19 package org.sleuthkit.datamodel;
21 import java.text.MessageFormat;
22 import java.util.ResourceBundle;
23 import java.util.EnumSet;
32 private final static ResourceBundle bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
53 private short dirType;
57 this.dirType = (short) type;
88 if (v.dirType == dir_type) {
92 throw new IllegalArgumentException(
93 MessageFormat.format(bundle.getString(
"TskData.tskFsNameTypeEnum.exception.msg1.text"), dir_type));
116 private short metaType;
117 private String metaTypeStr;
120 this.metaType = (short) type;
121 this.metaTypeStr = metaTypeStr;
140 if (type.getValue() == metaType) {
144 throw new IllegalArgumentException(
145 MessageFormat.format(bundle.getString(
"TskData.tskFsMetaTypeEnum.exception.msg1.text"), metaType));
156 ALLOC(1, bundle.getString(
"TskData.tskFsNameFlagEnum.allocated")),
157 UNALLOC(2, bundle.getString(
"TskData.tskFsNameFlagEnum.unallocated"));
159 private short dirFlag;
160 private String dirFlagStr;
163 this.dirFlag = (short) flag;
164 this.dirFlagStr = dirFlagStr;
190 if (flag.dirFlag == dirFlag) {
194 throw new IllegalArgumentException(
195 MessageFormat.format(bundle.getString(
"TskData.tskFsNameFlagEnum.exception.msg1.text"), dirFlag));
206 ALLOC(1, bundle.getString(
"TskData.tskFsMetaFlagEnum.allocated")),
207 UNALLOC(2, bundle.getString(
"TskData.tskFsMetaFlagEnum.unallocated")),
208 USED(4, bundle.getString(
"TskData.tskFsMetaFlagEnum.used")),
209 UNUSED(8, bundle.getString(
"TskData.tskFsMetaFlagEnum.unused")),
210 COMP(16, bundle.getString(
"TskData.tskFsMetaFlagEnum.compressed")),
211 ORPHAN(32, bundle.getString(
"TskData.tskFsMetaFlagEnum.orphan"));
213 private short meta_flag;
214 private String label;
217 this.meta_flag = (short) flag;
247 public static Set<TSK_FS_META_FLAG_ENUM>
valuesOf(
short metaFlags) {
251 long flag = v.getValue();
253 if ((metaFlags & flag) == flag) {
261 public static short toInt(Set<TSK_FS_META_FLAG_ENUM> metaFlags) {
264 val |= flag.getValue();
318 if (type.val == val) {
322 throw new IllegalArgumentException(
323 MessageFormat.format(bundle.getString(
"TskData.tskFsAttrTypeEnum.exception.msg1.text"), val));
338 private long vs_flag;
383 this.mode = (short) mode;
403 public static Set<TSK_FS_META_MODE_ENUM>
valuesOf(
short modes) {
407 long flag = v.getMode();
409 if ((modes & flag) == flag) {
422 public static short toInt(Set<TSK_FS_META_MODE_ENUM> modes) {
425 modesInt |= mode.getMode();
468 private String displayName;
472 this.displayName = displayName;
503 if (type.value == fsTypeValue) {
507 throw new IllegalArgumentException(
508 MessageFormat.format(bundle.getString(
"TskData.tskFsTypeEnum.exception.msg1.text"), fsTypeValue));
532 private long imgType;
542 if (type.getValue() == imgType) {
546 throw new IllegalArgumentException(
547 MessageFormat.format(bundle.getString(
"TskData.tskImgTypeEnum.exception.msg1.text"), imgType));
595 if (type.getVsType() == vsType) {
599 throw new IllegalArgumentException(
600 MessageFormat.format(bundle.getString(
"TskData.tskVSTypeEnum.exception.msg1.text"), vsType));
628 IMG(0, bundle.getString(
"TskData.ObjectType.IMG.name")),
629 VS(1, bundle.getString(
"TskData.ObjectType.VS.name")),
630 VOL(2, bundle.getString(
"TskData.ObjectType.VOL.name")),
631 FS(3, bundle.getString(
"TskData.ObjectType.FS.name")),
632 ABSTRACTFILE(4, bundle.getString(
"TskData.ObjectType.AbstractFile.name")),
633 ARTIFACT(5, bundle.getString(
"TskData.ObjectType.Artifact.name")),
634 REPORT(6, bundle.getString(
"TskData.ObjectType.Report.name")),
635 POOL(7, bundle.getString(
"TskData.ObjectType.Pool.name")),
636 OS_ACCOUNT(8, bundle.getString(
"TskData.ObjectType.OsAccount.name")),
637 HOST_ADDRESS(9, bundle.getString(
"TskData.ObjectType.HostAddress.name")),
638 UNSUPPORTED(-1, bundle.getString(
"TskData.ObjectType.Unsupported.name"))
640 private final short objectType;
641 private final String displayName;
643 private ObjectType(
int objectType, String displayName) {
644 this.objectType = (short) objectType;
645 this.displayName = displayName;
671 if (v.objectType == objectType) {
685 FS(0,
"File System"),
697 private final short fileType;
698 private final String name;
701 this.fileType = (short) fileType;
714 if (type.fileType == fileType) {
718 throw new IllegalArgumentException(
719 MessageFormat.format(bundle.getString(
"TskData.tskDbFilesTypeEnum.exception.msg1.text"), fileType));
743 TSK_POOL_TYPE_UNSUPP(0xffff,
"Unsupported")
746 private final short poolType;
747 private final String name;
750 this.poolType = (short) poolType;
763 if (type.poolType == poolType) {
767 throw new IllegalArgumentException(
768 MessageFormat.format(bundle.getString(
"TskData.tskDbFilesTypeEnum.exception.msg1.text"), poolType));
791 UNKNOWN(0, bundle.getString(
"TskData.fileKnown.unknown")),
792 KNOWN(1, bundle.getString(
"TskData.fileKnown.known")),
793 BAD(2, bundle.getString(
"TskData.fileKnown.knownBad"));
798 private FileKnown(
int known, String name) {
799 this.known = (byte) known;
812 if (v.known == known) {
816 throw new IllegalArgumentException(
817 MessageFormat.format(bundle.getString(
"TskData.fileKnown.exception.msg1.text"), known));
870 private final int type;
882 if (v.type == type) {
886 throw new IllegalArgumentException(
887 MessageFormat.format(bundle.getString(
"TskData.encodingType.exception.msg1.text"), type));
VIRT
Special (TSK added "Virtual" files) NON-NLS.
TSK_FS_ATTR_TYPE_NTFS_OBJID
FS
File that can be found in file system tree.
static FileKnown valueOf(byte known)
TSK_POOL_TYPE_ENUM(int poolType, String name)
TSK_VS_PART_FLAG_ALL
Show all sectors in the walk.
TSK_FS_ATTR_TYPE_NTFS_EAINFO
TSK_VS_TYPE_BSD
BSD Partition table NON-NLS.
TSK_FS_META_TYPE_WHT
Whiteout NON-NLS.
TSK_FS_TYPE_EXT_DETECT
ExtX auto detection.
TSK_VS_TYPE_MAC
Mac partition table NON-NLS.
TSK_FS_ATTR_TYPE_NTFS_VNAME
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
TSK_VS_TYPE_DBFILLER
fake partition table type for loaddb (for images that do not have a volume system) ...
UNUSED
Metadata structure has never been allocated.
TSK_FS_TYPE_EXT3
Ext3 file system.
ALLOC
Metadata structure is currently in an allocated state.
TSK_FS_ATTR_TYPE_NTFS_VINFO
TSK_VS_PART_FLAG_ALLOC
Sectors are allocated to a volume in the volume system.
TSK_FS_TYPE_NTFS_DETECT
NTFS auto detection.
static TSK_FS_TYPE_ENUM valueOf(int fsTypeValue)
TSK_FS_TYPE_NTFS
NTFS file system.
TSK_FS_META_TYPE_DIR
Directory file NON-NLS.
TSK_FS_META_TYPE_SHAD
SOLARIS ONLY NON-NLS.
TSK_FS_META_MODE_ISVTX
sticky bit
TSK_VS_TYPE_SUN
Sun VTOC NON-NLS.
UNALLOC
Metadata structure is currently in an unallocated state.
TSK_FS_ATTR_TYPE_HFS_EXT_ATTR
TSK_FS_TYPE_FAT32
FAT32 file system.
static TSK_FS_META_TYPE_ENUM valueOf(short metaType)
TSK_FS_META_MODE_IXOTH
X for other.
LNK
Symbolic link NON-NLS.
TSK_FS_META_TYPE_VIRT_DIR
"Virtual Directory" created by TSK for Orphan Files NON-NLS
TSK_FS_ATTR_TYPE_NTFS_ATTRLIST
COMP
The file contents are compressed.
TSK_FS_META_MODE_ISUID
set user id on execution
TSK_VS_TYPE_APFS
APFS pool NON-NLS.
TSK_FS_TYPE_HFS_DETECT
HFS auto detection.
TSK_FS_META_MODE_IXGRP
X for group.
TSK_FS_TYPE_FAT12
FAT12 file system.
HOST_ADDRESS
Host Address - see tsk_host_addresses for more details.
LAYOUT_FILE
Set of blocks from an image that have been designated as a file.
TSK_FS_TYPE_YAFFS2_DETECT
YAFFS2 auto detection.
TSK_FS_META_MODE_IWOTH
W for other.
WHT
Whiteout (openbsd) NON-NLS.
TSK_FS_META_MODE_IRGRP
R for group.
TSK_VS_PART_FLAG_META
Sectors contain volume system metadata and could also be ALLOC or UNALLOC.
TSK_FS_ATTR_TYPE_HFS_COMP_REC
TSK_FS_TYPE_FFS1B
UFS1b (Solaris - has no type)
SLACK
Slack space for a single file.
TSK_FS_ATTR_TYPE_NTFS_REPARSE
TSK_FS_TYPE_FFS1
UFS1 (FreeBSD, OpenBSD, BSDI ...)
TSK_FS_ATTR_TYPE_NTFS_IDXROOT
static TSK_FS_ATTR_TYPE_ENUM valueOf(int val)
LOCAL
Local file that was added (not from a disk image)
TSK_FS_META_MODE_IWUSR
W for owner.
TSK_VS_TYPE_UNSUPP
Unsupported.
TSK_FS_TYPE_SWAP_DETECT
SWAP auto detection.
TSK_FS_META_TYPE_CHR
Character device NON-NLS.
static TSK_POOL_TYPE_ENUM valueOf(long poolType)
TSK_POOL_TYPE_APFS
APFS Pooled Volumes.
TSK_FS_TYPE_APFS_DETECT
APFS auto detection.
CARVED
Set of blocks for a file found from carving. Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS ra...
static TSK_FS_NAME_FLAG_ENUM valueOf(int dirFlag)
TSK_FS_TYPE_ISO9660_DETECT
ISO9660 auto detection.
TSK_FS_ATTR_TYPE_HFS_DATA
FS
File System - see tsk_fs_info for more details.
TSK_FS_TYPE_SWAP
SWAP file system.
TSK_FS_META_MODE_IROTH
R for other.
TSK_FS_TYPE_UNSUPP
Unsupported file system.
TSK_FS_TYPE_RAW
RAW file system.
TSK_FS_TYPE_EXFAT
ExFAT file system.
USED
Metadata structure has been allocated at least once.
VIRT_DIR
Special (TSK added "Virtual" directories) NON-NLS.
LOCAL_DIR
Local directory that was added (not from a disk image)
TSK_FS_TYPE_FAT_DETECT
FAT auto detection.
VOL
Volume - see tsk_vs_parts for more details.
TSK_FS_ATTR_TYPE_NTFS_IDXALLOC
static EncodingType valueOf(int type)
TSK_FS_ATTR_TYPE_NTFS_BITMAP
TSK_FS_TYPE_RAW_DETECT
RAW auto detection.
TSK_FS_META_TYPE_VIRT
"Virtual File" created by TSK for file system areas NON-NLS
TSK_VS_TYPE_GPT
GPT partition table NON-NLS.
TSK_FS_META_MODE_IRUSR
R for owner.
TSK_FS_TYPE_DETECT
Use autodetection methods.
TSK_FS_ATTR_TYPE_HFS_DEFAULT
static TSK_FS_NAME_TYPE_ENUM valueOf(short dir_type)
CHR
Character device NON-NLS.
TSK_FS_TYPE_APFS
APFS file system.
REPORT
Artifact - see blackboard_artifacts for more details.
SHAD
Shadow inode (solaris) NON-NLS.
static short toInt(Set< TSK_FS_META_MODE_ENUM > modes)
BAD
File marked as known and bad/notable/interesting by hash db.
DERIVED
File derived from a parent file (i.e. from ZIP)
TSK_FS_TYPE_EXT2
Ext2 file system.
TSK_FS_ATTR_TYPE_NTFS_LOG
TSK_FS_ATTR_TYPE_UNIX_INDIR
TSK_FS_TYPE_HFS
HFS file system.
OS_ACCOUNT
OS Account - see tsk_os_accounts for more details.
static TSK_DB_FILES_TYPE_ENUM valueOf(short fileType)
TSK_FS_META_TYPE_BLK
Block device NON-NLS.
TSK_FS_TYPE_EXT4
Ext4 file system.
TSK_FS_ATTR_TYPE_NTFS_PROP
static short toInt(Set< TSK_FS_META_FLAG_ENUM > metaFlags)
TSK_FS_ATTR_TYPE_HFS_RSRC
static TSK_IMG_TYPE_ENUM valueOf(long imgType)
TSK_FS_TYPE_YAFFS2
YAFFS2 file system.
UNALLOC_BLOCKS
Set of blocks not allocated by file system. Parent should be image, volume, or file system...
TSK_FS_META_TYPE_SOCK
UNIX domain socket NON-NLS.
static ObjectType valueOf(short objectType)
TSK_POOL_TYPE_DETECT
Use autodetection methods.
TSK_FS_META_TYPE_FIFO
Named pipe (fifo) NON-NLS.
UNKNOWN
File marked as unknown by hash db.
static Set< TSK_FS_META_MODE_ENUM > valuesOf(short modes)
TSK_FS_META_TYPE_LNK
Symbolic link NON-NLS.
TSK_VS_TYPE_DETECT
Use autodetection methods.
TSK_FS_ATTR_TYPE_NTFS_SEC
TSK_FS_TYPE_FAT16
FAT16 file system.
TSK_FS_TYPE_FFS_DETECT
UFS auto detection.
KNOWN
File marked as a known by hash db.
TSK_FS_ATTR_TYPE_NTFS_DATA
TSK_FS_META_MODE_IWGRP
W for group.
ALLOC
Name is in an allocated state.
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
TSK_VS_PART_FLAG_UNALLOC
Sectors are not allocated to a volume.
TSK_FS_ATTR_TYPE_NTFS_FNAME
static TSK_VS_TYPE_ENUM valueOf(long vsType)
ABSTRACTFILE
File - see tsk_files for more details.
TSK_FS_ATTR_TYPE_NTFS_SYMLNK
TSK_FS_TYPE_ISO9660
ISO9660 file system.
TSK_VS_TYPE_DOS
DOS Partition table NON-NLS.
TSK_FS_META_TYPE_REG
Regular file NON-NLS.
TSK_FS_ATTR_TYPE_NOT_FOUND
TSK_FS_META_MODE_ISGID
set group id on execution
ORPHAN
Return only metadata structures that have no file name pointing to the (inode_walk flag only) ...
TSK_FS_TYPE_FFS2
UFS2 - FreeBSD, NetBSD.
TSK_FS_META_MODE_IXUSR
X for owner.
UNUSED_BLOCKS
Set of blocks that are unallocated AND not used by a carved or other file type. Parent should be UNAL...
VS
Volume System - see tsk_vs_info for more details.
IMG
Disk Image - see tsk_image_info for more details.
UNALLOC
Name is in an unallocated state.
TSK_FS_ATTR_TYPE_NTFS_VVER