Inherits org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.DataSource.

Public Member Functions
void	close ()
void	finalize () throws Throwable
String	getAcquisitionDetails () throws TskCoreException
String	getAcquisitionToolName () throws TskCoreException
String	getAcquisitionToolSettings () throws TskCoreException
String	getAcquisitionToolVersion () throws TskCoreException
List< Content >	getChildren () throws TskCoreException
List< Long >	getChildrenIds () throws TskCoreException
long	getContentSize (SleuthkitCase sleuthkitCase) throws TskCoreException
Content	getDataSource ()
Long	getDateAdded () throws TskCoreException
String	getDeviceId ()
List< FileSystem >	getFileSystems () throws TskCoreException
Host	getHost () throws TskCoreException
synchronized long	getImageHandle () throws TskCoreException
String	getMd5 () throws TskCoreException
String[]	getPaths ()
String	getSha1 () throws TskCoreException
String	getSha256 () throws TskCoreException
long	getSize ()
long	getSsize ()
String	getTimeZone ()
TskData.TSK_IMG_TYPE_ENUM	getType ()
String	getUniquePath () throws TskCoreException
List< Volume >	getVolumes () throws TskCoreException
List< VolumeSystem >	getVolumeSystems () throws TskCoreException
Boolean	imageFileExists ()
int	read (byte[] buf, long offset, long len) throws TskCoreException
void	setAcquisitionDetails (String details) throws TskCoreException
void	setAcquisitionToolDetails (String name, String version, String settings) throws TskCoreException
void	setDisplayName (String newName) throws TskCoreException
void	setMD5 (String md5) throws TskCoreException, TskDataException
void	setSha1 (String sha1) throws TskCoreException, TskDataException
void	setSha256 (String sha256) throws TskCoreException, TskDataException
void	setSizes (long totalSize, long sectorSize) throws TskCoreException
String	toString (boolean preserveState)
String	verifyImageSize ()
Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean	equals (Object obj)
Score	getAggregateScore () throws TskCoreException
List< AnalysisResult >	getAllAnalysisResults () throws TskCoreException
ArrayList< BlackboardArtifact >	getAllArtifacts () throws TskCoreException
long	getAllArtifactsCount () throws TskCoreException
List< DataArtifact >	getAllDataArtifacts () throws TskCoreException
List< AnalysisResult >	getAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (int artifactTypeID) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (String artifactTypeName) throws TskCoreException
long	getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException
long	getArtifactsCount (int artifactTypeID) throws TskCoreException
long	getArtifactsCount (String artifactTypeName) throws TskCoreException
int	getChildrenCount () throws TskCoreException
BlackboardArtifact	getGenInfoArtifact () throws TskCoreException
BlackboardArtifact	getGenInfoArtifact (boolean create) throws TskCoreException
ArrayList< BlackboardAttribute >	getGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException
Set< String >	getHashSetNames () throws TskCoreException
long	getId ()
String	getName ()
Content	getParent () throws TskCoreException
Optional< Long >	getParentId () throws TskCoreException
SleuthkitCase	getSleuthkitCase ()
boolean	hasChildren () throws TskCoreException
int	hashCode ()
AnalysisResultAdded	newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException
AnalysisResultAdded	newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException
BlackboardArtifact	newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
BlackboardArtifact	newArtifact (int artifactTypeID) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException
String	toString ()
Public Member Functions inherited from org.sleuthkit.datamodel.Content
long	getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
ArrayList< BlackboardAttribute >	getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException

Protected Member Functions
	Image (SleuthkitCase db, long obj_id, long type, long ssize, String name, String[] paths, String timezone, String md5) throws TskCoreException
Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
	AbstractContent (SleuthkitCase db, long obj_id, String name)

Additional Inherited Members
Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long	UNKNOWN_ID = -1
Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long	parentId

Detailed Description

Represents a disk image file, stored in tsk_image_info. Populated based on data in database.

Caches internal tsk image handle and reuses it for reads

Definition at line 39 of file Image.java.

Constructor & Destructor Documentation

◆ Image()

org.sleuthkit.datamodel.Image.Image	(	SleuthkitCase	db,
		long	obj_id,
		long	type,
		long	ssize,
		String	name,
		String[]	paths,
		String	timezone,
		String	md5 ) throws TskCoreException

protected

Create a disk image.

Note: Most inputs originate from the database.

Parameters

db	Case database.
obj_id	Object ID.
type	Image type.
ssize	Sector size.
name	Display name.
paths	Image paths.
timezone	Timezone.
md5	MD5 hash.

Exceptions

TskCoreException

Deprecated: Use the constructor that takes a device ID and size.

Definition at line 72 of file Image.java.

Referenced by getSize().

Member Function Documentation

◆ close()

void org.sleuthkit.datamodel.Image.close ( )

Free native resources after read is done on the Content object. After closing, read can be called again on the same Content object, which should result in re-opening of new native resources.

Implements org.sleuthkit.datamodel.Content.

Definition at line 144 of file Image.java.

◆ finalize()

void org.sleuthkit.datamodel.Image.finalize ( ) throws Throwable

Definition at line 150 of file Image.java.

◆ getAcquisitionDetails()

String org.sleuthkit.datamodel.Image.getAcquisitionDetails ( ) throws TskCoreException

Gets the acquisition details field from the case database.

Returns: The acquisition details

Exceptions

TskCoreException Thrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 599 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ getAcquisitionToolName()

String org.sleuthkit.datamodel.Image.getAcquisitionToolName ( ) throws TskCoreException

Gets the acquisition tool name field from the case database.

Returns: The acquisition tool name. May be Null if not set.

Exceptions

TskCoreException Thrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 565 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ getAcquisitionToolSettings()

String org.sleuthkit.datamodel.Image.getAcquisitionToolSettings ( ) throws TskCoreException

Gets the acquisition tool settings field from the case database.

Returns: The acquisition tool settings. May be Null if not set.

Exceptions

TskCoreException Thrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 554 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ getAcquisitionToolVersion()

String org.sleuthkit.datamodel.Image.getAcquisitionToolVersion ( ) throws TskCoreException

Gets the acquisition tool version field from the case database.

Returns: The acquisition tool version. May be Null if not set.

Exceptions

TskCoreException Thrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 576 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ getChildren()

List< Content > org.sleuthkit.datamodel.Image.getChildren ( ) throws TskCoreException

Gets all children of this abstract content, if any.

Returns: A list of the children.

Exceptions

TskCoreException if there was an error querying the case database.

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Definition at line 290 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by getVolumes(), and getVolumeSystems().

◆ getChildrenIds()

List< Long > org.sleuthkit.datamodel.Image.getChildrenIds ( ) throws TskCoreException

Gets the object ids of objects, if any, that are children of this abstract content.

Returns: A list of the object ids.

Exceptions

TskCoreException if there was an error querying the case database.

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Definition at line 295 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ getContentSize()

long org.sleuthkit.datamodel.Image.getContentSize ( SleuthkitCase sleuthkitCase ) throws TskCoreException

Gets the size of the contents of the data source in bytes. This size can change as archive files within the data source are expanded, files are carved, etc., and is different from the size of the data source as returned by Content.getSize, which is the size of the data source as a file.

Parameters

sleuthkitCase The sleuthkit case instance from which to make calls to the database.

Returns: The size in bytes.

Exceptions

TskCoreException Thrown when there is an issue trying to retrieve data from the database.

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 495 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getId().

◆ getDataSource()

Content org.sleuthkit.datamodel.Image.getDataSource ( )

Gets the root data source (image, virtual directory, etc.) of this content.

Returns: Content associated with data source or null if one can't be found

Exceptions

TskCoreException if critical error occurred within tsk core

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Definition at line 139 of file Image.java.

◆ getDateAdded()

Long org.sleuthkit.datamodel.Image.getDateAdded ( ) throws TskCoreException

Gets the added date field from the case database.

Returns: The date time when the image was added in epoch seconds.

Exceptions

TskCoreException Thrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 587 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ getDeviceId()

String org.sleuthkit.datamodel.Image.getDeviceId ( )

Gets the ASCII-printable identifier for the device associated with the data source. This identifier is intended to be unique across multiple cases (e.g., a UUID).

Returns: The device id.

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 463 of file Image.java.

◆ getFileSystems()

List< FileSystem > org.sleuthkit.datamodel.Image.getFileSystems ( ) throws TskCoreException

Returns: a list of FileSystems in this Image. This includes FileSystems that are both children of this Image as well as children of Volumes in this image.

Exceptions

TskCoreException

Definition at line 263 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by verifyImageSize().

◆ getHost()

Host org.sleuthkit.datamodel.Image.getHost ( ) throws TskCoreException

Gets the host for this data source.

Returns: The host

Exceptions

TskCoreException

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 611 of file Image.java.

References org.sleuthkit.datamodel.HostManager.getHostByDataSource(), org.sleuthkit.datamodel.SleuthkitCase.getHostManager(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ getImageHandle()

synchronized long org.sleuthkit.datamodel.Image.getImageHandle ( ) throws TskCoreException

Get the handle to the sleuthkit image info object

Returns: the object pointer

Exceptions

TskCoreException

Definition at line 122 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase(), and org.sleuthkit.datamodel.SleuthkitJNI.openImage().

Referenced by org.sleuthkit.datamodel.VolumeSystem.getVolumeSystemHandle(), read(), and org.sleuthkit.datamodel.LayoutFile.readInt().

◆ getMd5()

String org.sleuthkit.datamodel.Image.getMd5 ( ) throws TskCoreException

Gets the md5 hash value

Returns: md5 hash if attained(from database), empty string otherwise

Exceptions

TskCoreException

Definition at line 378 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by setMD5().

◆ getPaths()

String[] org.sleuthkit.datamodel.Image.getPaths ( )

Get the image path

Returns: image path

Definition at line 216 of file Image.java.

◆ getSha1()

String org.sleuthkit.datamodel.Image.getSha1 ( ) throws TskCoreException

gets the SHA1 hash value

Returns: SHA1 hash if attained(from database), empty string otherwise

Exceptions

TskCoreException on DB error.

Definition at line 392 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by setSha1().

◆ getSha256()

String org.sleuthkit.datamodel.Image.getSha256 ( ) throws TskCoreException

gets the SHA256 hash value

Returns: SHA256 hash if attained(from database), empty string otherwise

Exceptions

TskCoreException

Definition at line 406 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by setSha256().

◆ getSize()

long org.sleuthkit.datamodel.Image.getSize ( )

Get the (reported) size of the content object and, in theory, how much you should be able to read from it. In some cases, data corruption may mean that you cannot read this much data.

Returns: size of the content in bytes

Implements org.sleuthkit.datamodel.Content.

Definition at line 173 of file Image.java.

References Image(), and org.sleuthkit.datamodel.SleuthkitJNI.findDeviceSize().

◆ getSsize()

long org.sleuthkit.datamodel.Image.getSsize ( )

Get the sector size

Returns: sector size

Definition at line 202 of file Image.java.

◆ getTimeZone()

String org.sleuthkit.datamodel.Image.getTimeZone ( )

Get the timezone set for the image

Returns: timezone string representation

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 275 of file Image.java.

Referenced by org.sleuthkit.datamodel.BlackboardAttribute.getDisplayString().

◆ getType()

TskData.TSK_IMG_TYPE_ENUM org.sleuthkit.datamodel.Image.getType ( )

Get the image type

Returns: image type

Definition at line 193 of file Image.java.

References org.sleuthkit.datamodel.TskData.TSK_IMG_TYPE_ENUM.valueOf().

◆ getUniquePath()

String org.sleuthkit.datamodel.Image.getUniquePath ( ) throws TskCoreException

Returns: returns the full path to this Content object starting with a "/" followed by the Image name and similarly for all other segments in the hierarchy.

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Definition at line 207 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getName().

◆ getVolumes()

List< Volume > org.sleuthkit.datamodel.Image.getVolumes ( ) throws TskCoreException

Returns: a list of Volume associated with this Image.

Exceptions

TskCoreException

Definition at line 243 of file Image.java.

References getChildren().

◆ getVolumeSystems()

List< VolumeSystem > org.sleuthkit.datamodel.Image.getVolumeSystems ( ) throws TskCoreException

Returns: a list of VolumeSystem associated with this Image.

Exceptions

TskCoreException

Definition at line 225 of file Image.java.

References getChildren().

Referenced by verifyImageSize().

◆ imageFileExists()

Boolean org.sleuthkit.datamodel.Image.imageFileExists ( )

Test if the file that created this image exists on disk. Does not work on local disks - will always return false

Returns: True if the file still exists

Definition at line 310 of file Image.java.

References org.sleuthkit.datamodel.AbstractFile.exists().

◆ read()

int org.sleuthkit.datamodel.Image.read	(	byte[]	buf,
		long	offset,
		long	len ) throws TskCoreException

Reads data that this content object is associated with (file contents, volume contents, etc.).

Parameters

buf	a character array of data (in bytes) to copy read data to
offset	byte offset in the content to start reading from
len	number of bytes to read into buf.

Returns: num of bytes read, or -1 on error

Exceptions

TskCoreException if critical error occurred during read in the tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 162 of file Image.java.

References getImageHandle(), and org.sleuthkit.datamodel.SleuthkitJNI.readImg().

Referenced by verifyImageSize().

◆ setAcquisitionDetails()

void org.sleuthkit.datamodel.Image.setAcquisitionDetails ( String details ) throws TskCoreException

Sets the acquisition details field in the case database.

Parameters

details The acquisition details

Exceptions

TskCoreException Thrown if the data can not be written

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 528 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ setAcquisitionToolDetails()

void org.sleuthkit.datamodel.Image.setAcquisitionToolDetails	(	String	name,
		String	version,
		String	settings ) throws TskCoreException

Sets the acquisition tool details such as its name, version number and any settings used during the acquisition to acquire data.

Parameters

name	The name of the acquisition tool. May be NULL.
version	The acquisition tool version number. May be NULL.
settings	The settings used by the acquisition tool. May be NULL.

Exceptions

TskCoreException Thrown if the data can not be written

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 543 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ setDisplayName()

void org.sleuthkit.datamodel.Image.setDisplayName ( String newName ) throws TskCoreException

Set the name for this data source.

Parameters

newName The new name for the data source

Exceptions

TskCoreException Thrown if an error occurs while updating the database

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 475 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getId(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ setMD5()

void org.sleuthkit.datamodel.Image.setMD5 ( String md5 ) throws TskCoreException, TskDataException

Parameters

md5

Exceptions

TskCoreException	On DB errors
TskDataException	If hash has already been set

Definition at line 419 of file Image.java.

References getMd5(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ setSha1()

void org.sleuthkit.datamodel.Image.setSha1 ( String sha1 ) throws TskCoreException, TskDataException

Parameters

sha1

Exceptions

TskCoreException	On DB errors
TskDataException	If hash has already been set

Definition at line 433 of file Image.java.

References getSha1(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ setSha256()

void org.sleuthkit.datamodel.Image.setSha256 ( String sha256 ) throws TskCoreException, TskDataException

Parameters

sha256

Exceptions

TskCoreException	On DB errors
TskDataException	If hash has already been set

Definition at line 447 of file Image.java.

References getSha256(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ setSizes()

void org.sleuthkit.datamodel.Image.setSizes	(	long	totalSize,
		long	sectorSize ) throws TskCoreException

Updates the image's total size and sector size.This function may be used to update the sizes after the image was created.

Can only update the sizes if they were not set before. Will throw TskCoreException if the values in the db are not 0 prior to this call.

Parameters

totalSize	The total size
sectorSize	The sector size

Exceptions

TskCoreException If there is an error updating the case database.

Definition at line 633 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ toString()

String org.sleuthkit.datamodel.Image.toString ( boolean preserveState )

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Definition at line 300 of file Image.java.

◆ verifyImageSize()

String org.sleuthkit.datamodel.Image.verifyImageSize ( )

Perform some sanity checks on the bounds of the image contents to determine if we could be missing some pieces of the image.

Returns: String of error messages to display to user or empty string if there are no errors

Definition at line 326 of file Image.java.

References getFileSystems(), getVolumeSystems(), and read().

The documentation for this class was generated from the following file:

/home/carriersleuth/repos/sleuthkit/bindings/java/src/org/sleuthkit/datamodel/Image.java

Public Member Functions

Protected Member Functions

Additional Inherited Members

Detailed Description

Constructor & Destructor Documentation

◆ Image()

Member Function Documentation

◆ close()

◆ finalize()

◆ getAcquisitionDetails()

◆ getAcquisitionToolName()

◆ getAcquisitionToolSettings()

◆ getAcquisitionToolVersion()

◆ getChildren()

◆ getChildrenIds()

◆ getContentSize()

◆ getDataSource()

◆ getDateAdded()

◆ getDeviceId()

◆ getFileSystems()

◆ getHost()

◆ getImageHandle()

◆ getMd5()

◆ getPaths()

◆ getSha1()

◆ getSha256()

◆ getSize()

◆ getSsize()

◆ getTimeZone()

◆ getType()

◆ getUniquePath()

◆ getVolumes()

◆ getVolumeSystems()

◆ imageFileExists()

◆ read()

◆ setAcquisitionDetails()

◆ setAcquisitionToolDetails()

◆ setDisplayName()

◆ setMD5()

◆ setSha1()

◆ setSha256()

◆ setSizes()

◆ toString()

◆ verifyImageSize()