Sleuth Kit Java Bindings (JNI) 4.14.0
Java bindings for using The Sleuth Kit
Loading...
Searching...
No Matches
org.sleuthkit.datamodel.LayoutFile Class Reference

Inherits org.sleuthkit.datamodel.AbstractFile.

Public Member Functions

void close ()
int getNumParts ()
boolean isRoot ()
String toString (boolean preserveState)
Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
void addAttributes (Collection< Attribute > attributes, final SleuthkitCase.CaseDbTransaction caseDbTransaction) throws TskCoreException
boolean canRead ()
long convertToImgOffset (long fileOffset) throws TskCoreException
List< TskFileRange > convertToImgRanges (long fileOffset, long length) throws TskCoreException
int countChildrenOfType (List< TSK_FS_NAME_TYPE_ENUM > types) throws TskCoreException
boolean exists ()
long getAtime ()
String getAtimeAsDate ()
int getAttributeId ()
List< Attribute > getAttributes () throws TskCoreException
short getAttrId ()
TskData.TSK_FS_ATTR_TYPE_ENUM getAttrType ()
TskData.CollectedStatus getCollected ()
long getCrtime ()
String getCrtimeAsDate ()
long getCtime ()
String getCtimeAsDate ()
Content getDataSource () throws TskCoreException
long getDataSourceObjectId ()
String getDirFlagAsString ()
TSK_FS_NAME_TYPE_ENUM getDirType ()
String getDirTypeAsString ()
FileSystem getFileSystem () throws TskCoreException
Optional< Long > getFileSystemObjectId ()
int getGid ()
TskData.FileKnown getKnown ()
String getLocalAbsPath ()
String getLocalPath ()
String getMd5Hash ()
long getMetaAddr ()
String getMetaFlagsAsString ()
long getMetaSeq ()
TSK_FS_META_TYPE_ENUM getMetaType ()
String getMetaTypeAsString ()
String getMIMEType ()
String getModesAsString ()
long getMtime ()
String getMtimeAsDate ()
String getNameExtension ()
Optional< Long > getOsAccountObjectId ()
Optional< String > getOwnerUid ()
String getParentPath ()
List< TskFileRange > getRanges () throws TskCoreException
String getSha1Hash ()
String getSha256Hash ()
long getSize ()
TskData.TSK_DB_FILES_TYPE_ENUM getType ()
int getUid ()
String getUniquePath () throws TskCoreException
boolean hasFileSystem ()
boolean isDir ()
boolean isDirNameFlagSet (TSK_FS_NAME_FLAG_ENUM flag)
boolean isFile ()
boolean isMetaFlagSet (TSK_FS_META_FLAG_ENUM metaFlag)
MimeMatchEnum isMimeType (SortedSet< String > mimeTypes)
boolean isModeSet (TskData.TSK_FS_META_MODE_ENUM mode)
boolean isVirtual ()
List< AbstractFile > listFiles () throws TskCoreException
BlackboardArtifact newArtifact (int artifactTypeID) throws TskCoreException
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException
final int read (byte[] buf, long offset, long len) throws TskCoreException
void save () throws TskCoreException
void save (CaseDbTransaction transaction) throws TskCoreException
void setCollected (TskData.CollectedStatus collected)
void setKnown (TskData.FileKnown knownState)
void setMd5Hash (String md5Hash)
void setMIMEType (String mimeType)
void setSha1Hash (String sha1Hash)
void setSha256Hash (String sha256Hash)
Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean equals (Object obj)
Score getAggregateScore () throws TskCoreException
List< AnalysisResult > getAllAnalysisResults () throws TskCoreException
ArrayList< BlackboardArtifact > getAllArtifacts () throws TskCoreException
long getAllArtifactsCount () throws TskCoreException
List< DataArtifact > getAllDataArtifacts () throws TskCoreException
List< AnalysisResult > getAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException
ArrayList< BlackboardArtifact > getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
ArrayList< BlackboardArtifact > getArtifacts (int artifactTypeID) throws TskCoreException
ArrayList< BlackboardArtifact > getArtifacts (String artifactTypeName) throws TskCoreException
long getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException
long getArtifactsCount (int artifactTypeID) throws TskCoreException
long getArtifactsCount (String artifactTypeName) throws TskCoreException
List< Content > getChildren () throws TskCoreException
int getChildrenCount () throws TskCoreException
List< Long > getChildrenIds () throws TskCoreException
BlackboardArtifact getGenInfoArtifact () throws TskCoreException
BlackboardArtifact getGenInfoArtifact (boolean create) throws TskCoreException
ArrayList< BlackboardAttribute > getGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException
Set< String > getHashSetNames () throws TskCoreException
long getId ()
String getName ()
Content getParent () throws TskCoreException
Optional< Long > getParentId () throws TskCoreException
SleuthkitCase getSleuthkitCase ()
boolean hasChildren () throws TskCoreException
int hashCode ()
AnalysisResultAdded newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException
AnalysisResultAdded newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException
BlackboardArtifact newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException
String toString ()
Public Member Functions inherited from org.sleuthkit.datamodel.Content
long getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
ArrayList< BlackboardAttribute > getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException

Protected Member Functions

int readInt (byte[] buf, long offset, long len) throws TskCoreException
Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
void finalize () throws Throwable
final int readLocal (byte[] buf, long offset, long len) throws TskCoreException
void setLocalPath (String localPath, boolean isAbsolute)
Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
 AbstractContent (SleuthkitCase db, long obj_id, String name)

Additional Inherited Members

Static Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
static String createNonUniquePath (String uniquePath)
static String epochToTime (long epoch)
static String epochToTime (long epoch, TimeZone tzone)
static long timeToEpoch (String time)
Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long UNKNOWN_ID = -1
Protected Attributes inherited from org.sleuthkit.datamodel.AbstractFile
final long atime
final int attrId
final TskData.TSK_FS_ATTR_TYPE_ENUM attrType
final long crtime
final long ctime
TSK_FS_NAME_FLAG_ENUM dirFlag
final TSK_FS_NAME_TYPE_ENUM dirType
final Long fileSystemObjectId
final TskData.TSK_DB_FILES_TYPE_ENUM fileType
final int gid
TskData.FileKnown knownState
String md5Hash
final long metaAddr
Set< TSK_FS_META_FLAG_ENUM > metaFlags
final int metaSeq
final TSK_FS_META_TYPE_ENUM metaType
final Set< TskData.TSK_FS_META_MODE_ENUM > modes
final long mtime
final String parentPath
String sha1Hash
String sha256Hash
long size
final int uid
Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long parentId

Detailed Description

A representation of a layout file that has been added to a case. Layout files are not file system files, but "virtual" files created from blocks of data (e.g. unallocated) that are treated as files for convenience and uniformity.

Because layout files are not real file system files, they only utilize a subset of meta-data attributes. A layout file normally contains one or more entry in tsk_file_layout table that define ordered byte block ranges, with respect to the image.

The class also supports reads of layout files, reading blocks across ranges in a sequence.

Definition at line 44 of file LayoutFile.java.

Member Function Documentation

◆ close()

void org.sleuthkit.datamodel.LayoutFile.close ( )

Does nothing, a layout file cannot be directly opened, read, or closed. Use the readInt method to get layout file content.

Reimplemented from org.sleuthkit.datamodel.AbstractFile.

Definition at line 142 of file LayoutFile.java.

◆ getNumParts()

int org.sleuthkit.datamodel.LayoutFile.getNumParts ( )

Gets the number of file layout ranges associated with this layout file.

Returns
The number of file layout ranges.

Definition at line 116 of file LayoutFile.java.

References org.sleuthkit.datamodel.AbstractContent.getId(), and org.sleuthkit.datamodel.AbstractFile.getRanges().

◆ isRoot()

boolean org.sleuthkit.datamodel.LayoutFile.isRoot ( )

Indicates whether or not this layout file is the root of a file system, always returns false.

Returns
False.

Reimplemented from org.sleuthkit.datamodel.AbstractFile.

Definition at line 133 of file LayoutFile.java.

◆ readInt()

int org.sleuthkit.datamodel.LayoutFile.readInt ( byte[] buf,
long offset,
long len ) throws TskCoreException
protected

Reads bytes from the layout ranges associated with this file.

Parameters
bufBuffer to read into.
offsetStart position in the file.
lenNumber of bytes to read.
Returns
Number of bytes read.
Exceptions
TskCoreExceptionif there is a problem reading the file.

Reimplemented from org.sleuthkit.datamodel.AbstractFile.

Definition at line 157 of file LayoutFile.java.

References org.sleuthkit.datamodel.AbstractFile.getDataSource(), org.sleuthkit.datamodel.Image.getImageHandle(), org.sleuthkit.datamodel.AbstractFile.getRanges(), and org.sleuthkit.datamodel.AbstractFile.size.

◆ toString()

String org.sleuthkit.datamodel.LayoutFile.toString ( boolean preserveState)

Provides a string representation of this file.

Parameters
preserveStateTrue if state should be included in the string representation of this object.

Reimplemented from org.sleuthkit.datamodel.AbstractFile.

Definition at line 256 of file LayoutFile.java.

The documentation for this class was generated from the following file:
  • /home/carriersleuth/repos/sleuthkit/bindings/java/src/org/sleuthkit/datamodel/LayoutFile.java

Copyright © 2011-2024 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.