Sleuth Kit Java Bindings (JNI)  4.12.1
Java bindings for using The Sleuth Kit
FileManager.java
Go to the documentation of this file.
1 /*
2  * SleuthKit Java Bindings
3  *
4  * Copyright 2021 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.sql.PreparedStatement;
22 import java.sql.ResultSet;
23 import java.sql.SQLException;
24 import java.sql.Statement;
25 import java.util.List;
26 import java.util.Objects;
27 
31 public class FileManager {
32 
33  private final SleuthkitCase skCase;
34 
40  FileManager(SleuthkitCase skCase) {
41  this.skCase = Objects.requireNonNull(skCase, "Cannot create Blackboard for null SleuthkitCase");
42  }
43 
54  public List<AbstractFile> findFilesExactName(long parentId, String name) throws TskCoreException {
55  String ext = SleuthkitCase.extractExtension(name);
56 
57  String query = "SELECT tsk_files.* FROM tsk_files JOIN tsk_objects ON tsk_objects.obj_id = tsk_files.obj_id "
58  + " WHERE tsk_objects.par_obj_id = ? AND tsk_files.name = ? ";
59 
60  if (!ext.isEmpty()) {
61  query += " AND tsk_files.extension = ? ";
62  }
63 
65  try (SleuthkitCase.CaseDbConnection connection = skCase.getConnection()) {
66  PreparedStatement statement = connection.getPreparedStatement(query, Statement.RETURN_GENERATED_KEYS);
67  statement.clearParameters();
68  statement.setLong(1, parentId);
69  statement.setString(2, name);
70 
71  if (!ext.isEmpty()) {
72  statement.setString(3, ext);
73  }
74 
75  try (ResultSet rs = connection.executeQuery(statement)) {
76  return skCase.resultSetToAbstractFiles(rs, connection);
77  }
78  } catch (SQLException ex) {
79  throw new TskCoreException("SQLException thrown when calling query: " + query + " for parentID = " + parentId + " and name " + name, ex);
80  } finally {
82  }
83  }
84 
96  public List<AbstractFile> findFilesExactNameExactPath(Content dataSource, String name, String path) throws TskCoreException {
97 
98  // Database paths will always start and end with a forward slash, so add those if not present
99  String normalizedPath = path;
100  if (!normalizedPath.startsWith("/")) {
101  normalizedPath = "/" + normalizedPath;
102  }
103  if (!normalizedPath.endsWith("/")) {
104  normalizedPath = normalizedPath + "/";
105  }
106 
107  String ext = SleuthkitCase.extractExtension(name);
108 
109  String query = "";
111  try (SleuthkitCase.CaseDbConnection connection = skCase.getConnection()) {
112  PreparedStatement statement;
113  if (ext.isEmpty()) {
114  query = "SELECT tsk_files.* FROM tsk_files JOIN tsk_objects ON tsk_objects.obj_id = tsk_files.obj_id WHERE parent_path = ? AND name = ? AND data_source_obj_id = ?";
115  statement = connection.getPreparedStatement(query, Statement.RETURN_GENERATED_KEYS);
116  statement.clearParameters();
117  statement.setString(1, normalizedPath);
118  statement.setString(2, name);
119  statement.setLong(3, dataSource.getId());
120  } else {
121  // This is done as an optimization since the extension column in tsk_files is indexed
122  query = "SELECT tsk_files.* FROM tsk_files JOIN tsk_objects ON tsk_objects.obj_id = tsk_files.obj_id WHERE extension = ? AND parent_path = ? AND name = ? AND data_source_obj_id = ?";
123  statement = connection.getPreparedStatement(query, Statement.RETURN_GENERATED_KEYS);
124  statement.clearParameters();
125  statement.setString(1, ext);
126  statement.setString(2, normalizedPath);
127  statement.setString(3, name);
128  statement.setLong(4, dataSource.getId());
129  }
130  try (ResultSet rs = connection.executeQuery(statement)) {
131  return skCase.resultSetToAbstractFiles(rs, connection);
132  }
133  } catch (SQLException ex) {
134  throw new TskCoreException("SQLException thrown when calling query: " + query + " for parent path = " + path + " and name " + name, ex);
135  } finally {
137  }
138  }
139 }
List< AbstractFile > findFilesExactName(long parentId, String name)
List< AbstractFile > findFilesExactNameExactPath(Content dataSource, String name, String path)

Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.