Sleuth Kit Java Bindings (JNI)  4.12.1
Java bindings for using The Sleuth Kit
org.sleuthkit.datamodel.Image Class Reference

Inherits org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.DataSource.

Public Member Functions

void close ()
 
void finalize () throws Throwable
 
String getAcquisitionDetails () throws TskCoreException
 
String getAcquisitionToolName () throws TskCoreException
 
String getAcquisitionToolSettings () throws TskCoreException
 
String getAcquisitionToolVersion () throws TskCoreException
 
List< ContentgetChildren () throws TskCoreException
 
List< Long > getChildrenIds () throws TskCoreException
 
long getContentSize (SleuthkitCase sleuthkitCase) throws TskCoreException
 
Content getDataSource ()
 
Long getDateAdded () throws TskCoreException
 
String getDeviceId ()
 
List< FileSystemgetFileSystems () throws TskCoreException
 
Host getHost () throws TskCoreException
 
synchronized long getImageHandle () throws TskCoreException
 
String getMd5 () throws TskCoreException
 
String[] getPaths ()
 
String getSha1 () throws TskCoreException
 
String getSha256 () throws TskCoreException
 
long getSize ()
 
long getSsize ()
 
String getTimeZone ()
 
TskData.TSK_IMG_TYPE_ENUM getType ()
 
String getUniquePath () throws TskCoreException
 
List< VolumegetVolumes () throws TskCoreException
 
List< VolumeSystemgetVolumeSystems () throws TskCoreException
 
Boolean imageFileExists ()
 
int read (byte[] buf, long offset, long len) throws TskCoreException
 
void setAcquisitionDetails (String details) throws TskCoreException
 
void setAcquisitionToolDetails (String name, String version, String settings) throws TskCoreException
 
void setDisplayName (String newName) throws TskCoreException
 
void setMD5 (String md5) throws TskCoreException, TskDataException
 
void setSha1 (String sha1) throws TskCoreException, TskDataException
 
void setSha256 (String sha256) throws TskCoreException, TskDataException
 
void setSizes (long totalSize, long sectorSize) throws TskCoreException
 
String toString (boolean preserveState)
 
String verifyImageSize ()
 
- Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean equals (Object obj)
 
Score getAggregateScore () throws TskCoreException
 
List< AnalysisResultgetAllAnalysisResults () throws TskCoreException
 
ArrayList< BlackboardArtifactgetAllArtifacts () throws TskCoreException
 
long getAllArtifactsCount () throws TskCoreException
 
List< DataArtifactgetAllDataArtifacts () throws TskCoreException
 
List< AnalysisResultgetAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (String artifactTypeName) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (int artifactTypeID) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
long getArtifactsCount (String artifactTypeName) throws TskCoreException
 
long getArtifactsCount (int artifactTypeID) throws TskCoreException
 
long getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException
 
List< ContentgetChildren () throws TskCoreException
 
int getChildrenCount () throws TskCoreException
 
List< Long > getChildrenIds () throws TskCoreException
 
Content getDataSource () throws TskCoreException
 
BlackboardArtifact getGenInfoArtifact () throws TskCoreException
 
BlackboardArtifact getGenInfoArtifact (boolean create) throws TskCoreException
 
ArrayList< BlackboardAttributegetGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException
 
Set< String > getHashSetNames () throws TskCoreException
 
long getId ()
 
String getName ()
 
Content getParent () throws TskCoreException
 
Optional< Long > getParentId () throws TskCoreException
 
SleuthkitCase getSleuthkitCase ()
 
String getUniquePath () throws TskCoreException
 
boolean hasChildren () throws TskCoreException
 
int hashCode ()
 
AnalysisResultAdded newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException
 
AnalysisResultAdded newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException
 
BlackboardArtifact newArtifact (int artifactTypeID) throws TskCoreException
 
BlackboardArtifact newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException
 
String toString ()
 
String toString (boolean preserveState)
 
- Public Member Functions inherited from org.sleuthkit.datamodel.Content
long getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
ArrayList< BlackboardAttributegetGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException
 

Protected Member Functions

 Image (SleuthkitCase db, long obj_id, long type, long ssize, String name, String[] paths, String timezone, String md5) throws TskCoreException
 
- Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
 AbstractContent (SleuthkitCase db, long obj_id, String name)
 

Additional Inherited Members

- Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long UNKNOWN_ID = -1
 
- Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long parentId
 

Detailed Description

Represents a disk image file, stored in tsk_image_info. Populated based on data in database.

Caches internal tsk image handle and reuses it for reads

Definition at line 39 of file Image.java.

Constructor & Destructor Documentation

org.sleuthkit.datamodel.Image.Image ( SleuthkitCase  db,
long  obj_id,
long  type,
long  ssize,
String  name,
String[]  paths,
String  timezone,
String  md5 
) throws TskCoreException
protected

Create a disk image.

Note: Most inputs originate from the database.

Parameters
dbCase database.
obj_idObject ID.
typeImage type.
ssizeSector size.
nameDisplay name.
pathsImage paths.
timezoneTimezone.
md5MD5 hash.
Exceptions
TskCoreException
Deprecated:
Use the constructor that takes a device ID and size.

Definition at line 72 of file Image.java.

Member Function Documentation

void org.sleuthkit.datamodel.Image.close ( )

Free native resources after read is done on the Content object. After closing, read can be called again on the same Content object, which should result in re-opening of new native resources.

Implements org.sleuthkit.datamodel.Content.

Definition at line 144 of file Image.java.

void org.sleuthkit.datamodel.Image.finalize ( ) throws Throwable

Definition at line 150 of file Image.java.

String org.sleuthkit.datamodel.Image.getAcquisitionDetails ( ) throws TskCoreException

Gets the acquisition details field from the case database.

Returns
The acquisition details
Exceptions
TskCoreExceptionThrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 599 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

String org.sleuthkit.datamodel.Image.getAcquisitionToolName ( ) throws TskCoreException

Gets the acquisition tool name field from the case database.

Returns
The acquisition tool name. May be Null if not set.
Exceptions
TskCoreExceptionThrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 565 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

String org.sleuthkit.datamodel.Image.getAcquisitionToolSettings ( ) throws TskCoreException

Gets the acquisition tool settings field from the case database.

Returns
The acquisition tool settings. May be Null if not set.
Exceptions
TskCoreExceptionThrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 554 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

String org.sleuthkit.datamodel.Image.getAcquisitionToolVersion ( ) throws TskCoreException

Gets the acquisition tool version field from the case database.

Returns
The acquisition tool version. May be Null if not set.
Exceptions
TskCoreExceptionThrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 576 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

List<Content> org.sleuthkit.datamodel.Image.getChildren ( ) throws TskCoreException

Gets the child content objects of this content.

Returns
List of children
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 290 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.getVolumes(), and org.sleuthkit.datamodel.Image.getVolumeSystems().

List<Long> org.sleuthkit.datamodel.Image.getChildrenIds ( ) throws TskCoreException

Gets the child content ids of this content.

Returns
List of children ids
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 295 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

long org.sleuthkit.datamodel.Image.getContentSize ( SleuthkitCase  sleuthkitCase) throws TskCoreException

Gets the size of the contents of the data source in bytes. This size can change as archive files within the data source are expanded, files are carved, etc., and is different from the size of the data source as returned by Content.getSize, which is the size of the data source as a file.

Parameters
sleuthkitCaseThe sleuthkit case instance from which to make calls to the database.
Returns
The size in bytes.
Exceptions
TskCoreExceptionThrown when there is an issue trying to retrieve data from the database.

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 495 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getId().

Content org.sleuthkit.datamodel.Image.getDataSource ( )

Gets the root data source (image, virtual directory, etc.) of this content.

Returns
Content associated with data source or null if one can't be found
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 139 of file Image.java.

Long org.sleuthkit.datamodel.Image.getDateAdded ( ) throws TskCoreException

Gets the added date field from the case database.

Returns
The date time when the image was added in epoch seconds.
Exceptions
TskCoreExceptionThrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 587 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

String org.sleuthkit.datamodel.Image.getDeviceId ( )

Gets the ASCII-printable identifier for the device associated with the data source. This identifier is intended to be unique across multiple cases (e.g., a UUID).

Returns
The device id.

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 463 of file Image.java.

List<FileSystem> org.sleuthkit.datamodel.Image.getFileSystems ( ) throws TskCoreException
Returns
a list of FileSystems in this Image. This includes FileSystems that are both children of this Image as well as children of Volumes in this image.
Exceptions
TskCoreException

Definition at line 263 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.verifyImageSize().

Host org.sleuthkit.datamodel.Image.getHost ( ) throws TskCoreException
synchronized long org.sleuthkit.datamodel.Image.getImageHandle ( ) throws TskCoreException
String org.sleuthkit.datamodel.Image.getMd5 ( ) throws TskCoreException

Gets the md5 hash value

Returns
md5 hash if attained(from database), empty string otherwise
Exceptions
TskCoreException

Definition at line 378 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.setMD5().

String [] org.sleuthkit.datamodel.Image.getPaths ( )

Get the image path

Returns
image path

Definition at line 216 of file Image.java.

String org.sleuthkit.datamodel.Image.getSha1 ( ) throws TskCoreException

gets the SHA1 hash value

Returns
SHA1 hash if attained(from database), empty string otherwise
Exceptions
TskCoreExceptionon DB error.

Definition at line 392 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.setSha1().

String org.sleuthkit.datamodel.Image.getSha256 ( ) throws TskCoreException

gets the SHA256 hash value

Returns
SHA256 hash if attained(from database), empty string otherwise
Exceptions
TskCoreException

Definition at line 406 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.setSha256().

long org.sleuthkit.datamodel.Image.getSize ( )

Get the (reported) size of the content object and, in theory, how much you should be able to read from it. In some cases, data corruption may mean that you cannot read this much data.

Returns
size of the content in bytes

Implements org.sleuthkit.datamodel.Content.

Definition at line 173 of file Image.java.

References org.sleuthkit.datamodel.SleuthkitJNI.findDeviceSize(), and org.sleuthkit.datamodel.AbstractContent.getName().

long org.sleuthkit.datamodel.Image.getSsize ( )

Get the sector size

Returns
sector size

Definition at line 202 of file Image.java.

String org.sleuthkit.datamodel.Image.getTimeZone ( )

Get the timezone set for the image

Returns
timezone string representation

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 275 of file Image.java.

Referenced by org.sleuthkit.datamodel.BlackboardAttribute.getDisplayString().

TskData.TSK_IMG_TYPE_ENUM org.sleuthkit.datamodel.Image.getType ( )

Get the image type

Returns
image type

Definition at line 193 of file Image.java.

References org.sleuthkit.datamodel.TskData.TSK_IMG_TYPE_ENUM.valueOf().

String org.sleuthkit.datamodel.Image.getUniquePath ( ) throws TskCoreException
Returns
returns the full path to this Content object starting with a "/" followed by the Image name and similarly for all other segments in the hierarchy.

Implements org.sleuthkit.datamodel.Content.

Definition at line 207 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getName().

List<Volume> org.sleuthkit.datamodel.Image.getVolumes ( ) throws TskCoreException
Returns
a list of Volume associated with this Image.
Exceptions
TskCoreException

Definition at line 243 of file Image.java.

References org.sleuthkit.datamodel.Image.getChildren().

List<VolumeSystem> org.sleuthkit.datamodel.Image.getVolumeSystems ( ) throws TskCoreException
Returns
a list of VolumeSystem associated with this Image.
Exceptions
TskCoreException

Definition at line 225 of file Image.java.

References org.sleuthkit.datamodel.Image.getChildren().

Referenced by org.sleuthkit.datamodel.Image.verifyImageSize().

Boolean org.sleuthkit.datamodel.Image.imageFileExists ( )

Test if the file that created this image exists on disk. Does not work on local disks - will always return false

Returns
True if the file still exists

Definition at line 310 of file Image.java.

References org.sleuthkit.datamodel.AbstractFile.exists().

int org.sleuthkit.datamodel.Image.read ( byte[]  buf,
long  offset,
long  len 
) throws TskCoreException

Reads data that this content object is associated with (file contents, volume contents, etc.).

Parameters
bufa character array of data (in bytes) to copy read data to
offsetbyte offset in the content to start reading from
lennumber of bytes to read into buf.
Returns
num of bytes read, or -1 on error
Exceptions
TskCoreExceptionif critical error occurred during read in the tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 162 of file Image.java.

References org.sleuthkit.datamodel.Image.getImageHandle(), and org.sleuthkit.datamodel.SleuthkitJNI.readImg().

Referenced by org.sleuthkit.datamodel.Image.verifyImageSize().

void org.sleuthkit.datamodel.Image.setAcquisitionDetails ( String  details) throws TskCoreException

Sets the acquisition details field in the case database.

Parameters
detailsThe acquisition details
Exceptions
TskCoreExceptionThrown if the data can not be written

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 528 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

void org.sleuthkit.datamodel.Image.setAcquisitionToolDetails ( String  name,
String  version,
String  settings 
) throws TskCoreException

Sets the acquisition tool details such as its name, version number and any settings used during the acquisition to acquire data.

Parameters
nameThe name of the acquisition tool. May be NULL.
versionThe acquisition tool version number. May be NULL.
settingsThe settings used by the acquisition tool. May be NULL.
Exceptions
TskCoreExceptionThrown if the data can not be written

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 543 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

void org.sleuthkit.datamodel.Image.setDisplayName ( String  newName) throws TskCoreException

Set the name for this data source.

Parameters
newNameThe new name for the data source
Exceptions
TskCoreExceptionThrown if an error occurs while updating the database

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 475 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getId(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

void org.sleuthkit.datamodel.Image.setMD5 ( String  md5) throws TskCoreException, TskDataException
Parameters
md5
Exceptions
TskCoreExceptionOn DB errors
TskDataExceptionIf hash has already been set

Definition at line 419 of file Image.java.

References org.sleuthkit.datamodel.Image.getMd5(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

void org.sleuthkit.datamodel.Image.setSha1 ( String  sha1) throws TskCoreException, TskDataException
Parameters
sha1
Exceptions
TskCoreExceptionOn DB errors
TskDataExceptionIf hash has already been set

Definition at line 433 of file Image.java.

References org.sleuthkit.datamodel.Image.getSha1(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

void org.sleuthkit.datamodel.Image.setSha256 ( String  sha256) throws TskCoreException, TskDataException
Parameters
sha256
Exceptions
TskCoreExceptionOn DB errors
TskDataExceptionIf hash has already been set

Definition at line 447 of file Image.java.

References org.sleuthkit.datamodel.Image.getSha256(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

void org.sleuthkit.datamodel.Image.setSizes ( long  totalSize,
long  sectorSize 
) throws TskCoreException

Updates the image's total size and sector size.This function may be used to update the sizes after the image was created.

Can only update the sizes if they were not set before. Will throw TskCoreException if the values in the db are not 0 prior to this call.

Parameters
totalSizeThe total size
sectorSizeThe sector size
Exceptions
TskCoreExceptionIf there is an error updating the case database.

Definition at line 633 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

String org.sleuthkit.datamodel.Image.toString ( boolean  preserveState)

Definition at line 300 of file Image.java.

String org.sleuthkit.datamodel.Image.verifyImageSize ( )

Perform some sanity checks on the bounds of the image contents to determine if we could be missing some pieces of the image.

Returns
String of error messages to display to user or empty string if there are no errors

Definition at line 326 of file Image.java.

References org.sleuthkit.datamodel.Image.getFileSystems(), org.sleuthkit.datamodel.Image.getVolumeSystems(), and org.sleuthkit.datamodel.Image.read().


The documentation for this class was generated from the following file:

Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.