Returns the fully qualified path to the module.
std::string	getVersion () const
	Get the module version.
virtual Status	report ()
	Method that is used to run report modules. More...
virtual Status	run (TskFile *fileToAnalyze)=0
	Method that is used to run file analysis modules. More...
void	setArguments (const std::string &args)
	Set the arguments to be passed to the module.
void	setModuleId (int moduleId)
	Set the module id.
virtual void	setPath (const std::string &location)
	Sets the location of the module given an absolute or relative location. More...

Static Public Attributes
static const std::string	CURRENT_FILE_MACRO = "#CURRENT_FILE#"
	The TskModule class supports the use of a string macro that is expanded to the path of the file currently under analysis. More...

Static Protected Member Functions
static std::string	expandArgumentMacros (const std::string &args, const TskFile *fileToAnalyze)

Protected Attributes
std::string	m_arguments
std::string	m_description
int	m_moduleId
std::string	m_modulePath
std::string	m_name
std::string	m_version

Detailed Description

Interface for classes that represent different types of modules in the pipeline.

Example module types include dynamic library and executables. These modules perform some operation in the context of a TskPipeline.

Member Enumeration Documentation

enum TskModule::Status

Standard values that module methods can return.

Enumerator
OK	Indicates that the module sucessfully analyzed the data or was able to decide that it should not analyze the data.
FAIL	Indicates that the module wanted to perform analysis on the data, but was unable to because of an error.
STOP	Indicates that the module wants the pipeline to stop processing.

Member Function Documentation

virtual Status TskModule::report ( )

inlinevirtual

Method that is used to run report modules.

Returns

Status of module

Reimplemented in TskExecutableModule, and TskReportPluginModule.

References OK.

Referenced by TskReportPluginModule::run().

virtual Status TskModule::run ( TskFile *  fileToAnalyze)

pure virtual

Method that is used to run file analysis modules.

Returns

Status of module

Implemented in TskExecutableModule, TskFileAnalysisPluginModule, and TskReportPluginModule.

void TskModule::setPath ( const std::string &  location)

virtual

Sets the location of the module given an absolute or relative location.

For relative paths we look for the module first in PROG_DIR, then MODULE_DIR, then the current directory, and finally the system path. Will throw an exception if the module cannot be found.

Parameters

location

Absolute or relative path string for module.

Reimplemented in TskPluginModule, and TskExecutableModule.

References LOGINFO, TskSystemProperties::MODULE_DIR, and TskSystemProperties::PROG_DIR.

Referenced by TskExecutableModule::setPath().

Member Data Documentation

const std::string TskModule::CURRENT_FILE_MACRO = "#CURRENT_FILE#"

static

The TskModule class supports the use of a string macro that is expanded to the path of the file currently under analysis.

This macro is intended to be used in the arguments strings passed to the initialization functions of file analysis modules. "#CURRENT_FILE#" is the literal form of the macro.

---

The documentation for this class was generated from the following files:

• framework/tsk/framework/pipeline/TskModule.h
• framework/tsk/framework/pipeline/TskModule.cpp