Sleuth Kit Java Bindings (JNI)  4.11.0
Java bindings for using The Sleuth Kit
Deprecated List
Member org.sleuthkit.datamodel.AbstractFile.AbstractFile (SleuthkitCase db, long objId, TskData.TSK_FS_ATTR_TYPE_ENUM attrType, short attrId, String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, short modes, int uid, int gid, String md5Hash, FileKnown knownState, String parentPath)
Do not make subclasses outside of this package.
Member org.sleuthkit.datamodel.AbstractFile.epochToTime (long epoch)
Member org.sleuthkit.datamodel.AbstractFile.epochToTime (long epoch, TimeZone tzone)
Member org.sleuthkit.datamodel.AbstractFile.getAttrId ()
Use getAttributeId() method instead as it returns integer instead of short.
Member org.sleuthkit.datamodel.AbstractFile.setLocalPath (String localPath, boolean isAbsolute)
Do not make subclasses outside of this package.
Member org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_DOWNLOAD_SOURCE
TSK_ASSOCIATED_OBJECT should be used instead to associate the file/object with its source artifact/object..
Member org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT
Use TSK_GPS_TRACK instead
Member org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT
Tags are no longer treated as artifacts.
Member org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE
Tags are no longer treated as artifacts.
Member org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_TOOL_OUTPUT
Tool output should be saved as a report.
Member org.sleuthkit.datamodel.BlackboardArtifact.BlackboardArtifact (SleuthkitCase sleuthkitCase, long artifactID, long objID, long artifactObjID, long dataSourceObjId, int artifactTypeID, String artifactTypeName, String displayName)
Use new BlackboardArtifact(SleuthkitCase, long, long, int, String, String, ReviewStatus) instead.
Member org.sleuthkit.datamodel.BlackboardArtifact.getAttributes (final BlackboardAttribute.ATTRIBUTE_TYPE attributeType)
An artifact should not have multiple attributes of the same type. Use getAttribute(BlackboardAttribute.Type) instead.
Member org.sleuthkit.datamodel.BlackboardArtifact.newArtifact (int artifactTypeID)
Use the Blackboard to create Data Artifacts and Analysis Results.
Member org.sleuthkit.datamodel.BlackboardArtifact.newArtifact (BlackboardArtifact.ARTIFACT_TYPE type)
Use the Blackboard to create Data Artifacts and Analysis Results.
Member org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ENCRYPTION_DETECTED
Use a TSK_ENCRYPTION_DETECTED artifact instead.
Member org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG
Use the mime type field of the AbstractFile object instead.
Member org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_HASHSET_NAME
Use a TSK_SET_NAME attribute instead.
Member org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_INTERESTING_FILE
Use a TSK_INTERESTING_FILE_HIT artifact instead.
Member org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_SET
Use a TSK_SET_NAME attribute instead.
Member org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TAG_NAME
Do not use. Tags are no longer implemented as artifact attributes.
Member org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TAGGED_ARTIFACT
Do not use. Tags are no longer implemented as artifact attributes.
Member org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute (int attributeTypeID, String moduleName, String context, int valueInt)
Member org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute (int attributeTypeID, String moduleName, long valueLong)
Member org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute (int attributeTypeID, String moduleName, String context, long valueLong)
Member org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute (int attributeTypeID, String moduleName, double valueDouble)
Member org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute (int attributeTypeID, String moduleName, String context, double valueDouble)
Member org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute (int attributeTypeID, String moduleName, String valueString)
Member org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute (int attributeTypeID, String moduleName, String context, String valueString)
Member org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute (int attributeTypeID, String moduleName, byte[] valueBytes)
Member org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute (int attributeTypeID, String moduleName, String context, byte[] valueBytes)
Member org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute (int attributeTypeID, String moduleName, int valueInt)
Member org.sleuthkit.datamodel.BlackboardAttribute.getAttributeTypeDisplayName ()
Use BlackboardAttribute.getAttributeType.getDisplayName instead.
Member org.sleuthkit.datamodel.BlackboardAttribute.getAttributeTypeID ()
Use BlackboardAttribute.getAttributeType.getTypeID instead.
Member org.sleuthkit.datamodel.BlackboardAttribute.getAttributeTypeName ()
Use BlackboardAttribute.getAttributeType.getTypeName instead.
Member org.sleuthkit.datamodel.BlackboardAttribute.getContext ()
Setting context for an attribute is deprecated.
Member org.sleuthkit.datamodel.BlackboardAttribute.getModuleName ()
Use getSources instead.
Member org.sleuthkit.datamodel.BlackboardAttribute.setArtifactID (long artifactID)
The preferred method for doing this is to add the attribute to a BlackboardArtifact object by calling BlackboardArtifact.addAttribute or BlackboardArtifact.addAttributes, both of which post the attributes to the blackboard.
Member org.sleuthkit.datamodel.BlackboardAttribute.setCase (SleuthkitCase sleuthkitCase)
The preferred method for doing this is to add the attribute to a BlackboardArtifact object by calling BlackboardArtifact.addAttribute or BlackboardArtifact.addAttributes, both of which post the attributes to the blackboard.
Class org.sleuthkit.datamodel.CarvedFileContainer
Use CarvingResult instead.
Member org.sleuthkit.datamodel.Content.newArtifact (int artifactTypeID)
Please use newDataArtifact or newAnalysisResult.
Member org.sleuthkit.datamodel.Content.newArtifact (BlackboardArtifact.ARTIFACT_TYPE type)
Please use newDataArtifact or newAnalysisResult.
Member org.sleuthkit.datamodel.DerivedFile.DerivedFile (SleuthkitCase db, long objId, String name, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, String md5Hash, FileKnown knownState, String parentPath, String localPath, long parentId)
Do not make subclasses outside of this package.
Member org.sleuthkit.datamodel.Directory.Directory (SleuthkitCase db, long objId, long fsObjId, TSK_FS_ATTR_TYPE_ENUM attrType, short attrId, String name, long metaAddr, int metaSeq, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, short modes, int uid, int gid, String md5Hash, FileKnown knownState, String parentPath)
Do not make subclasses outside of this package.
Member org.sleuthkit.datamodel.File.File (SleuthkitCase db, long objId, long fsObjId, TSK_FS_ATTR_TYPE_ENUM attrType, short attrId, String name, long metaAddr, int metaSeq, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, short modes, int uid, int gid, String md5Hash, FileKnown knownState, String parentPath)
Do not make subclasses outside of this package.
Member org.sleuthkit.datamodel.FsContent.fileHandle
Use getFileHandle instead.
Member org.sleuthkit.datamodel.FsContent.fsObjId
Use getFileSystemId instead.
Member org.sleuthkit.datamodel.HashUtility.calculateMd5 (AbstractFile file)
Use calculateHashes() instead
Member org.sleuthkit.datamodel.HashUtility.calculateMd5Hash (Content content)
Use calculateHashes() instead
Member org.sleuthkit.datamodel.Image.Image (SleuthkitCase db, long obj_id, long type, long ssize, String name, String[] paths, String timezone, String md5)
Use the constructor that takes a device ID and size.
Member org.sleuthkit.datamodel.LayoutFile.LayoutFile (SleuthkitCase db, long objId, String name, TSK_DB_FILES_TYPE_ENUM fileType, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, String md5Hash, FileKnown knownState, String parentPath)
Do not make subclasses outside of this package.
Member org.sleuthkit.datamodel.LocalFile.LocalFile (SleuthkitCase db, long objId, String name, TSK_DB_FILES_TYPE_ENUM fileType, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, String md5Hash, FileKnown knownState, String parentPath, String localPath)
Do not make subclasses outside of this package.
Member org.sleuthkit.datamodel.LocalFile.LocalFile (SleuthkitCase db, long objId, String name, TSK_DB_FILES_TYPE_ENUM fileType, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, String md5Hash, FileKnown knownState, String parentPath, String localPath, long parentId)
Do not make subclasses outside of this package.
Member org.sleuthkit.datamodel.LocalFile.LocalFile (SleuthkitCase db, long objId, String name, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, String md5Hash, FileKnown knownState, String parentPath, String localPath, long parentId)
Do not make subclasses outside of this package.
Member org.sleuthkit.datamodel.LocalFilesDataSource.getRootDirectory ()
LocalFilesDataSource is already a VirtualDirectory.
Member org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource (SleuthkitCase db, long objId, long dataSourceObjectId, String deviceId, String name, TskData.TSK_FS_NAME_TYPE_ENUM dirType, TskData.TSK_FS_META_TYPE_ENUM metaType, TskData.TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, String timezone, String md5Hash, TskData.FileKnown knownState, String parentPath)
Use version with SHA-256 parameter
Member org.sleuthkit.datamodel.SleuthkitCase.acquireExclusiveLock ()
Use acquireSingleUserCaseWriteLock.
Member org.sleuthkit.datamodel.SleuthkitCase.acquireSharedLock ()
Use acquireSingleUserCaseReadLock.
Member org.sleuthkit.datamodel.SleuthkitCase.addArtifactType (String artifactTypeName, String displayName)
Use SleuthkitCase.addBlackboardArtifactType instead.
Member org.sleuthkit.datamodel.SleuthkitCase.addAttrType (String attrTypeString, String displayName)
Use SleuthkitCase.addArtifactAttributeType instead.
Member org.sleuthkit.datamodel.SleuthkitCase.addBlackboardArtifactTag (BlackboardArtifact artifact, TagName tagName, String comment)
User TaggingManager.addArtifactTag instead.
Member org.sleuthkit.datamodel.SleuthkitCase.addCarvedFile (String carvedFileName, long carvedFileSize, long containerId, List< TskFileRange > data)
Use addCarvedFile(CarvingResult) instead
Member org.sleuthkit.datamodel.SleuthkitCase.addCarvedFiles (List< CarvedFileContainer > filesToAdd)
Use addCarvedFile(CarvingResult) instead
Member org.sleuthkit.datamodel.SleuthkitCase.addContentTag (Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset)
Use TaggingManager.addContentTag
Member org.sleuthkit.datamodel.SleuthkitCase.addDerivedFile (String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
Use the newer version with explicit encoding type parameter
Member org.sleuthkit.datamodel.SleuthkitCase.addErrorObserver (ErrorObserver observer)
Catch exceptions instead.
Member org.sleuthkit.datamodel.SleuthkitCase.addLocalFile (String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent)
Use the newer version with explicit encoding type parameter
Member org.sleuthkit.datamodel.SleuthkitCase.addLocalFile (String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
Use the newer version with explicit sha256 parameter
Member org.sleuthkit.datamodel.SleuthkitCase.addLocalFile (String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent, CaseDbTransaction transaction)
Use the newer version with explicit encoding type parameter
Member org.sleuthkit.datamodel.SleuthkitCase.addOrUpdateTagName (String displayName, String description, TagName.HTML_COLOR color, TskData.FileKnown knownStatus)
This method has been replaced by TaggingManager.addOrUpdateTagName.
Member org.sleuthkit.datamodel.SleuthkitCase.addTagName (String displayName, String description, TagName.HTML_COLOR color)
TaggingManager.addOrUpdateTagName should be used instead with the default knowStatus of TskData.FileKnown.UNKNOWN
Member org.sleuthkit.datamodel.SleuthkitCase.closeRunQuery (ResultSet resultSet)
Do not use runQuery() and closeRunQuery(), use executeQuery() instead. Query the Database
Class org.sleuthkit.datamodel.SleuthkitCase.ErrorObserver
Catch exceptions instead.
Member org.sleuthkit.datamodel.SleuthkitCase.findFiles (Content dataSource, String fileName, AbstractFile parentFile)
Use findFilesInFolder()
Member org.sleuthkit.datamodel.SleuthkitCase.findFilesWhere (String sqlWhereClause)
use SleuthkitCase.findAllFilesWhere() instead
Member org.sleuthkit.datamodel.SleuthkitCase.getArtifactByArtifactId (long id)
Use the type specific methods in Blackboard getAnalysisResultsById and getDataArtifactById
Member org.sleuthkit.datamodel.SleuthkitCase.getArtifactTypeID (String artifactTypeName)
Use getArtifactType instead
Member org.sleuthkit.datamodel.SleuthkitCase.getAttrTypeDisplayName (int attrTypeID)
Use getAttributeType instead
Member org.sleuthkit.datamodel.SleuthkitCase.getAttrTypeID (String attrTypeName)
Use SleuthkitCase.getAttributeType instead.
Member org.sleuthkit.datamodel.SleuthkitCase.getAttrTypeString (int attrTypeID)
Use getAttributeType instead
Member org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts (BlackboardAttribute.ATTRIBUTE_TYPE attrType, long value)
Do not use.
Member org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts (ARTIFACT_TYPE artifactType, BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
Do not use.
Member org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts (BlackboardAttribute.ATTRIBUTE_TYPE attrType, double value)
Do not use.
Member org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts (BlackboardAttribute.ATTRIBUTE_TYPE attrType, byte value)
Do not use.
Member org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts (BlackboardAttribute.ATTRIBUTE_TYPE attrType, String subString, boolean startsWith)
Do not use.
Member org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts (int artifactTypeID)
Use Blackboard.getArtifactsByType instead.
Member org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts (BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
Do not use.
Member org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts (BlackboardAttribute.ATTRIBUTE_TYPE attrType, int value)
Do not use.
Member org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactTypes ()
For a list of standard blackboard artifacts type enum objects, use BlackboardArtifact.ARTIFACT_TYPE.values.
Member org.sleuthkit.datamodel.SleuthkitCase.getBlackboardAttributeTypes ()
For a list of standard blackboard attribute types enum objects, use BlackboardAttribute.ATTRIBUTE_TYP.values.
Member org.sleuthkit.datamodel.SleuthkitCase.getFileSystems (Image image)
Use getImageFileSystems which throws an exception if an error occurs.
Member org.sleuthkit.datamodel.SleuthkitCase.getLastObjectId ()
Do not use, assumes a single-threaded, single-user case.
Member org.sleuthkit.datamodel.SleuthkitCase.getSchemaVersion ()
since 4.5.0 Use getDBSchemaVersion() instead for more complete version info.
Member org.sleuthkit.datamodel.SleuthkitCase.makeAddImageProcess (String timezone, boolean addUnallocSpace, boolean noFatFsOrphans)
Use the newer version with explicit image writer path parameter
Member org.sleuthkit.datamodel.SleuthkitCase.newBlackboardArtifact (ARTIFACT_TYPE artifactType, long obj_id)
Please use newDataArtifact or newAnalysisResult.
Member org.sleuthkit.datamodel.SleuthkitCase.newBlackboardArtifact (int artifactTypeID, long obj_id)
Please use newDataArtifact or newAnalysisResult.
Member org.sleuthkit.datamodel.SleuthkitCase.releaseExclusiveLock ()
Use releaseSingleUserCaseWriteLock.
Member org.sleuthkit.datamodel.SleuthkitCase.releaseSharedLock ()
Use releaseSingleUserCaseReadLock.
Member org.sleuthkit.datamodel.SleuthkitCase.removeErrorObserver (ErrorObserver observer)
Catch exceptions instead.
Member org.sleuthkit.datamodel.SleuthkitCase.runQuery (String query)
Do not use runQuery(), use executeQuery() instead. Query the Database
Member org.sleuthkit.datamodel.SleuthkitCase.submitError (String context, String errorMessage)
Catch exceptions instead.
Member org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.AddImageProcess.commit ()
No longer necessary
Member org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.AddImageProcess.revert ()
No longer necessary
Member org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.AddImageProcess.run (String[] imageFilePaths)
Use run(String dataSourceId, String[] imageFilePaths) instead
Member org.sleuthkit.datamodel.SleuthkitJNI.openFile (long fsHandle, long fileId, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId)
Use the version with the SleuthkitCase argument
Member org.sleuthkit.datamodel.SleuthkitJNI.openFs (long imgHandle, long fsOffset)
Use the version with the SleuthkitCase argument
Member org.sleuthkit.datamodel.SleuthkitJNI.openImage (String[] imageFiles)
Use the version with the SleuthkitCase argument
Member org.sleuthkit.datamodel.SleuthkitJNI.openImage (String[] imageFiles, int sSize)
Use the version with the SleuthkitCase argument

Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.