SleuthkitJNI.java

Go to the documentation of this file.

/*
 * Sleuth Kit Data Model
 *
 * Copyright 2011-2018 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *       http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.datamodel;

import java.io.BufferedReader;
import java.io.FileReader;
import java.io.IOException;
import java.text.DateFormat;
import java.text.SimpleDateFormat;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.GregorianCalendar;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.TimeZone;
import java.util.UUID;
import java.util.concurrent.locks.ReadWriteLock;
import java.util.concurrent.locks.ReentrantReadWriteLock;
import java.util.logging.Level;
import java.util.logging.Logger;
import org.apache.commons.lang3.StringUtils;
import org.sleuthkit.datamodel.TskData.TSK_FS_ATTR_TYPE_ENUM;
import org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;

public class SleuthkitJNI {

        private static final Logger logger = Logger.getLogger(SleuthkitJNI.class.getName());
        
        private static final ReadWriteLock tskLock = new ReentrantReadWriteLock();

        /*
         * Loads the SleuthKit libraries.
         */
        static {
                LibraryUtils.loadSleuthkitJNI();
        }

        private SleuthkitJNI() {
        }

        private static class CaseHandles {
                /*
                 * A SleuthKit image handle cache implemented as a mappng of
                 * concatenated image file paths to image handles.
                 */
                private final Map<String, Long> imageHandleCache = new HashMap<>();

                /*
                 * A SleuthKit file system handles cache implemented as a mapping of
                 * image handles to image offset and file system handle pairs.
                 */
                private final Map<Long, Map<Long, Long>> fsHandleCache = new HashMap<>();

                /*
                 * The collection of open file handles. We will only allow requests
                 * through to the C code if the file handle exists in this collection.
                 */
                private final Set<Long> fileHandleCache = new HashSet<>();

                private final Map<Long, List<Long>> fileSystemToFileHandles = new HashMap<>();
                
                private final Map<Long, Map<Long, Long>> poolHandleCache = new HashMap<>();
                
                // The poolImgCache is only used to close the images later.
                private final List<Long> poolImgCache = new ArrayList<>();
                
                /*
                 * Currently, our APFS code is not thread-safe and it is the only code
                 * that uses pools. To prevent crashes, we make any reads to a file system
                 * contained in a pool single-threaded. This cache keeps track of which
                 * open file system handles are contained in a pool so we can set the locks
                 * appropriately. 
                 */
                private final List<Long> poolFsList = new ArrayList<>();
                
                private CaseHandles() {
                        // Nothing to do here
                }
        }
        
        private static class HandleCache {

                /*
                 * A monitor used to guard access to cached Sleuthkit JNI handles.
                 */
                private static final Object cacheLock = new Object();

                private static final Map<String, CaseHandles> caseHandlesCache = new HashMap<>();

                private static final String INVALID_FILE_HANDLE = "Invalid file handle."; //NON-NLS
                
                /*
                 * Currently, our APFS code is not thread-safe and it is the only code
                 * that uses pools. To prevent crashes, we make any reads to a file system
                 * contained in a pool single-threaded. This cache keeps track of which
                 * open file handles are contained in a pool so we can set the locks
                 * appropriately. 
                 * 
                 * Access to this list should be guarded by cacheLock.
                 */
                private static final List<Long> poolFileHandles = new ArrayList<>();
                
                private static void createCaseHandleCache(String caseIdentifier) {
                        caseHandlesCache.put(caseIdentifier, new CaseHandles());
                }
                
                private static String getDefaultCaseIdentifier() throws TskCoreException {
                        synchronized (cacheLock) {
                                if (caseHandlesCache.keySet().size() > 1) {
                                        throw new TskCoreException("Can not get default case identifier with multiple open cases");
                                } else if (caseHandlesCache.keySet().isEmpty()) {
                                        throw new TskCoreException("Can not get default case identifier with no open case");
                                }

                                return (caseHandlesCache.keySet().iterator().next());
                        }
                }
                        
                private static CaseHandles getCaseHandles(String caseIdentifier) throws TskCoreException {
                        synchronized (cacheLock) {
                                if (caseHandlesCache.containsKey(caseIdentifier)) {
                                        return caseHandlesCache.get(caseIdentifier);
                                }
                                // If the CaseHandles object isn't in there, it should mean the case has been closed.
                                throw new TskCoreException("No entry for case " + caseIdentifier + " in cache. Case may have been closed");
                        }
                }
                
                private static void removeCaseHandlesCache(String caseIdentifier) {
                        synchronized (cacheLock) {
                                if (caseHandlesCache.containsKey(caseIdentifier)) {
                                        caseHandlesCache.get(caseIdentifier).fsHandleCache.clear();
                                        caseHandlesCache.get(caseIdentifier).imageHandleCache.clear();
                                        caseHandlesCache.get(caseIdentifier).fileHandleCache.clear();
                                        caseHandlesCache.get(caseIdentifier).fileSystemToFileHandles.clear();
                                        caseHandlesCache.get(caseIdentifier).poolHandleCache.clear();
                                        caseHandlesCache.remove(caseIdentifier);
                                }
                        }
                }
                
                private static boolean isImageInAnyCache(long imgHandle) {
                        synchronized (cacheLock) {
                                for (String caseIdentifier:caseHandlesCache.keySet()) {
                                        if (caseHandlesCache.get(caseIdentifier).fsHandleCache.keySet().contains(imgHandle)) {
                                                return true;
                                        }
                                }
                                return false;
                        }
                }
                
                private static void addFileHandle(String caseIdentifier, long fileHandle, long fsHandle) {
                        try {
                                synchronized (cacheLock) {
                                        // Add to collection of open file handles.
                                        getCaseHandles(caseIdentifier).fileHandleCache.add(fileHandle);

                                        // Add to map of file system to file handles.
                                        if (getCaseHandles(caseIdentifier).fileSystemToFileHandles.containsKey(fsHandle)) {
                                                getCaseHandles(caseIdentifier).fileSystemToFileHandles.get(fsHandle).add(fileHandle);
                                        } else {
                                                getCaseHandles(caseIdentifier).fileSystemToFileHandles.put(fsHandle, new ArrayList<>(Arrays.asList(fileHandle)));
                                        }
                                }
                        } catch (TskCoreException ex) {
                                logger.log(Level.WARNING, "Error caching file handle for case {0}", caseIdentifier);
                        }
                }

                private static void removeFileHandle(long fileHandle, SleuthkitCase skCase) {
                        synchronized (cacheLock) {
                                // Remove from collection of open file handles.
                                if (skCase != null) {
                                        try {
                                                getCaseHandles(skCase.getCaseHandleIdentifier()).fileHandleCache.remove(fileHandle);
                                        } catch (TskCoreException ex) {
                                                // If the call to getCaseHandles() failed, we've already cleared the cache.
                                        }
                                } else {
                                        // If we don't know what case the handle is from, delete the first one we find
                                        for (String caseIdentifier:caseHandlesCache.keySet()) {
                                                if (caseHandlesCache.get(caseIdentifier).fileHandleCache.contains(fileHandle)) {
                                                        caseHandlesCache.get(caseIdentifier).fileHandleCache.remove(fileHandle);
                                                        return;
                                                }
                                        }
                                }
                        }
                }

                private static boolean isValidFileHandle(long fileHandle) {
                        synchronized (cacheLock) {
                                for (String caseIdentifier:caseHandlesCache.keySet()) {
                                        if (caseHandlesCache.get(caseIdentifier).fileHandleCache.contains(fileHandle)) {
                                                return true;
                                        }
                                }
                                return false;
                        }
                }

                private static void closeHandlesAndClearCache(String caseIdentifier) throws TskCoreException {
                        synchronized (cacheLock) {
                                /*
                                 * Close any cached file system handles.
                                 */
                                for (Map<Long, Long> imageToFsMap : getCaseHandles(caseIdentifier).fsHandleCache.values()) {
                                        for (Long fsHandle : imageToFsMap.values()) {                                           
                                                // First close all open file handles for the file system.
                                                if (getCaseHandles(caseIdentifier).fileSystemToFileHandles.containsKey(fsHandle)) {
                                                        for (Long fileHandle : getCaseHandles(caseIdentifier).fileSystemToFileHandles.get(fsHandle)) {
                                                                // Update the cache of file handles contained in pools
                                                                if (poolFileHandles.contains(fileHandle)) {
                                                                        poolFileHandles.remove(fileHandle);
                                                                }
                                                                closeFile(fileHandle);
                                                        }
                                                }
                                                // Then close the file system handle.
                                                closeFsNat(fsHandle);
                                        }
                                }
                                
                                /*
                                 * Clear out the list of pool file systems.
                                 */
                                getCaseHandles(caseIdentifier).poolFsList.clear();
                                
                                /*
                                 * Close any cached pools
                                 */
                                for (Long imgHandle : getCaseHandles(caseIdentifier).poolHandleCache.keySet()) {
                                        for (Long poolHandle : getCaseHandles(caseIdentifier).poolHandleCache.get(imgHandle).values()) {
                                                closePoolNat(poolHandle);
                                        }
                                }
                                
                                /*
                                 * Close any open pool images
                                 */
                                for (Long imageHandle : getCaseHandles(caseIdentifier).poolImgCache) {
                                        closeImgNat(imageHandle);
                                }

                                /*
                                 * Close any cached image handles.
                                 */
                                for (Long imageHandle : getCaseHandles(caseIdentifier).imageHandleCache.values()) {
                                        closeImgNat(imageHandle);
                                }

                                removeCaseHandlesCache(caseIdentifier);
                        }

                }
        }

        public static class CaseDbHandle {

                /*
                 * A unique indentifier for a case
                 */
                private final String caseDbIdentifier;

                private CaseDbHandle(String databaseName) {
                        this.caseDbIdentifier = "SingleUser:" + databaseName; // NON-NLS
                        HandleCache.createCaseHandleCache(caseDbIdentifier);
                }
                
                private CaseDbHandle(String databaseName, CaseDbConnectionInfo info) {
                        this.caseDbIdentifier = "MultiUser:" + info.getHost() + ":" + databaseName;
                        HandleCache.createCaseHandleCache(caseDbIdentifier);
                }
                
                String getCaseDbIdentifier() {
                        return caseDbIdentifier;
                }

                void free() throws TskCoreException {
                        tskLock.writeLock().lock();
                        try {
                                HandleCache.closeHandlesAndClearCache(caseDbIdentifier);
                                //SleuthkitJNI.closeCaseDbNat(caseDbIdentifier);
                        } finally {
                                tskLock.writeLock().unlock();
                        }
                }

                long addImageInfo(long deviceObjId, List<String> imageFilePaths, String timeZone, SleuthkitCase skCase) throws TskCoreException {
                        TskCaseDbBridge dbHelper = new TskCaseDbBridge(skCase, new DefaultAddDataSourceCallbacks());
                        try {
                                long tskAutoDbPointer = initializeAddImgNat(dbHelper, timezoneLongToShort(timeZone), false, false, false);
                                runOpenAndAddImgNat(tskAutoDbPointer, UUID.randomUUID().toString(), imageFilePaths.toArray(new String[0]), imageFilePaths.size(), timeZone);                            
                                long id = finishAddImgNat(tskAutoDbPointer);
                                dbHelper.finish();
                                skCase.addDataSourceToHasChildrenMap();
                                return id;
                        } catch (TskDataException ex) {
                                throw new TskCoreException("Error adding image to case database", ex);
                        }
                }

                AddImageProcess initAddImageProcess(String timeZone, boolean addUnallocSpace, boolean skipFatFsOrphans, String imageCopyPath, SleuthkitCase skCase) {
                        return new AddImageProcess(timeZone, addUnallocSpace, skipFatFsOrphans, imageCopyPath, skCase);
                }

                public class AddImageProcess {

                        private final String timeZone;
                        private final boolean addUnallocSpace;
                        private final boolean skipFatFsOrphans;
                        private final String imageWriterPath;
                        private volatile long tskAutoDbPointer;
                        private long imageId = 0;
                        private boolean isCanceled;
                        private final SleuthkitCase skCase;
                        private TskCaseDbBridge dbHelper;

                        private AddImageProcess(String timeZone, boolean addUnallocSpace, boolean skipFatFsOrphans, String imageWriterPath, SleuthkitCase skCase) {
                                this.timeZone = timeZone;
                                this.addUnallocSpace = addUnallocSpace;
                                this.skipFatFsOrphans = skipFatFsOrphans;
                                this.imageWriterPath = imageWriterPath;
                                tskAutoDbPointer = 0;
                                this.isCanceled = false;
                                this.skCase = skCase;
                                
                        }

                        public void run(String deviceId, String[] imageFilePaths, int sectorSize) throws TskCoreException, TskDataException {
                                Image img = addImageToDatabase(skCase, imageFilePaths, sectorSize, "", "", "", "", deviceId);
                                run(deviceId, img, sectorSize, new DefaultAddDataSourceCallbacks());
                        }

                        public void run(String deviceId, Image image, int sectorSize, 
                                        AddDataSourceCallbacks addDataSourceCallbacks) throws TskCoreException, TskDataException {                      
                                dbHelper = new TskCaseDbBridge(skCase, addDataSourceCallbacks);
                                getTSKReadLock();
                                try {
                                        long imageHandle = 0;
                                        synchronized (this) {
                                                if (0 != tskAutoDbPointer) {
                                                        throw new TskCoreException("Add image process already started");
                                                }
                                                if (!isCanceled) { //with isCanceled being guarded by this it will have the same value everywhere in this synchronized block
                                                        imageHandle = image.getImageHandle();
                                                        tskAutoDbPointer = initAddImgNat(dbHelper, timezoneLongToShort(timeZone), addUnallocSpace, skipFatFsOrphans);
                                                }
                                                if (0 == tskAutoDbPointer) {
                                                        throw new TskCoreException("initAddImgNat returned a NULL TskAutoDb pointer");
                                                }
                                        }
                                        if (imageHandle != 0) {
                                                runAddImgNat(tskAutoDbPointer, deviceId, imageHandle, image.getId(), timeZone, imageWriterPath);
                                        }
                                } finally {
                                        finishAddImageProcess();
                                        releaseTSKReadLock();
                                }
                        }                       

                        public synchronized void stop() throws TskCoreException {
                                getTSKReadLock();
                                try {
                                        isCanceled = true;
                                        if (tskAutoDbPointer != 0) {
                                                stopAddImgNat(tskAutoDbPointer);
                                        }
                                } finally {
                                        releaseTSKReadLock();
                                }
                        }
                        
                        private synchronized void finishAddImageProcess() throws TskCoreException {
                                if (tskAutoDbPointer == 0) {
                                        return;
                                }

                                // If the process wasn't cancelled, finish up processing the
                                // remaining files.
                                if (! this.isCanceled && dbHelper != null) {
                                        dbHelper.finish();
                                }

                                // Free the auto DB pointer and get the image ID
                                imageId = finishAddImgNat(tskAutoDbPointer);
                                tskAutoDbPointer = 0;

                                skCase.addDataSourceToHasChildrenMap();
                        }                       

                        @Deprecated
                        public synchronized void revert() throws TskCoreException {
                                // No-op
                        }

                        @Deprecated
                        public synchronized long commit() throws TskCoreException {
                                return imageId;
                        }

                        public synchronized String currentDirectory() {
                                return tskAutoDbPointer == 0 ? "" : getCurDirNat(tskAutoDbPointer); //NON-NLS
                        }

                        @Deprecated
                        public void run(String[] imageFilePaths) throws TskCoreException, TskDataException {
                                run(null, imageFilePaths, 0);
                        }

                        public void run(String deviceId, String[] imageFilePaths) throws TskCoreException, TskDataException {
                                run(deviceId, imageFilePaths, 0);
                        }
                }

        }

        static CaseDbHandle newCaseDb(String path) throws TskCoreException {
                return new CaseDbHandle(path);
        }

        static CaseDbHandle newCaseDb(String databaseName, CaseDbConnectionInfo info) throws TskCoreException {
                return new CaseDbHandle(databaseName, info);
        }

        static CaseDbHandle openCaseDb(String path) throws TskCoreException {
                return new CaseDbHandle(path);
        }

        static CaseDbHandle openCaseDb(String databaseName, CaseDbConnectionInfo info) throws TskCoreException {
                return new CaseDbHandle(databaseName, info);
        }

        public static String getVersion() {
                return getVersionNat();
        }

        public static void startVerboseLogging(String logPath) {
                startVerboseLoggingNat(logPath);
        }

        public static long openImage(String[] imageFiles, SleuthkitCase skCase) throws TskCoreException {
                if (skCase == null) {
                        throw new TskCoreException("SleuthkitCase can not be null");
                }
                return openImage(imageFiles, 0, true, skCase.getCaseHandleIdentifier());
        }

        public static long openImage(String[] imageFiles, int sSize, SleuthkitCase skCase) throws TskCoreException {
                if (skCase == null) {
                        throw new TskCoreException("SleuthkitCase can not be null");
                }
                return openImage(imageFiles, sSize, true, skCase.getCaseHandleIdentifier());
        }
        
        private static long openImage(String[] imageFiles, int sSize, boolean useCache, String caseIdentifer) throws TskCoreException {
                getTSKReadLock();
                try {
                        long imageHandle;

                        StringBuilder keyBuilder = new StringBuilder();
                        for (int i = 0; i < imageFiles.length; ++i) {
                                keyBuilder.append(imageFiles[i]);
                        }
                        final String imageKey = keyBuilder.toString();

                        synchronized (HandleCache.cacheLock) {
                                String nonNullCaseIdentifer = caseIdentifer;
                                if (nonNullCaseIdentifer == null) {
                                        nonNullCaseIdentifer = HandleCache.getDefaultCaseIdentifier();
                                }
                                
                                // If we're getting a fresh copy and an image with this path is already
                                // in the cache, move the existing cache reference so it won't be used by 
                                // any subsequent calls to openImage but will still be valid if any objects
                                // have it cached. This happens in the case where the user adds the same data
                                // source twice (see JIRA-5868).
                                if (!useCache && HandleCache.getCaseHandles(nonNullCaseIdentifer).imageHandleCache.containsKey(imageKey)) {
                                        long tempImageHandle = HandleCache.getCaseHandles(nonNullCaseIdentifer).imageHandleCache.get(imageKey);
                                        
                                        // Store the old image handle in a fake path. This way it will no longer be found but will
                                        // still be valid and the image and its file systems will be closed with the case.
                                        String newPath = "Image_" + UUID.randomUUID().toString();
                                        HandleCache.getCaseHandles(nonNullCaseIdentifer).imageHandleCache.put(newPath, tempImageHandle);
                                        HandleCache.getCaseHandles(nonNullCaseIdentifer).imageHandleCache.remove(imageKey);
                                }

                                if (useCache && HandleCache.getCaseHandles(nonNullCaseIdentifer).imageHandleCache.containsKey(imageKey)) //get from cache
                                {
                                        imageHandle = HandleCache.getCaseHandles(nonNullCaseIdentifer).imageHandleCache.get(imageKey);
                                } else {
                                        //open new handle and cache it
                                        imageHandle = openImgNat(imageFiles, imageFiles.length, sSize);
                                        HandleCache.getCaseHandles(nonNullCaseIdentifer).fsHandleCache.put(imageHandle, new HashMap<>());
                                        HandleCache.getCaseHandles(nonNullCaseIdentifer).imageHandleCache.put(imageKey, imageHandle);
                                }
                        }
                        return imageHandle;
                } finally {
                        releaseTSKReadLock();
                }
        }
        
        private static void cacheImageHandle(SleuthkitCase skCase, List<String> imagePaths, long imageHandle) throws TskCoreException {
                
                // Construct the hash key from the image paths
                StringBuilder keyBuilder = new StringBuilder();
                for (int i = 0; i < imagePaths.size(); ++i) {
                        keyBuilder.append(imagePaths.get(i));
                }
                final String imageKey = keyBuilder.toString();
                
                // Get the case identifier
                String caseIdentifier = skCase.getCaseHandleIdentifier();

                synchronized (HandleCache.cacheLock) {
                        HandleCache.getCaseHandles(caseIdentifier).fsHandleCache.put(imageHandle, new HashMap<>());
                        HandleCache.getCaseHandles(caseIdentifier).imageHandleCache.put(imageKey, imageHandle);
                }
        }
        
        public static Image addImageToDatabase(SleuthkitCase skCase, String[] imagePaths, int sectorSize,
                String timeZone, String md5fromSettings, String sha1fromSettings, String sha256fromSettings, String deviceId) throws TskCoreException {
                
                // Open the image
                long imageHandle = openImgNat(imagePaths, 1, sectorSize);
                
                // Get the fields stored in the native code
                List<String> computedPaths = Arrays.asList(getPathsForImageNat(imageHandle));
                long size = getSizeForImageNat(imageHandle);
                long type = getTypeForImageNat(imageHandle);
                long computedSectorSize = getSectorSizeForImageNat(imageHandle);
                String md5 = md5fromSettings;
                if (StringUtils.isEmpty(md5)) {
                        md5 = getMD5HashForImageNat(imageHandle);
                }
                String sha1 = sha1fromSettings;
                if (StringUtils.isEmpty(sha1)) {
                        sha1 = getSha1HashForImageNat(imageHandle);
                }
                // Sleuthkit does not currently generate any SHA256 hashes. Set to empty
                // string for consistency.
                String sha256 = sha256fromSettings;
                if (sha256 == null) {
                        sha256 = "";
                }
                String collectionDetails = getCollectionDetailsForImageNat(imageHandle);
                
                //  Now save to database
                CaseDbTransaction transaction = skCase.beginTransaction();
                try {
                        Image img = skCase.addImage(TskData.TSK_IMG_TYPE_ENUM.valueOf(type), computedSectorSize, 
                                size, null, computedPaths, 
                                timeZone, md5, sha1, sha256, 
                                deviceId, transaction);
                        if (!StringUtils.isEmpty(collectionDetails)) {
                                skCase.setAcquisitionDetails(img, collectionDetails);
                        }
                        transaction.commit();
                        
                    img.setImageHandle(imageHandle);
                        cacheImageHandle(skCase, computedPaths, imageHandle);
                        return img;
                } catch (TskCoreException ex) {
                        transaction.rollback();
                        throw(ex);
                }
        }
        
        

        public static long openVs(long imgHandle, long vsOffset) throws TskCoreException {
                getTSKReadLock();
                try {
                        if(! imgHandleIsValid(imgHandle)) {
                                throw new TskCoreException("Image handle " + imgHandle + " is closed");
                        }
                        return openVsNat(imgHandle, vsOffset);
                } finally {
                        releaseTSKReadLock();
                }
        }

        //get pointers
        public static long openVsPart(long vsHandle, long volId) throws TskCoreException {
                getTSKReadLock();
                try {
                        //returned long is ptr to vs Handle object in tsk
                        return openVolNat(vsHandle, volId);
                } finally {
                        releaseTSKReadLock();
                }
        }
        
        static long openPool(long imgHandle, long offset, SleuthkitCase skCase) throws TskCoreException {
                getTSKReadLock();
                try {
                        if(! imgHandleIsValid(imgHandle)) {
                                throw new TskCoreException("Image handle " + imgHandle + " is closed");
                        }
                        
                        synchronized (HandleCache.cacheLock) {
                                String caseIdentifier;
                                if (skCase == null) {
                                        caseIdentifier = HandleCache.getDefaultCaseIdentifier();
                                } else {
                                        caseIdentifier = skCase.getCaseHandleIdentifier();
                                }
                                
                                // If a pool handle cache for this image does not exist, make one
                                if (! HandleCache.getCaseHandles(caseIdentifier).poolHandleCache.containsKey(imgHandle)) {
                                        HandleCache.getCaseHandles(caseIdentifier).poolHandleCache.put(imgHandle, new HashMap<>());
                                }
                                
                                // Get the pool handle cache for this image
                                Map<Long, Long> poolCacheForImage = HandleCache.getCaseHandles(caseIdentifier).poolHandleCache.get(imgHandle);
                                
                                if (poolCacheForImage.containsKey(offset)) {
                                        return poolCacheForImage.get(offset);
                                } else {
                                        //returned long is ptr to pool Handle object in tsk
                                        long poolHandle = openPoolNat(imgHandle, offset);
                                        poolCacheForImage.put(offset, poolHandle);
                                        return poolHandle;
                                }
                        }
                } finally {
                        releaseTSKReadLock();
                }
        }       
        
        public static long openFs(long imgHandle, long fsOffset, SleuthkitCase skCase) throws TskCoreException {
                getTSKReadLock();
                try {
                        long fsHandle;
                        synchronized (HandleCache.cacheLock) {
                                String caseIdentifier;
                                if (skCase == null) {
                                        caseIdentifier = HandleCache.getDefaultCaseIdentifier();
                                } else {
                                        caseIdentifier = skCase.getCaseHandleIdentifier();
                                }
                                final Map<Long, Long> imgOffSetToFsHandle = HandleCache.getCaseHandles(caseIdentifier).fsHandleCache.get(imgHandle);
                                if (imgOffSetToFsHandle == null) {
                                        throw new TskCoreException("Missing image offset to file system handle cache for image handle " + imgHandle);
                                }
                                if (imgOffSetToFsHandle.containsKey(fsOffset)) {
                                        //return cached
                                        fsHandle = imgOffSetToFsHandle.get(fsOffset);
                                } else {
                                        fsHandle = openFsNat(imgHandle, fsOffset);
                                        //cache it
                                        imgOffSetToFsHandle.put(fsOffset, fsHandle);
                                }
                        }
                        return fsHandle;
                } finally {
                        releaseTSKReadLock();
                }
        }
        
        static long openFsPool(long imgHandle, long fsOffset, long poolHandle, long poolBlock, SleuthkitCase skCase) throws TskCoreException {
                /*
                 * Currently, our APFS code is not thread-safe and it is the only code
                 * that uses pools. To prevent crashes, we make any reads to a file system
                 * contained in a pool single-threaded.
                 */
                getTSKWriteLock();
                try {
                        long fsHandle;
                        synchronized (HandleCache.cacheLock) {
                                String caseIdentifier;
                                if (skCase == null) {
                                        caseIdentifier = HandleCache.getDefaultCaseIdentifier();
                                } else {
                                        caseIdentifier = skCase.getCaseHandleIdentifier();
                                }
                                final Map<Long, Long> imgOffSetToFsHandle = HandleCache.getCaseHandles(caseIdentifier).fsHandleCache.get(imgHandle);
                                if (imgOffSetToFsHandle == null) {
                                        throw new TskCoreException("Missing image offset to file system handle cache for image handle " + imgHandle);
                                }
                                
                                if (imgOffSetToFsHandle.containsKey(poolBlock)) {
                                        //return cached
                                        fsHandle = imgOffSetToFsHandle.get(poolBlock);
                                } else {
                                        long poolImgHandle = getImgInfoForPoolNat(poolHandle, poolBlock);
                                        HandleCache.getCaseHandles(caseIdentifier).poolImgCache.add(poolImgHandle);
                                        fsHandle = openFsNat(poolImgHandle, fsOffset);
                                        //cache it
                                        imgOffSetToFsHandle.put(poolBlock, fsHandle);
                                        HandleCache.getCaseHandles(caseIdentifier).poolFsList.add(fsHandle);
                                }
                        }
                        return fsHandle;
                } finally {
                        releaseTSKWriteLock();
                }
        }

        public static long openFile(long fsHandle, long fileId, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, SleuthkitCase skCase) throws TskCoreException {
                /*
                 * NOTE: previously attrId used to be stored in AbstractFile as (signed)
                 * short even though it is stored as uint16 in TSK. In extremely rare
                 * occurrences attrId can be larger than what a signed short can hold
                 * (2^15). Changes were made to AbstractFile to store attrId as integer.
                 * However, a depricated method still exists in AbstractFile to get
                 * attrId as short. In that method we convert attribute ids that are
                 * larger than 32K to a negative number. Therefore if encountered, we
                 * need to convert negative attribute id to uint16 which is what TSK is
                 * using to store attribute id.
                 */
                boolean withinPool = false;
                synchronized (HandleCache.cacheLock) {
                        String caseIdentifier;
                        if (skCase == null) {
                                caseIdentifier = HandleCache.getDefaultCaseIdentifier();
                        } else {
                                caseIdentifier = skCase.getCaseHandleIdentifier();
                        }
                        if (HandleCache.getCaseHandles(caseIdentifier).poolFsList.contains(fsHandle)) {
                                withinPool = true;
                        }
                }
                
                /*
                 * The current APFS code is not thread-safe. To compensate, we make any
                 * reads to the APFS pool single-threaded by obtaining a write
                 * lock instead of a read lock.
                 */
                if (withinPool) {
                        getTSKWriteLock();
                } else {
                        getTSKReadLock();
                }
                try {
                        long fileHandle = openFileNat(fsHandle, fileId, attrType.getValue(), convertSignedToUnsigned(attrId));
                        synchronized (HandleCache.cacheLock) {
                                String caseIdentifier;
                                if (skCase == null) {
                                        caseIdentifier = HandleCache.getDefaultCaseIdentifier();
                                } else {
                                        caseIdentifier = skCase.getCaseHandleIdentifier();
                                }
                                HandleCache.addFileHandle(caseIdentifier, fileHandle, fsHandle);

                                // If this file is in a pool file system, record it so the locks
                                // can be set appropriately when reading it.
                                if (withinPool) {
                                        HandleCache.poolFileHandles.add(fileHandle);
                                }
                        }
                        return fileHandle;
                } finally {
                        if (withinPool) {
                                releaseTSKWriteLock();
                        } else {
                                releaseTSKReadLock();
                        }
                }
        }

        private static int convertSignedToUnsigned(int val) {
                if (val >= 0) {
                        return val;
                }

                return val & 0xffff;    // convert negative value to positive value
        }
        
        private static boolean imgHandleIsValid(long imgHandle) {
                synchronized(HandleCache.cacheLock) {
                        return HandleCache.isImageInAnyCache(imgHandle);
                }
        }

        //do reads
        public static int readImg(long imgHandle, byte[] readBuffer, long offset, long len) throws TskCoreException {
                getTSKReadLock();
                try {
                        if(! imgHandleIsValid(imgHandle)) {
                                throw new TskCoreException("Image handle " + imgHandle + " is closed");
                        }
                        //returned byte[] is the data buffer
                        return readImgNat(imgHandle, readBuffer, offset, len);
                } finally {
                        releaseTSKReadLock();
                }
        }

        public static int readVs(long vsHandle, byte[] readBuffer, long offset, long len) throws TskCoreException {
                getTSKReadLock();
                try {
                        return readVsNat(vsHandle, readBuffer, offset, len);
                } finally {
                        releaseTSKReadLock();
                }
        }
        
        static int readPool(long poolHandle, byte[] readBuffer, long offset, long len) throws TskCoreException {
                getTSKReadLock();
                try {
                        return readPoolNat(poolHandle, readBuffer, offset, len);
                } finally {
                        releaseTSKReadLock();
                }
        }

        public static int readVsPart(long volHandle, byte[] readBuffer, long offset, long len) throws TskCoreException {
                getTSKReadLock();
                try {
                        //returned byte[] is the data buffer
                        return readVolNat(volHandle, readBuffer, offset, len);
                } finally {
                        releaseTSKReadLock();
                }
        }

        public static int readFs(long fsHandle, byte[] readBuffer, long offset, long len) throws TskCoreException {
                getTSKReadLock();
                try {
                        //returned byte[] is the data buffer
                        return readFsNat(fsHandle, readBuffer, offset, len);
                } finally {
                        releaseTSKReadLock();
                }
        }

        private enum TSK_FS_FILE_READ_OFFSET_TYPE_ENUM {
                START_OF_FILE(0),
                START_OF_SLACK(1);

                private final int val;

                TSK_FS_FILE_READ_OFFSET_TYPE_ENUM(int val) {
                        this.val = val;
                }

                int getValue() {
                        return val;
                }
        }

        public static int readFile(long fileHandle, byte[] readBuffer, long offset, long len) throws TskCoreException {
                boolean withinPool = false;
                synchronized (HandleCache.cacheLock) {
                        if (HandleCache.poolFileHandles.contains(fileHandle)) {
                                withinPool = true;
                        }
                }
                
                /*
                 * The current APFS code is not thread-safe. To compensate, we make any
                 * reads to the APFS pool single-threaded by obtaining a write
                 * lock instead of a read lock.
                 */
                if (withinPool) {
                        getTSKWriteLock();
                } else {
                        getTSKReadLock();
                }
                try {
                        if (!HandleCache.isValidFileHandle(fileHandle)) {
                                throw new TskCoreException(HandleCache.INVALID_FILE_HANDLE);
                        }

                        return readFileNat(fileHandle, readBuffer, offset, TSK_FS_FILE_READ_OFFSET_TYPE_ENUM.START_OF_FILE.getValue(), len);
                } finally {
                        if (withinPool) {
                                releaseTSKWriteLock();
                        } else {
                                releaseTSKReadLock();
                        }
                }
        }

        public static int readFileSlack(long fileHandle, byte[] readBuffer, long offset, long len) throws TskCoreException {
                getTSKReadLock();
                try {
                        if (!HandleCache.isValidFileHandle(fileHandle)) {
                                throw new TskCoreException(HandleCache.INVALID_FILE_HANDLE);
                        }

                        return readFileNat(fileHandle, readBuffer, offset, TSK_FS_FILE_READ_OFFSET_TYPE_ENUM.START_OF_SLACK.getValue(), len);
                } finally {
                        releaseTSKReadLock();
                }
        }

        public static List<String> getFileMetaDataText(long fileHandle) throws TskCoreException {
                getTSKReadLock();
                try {
                        if (!HandleCache.isValidFileHandle(fileHandle)) {
                                throw new TskCoreException(HandleCache.INVALID_FILE_HANDLE);
                        }

                        try {
                                java.io.File tmp = java.io.File.createTempFile("tsk", ".txt");

                                saveFileMetaDataTextNat(fileHandle, tmp.getAbsolutePath());

                                FileReader fr = new FileReader(tmp.getAbsolutePath());
                                BufferedReader textReader = new BufferedReader(fr);

                                List<String> lines = new ArrayList<String>();
                                while (true) {
                                        String line = textReader.readLine();
                                        if (line == null) {
                                                break;
                                        }
                                        lines.add(line);
                                }
                                textReader.close();
                                fr.close();
                                tmp.delete();
                                return lines;
                        } catch (IOException ex) {
                                throw new TskCoreException("Error reading istat output: " + ex.getLocalizedMessage());
                        }
                } finally {
                        releaseTSKReadLock();
                }
        }

        public static void closeFile(long fileHandle) {
                closeFile(fileHandle, null);
        }
        
        public static void closeFile(long fileHandle, SleuthkitCase skCase) {           
                boolean withinPool = false;
                synchronized (HandleCache.cacheLock) {
                        if (HandleCache.poolFileHandles.contains(fileHandle)) {
                                withinPool = true;
                        }
                }
                
                /*
                 * The current APFS code is not thread-safe. To compensate, we make any
                 * reads to the APFS pool single-threaded by obtaining a write
                 * lock instead of a read lock.
                 */
                if (withinPool) {
                        getTSKWriteLock();
                } else {
                        getTSKReadLock();
                }
                try {
                        synchronized (HandleCache.cacheLock) {
                                if (!HandleCache.isValidFileHandle(fileHandle)) {
                                        // File handle is not open so this is a no-op.
                                        return;
                                }
                                closeFileNat(fileHandle);
                                HandleCache.removeFileHandle(fileHandle, skCase);
                                if (HandleCache.poolFileHandles.contains(fileHandle)) {
                                        HandleCache.poolFileHandles.remove(fileHandle);
                                }
                        }
                } finally {
                        if (withinPool) {
                                releaseTSKWriteLock();
                        } else {
                                releaseTSKReadLock();
                        }
                }
        }

        public static void createLookupIndexForHashDatabase(int dbHandle) throws TskCoreException {
                hashDbCreateIndexNat(dbHandle);
        }

        public static boolean hashDatabaseHasLookupIndex(int dbHandle) throws TskCoreException {
                return hashDbIndexExistsNat(dbHandle);
        }

        public static boolean hashDatabaseCanBeReindexed(int dbHandle) throws TskCoreException {
                return hashDbIsReindexableNat(dbHandle);
        }

        public static String getHashDatabasePath(int dbHandle) throws TskCoreException {
                return hashDbPathNat(dbHandle);
        }

        public static String getHashDatabaseIndexPath(int dbHandle) throws TskCoreException {
                return hashDbIndexPathNat(dbHandle);
        }

        public static int openHashDatabase(String path) throws TskCoreException {
                return hashDbOpenNat(path);
        }

        public static int createHashDatabase(String path) throws TskCoreException {
                return hashDbNewNat(path);
        }

        public static void closeAllHashDatabases() throws TskCoreException {
                hashDbCloseAll();
        }

        public static void closeHashDatabase(int dbHandle) throws TskCoreException {
                hashDbClose(dbHandle);
        }

        public static String getHashDatabaseDisplayName(int dbHandle) throws TskCoreException {
                return hashDbGetDisplayName(dbHandle);
        }

        public static boolean lookupInHashDatabase(String hash, int dbHandle) throws TskCoreException {
                return hashDbLookup(hash, dbHandle);
        }

        public static HashHitInfo lookupInHashDatabaseVerbose(String hash, int dbHandle) throws TskCoreException {
                return hashDbLookupVerbose(hash, dbHandle);
        }

        public static void addToHashDatabase(String filename, String md5, String sha1, String sha256, String comment, int dbHandle) throws TskCoreException {
                hashDbAddEntryNat(filename, md5, sha1, sha256, comment, dbHandle);
        }

        public static void addToHashDatabase(List<HashEntry> hashes, int dbHandle) throws TskCoreException {
                hashDbBeginTransactionNat(dbHandle);
                try {
                        for (HashEntry entry : hashes) {
                                hashDbAddEntryNat(entry.getFileName(), entry.getMd5Hash(), entry.getSha1Hash(), entry.getSha256Hash(), entry.getComment(), dbHandle);
                        }
                        hashDbCommitTransactionNat(dbHandle);
                } catch (TskCoreException ex) {
                        try {
                                hashDbRollbackTransactionNat(dbHandle);
                        } catch (TskCoreException ex2) {
                                ex2.initCause(ex);
                                throw ex2;
                        }
                        throw ex;
                }
        }

        public static boolean isUpdateableHashDatabase(int dbHandle) throws TskCoreException {
                return hashDbIsUpdateableNat(dbHandle);
        }

        public static boolean hashDatabaseIsIndexOnly(int dbHandle) throws TskCoreException {
                return hashDbIsIdxOnlyNat(dbHandle);
        }

        private static String timezoneLongToShort(String timezoneLongForm) {
                if (timezoneLongForm == null || timezoneLongForm.isEmpty()) {
                        return "";
                }

                String timezoneShortForm;
                TimeZone zone = TimeZone.getTimeZone(timezoneLongForm);
                int offset = zone.getRawOffset() / 1000;
                int hour = offset / 3600;
                int min = (offset % 3600) / 60;
                DateFormat dfm = new SimpleDateFormat("z");
                dfm.setTimeZone(zone);
                boolean hasDaylight = zone.useDaylightTime();
                String first = dfm.format(new GregorianCalendar(2010, 1, 1).getTime()).substring(0, 3); // make it only 3 letters code
                String second = dfm.format(new GregorianCalendar(2011, 6, 6).getTime()).substring(0, 3); // make it only 3 letters code
                int mid = hour * -1;
                timezoneShortForm = first + Integer.toString(mid);
                if (min != 0) {
                        timezoneShortForm = timezoneShortForm + ":" + (min < 10 ? "0" : "") + Integer.toString(min);
                }
                if (hasDaylight) {
                        timezoneShortForm += second;
                }
                return timezoneShortForm;
        }

        public static int finishImageWriter(long imgHandle) throws TskCoreException {
                getTSKReadLock();
                try {
                        if(! imgHandleIsValid(imgHandle)) {
                                throw new TskCoreException("Image handle " + imgHandle + " is closed");
                        }
                        return finishImageWriterNat(imgHandle);
                } finally {
                        releaseTSKReadLock();
                }
        }

        public static int getFinishImageProgress(long imgHandle) {
                getTSKReadLock();
                try {
                        if (imgHandleIsValid(imgHandle)) {
                                return getFinishImageProgressNat(imgHandle);
                        } else {
                                return 0;
                        }
                } finally {
                        releaseTSKReadLock();
                }
        }

        public static void cancelFinishImage(long imgHandle) {
                getTSKReadLock();
                try {
                        if (imgHandleIsValid(imgHandle)) {
                                cancelFinishImageNat(imgHandle);
                        }
                } finally {
                        releaseTSKReadLock();
                }
        }

        public static long findDeviceSize(String devPath) throws TskCoreException {
                return findDeviceSizeNat(devPath);
        }

        public static boolean isImageSupported(String imagePath) {
                return isImageSupportedNat(imagePath);
        }
        
        static long getSleuthkitVersion() {
                return getSleuthkitVersionNat();
        }

        private static void getTSKReadLock() {
                tskLock.readLock().lock();
        }

        private static void releaseTSKReadLock() {
                tskLock.readLock().unlock();
        }
        
        private static void getTSKWriteLock() {
                tskLock.writeLock().lock();
        }

        private static void releaseTSKWriteLock() {
                tskLock.writeLock().unlock();
        }       

        //free pointers
        @Deprecated
        public static void closeImg(long imgHandle) {
                //closeImgNat(imgHandle); 
        }

        @Deprecated
        public static void closeVs(long vsHandle) {
                //              closeVsNat(vsHandle);  TODO JIRA-3829 
        }

        @Deprecated
        public static void closeFs(long fsHandle) {
                //closeFsNat(fsHandle);
        }
        
        @Deprecated
        public static long openImage(String[] imageFiles) throws TskCoreException {
                
                return openImage(imageFiles, 0, true, null);
        }

        @Deprecated
        public static long openImage(String[] imageFiles, int sSize) throws TskCoreException {
                return openImage(imageFiles, sSize, true, null);
        }
        
                
        @Deprecated
        public static long openFs(long imgHandle, long fsOffset) throws TskCoreException {
                return openFs(imgHandle, fsOffset, null);
        }       
        
        @Deprecated
        public static long openFile(long fsHandle, long fileId, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId) throws TskCoreException {
                return openFile(fsHandle, fileId, attrType, attrId, null);
        }       
        

        private static native String getVersionNat();

        private static native void startVerboseLoggingNat(String logPath);

        private static native int hashDbOpenNat(String hashDbPath) throws TskCoreException;

        private static native int hashDbNewNat(String hashDbPath) throws TskCoreException;

        private static native int hashDbBeginTransactionNat(int dbHandle) throws TskCoreException;

        private static native int hashDbCommitTransactionNat(int dbHandle) throws TskCoreException;

        private static native int hashDbRollbackTransactionNat(int dbHandle) throws TskCoreException;

        private static native int hashDbAddEntryNat(String filename, String hashMd5, String hashSha1, String hashSha256, String comment, int dbHandle) throws TskCoreException;

        private static native boolean hashDbIsUpdateableNat(int dbHandle);

        private static native boolean hashDbIsReindexableNat(int dbHandle);

        private static native String hashDbPathNat(int dbHandle);

        private static native String hashDbIndexPathNat(int dbHandle);

        private static native String hashDbGetDisplayName(int dbHandle) throws TskCoreException;

        private static native void hashDbCloseAll() throws TskCoreException;

        private static native void hashDbClose(int dbHandle) throws TskCoreException;

        private static native void hashDbCreateIndexNat(int dbHandle) throws TskCoreException;

        private static native boolean hashDbIndexExistsNat(int dbHandle) throws TskCoreException;

        private static native boolean hashDbIsIdxOnlyNat(int dbHandle) throws TskCoreException;

        private static native boolean hashDbLookup(String hash, int dbHandle) throws TskCoreException;

        private static native HashHitInfo hashDbLookupVerbose(String hash, int dbHandle) throws TskCoreException;

        private static native long initAddImgNat(TskCaseDbBridge dbHelperObj, String timezone, boolean addUnallocSpace, boolean skipFatFsOrphans) throws TskCoreException;

        private static native long initializeAddImgNat(TskCaseDbBridge dbHelperObj, String timezone, boolean addFileSystems, boolean addUnallocSpace, boolean skipFatFsOrphans) throws TskCoreException;

        private static native void runOpenAndAddImgNat(long process, String deviceId, String[] imgPath, int splits, String timezone) throws TskCoreException, TskDataException;

        private static native void runAddImgNat(long process, String deviceId, long a_img_info, long image_id, String timeZone, String imageWriterPath) throws TskCoreException, TskDataException;

        private static native void stopAddImgNat(long process) throws TskCoreException;

        private static native long finishAddImgNat(long process) throws TskCoreException;

        private static native long openImgNat(String[] imgPath, int splits, int sSize) throws TskCoreException;

        private static native long openVsNat(long imgHandle, long vsOffset) throws TskCoreException;

        private static native long openVolNat(long vsHandle, long volId) throws TskCoreException;
        
        private static native long openPoolNat(long imgHandle, long offset) throws TskCoreException;
        
        private static native long getImgInfoForPoolNat(long poolHandle, long poolOffset) throws TskCoreException;
        
        private static native long openFsNat(long imgHandle, long fsId) throws TskCoreException;

        private static native long openFileNat(long fsHandle, long fileId, int attrType, int attrId) throws TskCoreException;

        private static native int readImgNat(long imgHandle, byte[] readBuffer, long offset, long len) throws TskCoreException;

        private static native int readVsNat(long vsHandle, byte[] readBuffer, long offset, long len) throws TskCoreException;
        
        private static native int readPoolNat(long poolHandle, byte[] readBuffer, long offset, long len) throws TskCoreException;       

        private static native int readVolNat(long volHandle, byte[] readBuffer, long offset, long len) throws TskCoreException;

        private static native int readFsNat(long fsHandle, byte[] readBuffer, long offset, long len) throws TskCoreException;

        private static native int readFileNat(long fileHandle, byte[] readBuffer, long offset, int offset_type, long len) throws TskCoreException;

        private static native int saveFileMetaDataTextNat(long fileHandle, String fileName) throws TskCoreException;
        
        private static native String[] getPathsForImageNat(long imgHandle);
        
        private static native long getSizeForImageNat(long imgHandle);
        
        private static native long getTypeForImageNat(long imgHandle);
        
        private static native long getSectorSizeForImageNat(long imgHandle);
        
        private static native String getMD5HashForImageNat(long imgHandle);
        
        private static native String getSha1HashForImageNat(long imgHandle);
        
        private static native String getCollectionDetailsForImageNat(long imgHandle);

        private static native void closeImgNat(long imgHandle);
        
        private static native void closePoolNat(long poolHandle);

        private static native void closeVsNat(long vsHandle);

        private static native void closeFsNat(long fsHandle);

        private static native void closeFileNat(long fileHandle);

        private static native long findDeviceSizeNat(String devicePath) throws TskCoreException;

        private static native String getCurDirNat(long process);

        private static native boolean isImageSupportedNat(String imagePath);
        
        private static native long getSleuthkitVersionNat();

        private static native int finishImageWriterNat(long a_img_info);

        private static native int getFinishImageProgressNat(long a_img_info);

        private static native void cancelFinishImageNat(long a_img_info);

}