|
Sleuth Kit Java Bindings (JNI)
4.12.1
Java bindings for using The Sleuth Kit
|
|
Sleuth Kit Java Bindings (JNI)
4.12.1
Java bindings for using The Sleuth Kit
|
Inherits org.sleuthkit.datamodel.AbstractFile.
Public Member Functions | |
| void | close () |
| int | getNumParts () |
| boolean | isRoot () |
| String | toString (boolean preserveState) |
 Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile | |
| void | addAttributes (Collection< Attribute > attributes, final SleuthkitCase.CaseDbTransaction caseDbTransaction) throws TskCoreException |
| boolean | canRead () |
| void | close () |
| long | convertToImgOffset (long fileOffset) throws TskCoreException |
| List< TskFileRange > | convertToImgRanges (long fileOffset, long length) throws TskCoreException |
| boolean | exists () |
| long | getAtime () |
| String | getAtimeAsDate () |
| int | getAttributeId () |
| List< Attribute > | getAttributes () throws TskCoreException |
| short | getAttrId () |
| TskData.TSK_FS_ATTR_TYPE_ENUM | getAttrType () |
| TskData.CollectedStatus | getCollected () |
| long | getCrtime () |
| String | getCrtimeAsDate () |
| long | getCtime () |
| String | getCtimeAsDate () |
| Content | getDataSource () throws TskCoreException |
| long | getDataSourceObjectId () |
| String | getDirFlagAsString () |
| TSK_FS_NAME_TYPE_ENUM | getDirType () |
| String | getDirTypeAsString () |
| FileSystem | getFileSystem () throws TskCoreException |
| Optional< Long > | getFileSystemObjectId () |
| int | getGid () |
| TskData.FileKnown | getKnown () |
| String | getLocalAbsPath () |
| String | getLocalPath () |
| String | getMd5Hash () |
| long | getMetaAddr () |
| String | getMetaFlagsAsString () |
| long | getMetaSeq () |
| TSK_FS_META_TYPE_ENUM | getMetaType () |
| String | getMetaTypeAsString () |
| String | getMIMEType () |
| String | getModesAsString () |
| long | getMtime () |
| String | getMtimeAsDate () |
| String | getNameExtension () |
| Optional< Long > | getOsAccountObjectId () |
| Optional< String > | getOwnerUid () |
| String | getParentPath () |
| List< TskFileRange > | getRanges () throws TskCoreException |
| String | getSha1Hash () |
| String | getSha256Hash () |
| long | getSize () |
| TskData.TSK_DB_FILES_TYPE_ENUM | getType () |
| int | getUid () |
| String | getUniquePath () throws TskCoreException |
| boolean | hasFileSystem () |
| boolean | isDir () |
| boolean | isDirNameFlagSet (TSK_FS_NAME_FLAG_ENUM flag) |
| boolean | isFile () |
| boolean | isMetaFlagSet (TSK_FS_META_FLAG_ENUM metaFlag) |
| MimeMatchEnum | isMimeType (SortedSet< String > mimeTypes) |
| boolean | isModeSet (TskData.TSK_FS_META_MODE_ENUM mode) |
| abstract boolean | isRoot () |
| boolean | isVirtual () |
| List< AbstractFile > | listFiles () throws TskCoreException |
| BlackboardArtifact | newArtifact (int artifactTypeID) throws TskCoreException |
| DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException |
| final int | read (byte[] buf, long offset, long len) throws TskCoreException |
| void | save () throws TskCoreException |
| void | save (CaseDbTransaction transaction) throws TskCoreException |
| void | setCollected (TskData.CollectedStatus collected) |
| void | setKnown (TskData.FileKnown knownState) |
| void | setMd5Hash (String md5Hash) |
| void | setMIMEType (String mimeType) |
| void | setSha1Hash (String sha1Hash) |
| void | setSha256Hash (String sha256Hash) |
| String | toString (boolean preserveState) |
| Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent | |
| boolean | equals (Object obj) |
| Score | getAggregateScore () throws TskCoreException |
| List< AnalysisResult > | getAllAnalysisResults () throws TskCoreException |
| ArrayList< BlackboardArtifact > | getAllArtifacts () throws TskCoreException |
| long | getAllArtifactsCount () throws TskCoreException |
| List< DataArtifact > | getAllDataArtifacts () throws TskCoreException |
| List< AnalysisResult > | getAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException |
| ArrayList< BlackboardArtifact > | getArtifacts (String artifactTypeName) throws TskCoreException |
| ArrayList< BlackboardArtifact > | getArtifacts (int artifactTypeID) throws TskCoreException |
| ArrayList< BlackboardArtifact > | getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
| long | getArtifactsCount (String artifactTypeName) throws TskCoreException |
| long | getArtifactsCount (int artifactTypeID) throws TskCoreException |
| long | getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException |
| List< Content > | getChildren () throws TskCoreException |
| int | getChildrenCount () throws TskCoreException |
| List< Long > | getChildrenIds () throws TskCoreException |
| Content | getDataSource () throws TskCoreException |
| BlackboardArtifact | getGenInfoArtifact () throws TskCoreException |
| BlackboardArtifact | getGenInfoArtifact (boolean create) throws TskCoreException |
| ArrayList< BlackboardAttribute > | getGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException |
| Set< String > | getHashSetNames () throws TskCoreException |
| long | getId () |
| String | getName () |
| Content | getParent () throws TskCoreException |
| Optional< Long > | getParentId () throws TskCoreException |
| SleuthkitCase | getSleuthkitCase () |
| String | getUniquePath () throws TskCoreException |
| boolean | hasChildren () throws TskCoreException |
| int | hashCode () |
| AnalysisResultAdded | newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException |
| AnalysisResultAdded | newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException |
| BlackboardArtifact | newArtifact (int artifactTypeID) throws TskCoreException |
| BlackboardArtifact | newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
| DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException |
| DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException |
| DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException |
| String | toString () |
| String | toString (boolean preserveState) |
| Public Member Functions inherited from org.sleuthkit.datamodel.Content | |
| long | getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
| ArrayList< BlackboardAttribute > | getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException |
Protected Member Functions | |
| int | readInt (byte[] buf, long offset, long len) throws TskCoreException |
| Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractFile | |
| void | finalize () throws Throwable |
| int | readInt (byte[] buf, long offset, long len) throws TskCoreException |
| final int | readLocal (byte[] buf, long offset, long len) throws TskCoreException |
| void | setLocalPath (String localPath, boolean isAbsolute) |
| Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent | |
| AbstractContent (SleuthkitCase db, long obj_id, String name) | |
Additional Inherited Members | |
| Static Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile | |
| static String | createNonUniquePath (String uniquePath) |
| static String | epochToTime (long epoch) |
| static String | epochToTime (long epoch, TimeZone tzone) |
| static long | timeToEpoch (String time) |
| Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent | |
| static final long | UNKNOWN_ID = -1 |
| Protected Attributes inherited from org.sleuthkit.datamodel.AbstractFile | |
| final int | attrId |
| final TskData.TSK_FS_ATTR_TYPE_ENUM | attrType |
| TSK_FS_NAME_FLAG_ENUM | dirFlag |
| final TSK_FS_NAME_TYPE_ENUM | dirType |
| final Long | fileSystemObjectId |
| final TskData.TSK_DB_FILES_TYPE_ENUM | fileType |
| TskData.FileKnown | knownState |
| String | md5Hash |
| final long | metaAddr |
| Set< TSK_FS_META_FLAG_ENUM > | metaFlags |
| final int | metaSeq |
| final TSK_FS_META_TYPE_ENUM | metaType |
| final Set< TskData.TSK_FS_META_MODE_ENUM > | modes |
| final String | parentPath |
| String | sha1Hash |
| String | sha256Hash |
| long | size |
| final int | uid |
| Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent | |
| long | parentId |
A representation of a layout file that has been added to a case. Layout files are not file system files, but "virtual" files created from blocks of data (e.g. unallocated) that are treated as files for convenience and uniformity.
Because layout files are not real file system files, they only utilize a subset of meta-data attributes. A layout file normally contains one or more entry in tsk_file_layout table that define ordered byte block ranges, with respect to the image.
The class also supports reads of layout files, reading blocks across ranges in a sequence.
Definition at line 44 of file LayoutFile.java.
| void org.sleuthkit.datamodel.LayoutFile.close | ( | ) |
Does nothing, a layout file cannot be directly opened, read, or closed. Use the readInt method to get layout file content.
Implements org.sleuthkit.datamodel.Content.
Definition at line 142 of file LayoutFile.java.
| int org.sleuthkit.datamodel.LayoutFile.getNumParts | ( | ) |
Gets the number of file layout ranges associated with this layout file.
Definition at line 116 of file LayoutFile.java.
References org.sleuthkit.datamodel.AbstractContent.getId(), org.sleuthkit.datamodel.AbstractContent.getName(), and org.sleuthkit.datamodel.AbstractFile.getRanges().
| boolean org.sleuthkit.datamodel.LayoutFile.isRoot | ( | ) |
Indicates whether or not this layout file is the root of a file system, always returns false.
Definition at line 133 of file LayoutFile.java.
|
protected |
Reads bytes from the layout ranges associated with this file.
| buf | Buffer to read into. |
| offset | Start position in the file. |
| len | Number of bytes to read. |
| TskCoreException | if there is a problem reading the file. |
Definition at line 157 of file LayoutFile.java.
References org.sleuthkit.datamodel.AbstractFile.getDataSource(), org.sleuthkit.datamodel.Image.getImageHandle(), and org.sleuthkit.datamodel.AbstractFile.getRanges().
| String org.sleuthkit.datamodel.LayoutFile.toString | ( | boolean | preserveState | ) |
Provides a string representation of this file.
| preserveState | True if state should be included in the string representation of this object. |
Definition at line 256 of file LayoutFile.java.
Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.
