org.sleuthkit.datamodel.OsAccount Class Reference

Inherits org.sleuthkit.datamodel.AbstractContent.

Classes
class	OsAccountAttribute
enum	OsAccountDbStatus
enum	OsAccountStatus
enum	OsAccountType

Public Member Functions
void	close ()
Optional< String >	getAddr ()
Optional< Long >	getCreationTime ()
synchronized List< OsAccountAttribute >	getExtendedOsAccountAttributes () throws TskCoreException
Optional< String >	getFullName ()
long	getId ()
Optional< String >	getLoginName ()
OsAccountDbStatus	getOsAccountDbStatus ()
synchronized List< OsAccountInstance >	getOsAccountInstances () throws TskCoreException
Optional< OsAccountStatus >	getOsAccountStatus ()
Optional< OsAccountType >	getOsAccountType ()
long	getRealmId ()
long	getSize ()
SleuthkitCase	getSleuthkitCase ()
int	read (byte[] buf, long offset, long len) throws TskCoreException
Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean	equals (Object obj)
Score	getAggregateScore () throws TskCoreException
List< AnalysisResult >	getAllAnalysisResults () throws TskCoreException
ArrayList< BlackboardArtifact >	getAllArtifacts () throws TskCoreException
long	getAllArtifactsCount () throws TskCoreException
List< DataArtifact >	getAllDataArtifacts () throws TskCoreException
List< AnalysisResult >	getAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (int artifactTypeID) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (String artifactTypeName) throws TskCoreException
long	getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException
long	getArtifactsCount (int artifactTypeID) throws TskCoreException
long	getArtifactsCount (String artifactTypeName) throws TskCoreException
List< Content >	getChildren () throws TskCoreException
int	getChildrenCount () throws TskCoreException
List< Long >	getChildrenIds () throws TskCoreException
Content	getDataSource () throws TskCoreException
BlackboardArtifact	getGenInfoArtifact () throws TskCoreException
BlackboardArtifact	getGenInfoArtifact (boolean create) throws TskCoreException
ArrayList< BlackboardAttribute >	getGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException
Set< String >	getHashSetNames () throws TskCoreException
String	getName ()
Content	getParent () throws TskCoreException
Optional< Long >	getParentId () throws TskCoreException
String	getUniquePath () throws TskCoreException
boolean	hasChildren () throws TskCoreException
int	hashCode ()
AnalysisResultAdded	newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException
AnalysisResultAdded	newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException
BlackboardArtifact	newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
BlackboardArtifact	newArtifact (int artifactTypeID) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException
String	toString ()
String	toString (boolean preserveState)
Public Member Functions inherited from org.sleuthkit.datamodel.Content
long	getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
ArrayList< BlackboardAttribute >	getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException

Additional Inherited Members
Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long	UNKNOWN_ID = -1
Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
	AbstractContent (SleuthkitCase db, long obj_id, String name)
Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long	parentId

Detailed Description

Abstracts an OS user account. OS Accounts have a scope, which is defined by their parent OsAccountRealm.

An OS user account may own files and (some) artifacts.

OsAcounts can be created with minimal data and updated as more is learned. Caller must call update() to save any new data.

Definition at line 35 of file OsAccount.java.

Member Function Documentation

close()

void org.sleuthkit.datamodel.OsAccount.close

(

)

Free native resources after read is done on the Content object. After closing, read can be called again on the same Content object, which should result in re-opening of new native resources.

Implements org.sleuthkit.datamodel.Content.

Definition at line 389 of file OsAccount.java.

getAddr()

Optional< String > org.sleuthkit.datamodel.OsAccount.getAddr

(

)

Get the unique identifier for the account, such as UID or SID. The id is unique within the account realm.

Returns

Optional unique identifier.

Definition at line 269 of file OsAccount.java.

getCreationTime()

Optional< Long > org.sleuthkit.datamodel.OsAccount.getCreationTime

(

)

Get account creation time.

Returns

Optional with account creation time.

Definition at line 316 of file OsAccount.java.

getExtendedOsAccountAttributes()

synchronized List< OsAccountAttribute > org.sleuthkit.datamodel.OsAccount.getExtendedOsAccountAttributes

(

)

throws TskCoreException

Get additional account attributes.

Returns

List of additional account attributes. May return an empty list.

Exceptions

TskCoreException

Definition at line 354 of file OsAccount.java.

getFullName()

Optional< String > org.sleuthkit.datamodel.OsAccount.getFullName

(

)

Get account user full name, such as "John Doe"

Returns

Optional with full name.

Definition at line 307 of file OsAccount.java.

getId()

long org.sleuthkit.datamodel.OsAccount.getId

(

)

Get the account Object Id that is unique within the scope of the case.

Returns

Account id.

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Definition at line 259 of file OsAccount.java.

Referenced by org.sleuthkit.datamodel.OsAccount.OsAccountAttribute.OsAccountAttribute(), org.sleuthkit.datamodel.OsAccount.OsAccountAttribute.OsAccountAttribute(), org.sleuthkit.datamodel.OsAccount.OsAccountAttribute.OsAccountAttribute(), org.sleuthkit.datamodel.OsAccount.OsAccountAttribute.OsAccountAttribute(), and org.sleuthkit.datamodel.OsAccount.OsAccountAttribute.OsAccountAttribute().

getLoginName()

Optional< String > org.sleuthkit.datamodel.OsAccount.getLoginName

(

)

Get account login name, such as "jdoe"

Returns

Optional login name.

Definition at line 289 of file OsAccount.java.

getOsAccountDbStatus()

OsAccountDbStatus org.sleuthkit.datamodel.OsAccount.getOsAccountDbStatus

(

)

Get account status in the database.

Returns

Database account status.

Definition at line 343 of file OsAccount.java.

getOsAccountInstances()

synchronized List< OsAccountInstance > org.sleuthkit.datamodel.OsAccount.getOsAccountInstances

(

)

throws TskCoreException

Return the os account instances.

Returns

List of all the OsAccountInstances. May return an empty list.

Exceptions

TskCoreException

Definition at line 368 of file OsAccount.java.

getOsAccountStatus()

Optional< OsAccountStatus > org.sleuthkit.datamodel.OsAccount.getOsAccountStatus

(

)

Get account status.

Returns

Optional with account status.

Definition at line 334 of file OsAccount.java.

getOsAccountType()

Optional< OsAccountType > org.sleuthkit.datamodel.OsAccount.getOsAccountType

(

)

Get account type.

Returns

Optional with account type.

Definition at line 325 of file OsAccount.java.

getRealmId()

long org.sleuthkit.datamodel.OsAccount.getRealmId

(

)

Get the ID for the account realm. Get the Realm via OsAccountRealmManager.getRealmByRealmId() NOTE: The realm may get updated as more data is parsed, so listen for events to update as needed.

Returns

Definition at line 280 of file OsAccount.java.

getSize()

long org.sleuthkit.datamodel.OsAccount.getSize

(

)

Get the (reported) size of the content object and, in theory, how much you should be able to read from it. In some cases, data corruption may mean that you cannot read this much data.

Returns

size of the content in bytes

Implements org.sleuthkit.datamodel.Content.

Definition at line 394 of file OsAccount.java.

getSleuthkitCase()

SleuthkitCase org.sleuthkit.datamodel.OsAccount.getSleuthkitCase

(

)

Gets the SleuthKit case database for this account.

Returns

The SleuthKit case object.

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Definition at line 378 of file OsAccount.java.

read()

int org.sleuthkit.datamodel.OsAccount.read	(	byte[]	buf,
		long	offset,
		long	len ) throws TskCoreException

Reads data that this content object is associated with (file contents, volume contents, etc.).

Parameters

buf	a character array of data (in bytes) to copy read data to
offset	byte offset in the content to start reading from
len	number of bytes to read into buf.

Returns

num of bytes read, or -1 on error

Exceptions

TskCoreException

if critical error occurred during read in the tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 383 of file OsAccount.java.

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/sleuthkit/bindings/java/src/org/sleuthkit/datamodel/OsAccount.java