Inherits org.sleuthkit.datamodel.AbstractContent.

Public Member Functions
void	close ()

void	finalize () throws Throwable

List< Content >	getChildren () throws TskCoreException

List< Long >	getChildrenIds () throws TskCoreException

Content	getDataSource ()

List< FileSystem >	getFileSystems () throws TskCoreException

synchronized long	getImageHandle () throws TskCoreException

String	getMd5 ()

String[]	getPaths ()

long	getSize ()

long	getSsize ()

String	getTimeZone ()

TskData.TSK_IMG_TYPE_ENUM	getType ()

String	getUniquePath () throws TskCoreException

List< Volume >	getVolumes () throws TskCoreException

List< VolumeSystem >	getVolumeSystems () throws TskCoreException

Boolean	imageFileExists ()

int	read (byte[] buf, long offset, long len) throws TskCoreException

String	toString (boolean preserveState)

String	verifyImageSize ()

Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean	equals (Object obj)

ArrayList< BlackboardArtifact >	getAllArtifacts () throws TskCoreException

long	getAllArtifactsCount () throws TskCoreException

ArrayList< BlackboardArtifact >	getArtifacts (String artifactTypeName) throws TskCoreException

ArrayList< BlackboardArtifact >	getArtifacts (int artifactTypeID) throws TskCoreException

ArrayList< BlackboardArtifact >	getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException

long	getArtifactsCount (String artifactTypeName) throws TskCoreException

long	getArtifactsCount (int artifactTypeID) throws TskCoreException

long	getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException

int	getChildrenCount () throws TskCoreException

Content	getDataSource () throws TskCoreException

BlackboardArtifact	getGenInfoArtifact () throws TskCoreException

BlackboardArtifact	getGenInfoArtifact (boolean create) throws TskCoreException

ArrayList< BlackboardAttribute >	getGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException

Set< String >	getHashSetNames () throws TskCoreException

long	getId ()

String	getName ()

synchronized Content	getParent () throws TskCoreException

SleuthkitCase	getSleuthkitCase ()

synchronized String	getUniquePath () throws TskCoreException

boolean	hasChildren () throws TskCoreException

int	hashCode ()

BlackboardArtifact	newArtifact (int artifactTypeID) throws TskCoreException

BlackboardArtifact	newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException

String	toString ()

String	toString (boolean preserveState)

Public Member Functions inherited from org.sleuthkit.datamodel.Content
long	getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException

ArrayList< BlackboardAttribute >	getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException

Protected Member Functions
	Image (SleuthkitCase db, long obj_id, long type, long ssize, String name, String[] paths, String timezone, String md5) throws TskCoreException

Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
	AbstractContent (SleuthkitCase db, long obj_id, String name)

Private Attributes
volatile long	imageHandle = 0

String[]	paths

String	timezone

long	type

Static Private Attributes
static ResourceBundle	bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle")

Additional Inherited Members
Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long	UNKNOWN_ID = -1

Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long	parentId

Detailed Description

Represents a disk image file, stored in tsk_image_info. Populated based on data in database.

Caches internal tsk image handle and reuses it for reads

Definition at line 36 of file Image.java.

Constructor & Destructor Documentation

org.sleuthkit.datamodel.Image.Image	(	SleuthkitCase	db,
		long	obj_id,
		long	type,
		long	ssize,
		String	name,
		String[]	paths,
		String	timezone,
		String	md5
	)		throws TskCoreException

protected

constructor most inputs are from the database

Parameters

db	database object
obj_id
type
ssize	Sector Size
name	Display Name
paths
timezone
md5

Definition at line 57 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.db, org.sleuthkit.datamodel.AbstractContent.name, org.sleuthkit.datamodel.Image.paths, org.sleuthkit.datamodel.Image.timezone, and org.sleuthkit.datamodel.Image.type.

Member Function Documentation

void org.sleuthkit.datamodel.Image.close ( )

Free native resources after read is done on the Content object. After closing, read can be called again on the same Content object, which should result in re-opening of new native resources.

Implements org.sleuthkit.datamodel.Content.

Definition at line 86 of file Image.java.

void org.sleuthkit.datamodel.Image.finalize ( ) throws Throwable

Definition at line 91 of file Image.java.

References org.sleuthkit.datamodel.SleuthkitJNI.closeImg().

List<Content> org.sleuthkit.datamodel.Image.getChildren ( ) throws TskCoreException

Gets the child content objects of this content.

Returns: List of children

Exceptions

TskCoreException if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 222 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.getVolumes(), and org.sleuthkit.datamodel.Image.getVolumeSystems().

List<Long> org.sleuthkit.datamodel.Image.getChildrenIds ( ) throws TskCoreException

Gets the child content ids of this content.

Returns: List of children ids

Exceptions

TskCoreException if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 227 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Content org.sleuthkit.datamodel.Image.getDataSource ( )

Get the root data source of this content (image, virtual directory, etc.)

Returns: Content associated with data source or null if one can't be found

Exceptions

TskCoreException if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 81 of file Image.java.

List<FileSystem> org.sleuthkit.datamodel.Image.getFileSystems ( ) throws TskCoreException

Returns: a list of FileSystems in this Image. This includes FileSystems that are both children of this Image as well as children of Volumes in this image.

Exceptions

TskCoreException

Definition at line 196 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.verifyImageSize().

synchronized long org.sleuthkit.datamodel.Image.getImageHandle ( ) throws TskCoreException

Get the handle to the sleuthkit image info object

Returns: the object pointer

Definition at line 72 of file Image.java.

References org.sleuthkit.datamodel.Image.imageHandle, and org.sleuthkit.datamodel.SleuthkitJNI.openImage().

Referenced by org.sleuthkit.datamodel.VolumeSystem.getVolumeSystemHandle(), org.sleuthkit.datamodel.Image.read(), and org.sleuthkit.datamodel.LayoutFile.readInt().

String org.sleuthkit.datamodel.Image.getMd5 ( )

gets the md5 hash value

Returns: md5 hash if attained(from database). returns null if not set.

Definition at line 307 of file Image.java.

String [] org.sleuthkit.datamodel.Image.getPaths ( )

Get the image path

Returns: image path

Definition at line 152 of file Image.java.

References org.sleuthkit.datamodel.Image.paths.

long org.sleuthkit.datamodel.Image.getSize ( )

Get the (reported) size of the content object and, in theory, how much you should be able to read from it. In some cases, data corruption may mean that you cannot read this much data.

Returns: size of the content

Implements org.sleuthkit.datamodel.Content.

Definition at line 109 of file Image.java.

References org.sleuthkit.datamodel.SleuthkitJNI.findDeviceSize(), and org.sleuthkit.datamodel.AbstractContent.getName().

long org.sleuthkit.datamodel.Image.getSsize ( )

Get the sector size

Returns: sector size

Definition at line 138 of file Image.java.

String org.sleuthkit.datamodel.Image.getTimeZone ( )

Get the timezone set for the image

Returns: timezone string representation

Definition at line 207 of file Image.java.

References org.sleuthkit.datamodel.Image.timezone.

TskData.TSK_IMG_TYPE_ENUM org.sleuthkit.datamodel.Image.getType ( )

Get the image type

Returns: image type

Definition at line 129 of file Image.java.

References org.sleuthkit.datamodel.TskData.TSK_IMG_TYPE_ENUM.valueOf().

String org.sleuthkit.datamodel.Image.getUniquePath ( ) throws TskCoreException

Returns: returns the full path to this Content object starting with a "/" followed by the Image name and similarly for all other segments in the hierarchy.

Implements org.sleuthkit.datamodel.Content.

Definition at line 143 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getName().

List<Volume> org.sleuthkit.datamodel.Image.getVolumes ( ) throws TskCoreException

Returns: a list of Volume associated with this Image.

Exceptions

TskCoreException

Definition at line 177 of file Image.java.

References org.sleuthkit.datamodel.Image.getChildren().

List<VolumeSystem> org.sleuthkit.datamodel.Image.getVolumeSystems ( ) throws TskCoreException

Returns: a list of VolumeSystem associated with this Image.

Exceptions

TskCoreException

Definition at line 160 of file Image.java.

References org.sleuthkit.datamodel.Image.getChildren().

Referenced by org.sleuthkit.datamodel.Image.verifyImageSize().

Boolean org.sleuthkit.datamodel.Image.imageFileExists ( )

Test if the image represented by this object exists on disk.

Returns: True if the file still exists

Definition at line 241 of file Image.java.

References org.sleuthkit.datamodel.AbstractFile.exists().

Referenced by org.sleuthkit.datamodel.FsContent.readInt().

int org.sleuthkit.datamodel.Image.read	(	byte[]	buf,
		long	offset,
		long	len
	)		throws TskCoreException

Reads data that this content object is associated with (file contents, volume contents, etc.).

Parameters

buf	a character array of data (in bytes) to copy read data to
offset	byte offset in the content to start reading from
len	number of bytes to read into buf.