org.sleuthkit.datamodel.Volume Class Reference

Inherits org.sleuthkit.datamodel.AbstractContent.

Public Member Functions
void	close ()
void	finalize () throws Throwable
long	getAddr ()
List< Content >	getChildren () throws TskCoreException
List< Long >	getChildrenIds () throws TskCoreException
String	getDescription ()
List< FileSystem >	getFileSystems () throws TskCoreException
long	getFlags ()
String	getFlagsAsString ()
long	getLength ()
long	getSize ()
long	getStart ()
String	getUniquePath () throws TskCoreException
int	read (byte[] buf, long offset, long len) throws TskCoreException
String	toString (boolean preserveState)
Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean	equals (Object obj)
Score	getAggregateScore () throws TskCoreException
List< AnalysisResult >	getAllAnalysisResults () throws TskCoreException
ArrayList< BlackboardArtifact >	getAllArtifacts () throws TskCoreException
long	getAllArtifactsCount () throws TskCoreException
List< DataArtifact >	getAllDataArtifacts () throws TskCoreException
List< AnalysisResult >	getAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (int artifactTypeID) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (String artifactTypeName) throws TskCoreException
long	getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException
long	getArtifactsCount (int artifactTypeID) throws TskCoreException
long	getArtifactsCount (String artifactTypeName) throws TskCoreException
int	getChildrenCount () throws TskCoreException
Content	getDataSource () throws TskCoreException
BlackboardArtifact	getGenInfoArtifact () throws TskCoreException
BlackboardArtifact	getGenInfoArtifact (boolean create) throws TskCoreException
ArrayList< BlackboardAttribute >	getGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException
Set< String >	getHashSetNames () throws TskCoreException
long	getId ()
String	getName ()
Content	getParent () throws TskCoreException
Optional< Long >	getParentId () throws TskCoreException
SleuthkitCase	getSleuthkitCase ()
boolean	hasChildren () throws TskCoreException
int	hashCode ()
AnalysisResultAdded	newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException
AnalysisResultAdded	newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException
BlackboardArtifact	newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
BlackboardArtifact	newArtifact (int artifactTypeID) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException
String	toString ()
Public Member Functions inherited from org.sleuthkit.datamodel.Content
long	getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
ArrayList< BlackboardAttribute >	getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException

Static Public Member Functions
static long	valueToVsFlag (String vsFlag)
static String	vsFlagToString (long vsFlag)
static String	vsFlagToValue (long vsFlag)

Protected Member Functions
	Volume (SleuthkitCase db, long obj_id, long addr, long startSector, long lengthInSectors, long flags, String desc)
Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
	AbstractContent (SleuthkitCase db, long obj_id, String name)

Additional Inherited Members
Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long	UNKNOWN_ID = -1
Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long	parentId

Detailed Description

Represents a volume in a VolumeSystem, object stored in tsk_vs_parts table. Populated based on data in database.

Definition at line 29 of file Volume.java.

Constructor & Destructor Documentation

Volume()

org.sleuthkit.datamodel.Volume.Volume ( SleuthkitCase db, long obj_id, long addr, long startSector, long lengthInSectors, long flags, String desc )

protected

Constructor to create the data object mapped from tsk_vs_parts entry

Parameters

db	database object
obj_id
addr
startSector	starting sector, relative to start of VS
lengthInSectors
flags
desc

Definition at line 51 of file Volume.java.

Referenced by getFlagsAsString().

Member Function Documentation

close()

void org.sleuthkit.datamodel.Volume.close

(

)

Free native resources after read is done on the Content object. After closing, read can be called again on the same Content object, which should result in re-opening of new native resources.

Implements org.sleuthkit.datamodel.Content.

Definition at line 89 of file Volume.java.

Referenced by finalize().

finalize()

void org.sleuthkit.datamodel.Volume.finalize

(

)

throws Throwable

Definition at line 97 of file Volume.java.

References close().

getAddr()

long org.sleuthkit.datamodel.Volume.getAddr

(

)

get the unique partition address within this volume system (assigned by The Sleuth Kit)

Returns

partition address in volume system

Definition at line 140 of file Volume.java.

getChildren()

List< Content > org.sleuthkit.datamodel.Volume.getChildren

(

)

throws TskCoreException

Gets all children of this abstract content, if any.

Returns

A list of the children.

Exceptions

TskCoreException

if there was an error querying the case database.

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Definition at line 270 of file Volume.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by getFileSystems().

getChildrenIds()

List< Long > org.sleuthkit.datamodel.Volume.getChildrenIds

(

)

throws TskCoreException

Gets the object ids of objects, if any, that are children of this abstract content.

Returns

A list of the object ids.

Exceptions

TskCoreException

if there was an error querying the case database.

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Definition at line 275 of file Volume.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

getDescription()

String org.sleuthkit.datamodel.Volume.getDescription

(

)

get the description. This is set by the volume system and doesn't exist for all volumes.

Returns

description

Definition at line 187 of file Volume.java.

getFileSystems()

List< FileSystem > org.sleuthkit.datamodel.Volume.getFileSystems

(

)

throws TskCoreException

Returns

a list of FileSystem that are direct descendants of this Image.

Exceptions

TskCoreException

Definition at line 284 of file Volume.java.

References getChildren().

getFlags()

long org.sleuthkit.datamodel.Volume.getFlags

(

)

get the flags

Returns

flags

Definition at line 168 of file Volume.java.

getFlagsAsString()

String org.sleuthkit.datamodel.Volume.getFlagsAsString

(

)

get the flags as String

Returns

flags as String

Definition at line 177 of file Volume.java.

References Volume().

getLength()

long org.sleuthkit.datamodel.Volume.getLength

(

)

get the length of the volume in sectors

Returns

length

Definition at line 159 of file Volume.java.

getSize()

long org.sleuthkit.datamodel.Volume.getSize

(

)

Get the (reported) size of the content object and, in theory, how much you should be able to read from it. In some cases, data corruption may mean that you cannot read this much data.

Returns

size of the content in bytes

Implements org.sleuthkit.datamodel.Content.

Definition at line 106 of file Volume.java.

getStart()

long org.sleuthkit.datamodel.Volume.getStart

(

)

get the starting sector address of this volume relative to start of the volume system

Returns

starting address

Definition at line 150 of file Volume.java.

getUniquePath()

String org.sleuthkit.datamodel.Volume.getUniquePath

(

)

throws TskCoreException

Returns

returns the full path to this Content object starting with a "/" followed by the Image name and similarly for all other segments in the hierarchy.

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Definition at line 111 of file Volume.java.

References org.sleuthkit.datamodel.AbstractContent.getName(), org.sleuthkit.datamodel.AbstractContent.getParent(), and org.sleuthkit.datamodel.Content.getUniquePath().

read()

int org.sleuthkit.datamodel.Volume.read	(	byte[]	buf,
		long	offset,
		long	len ) throws TskCoreException

Reads data that this content object is associated with (file contents, volume contents, etc.).

Parameters

buf	a character array of data (in bytes) to copy read data to
offset	byte offset in the content to start reading from
len	number of bytes to read into buf.

Returns

num of bytes read, or -1 on error

Exceptions

TskCoreException

if critical error occurred during read in the tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 66 of file Volume.java.

References org.sleuthkit.datamodel.AbstractContent.getParent(), org.sleuthkit.datamodel.VolumeSystem.getType(), org.sleuthkit.datamodel.VolumeSystem.getVolumeSystemHandle(), org.sleuthkit.datamodel.SleuthkitJNI.openVsPart(), org.sleuthkit.datamodel.SleuthkitJNI.readVsPart(), and org.sleuthkit.datamodel.TskData.TSK_VS_TYPE_ENUM.TSK_VS_TYPE_APFS.

toString()

String org.sleuthkit.datamodel.Volume.toString

(

boolean

preserveState

)

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Definition at line 298 of file Volume.java.

valueToVsFlag()

long org.sleuthkit.datamodel.Volume.valueToVsFlag ( String vsFlag )

static

Convert volume flag string to long

Parameters

vsFlag

string representation of the flag

Returns

long representation of the flag

Definition at line 218 of file Volume.java.

vsFlagToString()

String org.sleuthkit.datamodel.Volume.vsFlagToString ( long vsFlag )

static

Convert long representation of the flag to user readable format

Parameters

vsFlag

long repr. of the flag

Returns

user readable string representation

Definition at line 237 of file Volume.java.

References org.sleuthkit.datamodel.TskData.TSK_VS_PART_FLAG_ENUM.TSK_VS_PART_FLAG_ALL, org.sleuthkit.datamodel.TskData.TSK_VS_PART_FLAG_ENUM.TSK_VS_PART_FLAG_ALLOC, org.sleuthkit.datamodel.TskData.TSK_VS_PART_FLAG_ENUM.TSK_VS_PART_FLAG_META, and org.sleuthkit.datamodel.TskData.TSK_VS_PART_FLAG_ENUM.TSK_VS_PART_FLAG_UNALLOC.

vsFlagToValue()

String org.sleuthkit.datamodel.Volume.vsFlagToValue ( long vsFlag )

static

Convert volume type flag to string

Parameters

vsFlag

long flag to convert

Returns

string representation

Definition at line 199 of file Volume.java.

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/sleuthkit/bindings/java/src/org/sleuthkit/datamodel/Volume.java