19 package org.sleuthkit.datamodel;
21 import java.io.FileNotFoundException;
22 import java.io.IOException;
23 import java.io.RandomAccessFile;
24 import java.sql.SQLException;
25 import java.sql.Statement;
26 import java.text.MessageFormat;
27 import java.util.ArrayList;
28 import java.util.List;
29 import java.util.ResourceBundle;
31 import java.util.SortedSet;
32 import java.util.TimeZone;
33 import java.util.logging.Level;
34 import java.util.logging.Logger;
51 protected final Set<TSK_FS_META_FLAG_ENUM>
metaFlags;
53 protected final long metaAddr, ctime, crtime, atime, mtime;
55 protected final int uid, gid;
60 private boolean localPathSet =
false;
61 private String localPath;
62 private String localAbsPath;
63 private volatile RandomAccessFile localFileHandle;
64 private volatile java.io.File localFile;
67 private List<TskFileRange> ranges;
76 private boolean knownStateDirty =
false;
81 private boolean md5HashDirty =
false;
82 private String mimeType;
83 private boolean mimeTypeDirty =
false;
85 private static final ResourceBundle BUNDLE = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
86 private long dataSourceObjectId;
87 private final String extension;
126 long dataSourceObjectId,
130 long metaAddr,
int metaSeq,
134 long ctime,
long crtime,
long atime,
long mtime,
141 super(db, objId, name);
142 this.dataSourceObjectId = dataSourceObjectId;
154 this.crtime = crtime;
162 if (knownState == null) {
168 this.mimeType = mimeType;
169 this.extension = extension == null ?
"" : extension;
338 if ((mode & irusr) == irusr) {
343 if ((mode & iwusr) == iwusr) {
350 if ((mode & isuid) == isuid) {
351 if ((mode & ixusr) == ixusr) {
357 if ((mode & ixusr) == ixusr) {
365 if ((mode & irgrp) == irgrp) {
370 if ((mode & iwgrp) == iwgrp) {
377 if ((mode & isgid) == isgid) {
378 if ((mode & ixgrp) == ixgrp) {
384 if ((mode & ixgrp) == ixgrp) {
392 if ((mode & iroth) == iroth) {
397 if ((mode & iwoth) == iwoth) {
404 if ((mode & isvtx) == isvtx) {
405 if ((mode & ixoth) == ixoth) {
411 if ((mode & ixoth) == ixoth) {
419 if (result.length() != 10) {
444 this.mimeType = mimeType;
445 this.mimeTypeDirty =
true;
449 return modes.contains(mode);
462 this.md5HashDirty =
true;
492 this.knownStateDirty =
true;
557 return dataSourceObjectId;
571 if (ranges == null) {
596 long rangeLength = byteRange.getByteLen();
597 if (fileOffset < rangeLength) {
598 imgOffset = byteRange.getByteStart() + fileOffset;
604 fileOffset -= rangeLength;
651 public abstract boolean isRoot();
664 String[] pathSegments = uniquePath.split(
"/");
668 if (pathSegments[0].startsWith(
"img_")) {
671 if (pathSegments[1].startsWith(
"vol_")) {
677 StringBuilder strbuf =
new StringBuilder();
678 for (; index < pathSegments.length; ++index) {
679 if (!pathSegments[index].isEmpty()) {
680 strbuf.append(
"/").append(pathSegments[index]);
684 return strbuf.toString();
698 List<AbstractFile> files =
new ArrayList<AbstractFile>();
699 for (
Content child : children) {
701 AbstractFile afChild = (AbstractFile) child;
731 return dirType.toString();
740 return dirFlag == flag;
770 return metaFlags.contains(metaFlag);
780 return readInt(buf, offset, len);
814 BUNDLE.getString(
"AbstractFile.readLocal.exception.msg1.text"));
827 if (!localFile.
exists()) {
829 MessageFormat.format(BUNDLE.getString(
"AbstractFile.readLocal.exception.msg2.text"), localAbsPath));
833 MessageFormat.format(BUNDLE.getString(
"AbstractFile.readLocal.exception.msg3.text"), localAbsPath));
838 if (localFileHandle == null) {
839 synchronized (
this) {
840 if (localFileHandle == null) {
842 localFileHandle =
new RandomAccessFile(localFile,
"r");
843 }
catch (FileNotFoundException ex) {
844 final String msg = MessageFormat.format(BUNDLE.getString(
845 "AbstractFile.readLocal.exception.msg4.text"),
847 LOGGER.log(Level.SEVERE, msg, ex);
859 long encodedOffset = offset + EncodedFileUtil.getHeaderLength();
862 long curOffset = localFileHandle.getFilePointer();
863 if (curOffset != encodedOffset) {
864 localFileHandle.seek(encodedOffset);
866 bytesRead = localFileHandle.read(buf, 0, (
int) len);
867 for (
int i = 0; i < bytesRead; i++) {
868 buf[i] = EncodedFileUtil.decodeByte(buf[i], encodingType);
873 long curOffset = localFileHandle.getFilePointer();
874 if (curOffset != offset) {
875 localFileHandle.seek(offset);
878 return localFileHandle.read(buf, 0, (
int) len);
880 }
catch (IOException ex) {
881 final String msg = MessageFormat.format(BUNDLE.getString(
"AbstractFile.readLocal.exception.msg5.text"), localAbsPath);
882 LOGGER.log(Level.SEVERE, msg, ex);
895 void setLocalFilePath(String localPath) {
897 if (localPath == null || localPath.equals(
"")) {
900 localPathSet =
false;
905 this.localPath = localPath;
906 if (
this instanceof DerivedFile) {
912 if (localPath.startsWith(
"/") || localPath.startsWith(
"\\")
913 || localPath.matches(
"[A-Za-z]:[/\\\\].*")) {
914 this.localAbsPath = localPath;
919 this.localPathSet =
true;
947 this.encodingType = encodingType;
962 return localFile.
exists();
964 LOGGER.log(Level.SEVERE, ex.getMessage());
985 LOGGER.log(Level.SEVERE, ex.getMessage());
999 throw new TskCoreException(
1000 BUNDLE.getString(
"AbstractFile.readLocal.exception.msg1.text"));
1004 if (localFile != null) {
1008 synchronized (
this) {
1009 if (localFile == null) {
1010 localFile =
new java.io.File(localAbsPath);
1019 if (localFileHandle != null) {
1020 synchronized (
this) {
1021 if (localFileHandle != null) {
1023 localFileHandle.close();
1024 }
catch (IOException ex) {
1025 LOGGER.log(Level.SEVERE,
"Could not close file handle for file: " +
getParentPath() +
getName(), ex);
1027 localFileHandle = null;
1045 return super.toString(preserveState) +
"AbstractFile [\t"
1047 +
"\tctime " + ctime
1048 +
"\tcrtime " + crtime
1049 +
"\t" +
"mtime " + mtime +
"\t" +
"atime " + atime
1050 +
"\t" +
"attrId " + attrId
1052 +
"\t" +
"dirFlag " + dirFlag +
"\t" +
"dirType " + dirType
1053 +
"\t" +
"uid " + uid
1054 +
"\t" +
"gid " + gid
1055 +
"\t" +
"metaAddr " + metaAddr +
"\t" +
"metaSeq " + metaSeq +
"\t" +
"metaFlags " + metaFlags
1056 +
"\t" +
"metaType " + metaType +
"\t" +
"modes " +
modes
1057 +
"\t" +
"parentPath " + parentPath +
"\t" +
"size " + size
1058 +
"\t" +
"knownState " +
knownState +
"\t" +
"md5Hash " + md5Hash
1059 +
"\t" +
"localPathSet " + localPathSet +
"\t" +
"localPath " + localPath
1060 +
"\t" +
"localAbsPath " + localAbsPath +
"\t" +
"localFile " + localFile
1083 if (this.mimeType == null) {
1086 if (mimeTypes.contains(
this.mimeType)) {
1099 public void save() throws TskCoreException {
1102 if (!(md5HashDirty || mimeTypeDirty || knownStateDirty)) {
1106 String queryStr =
"";
1107 if (mimeTypeDirty) {
1108 queryStr =
"mime_type = '" + this.
getMIMEType() +
"'";
1111 if (!queryStr.isEmpty()) {
1114 queryStr +=
"md5 = '" + this.
getMd5Hash() +
"'";
1116 if (knownStateDirty) {
1117 if (!queryStr.isEmpty()) {
1120 queryStr +=
"known = '" + this.
getKnown().getFileKnownValue() +
"'";
1123 queryStr =
"UPDATE tsk_files SET " + queryStr +
" WHERE obj_id = " + this.
getId();
1127 Statement statement = connection.createStatement();) {
1129 connection.executeUpdate(statement, queryStr);
1130 md5HashDirty =
false;
1131 mimeTypeDirty =
false;
1132 knownStateDirty =
false;
1133 }
catch (SQLException ex) {
1134 throw new TskCoreException(String.format(
"Error saving properties for file (obj_id = %s)",
this.getId()), ex);
1182 @SuppressWarnings(
"deprecation")
1186 long size,
long ctime,
long crtime,
long atime,
long mtime,
short modes,
int uid,
int gid, String md5Hash,
FileKnown knownState,
1187 String parentPath) {
1188 this(db, objId, db.getDataSourceObjectId(objId),
attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
1228 @SuppressWarnings(
"deprecation")
1232 int uid,
int gid, String md5Hash,
FileKnown knownState, String parentPath, String mimeType) {
1233 this(db, objId, dataSourceObjectId,
attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
1245 @SuppressWarnings(
"deprecation")
1272 setLocalFilePath(localPath);
VIRT
Special (TSK added "Virtual" files) NON-NLS.
boolean isModeSet(TskData.TSK_FS_META_MODE_ENUM mode)
final TSK_FS_NAME_TYPE_ENUM dirType
static long timeToEpoch(String time)
static String epochToTime(long epoch)
static String epochToTime(long epoch)
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
String getMetaFlagsAsString()
final int readLocal(byte[] buf, long offset, long len)
boolean isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM flag)
List< Content > getChildren()
ALLOC
Metadata structure is currently in an allocated state.
final TSK_FS_NAME_FLAG_ENUM dirFlag
TSK_FS_META_TYPE_DIR
Directory file NON-NLS.
void setMIMEType(String mimeType)
TSK_FS_META_MODE_ISVTX
sticky bit
final TskData.TSK_DB_FILES_TYPE_ENUM fileType
UNALLOC
Metadata structure is currently in an unallocated state.
TskData.TSK_DB_FILES_TYPE_ENUM getType()
final TskData.TSK_FS_ATTR_TYPE_ENUM attrType
TSK_FS_META_MODE_IXOTH
X for other.
TSK_FS_META_TYPE_VIRT_DIR
"Virtual Directory" created by TSK for Orphan Files NON-NLS
long convertToImgOffset(long fileOffset)
TSK_FS_META_MODE_ISUID
set user id on execution
TSK_FS_NAME_TYPE_ENUM getDirType()
Content getContentById(long id)
String getDirFlagAsString()
TSK_FS_META_MODE_IXGRP
X for group.
String getNameExtension()
TSK_FS_META_MODE_IWOTH
W for other.
BlackboardArtifact newArtifact(int artifactTypeID)
TSK_FS_META_MODE_IRGRP
R for group.
long getDataSourceObjectId()
TSK_FS_META_MODE_IWUSR
W for owner.
MimeMatchEnum isMimeType(SortedSet< String > mimeTypes)
String getDirTypeAsString()
final Set< TSK_FS_META_FLAG_ENUM > metaFlags
TSK_FS_META_MODE_IROTH
R for other.
String toString(boolean preserveState)
TskData.FileKnown getKnown()
void setKnown(TskData.FileKnown knownState)
FALSE
file has a defined mime type and it is one of the given ones
final Set< TskData.TSK_FS_META_MODE_ENUM > modes
List< AbstractFile > listFiles()
TskData.FileKnown knownState
BlackboardArtifact newBlackboardArtifact(int artifactTypeID, long obj_id)
BlackboardArtifact getGenInfoArtifact()
TSK_FS_META_TYPE_VIRT
"Virtual File" created by TSK for file system areas NON-NLS
TSK_FS_META_TYPE_ENUM getMetaType()
TSK_FS_META_MODE_IRUSR
R for owner.
SleuthkitCase getSleuthkitCase()
boolean isMetaFlagSet(TSK_FS_META_FLAG_ENUM metaFlag)
TRUE
file does not have a defined mime time in blackboard
void acquireSingleUserCaseWriteLock()
static short toInt(Set< TSK_FS_META_MODE_ENUM > modes)
void releaseSingleUserCaseWriteLock()
static String epochToTime(long epoch, TimeZone tzone)
static long timeToEpoch(String time)
String getModesAsString()
int readInt(byte[] buf, long offset, long len)
UNKNOWN
File marked as unknown by hash db.
static Set< TSK_FS_META_MODE_ENUM > valuesOf(short modes)
void setLocalPath(String localPath, boolean isAbsolute)
void setMd5Hash(String md5Hash)
static String createNonUniquePath(String uniquePath)
TSK_FS_META_MODE_IWGRP
W for group.
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
List< TskFileRange > getRanges()
final int read(byte[] buf, long offset, long len)
String getMetaTypeAsString()
final TSK_FS_META_TYPE_ENUM metaType
TSK_FS_META_TYPE_REG
Regular file NON-NLS.
TSK_FS_META_MODE_ISGID
set group id on execution
List< TskFileRange > getFileRanges(long id)
TSK_FS_META_MODE_IXUSR
X for owner.
TskData.TSK_FS_ATTR_TYPE_ENUM getAttrType()
abstract boolean isRoot()