Sleuth Kit Java Bindings (JNI)  4.11.1
Java bindings for using The Sleuth Kit
org.sleuthkit.datamodel.LocalFilesDataSource Class Reference

Inherits org.sleuthkit.datamodel.VirtualDirectory, and org.sleuthkit.datamodel.DataSource.

Public Member Functions

 LocalFilesDataSource (SleuthkitCase db, long objId, long dataSourceObjectId, String deviceId, String name, TskData.TSK_FS_NAME_TYPE_ENUM dirType, TskData.TSK_FS_META_TYPE_ENUM metaType, TskData.TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, String timezone, String md5Hash, String sha256Hash, String sha1Hash, TskData.FileKnown knownState, String parentPath)
 
 LocalFilesDataSource (SleuthkitCase db, long objId, long dataSourceObjectId, String deviceId, String name, TskData.TSK_FS_NAME_TYPE_ENUM dirType, TskData.TSK_FS_META_TYPE_ENUM metaType, TskData.TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, String timezone, String md5Hash, TskData.FileKnown knownState, String parentPath)
 
String getAcquisitionDetails () throws TskCoreException
 
String getAcquisitionToolName () throws TskCoreException
 
String getAcquisitionToolSettings () throws TskCoreException
 
String getAcquisitionToolVersion () throws TskCoreException
 
long getContentSize (SleuthkitCase sleuthkitCase) throws TskCoreException
 
Long getDateAdded () throws TskCoreException
 
String getDeviceId ()
 
Host getHost () throws TskCoreException
 
VirtualDirectory getRootDirectory ()
 
String getTimeZone ()
 
String getUniquePath () throws TskCoreException
 
void setAcquisitionDetails (String details) throws TskCoreException
 
void setAcquisitionToolDetails (String name, String version, String settings) throws TskCoreException
 
void setDisplayName (String newName) throws TskCoreException
 
- Public Member Functions inherited from org.sleuthkit.datamodel.VirtualDirectory
Content getDataSource () throws TskCoreException
 
String toString (boolean preserveState)
 
- Public Member Functions inherited from org.sleuthkit.datamodel.SpecialDirectory
void close ()
 
List< TskFileRangegetRanges () throws TskCoreException
 
boolean isDataSource ()
 
boolean isRoot ()
 
- Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
void addAttributes (Collection< Attribute > attributes, final SleuthkitCase.CaseDbTransaction caseDbTransaction) throws TskCoreException
 
boolean canRead ()
 
void close ()
 
long convertToImgOffset (long fileOffset) throws TskCoreException
 
List< TskFileRangeconvertToImgRanges (long fileOffset, long length) throws TskCoreException
 
boolean exists ()
 
long getAtime ()
 
String getAtimeAsDate ()
 
int getAttributeId ()
 
List< AttributegetAttributes () throws TskCoreException
 
short getAttrId ()
 
TskData.TSK_FS_ATTR_TYPE_ENUM getAttrType ()
 
long getCrtime ()
 
String getCrtimeAsDate ()
 
long getCtime ()
 
String getCtimeAsDate ()
 
Content getDataSource () throws TskCoreException
 
long getDataSourceObjectId ()
 
String getDirFlagAsString ()
 
TSK_FS_NAME_TYPE_ENUM getDirType ()
 
String getDirTypeAsString ()
 
FileSystem getFileSystem () throws TskCoreException
 
Optional< Long > getFileSystemObjectId ()
 
int getGid ()
 
TskData.FileKnown getKnown ()
 
String getLocalAbsPath ()
 
String getLocalPath ()
 
String getMd5Hash ()
 
long getMetaAddr ()
 
String getMetaFlagsAsString ()
 
long getMetaSeq ()
 
TSK_FS_META_TYPE_ENUM getMetaType ()
 
String getMetaTypeAsString ()
 
String getMIMEType ()
 
String getModesAsString ()
 
long getMtime ()
 
String getMtimeAsDate ()
 
String getNameExtension ()
 
Optional< Long > getOsAccountObjectId ()
 
Optional< String > getOwnerUid ()
 
String getParentPath ()
 
List< TskFileRangegetRanges () throws TskCoreException
 
String getSha1Hash ()
 
String getSha256Hash ()
 
long getSize ()
 
TskData.TSK_DB_FILES_TYPE_ENUM getType ()
 
int getUid ()
 
String getUniquePath () throws TskCoreException
 
boolean hasFileSystem ()
 
boolean isDir ()
 
boolean isDirNameFlagSet (TSK_FS_NAME_FLAG_ENUM flag)
 
boolean isFile ()
 
boolean isMetaFlagSet (TSK_FS_META_FLAG_ENUM metaFlag)
 
MimeMatchEnum isMimeType (SortedSet< String > mimeTypes)
 
boolean isModeSet (TskData.TSK_FS_META_MODE_ENUM mode)
 
abstract boolean isRoot ()
 
boolean isVirtual ()
 
List< AbstractFilelistFiles () throws TskCoreException
 
BlackboardArtifact newArtifact (int artifactTypeID) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException
 
final int read (byte[] buf, long offset, long len) throws TskCoreException
 
void save () throws TskCoreException
 
void save (CaseDbTransaction transaction) throws TskCoreException
 
void setKnown (TskData.FileKnown knownState)
 
void setMd5Hash (String md5Hash)
 
void setMIMEType (String mimeType)
 
void setSha1Hash (String sha1Hash)
 
void setSha256Hash (String sha256Hash)
 
String toString (boolean preserveState)
 
- Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean equals (Object obj)
 
Score getAggregateScore () throws TskCoreException
 
List< AnalysisResultgetAllAnalysisResults () throws TskCoreException
 
ArrayList< BlackboardArtifactgetAllArtifacts () throws TskCoreException
 
long getAllArtifactsCount () throws TskCoreException
 
List< DataArtifactgetAllDataArtifacts () throws TskCoreException
 
List< AnalysisResultgetAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (String artifactTypeName) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (int artifactTypeID) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
long getArtifactsCount (String artifactTypeName) throws TskCoreException
 
long getArtifactsCount (int artifactTypeID) throws TskCoreException
 
long getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException
 
List< ContentgetChildren () throws TskCoreException
 
int getChildrenCount () throws TskCoreException
 
List< Long > getChildrenIds () throws TskCoreException
 
Content getDataSource () throws TskCoreException
 
BlackboardArtifact getGenInfoArtifact () throws TskCoreException
 
BlackboardArtifact getGenInfoArtifact (boolean create) throws TskCoreException
 
ArrayList< BlackboardAttributegetGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException
 
Set< String > getHashSetNames () throws TskCoreException
 
long getId ()
 
String getName ()
 
Content getParent () throws TskCoreException
 
Optional< Long > getParentId () throws TskCoreException
 
SleuthkitCase getSleuthkitCase ()
 
String getUniquePath () throws TskCoreException
 
boolean hasChildren () throws TskCoreException
 
int hashCode ()
 
AnalysisResultAdded newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException
 
AnalysisResultAdded newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException
 
BlackboardArtifact newArtifact (int artifactTypeID) throws TskCoreException
 
BlackboardArtifact newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException
 
String toString ()
 
String toString (boolean preserveState)
 
- Public Member Functions inherited from org.sleuthkit.datamodel.Content
long getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
ArrayList< BlackboardAttributegetGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException
 

Additional Inherited Members

- Static Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
static String createNonUniquePath (String uniquePath)
 
static String epochToTime (long epoch)
 
static String epochToTime (long epoch, TimeZone tzone)
 
static long timeToEpoch (String time)
 
- Static Public Attributes inherited from org.sleuthkit.datamodel.VirtualDirectory
static final String NAME_CARVED = "$CarvedFiles"
 
static final String NAME_UNALLOC = "$Unalloc"
 
- Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long UNKNOWN_ID = -1
 
- Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
void finalize () throws Throwable
 
int readInt (byte[] buf, long offset, long len) throws TskCoreException
 
final int readLocal (byte[] buf, long offset, long len) throws TskCoreException
 
void setLocalPath (String localPath, boolean isAbsolute)
 
- Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
 AbstractContent (SleuthkitCase db, long obj_id, String name)
 
- Protected Attributes inherited from org.sleuthkit.datamodel.AbstractFile
final int attrId
 
final TskData.TSK_FS_ATTR_TYPE_ENUM attrType
 
TSK_FS_NAME_FLAG_ENUM dirFlag
 
final TSK_FS_NAME_TYPE_ENUM dirType
 
final Long fileSystemObjectId
 
final TskData.TSK_DB_FILES_TYPE_ENUM fileType
 
TskData.FileKnown knownState
 
String md5Hash
 
final long metaAddr
 
Set< TSK_FS_META_FLAG_ENUMmetaFlags
 
final int metaSeq
 
final TSK_FS_META_TYPE_ENUM metaType
 
final Set< TskData.TSK_FS_META_MODE_ENUM > modes
 
final String parentPath
 
String sha1Hash
 
String sha256Hash
 
long size
 
final int uid
 
- Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long parentId
 

Detailed Description

A local/logical files and/or directories data source.

NOTE: The DataSource interface is an emerging feature and at present is only useful for obtaining the object id and the device id, an ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID). In the future, this interface will extend the Content interface and the AbstractDataSource will become an abstract superclass.

Definition at line 37 of file LocalFilesDataSource.java.

Constructor & Destructor Documentation

org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource ( SleuthkitCase  db,
long  objId,
long  dataSourceObjectId,
String  deviceId,
String  name,
TskData.TSK_FS_NAME_TYPE_ENUM  dirType,
TskData.TSK_FS_META_TYPE_ENUM  metaType,
TskData.TSK_FS_NAME_FLAG_ENUM  dirFlag,
short  metaFlags,
String  timezone,
String  md5Hash,
String  sha256Hash,
String  sha1Hash,
TskData.FileKnown  knownState,
String  parentPath 
)

Constructs a local/logical files and/or directories data source.

Parameters
dbThe case database.
objIdThe object id of the virtual directory.
dataSourceObjectIdThe object id of the data source for the virtual directory; same as objId if the virtual directory is a data source.
nameThe name of the virtual directory.
dirTypeThe TSK_FS_NAME_TYPE_ENUM for the virtual directory.
deviceIdThe device ID for the data source.
metaTypeThe TSK_FS_META_TYPE_ENUM for the virtual directory.
dirFlagThe TSK_FS_META_TYPE_ENUM for the virtual directory.
metaFlagsThe meta flags for the virtual directory.
timezoneThe timezone for the data source.
md5HashThe MD5 hash for the virtual directory.
sha256HashThe SHA-256 hash for the virtual directory.
sha1HashSHA-1 hash of the file, or null if not present
knownStateThe known state for the virtual directory
parentPathThe parent path for the virtual directory, should be "/" if the virtual directory is a data source.

Definition at line 72 of file LocalFilesDataSource.java.

References org.sleuthkit.datamodel.AbstractFile.dirFlag, org.sleuthkit.datamodel.AbstractFile.dirType, org.sleuthkit.datamodel.AbstractFile.knownState, and org.sleuthkit.datamodel.AbstractFile.metaType.

org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource ( SleuthkitCase  db,
long  objId,
long  dataSourceObjectId,
String  deviceId,
String  name,
TskData.TSK_FS_NAME_TYPE_ENUM  dirType,
TskData.TSK_FS_META_TYPE_ENUM  metaType,
TskData.TSK_FS_NAME_FLAG_ENUM  dirFlag,
short  metaFlags,
String  timezone,
String  md5Hash,
TskData.FileKnown  knownState,
String  parentPath 
)

Constructs a local/logical files and/or directories data source.

Parameters
dbThe case database.
objIdThe object id of the virtual directory.
dataSourceObjectIdThe object id of the data source for the virtual directory; same as objId if the virtual directory is a data source.
nameThe name of the virtual directory.
dirTypeThe TSK_FS_NAME_TYPE_ENUM for the virtual directory.
deviceIdThe device ID for the data source.
metaTypeThe TSK_FS_META_TYPE_ENUM for the virtual directory.
dirFlagThe TSK_FS_META_TYPE_ENUM for the virtual directory.
metaFlagsThe meta flags for the virtual directory.
timezoneThe timezone for the data source.
md5HashThe MD5 hash for the virtual directory.
knownStateThe known state for the virtual directory
parentPathThe parent path for the virtual directory, should be "/" if the virtual directory is a data source.
Deprecated:
Use version with SHA-256 parameter

Definition at line 378 of file LocalFilesDataSource.java.

References org.sleuthkit.datamodel.AbstractFile.dirFlag, org.sleuthkit.datamodel.AbstractFile.dirType, org.sleuthkit.datamodel.AbstractFile.knownState, org.sleuthkit.datamodel.AbstractFile.md5Hash, org.sleuthkit.datamodel.AbstractFile.metaFlags, org.sleuthkit.datamodel.AbstractFile.metaType, and org.sleuthkit.datamodel.AbstractFile.parentPath.

Member Function Documentation

String org.sleuthkit.datamodel.LocalFilesDataSource.getAcquisitionDetails ( ) throws TskCoreException

Gets the acquisition details field from the case database.

Returns
The acquisition details
Exceptions
TskCoreExceptionThrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 226 of file LocalFilesDataSource.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

String org.sleuthkit.datamodel.LocalFilesDataSource.getAcquisitionToolName ( ) throws TskCoreException

Gets the acquisition tool name field from the case database.

Returns
The acquisition tool name. May be Null if not set.
Exceptions
TskCoreExceptionThrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 250 of file LocalFilesDataSource.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

String org.sleuthkit.datamodel.LocalFilesDataSource.getAcquisitionToolSettings ( ) throws TskCoreException

Gets the acquisition tool settings field from the case database.

Returns
The acquisition tool settings. May be Null if not set.
Exceptions
TskCoreExceptionThrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 239 of file LocalFilesDataSource.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

String org.sleuthkit.datamodel.LocalFilesDataSource.getAcquisitionToolVersion ( ) throws TskCoreException

Gets the acquisition tool version field from the case database.

Returns
The acquisition tool version. May be Null if not set.
Exceptions
TskCoreExceptionThrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 261 of file LocalFilesDataSource.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

long org.sleuthkit.datamodel.LocalFilesDataSource.getContentSize ( SleuthkitCase  sleuthkitCase) throws TskCoreException

Gets the size of the contents of the data source in bytes. This size can change as archive files within the data source are expanded, files are carved, etc., and is different from the size of the data source as returned by Content.getSize, which is the size of the data source as a file.

Parameters
sleuthkitCaseThe sleuthkit case instance from which to make calls to the database.
Returns
The size in bytes.
Exceptions
TskCoreExceptionThrown when there is an issue trying to retrieve data from the database.

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 142 of file LocalFilesDataSource.java.

Long org.sleuthkit.datamodel.LocalFilesDataSource.getDateAdded ( ) throws TskCoreException

Gets the added date field from the case database.

Returns
The date time when the image was added in epoch seconds.
Exceptions
TskCoreExceptionThrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 289 of file LocalFilesDataSource.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

String org.sleuthkit.datamodel.LocalFilesDataSource.getDeviceId ( )

Gets the ASCII-printable identifier for the device associated with the data source. This identifier is intended to be unique across multiple cases (e.g., a UUID).

Returns
The device id.

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 100 of file LocalFilesDataSource.java.

Host org.sleuthkit.datamodel.LocalFilesDataSource.getHost ( ) throws TskCoreException
VirtualDirectory org.sleuthkit.datamodel.LocalFilesDataSource.getRootDirectory ( )

Returns the VirtualDirectory instance. /deprecated LocalFilesDataSource is already a VirtualDirectory.

Returns
This object.
Deprecated:
LocalFilesDataSource is already a VirtualDirectory.

Definition at line 88 of file LocalFilesDataSource.java.

String org.sleuthkit.datamodel.LocalFilesDataSource.getTimeZone ( )

Gets the time zone that was used to process the data source.

Returns
The time zone.

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 110 of file LocalFilesDataSource.java.

String org.sleuthkit.datamodel.LocalFilesDataSource.getUniquePath ( ) throws TskCoreException
Returns
returns the full path to this Content object starting with a "/" followed by the Image name and similarly for all other segments in the hierarchy.

Implements org.sleuthkit.datamodel.Content.

Definition at line 187 of file LocalFilesDataSource.java.

References org.sleuthkit.datamodel.Content.getName().

void org.sleuthkit.datamodel.LocalFilesDataSource.setAcquisitionDetails ( String  details) throws TskCoreException

Sets the acquisition details field in the case database.

Parameters
detailsThe acquisition details
Exceptions
TskCoreExceptionThrown if the data can not be written

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 199 of file LocalFilesDataSource.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

void org.sleuthkit.datamodel.LocalFilesDataSource.setAcquisitionToolDetails ( String  name,
String  version,
String  settings 
) throws TskCoreException

Sets the acquisition tool details such as its name, version number and any settings used during the acquisition to acquire data.

Parameters
nameThe name of the acquisition tool. May be NULL.
versionThe acquisition tool version number. May be NULL.
settingsThe settings used by the acquisition tool. May be NULL.
Exceptions
TskCoreExceptionThrown if the data can not be written

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 214 of file LocalFilesDataSource.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

void org.sleuthkit.datamodel.LocalFilesDataSource.setDisplayName ( String  newName) throws TskCoreException

Set the name for this data source.

Parameters
newNameThe new name for the data source
Exceptions
TskCoreExceptionThrown if an error occurs while updating the database

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 122 of file LocalFilesDataSource.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().


The documentation for this class was generated from the following file:

Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.