The Sleuth Kit Framework
4.1
|
![]() ![]() | This nested class should be used to hold a FilePtrList object returned by methods such as findFilesByName() so that the file objects will be automatically freed |
![]() ![]() | Interface for class that will carve an unallocated sectors image file |
![]() ![]() ![]() | Implements the CarveExtract interface to carve unallocated sectors image files using Scalpel |
![]() ![]() | Interface for class that prepares for later carving |
![]() ![]() ![]() | Implements the CarvePrep abstract interface |
![]() ![]() | |
![]() ![]() ![]() | Framework exception class |
![]() ![]() | |
![]() ![]() | Logging class to enable the framework, apps that use it, and modules to log error and warning messages |
![]() ![]() | Interface for class that will handle scheduling of tasks |
![]() ![]() ![]() | Implementation of the Scheduler interface that keeps a local queue of tasks to run |
![]() ![]() | Stores a list of runs (which have a starting sector and length) |
![]() ![]() | Describes a single task to be scheduled or perform |
![]() ![]() | Contains data about the mapping of data in the unallocated chunks back to their original location in the disk image |
![]() ![]() | Class used to store the pair of type and display names of artifacts |
![]() ![]() | Class used to store the pair of type and display names of attributes |
![]() ![]() | |
![]() ![]() ![]() | Implements TskAuto and is used to analyze the data in a disk image and populate TskImgDB with the results |
![]() ![]() | An interface for setting and retrieving name/value pairs to the blackboard |
![]() ![]() ![]() | An implementation of TskBlackboard that stores the name / value pairs in the TskImgDB |
![]() ![]() | Class that represents a blackboard artifact object |
![]() ![]() | Class that represents a blackboard attribute object |
![]() ![]() | Contains data for a blackboard entry for a given file and artifact ID |
![]() ![]() | Contains data derived from joining carved file records from multiple tables in the image database |
![]() ![]() | Abstract base interface class for container extractor classes |
![]() ![]() ![]() | |
![]() ![]() | An interface that is used to represent a file |
![]() ![]() ![]() | TskFileTsk is a Sleuthkit and Poco based implementation of the TskFile interface |
![]() ![]() | Responsible for managing TskFile objects in the system |
![]() ![]() ![]() | An implementation of the TskFileManager interface that stores files in a directory named 'files' based on their file ids |
![]() ![]() | Contains data from a file record in the database |
![]() ![]() | |
![]() ![]() | Contains data from a file system record in the database |
![]() ![]() | An interface to a class that allows file system and low-level access to a disk image |
![]() ![]() ![]() | A Sleuth Kit implementation of the TskImageFile interface |
![]() ![]() | Interface for class that implments database storage for an image |
![]() ![]() ![]() | Framework data access layer the uses PostgreSQL as the back end |
![]() ![]() ![]() | Implementation of TskImgDB that uses SQLite to store the data |
![]() ![]() | Interface for classes that represent different types of modules in the pipeline |
![]() ![]() ![]() | Supports launching a process via an executable file to perform some analysis on a TskFile object in a TskPipeline |
![]() ![]() ![]() | Supports the loading of a custom dynamic library to perform analysis in either a TskPipeline or TskReportPipeline |
![]() ![]() ![]() ![]() | Supports the loading of custom dynamic libraries to perform analysis on a single TskFile |
![]() ![]() ![]() ![]() | Supports the use of custom dynamic libraries to perform reporting and post-processing in a TskReportPipeline |
![]() ![]() | Contains data about a module |
![]() ![]() | Contains data about the module return status for a given file (as recorded in the database) |
![]() ![]() | The Pipeline class controls the processing of data through an ordered list of dynamic library or executable modules |
![]() ![]() ![]() | Controls the processing of a file analysis pipeline |
![]() ![]() ![]() | Controls a series of reporting modules that are run after all of the file-specific analysis modules are run |
![]() ![]() | Responsible for creation and destruction of of TskPipeline objects |
![]() ![]() | Provides singleton access to many framework services |
![]() ![]() | A base class for setting and retrieving system-wide name/value pairs |
![]() ![]() ![]() | An implementation of TskSystemProperties that uses Poco AbstractConfiguration class to set and retrieve name/value pairs from an XML file |
![]() ![]() | Contains data about the current status for an unallocated chunk of data |
![]() ![]() | Data about the 'unused sectors', which did not have carvable data |
![]() ![]() | Contains commonly needed utility methods |
![]() ![]() | Contains data from a volume/partition record in the database |
![]() ![]() | Stores information that can map a region in the original disk image to a region in one of the chunks of unallocated space (as created by the CarvePrep implementation |
Copyright © 2011-2013 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.