Sleuth Kit Java Bindings (JNI)  4.10.0
Java bindings for using The Sleuth Kit
AbstractFile.java
Go to the documentation of this file.
1 /*
2  * SleuthKit Java Bindings
3  *
4  * Copyright 2011-2020 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.io.FileNotFoundException;
22 import java.io.IOException;
23 import java.io.RandomAccessFile;
24 import java.sql.SQLException;
25 import java.sql.Statement;
26 import java.text.MessageFormat;
27 import java.util.ArrayList;
28 import java.util.List;
29 import java.util.ResourceBundle;
30 import java.util.Set;
31 import java.util.SortedSet;
32 import java.util.TimeZone;
33 import java.util.logging.Level;
34 import java.util.logging.Logger;
40 
45 public abstract class AbstractFile extends AbstractContent {
46 
48  protected final TSK_FS_NAME_TYPE_ENUM dirType;
50  protected final TSK_FS_NAME_FLAG_ENUM dirFlag;
51  protected final Set<TSK_FS_META_FLAG_ENUM> metaFlags;
52  protected long size;
53  protected final long metaAddr, ctime, crtime, atime, mtime;
54  protected final int metaSeq;
55  protected final int uid, gid;
56  protected final int attrId;
58  protected final Set<TskData.TSK_FS_META_MODE_ENUM> modes;
59  //local file support
60  private boolean localPathSet = false;
61  private String localPath;
62  private String localAbsPath;
63  private volatile RandomAccessFile localFileHandle;
64  private volatile java.io.File localFile;
65  private TskData.EncodingType encodingType;
66  //range support
67  private List<TskFileRange> ranges;
68  /*
69  * path of parent directory
70  */
71  protected final String parentPath;
76  private boolean knownStateDirty = false;
77  /*
78  * md5 hash
79  */
80  protected String md5Hash;
81  private boolean md5HashDirty = false;
82  private String mimeType;
83  private boolean mimeTypeDirty = false;
84  private static final Logger LOGGER = Logger.getLogger(AbstractFile.class.getName());
85  private static final ResourceBundle BUNDLE = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle");
86  private long dataSourceObjectId;
87  private final String extension;
88 
125  long objId,
126  long dataSourceObjectId,
128  String name,
130  long metaAddr, int metaSeq,
132  TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags,
133  long size,
134  long ctime, long crtime, long atime, long mtime,
135  short modes,
136  int uid, int gid,
137  String md5Hash, FileKnown knownState,
138  String parentPath,
139  String mimeType,
140  String extension) {
141  super(db, objId, name);
142  this.dataSourceObjectId = dataSourceObjectId;
143  this.attrType = attrType;
144  this.attrId = attrId;
145  this.fileType = fileType;
146  this.metaAddr = metaAddr;
147  this.metaSeq = metaSeq;
148  this.dirType = dirType;
149  this.metaType = metaType;
150  this.dirFlag = dirFlag;
151  this.metaFlags = TSK_FS_META_FLAG_ENUM.valuesOf(metaFlags);
152  this.size = size;
153  this.ctime = ctime;
154  this.crtime = crtime;
155  this.atime = atime;
156  this.mtime = mtime;
157  this.uid = uid;
158  this.gid = gid;
159  this.modes = TskData.TSK_FS_META_MODE_ENUM.valuesOf(modes);
160 
161  this.md5Hash = md5Hash;
162  if (knownState == null) {
163  this.knownState = FileKnown.UNKNOWN;
164  } else {
165  this.knownState = knownState;
166  }
167  this.parentPath = parentPath;
168  this.mimeType = mimeType;
169  this.extension = extension == null ? "" : extension;
170  this.encodingType = TskData.EncodingType.NONE;
171  }
172 
179  return fileType;
180  }
181 
188  return attrType;
189  }
190 
196  public int getAttributeId() {
197  return attrId;
198  }
199 
205  public long getCtime() {
206  return ctime;
207  }
208 
214  public String getCtimeAsDate() {
215  return epochToTime(ctime);
216  }
217 
223  public long getCrtime() {
224  return crtime;
225  }
226 
232  public String getCrtimeAsDate() {
233  return epochToTime(crtime);
234  }
235 
241  public long getAtime() {
242  return atime;
243  }
244 
250  public String getAtimeAsDate() {
251  return epochToTime(atime);
252  }
253 
259  public long getMtime() {
260  return mtime;
261  }
262 
268  public String getMtimeAsDate() {
269  return epochToTime(mtime);
270  }
271 
277  public int getUid() {
278  return uid;
279  }
280 
286  public int getGid() {
287  return gid;
288  }
289 
295  public long getMetaAddr() {
296  return metaAddr;
297  }
298 
305  public long getMetaSeq() {
306  return metaSeq;
307  }
308 
314  public String getModesAsString() {
316  String result = "";
317 
318  short isuid = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_ISUID.getMode();
319  short isgid = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_ISGID.getMode();
320  short isvtx = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_ISVTX.getMode();
321 
322  short irusr = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IRUSR.getMode();
323  short iwusr = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IWUSR.getMode();
324  short ixusr = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IXUSR.getMode();
325 
326  short irgrp = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IRGRP.getMode();
327  short iwgrp = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IWGRP.getMode();
328  short ixgrp = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IXGRP.getMode();
329 
330  short iroth = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IROTH.getMode();
331  short iwoth = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IWOTH.getMode();
332  short ixoth = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IXOTH.getMode();
333 
334  // first character = the Meta Type
335  result += metaType.toString();
336 
337  // second and third characters = user permissions
338  if ((mode & irusr) == irusr) {
339  result += "r"; //NON-NLS
340  } else {
341  result += "-"; //NON-NLS
342  }
343  if ((mode & iwusr) == iwusr) {
344  result += "w"; //NON-NLS
345  } else {
346  result += "-"; //NON-NLS
347  }
348 
349  // fourth character = set uid
350  if ((mode & isuid) == isuid) {
351  if ((mode & ixusr) == ixusr) {
352  result += "s"; //NON-NLS
353  } else {
354  result += "S"; //NON-NLS
355  }
356  } else {
357  if ((mode & ixusr) == ixusr) {
358  result += "x"; //NON-NLS
359  } else {
360  result += "-"; //NON-NLS
361  }
362  }
363 
364  // fifth and sixth characters = group permissions
365  if ((mode & irgrp) == irgrp) {
366  result += "r"; //NON-NLS
367  } else {
368  result += "-"; //NON-NLS
369  }
370  if ((mode & iwgrp) == iwgrp) {
371  result += "w"; //NON-NLS
372  } else {
373  result += "-"; //NON-NLS
374  }
375 
376  // seventh character = set gid
377  if ((mode & isgid) == isgid) {
378  if ((mode & ixgrp) == ixgrp) {
379  result += "s"; //NON-NLS
380  } else {
381  result += "S"; //NON-NLS
382  }
383  } else {
384  if ((mode & ixgrp) == ixgrp) {
385  result += "x"; //NON-NLS
386  } else {
387  result += "-"; //NON-NLS
388  }
389  }
390 
391  // eighth and ninth character = other permissions
392  if ((mode & iroth) == iroth) {
393  result += "r"; //NON-NLS
394  } else {
395  result += "-"; //NON-NLS
396  }
397  if ((mode & iwoth) == iwoth) {
398  result += "w"; //NON-NLS
399  } else {
400  result += "-"; //NON-NLS
401  }
402 
403  // tenth character = sticky bit
404  if ((mode & isvtx) == isvtx) {
405  if ((mode & ixoth) == ixoth) {
406  result += "t"; //NON-NLS
407  } else {
408  result += "T"; //NON-NLS
409  }
410  } else {
411  if ((mode & ixoth) == ixoth) {
412  result += "x"; //NON-NLS
413  } else {
414  result += "-"; //NON-NLS
415  }
416  }
417 
418  // check the result
419  if (result.length() != 10) {
420  // throw error here
421  result = "ERROR"; //NON-NLS
422  }
423  return result;
424  }
425 
431  public String getMIMEType() {
432  return mimeType;
433  }
434 
443  public void setMIMEType(String mimeType) {
444  this.mimeType = mimeType;
445  this.mimeTypeDirty = true;
446  }
447 
448  public boolean isModeSet(TskData.TSK_FS_META_MODE_ENUM mode) {
449  return modes.contains(mode);
450  }
451 
460  public void setMd5Hash(String md5Hash) {
461  this.md5Hash = md5Hash;
462  this.md5HashDirty = true;
463  }
464 
470  public String getMd5Hash() {
471  return this.md5Hash;
472  }
473 
485  // don't allow them to downgrade the known state
486  if (this.knownState.compareTo(knownState) > 0) {
487  // ideally we'd return some kind of error, but
488  // the API doesn't allow it
489  return;
490  }
491  this.knownState = knownState;
492  this.knownStateDirty = true;
493  }
494 
502  return knownState;
503  }
504 
512  public String getNameExtension() {
513  return extension;
514  }
515 
521  @Override
522  public long getSize() {
523  return size;
524  }
525 
531  public String getParentPath() {
532  return parentPath;
533  }
534 
546  @Override
548  return getSleuthkitCase().getContentById(this.dataSourceObjectId);
549  }
550 
556  public long getDataSourceObjectId() {
557  return dataSourceObjectId;
558  }
559 
570  public List<TskFileRange> getRanges() throws TskCoreException {
571  if (ranges == null) {
572  ranges = getSleuthkitCase().getFileRanges(this.getId());
573  }
574  return ranges;
575  }
576 
590  public long convertToImgOffset(long fileOffset) throws TskCoreException {
591  long imgOffset = -1;
592  for (TskFileRange byteRange : getRanges()) {
593 
594  // if fileOffset is within the current byteRange, calculate the image
595  // offset and break
596  long rangeLength = byteRange.getByteLen();
597  if (fileOffset < rangeLength) {
598  imgOffset = byteRange.getByteStart() + fileOffset;
599  break;
600  }
601 
602  // otherwise, decrement fileOffset by the length of the current
603  // byte range and continue
604  fileOffset -= rangeLength;
605  }
606  return imgOffset;
607  }
608 
615  public boolean isVirtual() {
617  || dirType.equals(TskData.TSK_FS_NAME_TYPE_ENUM.VIRT)
619  }
620 
628  public boolean isFile() {
629  return metaType.equals(TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG)
630  || (metaType.equals(TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_UNDEF)
631  && dirType.equals(TSK_FS_NAME_TYPE_ENUM.REG));
632 
633  }
634 
641  public boolean isDir() {
642  return (metaType.equals(TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR)
644  }
645 
651  public abstract boolean isRoot();
652 
661  public static String createNonUniquePath(String uniquePath) {
662 
663  // split the path into parts
664  String[] pathSegments = uniquePath.split("/");
665 
666  // see if uniquePath had an image and/or volume name
667  int index = 0;
668  if (pathSegments[0].startsWith("img_")) { //NON-NLS
669  ++index;
670  }
671  if (pathSegments[1].startsWith("vol_")) { //NON-NLS
672  ++index;
673  }
674 
675  // Assemble the non-unique path (skipping over the image and volume
676  // name, if they exist).
677  StringBuilder strbuf = new StringBuilder();
678  for (; index < pathSegments.length; ++index) {
679  if (!pathSegments[index].isEmpty()) {
680  strbuf.append("/").append(pathSegments[index]);
681  }
682  }
683 
684  return strbuf.toString();
685  }
686 
693  public List<AbstractFile> listFiles() throws TskCoreException {
694  // first, get all children
695  List<Content> children = getChildren();
696 
697  // only keep those that are of type AbstractFile
698  List<AbstractFile> files = new ArrayList<AbstractFile>();
699  for (Content child : children) {
700  if (child instanceof AbstractFile) {
701  AbstractFile afChild = (AbstractFile) child;
702  files.add(afChild);
703  }
704  }
705  return files;
706  }
707 
714  return metaType;
715  }
716 
717  public String getMetaTypeAsString() {
718  return metaType.toString();
719  }
720 
727  return dirType;
728  }
729 
730  public String getDirTypeAsString() {
731  return dirType.toString();
732  }
733 
740  return dirFlag == flag;
741  }
742 
747  public String getDirFlagAsString() {
748  return dirFlag.toString();
749  }
750 
754  public String getMetaFlagsAsString() {
755  String str = "";
756  if (metaFlags.contains(TSK_FS_META_FLAG_ENUM.ALLOC)) {
757  str = TSK_FS_META_FLAG_ENUM.ALLOC.toString();
758  } else if (metaFlags.contains(TSK_FS_META_FLAG_ENUM.UNALLOC)) {
759  str = TSK_FS_META_FLAG_ENUM.UNALLOC.toString();
760  }
761  return str;
762  }
763 
769  public boolean isMetaFlagSet(TSK_FS_META_FLAG_ENUM metaFlag) {
770  return metaFlags.contains(metaFlag);
771  }
772 
773  @Override
774  public final int read(byte[] buf, long offset, long len) throws TskCoreException {
775  //template method
776  //if localPath is set, use local, otherwise, use readCustom() supplied by derived class
777  if (localPathSet) {
778  return readLocal(buf, offset, len);
779  } else {
780  return readInt(buf, offset, len);
781  }
782 
783  }
784 
796  protected int readInt(byte[] buf, long offset, long len) throws TskCoreException {
797  return 0;
798  }
799 
811  protected final int readLocal(byte[] buf, long offset, long len) throws TskCoreException {
812  if (!localPathSet) {
813  throw new TskCoreException(
814  BUNDLE.getString("AbstractFile.readLocal.exception.msg1.text"));
815  }
816 
817  if (isDir()) {
818  return 0;
819  }
820 
821  // If the file is empty, just return that zero bytes were read.
822  if (getSize() == 0) {
823  return 0;
824  }
825 
826  loadLocalFile();
827  if (!localFile.exists()) {
828  throw new TskCoreException(
829  MessageFormat.format(BUNDLE.getString("AbstractFile.readLocal.exception.msg2.text"), localAbsPath));
830  }
831  if (!localFile.canRead()) {
832  throw new TskCoreException(
833  MessageFormat.format(BUNDLE.getString("AbstractFile.readLocal.exception.msg3.text"), localAbsPath));
834  }
835 
836  int bytesRead = 0;
837 
838  if (localFileHandle == null) {
839  synchronized (this) {
840  if (localFileHandle == null) {
841  try {
842  localFileHandle = new RandomAccessFile(localFile, "r");
843  } catch (FileNotFoundException ex) {
844  final String msg = MessageFormat.format(BUNDLE.getString(
845  "AbstractFile.readLocal.exception.msg4.text"),
846  localAbsPath);
847  LOGGER.log(Level.SEVERE, msg, ex);
848  //file could have been deleted or moved
849  throw new TskCoreException(msg, ex);
850  }
851  }
852  }
853  }
854 
855  try {
856  if (!encodingType.equals(TskData.EncodingType.NONE)) {
857  // The file is encoded, so we need to alter the offset to read (since there's
858  // a header on the encoded file) and then decode each byte
859  long encodedOffset = offset + EncodedFileUtil.getHeaderLength();
860 
861  //move to the user request offset in the stream
862  long curOffset = localFileHandle.getFilePointer();
863  if (curOffset != encodedOffset) {
864  localFileHandle.seek(encodedOffset);
865  }
866  bytesRead = localFileHandle.read(buf, 0, (int) len);
867  for (int i = 0; i < bytesRead; i++) {
868  buf[i] = EncodedFileUtil.decodeByte(buf[i], encodingType);
869  }
870  return bytesRead;
871  } else {
872  //move to the user request offset in the stream
873  long curOffset = localFileHandle.getFilePointer();
874  if (curOffset != offset) {
875  localFileHandle.seek(offset);
876  }
877  //note, we are always writing at 0 offset of user buffer
878  return localFileHandle.read(buf, 0, (int) len);
879  }
880  } catch (IOException ex) {
881  final String msg = MessageFormat.format(BUNDLE.getString("AbstractFile.readLocal.exception.msg5.text"), localAbsPath);
882  LOGGER.log(Level.SEVERE, msg, ex);
883  //local file could have been deleted / moved
884  throw new TskCoreException(msg, ex);
885  }
886  }
887 
895  void setLocalFilePath(String localPath) {
896 
897  if (localPath == null || localPath.equals("")) {
898  this.localPath = "";
899  localAbsPath = null;
900  localPathSet = false;
901  } else {
902  // It should always be the case that absolute paths start with slashes or a windows drive letter
903  // and relative paths do not, but some older versions of modules created derived file paths
904  // starting with slashes. So we first check if this file is a DerivedFile before looking at the path.
905  this.localPath = localPath;
906  if (this instanceof DerivedFile) {
907  // DerivedFiles always have relative paths
908  this.localAbsPath = getSleuthkitCase().getDbDirPath() + java.io.File.separator + localPath;
909  } else {
910  // If a path starts with a slash or with a Windows drive letter, then it is
911  // absolute. Otherwise it is relative.
912  if (localPath.startsWith("/") || localPath.startsWith("\\")
913  || localPath.matches("[A-Za-z]:[/\\\\].*")) {
914  this.localAbsPath = localPath;
915  } else {
916  this.localAbsPath = getSleuthkitCase().getDbDirPath() + java.io.File.separator + localPath;
917  }
918  }
919  this.localPathSet = true;
920  }
921  }
922 
928  public String getLocalPath() {
929  return localPath;
930  }
931 
937  public String getLocalAbsPath() {
938  return localAbsPath;
939  }
940 
946  final void setEncodingType(TskData.EncodingType encodingType) {
947  this.encodingType = encodingType;
948  }
949 
956  public boolean exists() {
957  if (!localPathSet) {
958  return true;
959  } else {
960  try {
961  loadLocalFile();
962  return localFile.exists();
963  } catch (TskCoreException ex) {
964  LOGGER.log(Level.SEVERE, ex.getMessage());
965  return false;
966  }
967  }
968  }
969 
977  public boolean canRead() {
978  if (!localPathSet) {
979  return true;
980  } else {
981  try {
982  loadLocalFile();
983  return localFile.canRead();
984  } catch (TskCoreException ex) {
985  LOGGER.log(Level.SEVERE, ex.getMessage());
986  return false;
987  }
988  }
989  }
990 
997  private void loadLocalFile() throws TskCoreException {
998  if (!localPathSet) {
999  throw new TskCoreException(
1000  BUNDLE.getString("AbstractFile.readLocal.exception.msg1.text"));
1001  }
1002 
1003  // already been set
1004  if (localFile != null) {
1005  return;
1006  }
1007 
1008  synchronized (this) {
1009  if (localFile == null) {
1010  localFile = new java.io.File(localAbsPath);
1011  }
1012  }
1013  }
1014 
1015  @Override
1016  public void close() {
1017 
1018  //close local file handle if set
1019  if (localFileHandle != null) {
1020  synchronized (this) {
1021  if (localFileHandle != null) {
1022  try {
1023  localFileHandle.close();
1024  } catch (IOException ex) {
1025  LOGGER.log(Level.SEVERE, "Could not close file handle for file: " + getParentPath() + getName(), ex); //NON-NLS
1026  }
1027  localFileHandle = null;
1028  }
1029  }
1030  }
1031 
1032  }
1033 
1034  @Override
1035  protected void finalize() throws Throwable {
1036  try {
1037  close();
1038  } finally {
1039  super.finalize();
1040  }
1041  }
1042 
1043  @Override
1044  public String toString(boolean preserveState) {
1045  return super.toString(preserveState) + "AbstractFile [\t" //NON-NLS
1046  + "\t" + "fileType " + fileType //NON-NLS
1047  + "\tctime " + ctime //NON-NLS
1048  + "\tcrtime " + crtime //NON-NLS
1049  + "\t" + "mtime " + mtime + "\t" + "atime " + atime //NON-NLS
1050  + "\t" + "attrId " + attrId //NON-NLS
1051  + "\t" + "attrType " + attrType //NON-NLS
1052  + "\t" + "dirFlag " + dirFlag + "\t" + "dirType " + dirType //NON-NLS
1053  + "\t" + "uid " + uid //NON-NLS
1054  + "\t" + "gid " + gid //NON-NLS
1055  + "\t" + "metaAddr " + metaAddr + "\t" + "metaSeq " + metaSeq + "\t" + "metaFlags " + metaFlags //NON-NLS
1056  + "\t" + "metaType " + metaType + "\t" + "modes " + modes //NON-NLS
1057  + "\t" + "parentPath " + parentPath + "\t" + "size " + size //NON-NLS
1058  + "\t" + "knownState " + knownState + "\t" + "md5Hash " + md5Hash //NON-NLS
1059  + "\t" + "localPathSet " + localPathSet + "\t" + "localPath " + localPath //NON-NLS
1060  + "\t" + "localAbsPath " + localAbsPath + "\t" + "localFile " + localFile //NON-NLS
1061  + "]\t";
1062  }
1063 
1067  public enum MimeMatchEnum {
1068 
1071  FALSE
1072  }
1073 
1082  public MimeMatchEnum isMimeType(SortedSet<String> mimeTypes) {
1083  if (this.mimeType == null) {
1084  return MimeMatchEnum.UNDEFINED;
1085  }
1086  if (mimeTypes.contains(this.mimeType)) {
1087  return MimeMatchEnum.TRUE;
1088  }
1089  return MimeMatchEnum.FALSE;
1090  }
1091 
1099  public void save() throws TskCoreException {
1100 
1101  // No fields have been updated
1102  if (!(md5HashDirty || mimeTypeDirty || knownStateDirty)) {
1103  return;
1104  }
1105 
1106  String queryStr = "";
1107  if (mimeTypeDirty) {
1108  queryStr = "mime_type = '" + this.getMIMEType() + "'";
1109  }
1110  if (md5HashDirty) {
1111  if (!queryStr.isEmpty()) {
1112  queryStr += ", ";
1113  }
1114  queryStr += "md5 = '" + this.getMd5Hash() + "'";
1115  }
1116  if (knownStateDirty) {
1117  if (!queryStr.isEmpty()) {
1118  queryStr += ", ";
1119  }
1120  queryStr += "known = '" + this.getKnown().getFileKnownValue() + "'";
1121  }
1122 
1123  queryStr = "UPDATE tsk_files SET " + queryStr + " WHERE obj_id = " + this.getId();
1124 
1126  try (SleuthkitCase.CaseDbConnection connection = getSleuthkitCase().getConnection();
1127  Statement statement = connection.createStatement();) {
1128 
1129  connection.executeUpdate(statement, queryStr);
1130  md5HashDirty = false;
1131  mimeTypeDirty = false;
1132  knownStateDirty = false;
1133  } catch (SQLException ex) {
1134  throw new TskCoreException(String.format("Error saving properties for file (obj_id = %s)", this.getId()), ex);
1135  } finally {
1137  }
1138  }
1139 
1140  @Override
1141  public BlackboardArtifact newArtifact(int artifactTypeID) throws TskCoreException {
1142  // don't let them make more than 1 GEN_INFO
1143  if (artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.getTypeID()) {
1144  return getGenInfoArtifact(true);
1145  }
1146  return getSleuthkitCase().newBlackboardArtifact(artifactTypeID, getId(), dataSourceObjectId);
1147  }
1148 
1149 
1181  @Deprecated
1182  @SuppressWarnings("deprecation")
1183  protected AbstractFile(SleuthkitCase db, long objId, TskData.TSK_FS_ATTR_TYPE_ENUM attrType, short attrId,
1184  String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq,
1185  TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags,
1186  long size, long ctime, long crtime, long atime, long mtime, short modes, int uid, int gid, String md5Hash, FileKnown knownState,
1187  String parentPath) {
1188  this(db, objId, db.getDataSourceObjectId(objId), attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
1189  }
1190 
1227  @Deprecated
1228  @SuppressWarnings("deprecation")
1229  AbstractFile(SleuthkitCase db, long objId, long dataSourceObjectId, TskData.TSK_FS_ATTR_TYPE_ENUM attrType, short attrId,
1230  String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType,
1231  TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, short modes,
1232  int uid, int gid, String md5Hash, FileKnown knownState, String parentPath, String mimeType) {
1233  this(db, objId, dataSourceObjectId, attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
1234  }
1235 
1244  @Deprecated
1245  @SuppressWarnings("deprecation")
1246  public short getAttrId() {
1247  /*
1248  * NOTE: previously attrId used to be stored in AbstractFile as (signed)
1249  * short even though it is stored as uint16 in TSK. In extremely rare
1250  * occurrences attrId can be larger than what a signed short can hold
1251  * (2^15). Changes were made to AbstractFile to store attrId as integer.
1252  * Therefore this method has been deprecated. For backwards
1253  * compatibility, attribute ids that are larger than 32K are converted
1254  * to a negative number.
1255  */
1256  return (short) attrId; // casting to signed short converts values over 32K to negative values
1257  }
1258 
1270  @Deprecated
1271  protected void setLocalPath(String localPath, boolean isAbsolute) {
1272  setLocalFilePath(localPath);
1273  }
1274 
1275  /*
1276  * -------------------------------------------------------------------------
1277  * Util methods to convert / map the data
1278  * -------------------------------------------------------------------------
1279  */
1289  @Deprecated
1290  public static String epochToTime(long epoch) {
1291  return TimeUtilities.epochToTime(epoch);
1292  }
1293 
1305  @Deprecated
1306  public static String epochToTime(long epoch, TimeZone tzone) {
1307  return TimeUtilities.epochToTime(epoch, tzone);
1308  }
1309 
1317  @Deprecated
1318  public static long timeToEpoch(String time) {
1319  return TimeUtilities.timeToEpoch(time);
1320  }
1321 }
VIRT
Special (TSK added "Virtual" files) NON-NLS.
Definition: TskData.java:50
boolean isModeSet(TskData.TSK_FS_META_MODE_ENUM mode)
final TSK_FS_NAME_TYPE_ENUM dirType
static long timeToEpoch(String time)
static String epochToTime(long epoch)
static String epochToTime(long epoch)
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
Definition: TskData.java:247
final int readLocal(byte[] buf, long offset, long len)
boolean isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM flag)
ALLOC
Metadata structure is currently in an allocated state.
Definition: TskData.java:206
final TSK_FS_NAME_FLAG_ENUM dirFlag
final TskData.TSK_DB_FILES_TYPE_ENUM fileType
UNALLOC
Metadata structure is currently in an unallocated state.
Definition: TskData.java:207
TskData.TSK_DB_FILES_TYPE_ENUM getType()
final TskData.TSK_FS_ATTR_TYPE_ENUM attrType
TSK_FS_META_TYPE_VIRT_DIR
"Virtual Directory" created by TSK for Orphan Files NON-NLS
Definition: TskData.java:114
long convertToImgOffset(long fileOffset)
TSK_FS_NAME_TYPE_ENUM getDirType()
BlackboardArtifact newArtifact(int artifactTypeID)
MimeMatchEnum isMimeType(SortedSet< String > mimeTypes)
final Set< TSK_FS_META_FLAG_ENUM > metaFlags
String toString(boolean preserveState)
void setKnown(TskData.FileKnown knownState)
FALSE
file has a defined mime type and it is one of the given ones
final Set< TskData.TSK_FS_META_MODE_ENUM > modes
BlackboardArtifact newBlackboardArtifact(int artifactTypeID, long obj_id)
TSK_FS_META_TYPE_VIRT
"Virtual File" created by TSK for file system areas NON-NLS
Definition: TskData.java:113
TSK_FS_META_TYPE_ENUM getMetaType()
boolean isMetaFlagSet(TSK_FS_META_FLAG_ENUM metaFlag)
TRUE
file does not have a defined mime time in blackboard
static short toInt(Set< TSK_FS_META_MODE_ENUM > modes)
Definition: TskData.java:422
static String epochToTime(long epoch, TimeZone tzone)
static long timeToEpoch(String time)
int readInt(byte[] buf, long offset, long len)
UNKNOWN
File marked as unknown by hash db.
Definition: TskData.java:782
static Set< TSK_FS_META_MODE_ENUM > valuesOf(short modes)
Definition: TskData.java:403
void setLocalPath(String localPath, boolean isAbsolute)
static String createNonUniquePath(String uniquePath)
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
Definition: TskData.java:682
final int read(byte[] buf, long offset, long len)
final TSK_FS_META_TYPE_ENUM metaType
List< TskFileRange > getFileRanges(long id)
TskData.TSK_FS_ATTR_TYPE_ENUM getAttrType()

Copyright © 2011-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.