Sleuth Kit Java Bindings (JNI)
4.12.1
Java bindings for using The Sleuth Kit
|
Inherits org.sleuthkit.datamodel.FsContent.
Public Member Functions | |
String | toString (boolean preserveState) |
Public Member Functions inherited from org.sleuthkit.datamodel.FsContent | |
synchronized void | close () |
void | finalize () throws Throwable |
Content | getDataSource () throws TskCoreException |
long | getFileSystemId () |
synchronized List< String > | getMetaDataText () throws TskCoreException |
AbstractFile | getParentDirectory () throws TskCoreException |
boolean | isRoot () |
String | toString (boolean preserveState) |
Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile | |
void | addAttributes (Collection< Attribute > attributes, final SleuthkitCase.CaseDbTransaction caseDbTransaction) throws TskCoreException |
boolean | canRead () |
void | close () |
long | convertToImgOffset (long fileOffset) throws TskCoreException |
List< TskFileRange > | convertToImgRanges (long fileOffset, long length) throws TskCoreException |
boolean | exists () |
long | getAtime () |
String | getAtimeAsDate () |
int | getAttributeId () |
List< Attribute > | getAttributes () throws TskCoreException |
short | getAttrId () |
TskData.TSK_FS_ATTR_TYPE_ENUM | getAttrType () |
TskData.CollectedStatus | getCollected () |
long | getCrtime () |
String | getCrtimeAsDate () |
long | getCtime () |
String | getCtimeAsDate () |
Content | getDataSource () throws TskCoreException |
long | getDataSourceObjectId () |
String | getDirFlagAsString () |
TSK_FS_NAME_TYPE_ENUM | getDirType () |
String | getDirTypeAsString () |
FileSystem | getFileSystem () throws TskCoreException |
Optional< Long > | getFileSystemObjectId () |
int | getGid () |
TskData.FileKnown | getKnown () |
String | getLocalAbsPath () |
String | getLocalPath () |
String | getMd5Hash () |
long | getMetaAddr () |
String | getMetaFlagsAsString () |
long | getMetaSeq () |
TSK_FS_META_TYPE_ENUM | getMetaType () |
String | getMetaTypeAsString () |
String | getMIMEType () |
String | getModesAsString () |
long | getMtime () |
String | getMtimeAsDate () |
String | getNameExtension () |
Optional< Long > | getOsAccountObjectId () |
Optional< String > | getOwnerUid () |
String | getParentPath () |
List< TskFileRange > | getRanges () throws TskCoreException |
String | getSha1Hash () |
String | getSha256Hash () |
long | getSize () |
TskData.TSK_DB_FILES_TYPE_ENUM | getType () |
int | getUid () |
String | getUniquePath () throws TskCoreException |
boolean | hasFileSystem () |
boolean | isDir () |
boolean | isDirNameFlagSet (TSK_FS_NAME_FLAG_ENUM flag) |
boolean | isFile () |
boolean | isMetaFlagSet (TSK_FS_META_FLAG_ENUM metaFlag) |
MimeMatchEnum | isMimeType (SortedSet< String > mimeTypes) |
boolean | isModeSet (TskData.TSK_FS_META_MODE_ENUM mode) |
abstract boolean | isRoot () |
boolean | isVirtual () |
List< AbstractFile > | listFiles () throws TskCoreException |
BlackboardArtifact | newArtifact (int artifactTypeID) throws TskCoreException |
DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException |
final int | read (byte[] buf, long offset, long len) throws TskCoreException |
void | save () throws TskCoreException |
void | save (CaseDbTransaction transaction) throws TskCoreException |
void | setCollected (TskData.CollectedStatus collected) |
void | setKnown (TskData.FileKnown knownState) |
void | setMd5Hash (String md5Hash) |
void | setMIMEType (String mimeType) |
void | setSha1Hash (String sha1Hash) |
void | setSha256Hash (String sha256Hash) |
String | toString (boolean preserveState) |
Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent | |
boolean | equals (Object obj) |
Score | getAggregateScore () throws TskCoreException |
List< AnalysisResult > | getAllAnalysisResults () throws TskCoreException |
ArrayList< BlackboardArtifact > | getAllArtifacts () throws TskCoreException |
long | getAllArtifactsCount () throws TskCoreException |
List< DataArtifact > | getAllDataArtifacts () throws TskCoreException |
List< AnalysisResult > | getAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException |
ArrayList< BlackboardArtifact > | getArtifacts (String artifactTypeName) throws TskCoreException |
ArrayList< BlackboardArtifact > | getArtifacts (int artifactTypeID) throws TskCoreException |
ArrayList< BlackboardArtifact > | getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
long | getArtifactsCount (String artifactTypeName) throws TskCoreException |
long | getArtifactsCount (int artifactTypeID) throws TskCoreException |
long | getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException |
List< Content > | getChildren () throws TskCoreException |
int | getChildrenCount () throws TskCoreException |
List< Long > | getChildrenIds () throws TskCoreException |
Content | getDataSource () throws TskCoreException |
BlackboardArtifact | getGenInfoArtifact () throws TskCoreException |
BlackboardArtifact | getGenInfoArtifact (boolean create) throws TskCoreException |
ArrayList< BlackboardAttribute > | getGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException |
Set< String > | getHashSetNames () throws TskCoreException |
long | getId () |
String | getName () |
Content | getParent () throws TskCoreException |
Optional< Long > | getParentId () throws TskCoreException |
SleuthkitCase | getSleuthkitCase () |
String | getUniquePath () throws TskCoreException |
boolean | hasChildren () throws TskCoreException |
int | hashCode () |
AnalysisResultAdded | newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException |
AnalysisResultAdded | newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException |
BlackboardArtifact | newArtifact (int artifactTypeID) throws TskCoreException |
BlackboardArtifact | newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException |
DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException |
DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException |
String | toString () |
String | toString (boolean preserveState) |
Public Member Functions inherited from org.sleuthkit.datamodel.Content | |
long | getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
ArrayList< BlackboardAttribute > | getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException |
Protected Member Functions | |
Directory (SleuthkitCase db, long objId, long fsObjId, TSK_FS_ATTR_TYPE_ENUM attrType, short attrId, String name, long metaAddr, int metaSeq, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, short modes, int uid, int gid, String md5Hash, FileKnown knownState, String parentPath) | |
Protected Member Functions inherited from org.sleuthkit.datamodel.FsContent | |
synchronized int | readInt (byte[] buf, long offset, long len) throws TskCoreException |
Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractFile | |
void | finalize () throws Throwable |
int | readInt (byte[] buf, long offset, long len) throws TskCoreException |
final int | readLocal (byte[] buf, long offset, long len) throws TskCoreException |
void | setLocalPath (String localPath, boolean isAbsolute) |
Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent | |
AbstractContent (SleuthkitCase db, long obj_id, String name) | |
Additional Inherited Members | |
Static Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile | |
static String | createNonUniquePath (String uniquePath) |
static String | epochToTime (long epoch) |
static String | epochToTime (long epoch, TimeZone tzone) |
static long | timeToEpoch (String time) |
Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent | |
static final long | UNKNOWN_ID = -1 |
Protected Attributes inherited from org.sleuthkit.datamodel.FsContent | |
volatile long | fileHandle = 0 |
Protected Attributes inherited from org.sleuthkit.datamodel.AbstractFile | |
final int | attrId |
final TskData.TSK_FS_ATTR_TYPE_ENUM | attrType |
TSK_FS_NAME_FLAG_ENUM | dirFlag |
final TSK_FS_NAME_TYPE_ENUM | dirType |
final Long | fileSystemObjectId |
final TskData.TSK_DB_FILES_TYPE_ENUM | fileType |
TskData.FileKnown | knownState |
String | md5Hash |
final long | metaAddr |
Set< TSK_FS_META_FLAG_ENUM > | metaFlags |
final int | metaSeq |
final TSK_FS_META_TYPE_ENUM | metaType |
final Set< TskData.TSK_FS_META_MODE_ENUM > | modes |
final String | parentPath |
String | sha1Hash |
String | sha256Hash |
long | size |
final int | uid |
Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent | |
long | parentId |
A representation of a file system directory that has been added to a case.
Definition at line 31 of file Directory.java.
|
protected |
Constructs a representation of a file system directory that has been added to a case.
db | The case database to which the file has been added. |
objId | The object id of the file in the case database. |
fsObjId | The object id of the file system to which this file belongs. |
attrType | The type attribute given to the file by the file system. |
attrId | The type id given to the file by the file system. |
name | The name of the file. |
metaAddr | The meta address of the file. |
metaSeq | The meta sequence number of the file. |
dirType | The type of the file, usually as reported in the name structure of the file system. May be set to TSK_FS_NAME_TYPE_ENUM.UNDEF. |
metaType | The type of the file, usually as reported in the metadata structure of the file system. May be set to TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_UNDEF. |
dirFlag | The allocated status of the file, usually as reported in the name structure of the file system. |
metaFlags | The allocated status of the file, usually as reported in the metadata structure of the file system. |
size | The size of the file. |
ctime | The changed time of the file. |
crtime | The created time of the file. |
atime | The accessed time of the file. |
mtime | The modified time of the file. |
modes | The modes for the file. |
uid | The UID for the file. |
gid | The GID for the file. |
md5Hash | The MD5 hash of the file, null if not yet calculated. |
knownState | The known state of the file from a hash database lookup, null if not yet looked up. |
parentPath | The path of the parent of the file. |
Definition at line 181 of file Directory.java.
References org.sleuthkit.datamodel.AbstractFile.attrId, org.sleuthkit.datamodel.AbstractFile.attrType, org.sleuthkit.datamodel.AbstractFile.dirFlag, org.sleuthkit.datamodel.AbstractFile.dirType, org.sleuthkit.datamodel.AbstractFile.knownState, org.sleuthkit.datamodel.AbstractFile.md5Hash, org.sleuthkit.datamodel.AbstractFile.metaAddr, org.sleuthkit.datamodel.AbstractFile.metaFlags, org.sleuthkit.datamodel.AbstractFile.metaSeq, org.sleuthkit.datamodel.AbstractFile.metaType, org.sleuthkit.datamodel.AbstractFile.modes, org.sleuthkit.datamodel.AbstractFile.parentPath, org.sleuthkit.datamodel.AbstractFile.size, and org.sleuthkit.datamodel.AbstractFile.uid.
String org.sleuthkit.datamodel.Directory.toString | ( | boolean | preserveState | ) |
Provides a string representation of this directory.
preserveState | True if state should be included in the string representation of this object. |
TskCoreException | if there was an error querying the case database. |
Definition at line 136 of file Directory.java.
Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.