Sleuth Kit Java Bindings (JNI)
4.3
Java bindings for using The Sleuth Kit
|
Inherits org.sleuthkit.datamodel.Content.
Inherited by org.sleuthkit.datamodel.AbstractFile, org.sleuthkit.datamodel.FileSystem, org.sleuthkit.datamodel.Image, org.sleuthkit.datamodel.Volume, and org.sleuthkit.datamodel.VolumeSystem.
Public Member Functions | |
boolean | equals (Object obj) |
ArrayList< BlackboardArtifact > | getAllArtifacts () throws TskCoreException |
long | getAllArtifactsCount () throws TskCoreException |
ArrayList< BlackboardArtifact > | getArtifacts (String artifactTypeName) throws TskCoreException |
ArrayList< BlackboardArtifact > | getArtifacts (int artifactTypeID) throws TskCoreException |
ArrayList< BlackboardArtifact > | getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
long | getArtifactsCount (String artifactTypeName) throws TskCoreException |
long | getArtifactsCount (int artifactTypeID) throws TskCoreException |
long | getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException |
int | getChildrenCount () throws TskCoreException |
Content | getDataSource () throws TskCoreException |
BlackboardArtifact | getGenInfoArtifact () throws TskCoreException |
BlackboardArtifact | getGenInfoArtifact (boolean create) throws TskCoreException |
ArrayList< BlackboardAttribute > | getGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException |
Set< String > | getHashSetNames () throws TskCoreException |
long | getId () |
String | getName () |
synchronized Content | getParent () throws TskCoreException |
SleuthkitCase | getSleuthkitCase () |
synchronized String | getUniquePath () throws TskCoreException |
boolean | hasChildren () throws TskCoreException |
int | hashCode () |
BlackboardArtifact | newArtifact (int artifactTypeID) throws TskCoreException |
BlackboardArtifact | newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
String | toString () |
String | toString (boolean preserveState) |
Public Member Functions inherited from org.sleuthkit.datamodel.Content | |
public< T > T | accept (ContentVisitor< T > v) |
void | close () |
long | getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
List< Content > | getChildren () throws TskCoreException |
List< Long > | getChildrenIds () throws TskCoreException |
ArrayList< BlackboardAttribute > | getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException |
long | getSize () |
int | read (byte[] buf, long offset, long len) throws TskCoreException |
Public Member Functions inherited from org.sleuthkit.datamodel.SleuthkitVisitableItem | |
public< T > T | accept (SleuthkitItemVisitor< T > v) |
Static Public Attributes | |
static final long | UNKNOWN_ID = -1 |
Protected Member Functions | |
AbstractContent (SleuthkitCase db, long obj_id, String name) | |
Protected Attributes | |
long | parentId |
Private Attributes | |
volatile boolean | checkedHasChildren |
volatile int | childrenCount |
final SleuthkitCase | db |
BlackboardArtifact | genInfoArtifact = null |
volatile boolean | hasChildren |
final String | name |
final long | objId |
Content | parent |
String | uniquePath |
Implements some general methods from the Content interface common across many content sub types
Definition at line 35 of file AbstractContent.java.
|
protected |
Definition at line 49 of file AbstractContent.java.
References org.sleuthkit.datamodel.AbstractContent.db, org.sleuthkit.datamodel.AbstractContent.name, and org.sleuthkit.datamodel.AbstractContent.UNKNOWN_ID.
Referenced by org.sleuthkit.datamodel.AbstractContent.equals().
boolean org.sleuthkit.datamodel.AbstractContent.equals | ( | Object | obj | ) |
ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.AbstractContent.getAllArtifacts | ( | ) | throws TskCoreException |
Get all artifacts associated with this content
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 298 of file AbstractContent.java.
References org.sleuthkit.datamodel.SleuthkitCase.getMatchingArtifacts().
long org.sleuthkit.datamodel.AbstractContent.getAllArtifactsCount | ( | ) | throws TskCoreException |
Get count of all artifacts associated with this content
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 318 of file AbstractContent.java.
References org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactsCount().
ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.AbstractContent.getArtifacts | ( | String | artifactTypeName | ) | throws TskCoreException |
Get all artifacts associated with this content that have the given type name
artifactTypeName | name of the type to look up |
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 223 of file AbstractContent.java.
References org.sleuthkit.datamodel.SleuthkitCase.getArtifactType().
Referenced by org.sleuthkit.datamodel.AbstractContent.getArtifacts(), and org.sleuthkit.datamodel.AbstractContent.getHashSetNames().
ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.AbstractContent.getArtifacts | ( | int | artifactTypeID | ) | throws TskCoreException |
Get all artifacts associated with this content that have the given type id
artifactTypeID | type id to look up |
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 228 of file AbstractContent.java.
References org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts(), org.sleuthkit.datamodel.AbstractContent.getGenInfoArtifact(), and org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.
ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.AbstractContent.getArtifacts | ( | BlackboardArtifact.ARTIFACT_TYPE | type | ) | throws TskCoreException |
Get all artifacts associated with this content that have the given type
type | type to look up |
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 246 of file AbstractContent.java.
References org.sleuthkit.datamodel.AbstractContent.getArtifacts().
long org.sleuthkit.datamodel.AbstractContent.getArtifactsCount | ( | String | artifactTypeName | ) | throws TskCoreException |
Get count of all artifacts associated with this content that have the given type name
artifactTypeName | name of the type to look up |
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 303 of file AbstractContent.java.
References org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactsCount().
long org.sleuthkit.datamodel.AbstractContent.getArtifactsCount | ( | int | artifactTypeID | ) | throws TskCoreException |
Get count of all artifacts associated with this content that have the given type id
artifactTypeID | type id to look up |
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 308 of file AbstractContent.java.
References org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactsCount().
long org.sleuthkit.datamodel.AbstractContent.getArtifactsCount | ( | ARTIFACT_TYPE | type | ) | throws TskCoreException |
Definition at line 313 of file AbstractContent.java.
References org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactsCount().
int org.sleuthkit.datamodel.AbstractContent.getChildrenCount | ( | ) | throws TskCoreException |
Returns count of children objects. Note, this should be more efficient than getting children and counting them.
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 103 of file AbstractContent.java.
References org.sleuthkit.datamodel.AbstractContent.childrenCount, and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().
Referenced by org.sleuthkit.datamodel.AbstractContent.equals(), and org.sleuthkit.datamodel.AbstractContent.hashCode().
Content org.sleuthkit.datamodel.AbstractContent.getDataSource | ( | ) | throws TskCoreException |
Gets the root data source (image, virtual directory, etc.) of this content.
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 153 of file AbstractContent.java.
References org.sleuthkit.datamodel.Content.getDataSource(), and org.sleuthkit.datamodel.AbstractContent.getParent().
Referenced by org.sleuthkit.datamodel.FsContent.getDataSource(), and org.sleuthkit.datamodel.VolumeSystem.getVolumeSystemHandle().
BlackboardArtifact org.sleuthkit.datamodel.AbstractContent.getGenInfoArtifact | ( | ) | throws TskCoreException |
Return the TSK_GEN_INFO artifact for the file so that individual attributes can be added to it. Creates one if it does not already exist.
TskCoreException |
Implements org.sleuthkit.datamodel.Content.
Definition at line 251 of file AbstractContent.java.
Referenced by org.sleuthkit.datamodel.AbstractContent.getArtifacts(), org.sleuthkit.datamodel.AbstractContent.getGenInfoAttributes(), and org.sleuthkit.datamodel.AbstractContent.newArtifact().
BlackboardArtifact org.sleuthkit.datamodel.AbstractContent.getGenInfoArtifact | ( | boolean | create | ) | throws TskCoreException |
Return the TSK_GEN_INFO artifact for the file so that individual attributes can be added to it. If one does not create, behavior depends on the create argument.
create | If true, an artifact will be created if it does not already exist. |
TskCoreException |
Implements org.sleuthkit.datamodel.Content.
Definition at line 256 of file AbstractContent.java.
References org.sleuthkit.datamodel.AbstractContent.genInfoArtifact, org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts(), org.sleuthkit.datamodel.SleuthkitCase.newBlackboardArtifact(), and org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.
ArrayList<BlackboardAttribute> org.sleuthkit.datamodel.AbstractContent.getGenInfoAttributes | ( | ATTRIBUTE_TYPE | attr_type | ) | throws TskCoreException |
Definition at line 278 of file AbstractContent.java.
References org.sleuthkit.datamodel.BlackboardArtifact.getAttributes(), and org.sleuthkit.datamodel.AbstractContent.getGenInfoArtifact().
Set<String> org.sleuthkit.datamodel.AbstractContent.getHashSetNames | ( | ) | throws TskCoreException |
Get the names of all the hashsets that this content is in.
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 323 of file AbstractContent.java.
References org.sleuthkit.datamodel.AbstractContent.getArtifacts(), org.sleuthkit.datamodel.BlackboardAttribute.getValueString(), org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT, and org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.
long org.sleuthkit.datamodel.AbstractContent.getId | ( | ) |
Returns the unique object ID that was assigned to it in the database. This is a Sleuth Kit database-assigned number.
Implements org.sleuthkit.datamodel.Content.
Definition at line 147 of file AbstractContent.java.
References org.sleuthkit.datamodel.AbstractContent.objId.
Referenced by org.sleuthkit.datamodel.SleuthkitCase.addCarvedFiles(), org.sleuthkit.datamodel.SleuthkitCase.addDerivedFile(), org.sleuthkit.datamodel.VirtualDirectory.getDataSource(), org.sleuthkit.datamodel.DerivedFile.getDerivedMethod(), org.sleuthkit.datamodel.SleuthkitCase.getFileSystems(), org.sleuthkit.datamodel.LayoutFile.getNumParts(), org.sleuthkit.datamodel.AbstractFile.getRanges(), and org.sleuthkit.datamodel.VirtualDirectory.isDataSource().
String org.sleuthkit.datamodel.AbstractContent.getName | ( | ) |
Get the name of this content object (does not include parent path)
Implements org.sleuthkit.datamodel.Content.
Definition at line 61 of file AbstractContent.java.
References org.sleuthkit.datamodel.AbstractContent.name.
Referenced by org.sleuthkit.datamodel.SleuthkitCase.addCarvedFiles(), org.sleuthkit.datamodel.SleuthkitCase.addDerivedFile(), org.sleuthkit.datamodel.AbstractFile.close(), org.sleuthkit.datamodel.AbstractContent.equals(), org.sleuthkit.datamodel.AbstractFile.getNameExtension(), org.sleuthkit.datamodel.LayoutFile.getNumParts(), org.sleuthkit.datamodel.Image.getSize(), org.sleuthkit.datamodel.AbstractContent.getUniquePath(), org.sleuthkit.datamodel.Volume.getUniquePath(), org.sleuthkit.datamodel.Image.getUniquePath(), org.sleuthkit.datamodel.FsContent.getUniquePath(), org.sleuthkit.datamodel.AbstractContent.hashCode(), org.sleuthkit.datamodel.SleuthkitCase.SleuthkitCase(), and org.sleuthkit.datamodel.AbstractContent.toString().
synchronized Content org.sleuthkit.datamodel.AbstractContent.getParent | ( | ) | throws TskCoreException |
TskCoreException |
Implements org.sleuthkit.datamodel.Content.
Definition at line 117 of file AbstractContent.java.
References org.sleuthkit.datamodel.SleuthkitCase.getContentById(), and org.sleuthkit.datamodel.AbstractContent.parent.
Referenced by org.sleuthkit.datamodel.AbstractContent.getDataSource(), org.sleuthkit.datamodel.OSUtility.getOSInfoInternal(), org.sleuthkit.datamodel.AbstractContent.getUniquePath(), org.sleuthkit.datamodel.Volume.getUniquePath(), org.sleuthkit.datamodel.Volume.read(), and org.sleuthkit.datamodel.AbstractContent.toString().
SleuthkitCase org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase | ( | ) |
Gets handle of SleuthkitCase to which this content belongs
Definition at line 167 of file AbstractContent.java.
References org.sleuthkit.datamodel.AbstractContent.db.
Referenced by org.sleuthkit.datamodel.Directory.getChildren(), org.sleuthkit.datamodel.File.getChildren(), org.sleuthkit.datamodel.VirtualDirectory.getChildren(), org.sleuthkit.datamodel.DerivedFile.getChildren(), org.sleuthkit.datamodel.LayoutFile.getChildren(), org.sleuthkit.datamodel.SlackFile.getChildren(), org.sleuthkit.datamodel.LocalFile.getChildren(), org.sleuthkit.datamodel.VolumeSystem.getChildren(), org.sleuthkit.datamodel.FileSystem.getChildren(), org.sleuthkit.datamodel.Image.getChildren(), org.sleuthkit.datamodel.Volume.getChildren(), org.sleuthkit.datamodel.AbstractContent.getChildrenCount(), org.sleuthkit.datamodel.Directory.getChildrenIds(), org.sleuthkit.datamodel.File.getChildrenIds(), org.sleuthkit.datamodel.VirtualDirectory.getChildrenIds(), org.sleuthkit.datamodel.DerivedFile.getChildrenIds(), org.sleuthkit.datamodel.LayoutFile.getChildrenIds(), org.sleuthkit.datamodel.SlackFile.getChildrenIds(), org.sleuthkit.datamodel.VolumeSystem.getChildrenIds(), org.sleuthkit.datamodel.LocalFile.getChildrenIds(), org.sleuthkit.datamodel.FileSystem.getChildrenIds(), org.sleuthkit.datamodel.Image.getChildrenIds(), org.sleuthkit.datamodel.Volume.getChildrenIds(), org.sleuthkit.datamodel.AbstractFile.getDataSource(), org.sleuthkit.datamodel.DerivedFile.getDerivedMethod(), org.sleuthkit.datamodel.FsContent.getFileSystem(), org.sleuthkit.datamodel.Image.getFileSystems(), org.sleuthkit.datamodel.FsContent.getParentDirectory(), org.sleuthkit.datamodel.AbstractFile.getRanges(), and org.sleuthkit.datamodel.AbstractContent.hasChildren().
synchronized String org.sleuthkit.datamodel.AbstractContent.getUniquePath | ( | ) | throws TskCoreException |
Implements org.sleuthkit.datamodel.Content.
Definition at line 71 of file AbstractContent.java.
References org.sleuthkit.datamodel.AbstractContent.getName(), org.sleuthkit.datamodel.AbstractContent.getParent(), org.sleuthkit.datamodel.Content.getUniquePath(), and org.sleuthkit.datamodel.AbstractContent.uniquePath.
Referenced by org.sleuthkit.datamodel.AbstractContent.toString().
boolean org.sleuthkit.datamodel.AbstractContent.hasChildren | ( | ) | throws TskCoreException |
Returns true if the content object has children objects. Note, this should be more efficient than getting children and checking it empty.
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 87 of file AbstractContent.java.
References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().
int org.sleuthkit.datamodel.AbstractContent.hashCode | ( | ) |
Definition at line 198 of file AbstractContent.java.
References org.sleuthkit.datamodel.AbstractContent.getChildrenCount(), and org.sleuthkit.datamodel.AbstractContent.getName().
BlackboardArtifact org.sleuthkit.datamodel.AbstractContent.newArtifact | ( | int | artifactTypeID | ) | throws TskCoreException |
Create and add an artifact associated with this content to the blackboard
artifactTypeID | id of the artifact type (if the id doesn't already exist an exception will be thrown) |
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 209 of file AbstractContent.java.
References org.sleuthkit.datamodel.AbstractContent.getGenInfoArtifact(), org.sleuthkit.datamodel.SleuthkitCase.newBlackboardArtifact(), and org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.
Referenced by org.sleuthkit.datamodel.AbstractContent.newArtifact().
BlackboardArtifact org.sleuthkit.datamodel.AbstractContent.newArtifact | ( | BlackboardArtifact.ARTIFACT_TYPE | type | ) | throws TskCoreException |
Create and add an artifact associated with this content to the blackboard
type | artifact enum tyoe |
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 218 of file AbstractContent.java.
References org.sleuthkit.datamodel.AbstractContent.newArtifact().
String org.sleuthkit.datamodel.AbstractContent.toString | ( | ) |
Definition at line 337 of file AbstractContent.java.
String org.sleuthkit.datamodel.AbstractContent.toString | ( | boolean | preserveState | ) |
|
private |
Definition at line 45 of file AbstractContent.java.
|
private |
Definition at line 46 of file AbstractContent.java.
Referenced by org.sleuthkit.datamodel.AbstractContent.getChildrenCount().
|
private |
Definition at line 38 of file AbstractContent.java.
Referenced by org.sleuthkit.datamodel.AbstractContent.AbstractContent(), org.sleuthkit.datamodel.AbstractFile.AbstractFile(), org.sleuthkit.datamodel.DerivedFile.DerivedFile(), org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase(), org.sleuthkit.datamodel.Image.Image(), org.sleuthkit.datamodel.LayoutFile.LayoutFile(), and org.sleuthkit.datamodel.LocalFile.LocalFile().
|
private |
Definition at line 47 of file AbstractContent.java.
Referenced by org.sleuthkit.datamodel.AbstractContent.getGenInfoArtifact().
|
private |
Definition at line 44 of file AbstractContent.java.
|
private |
Definition at line 40 of file AbstractContent.java.
Referenced by org.sleuthkit.datamodel.AbstractContent.AbstractContent(), org.sleuthkit.datamodel.DerivedFile.DerivedFile(), org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), org.sleuthkit.datamodel.AbstractContent.getName(), org.sleuthkit.datamodel.Volume.getUniquePath(), org.sleuthkit.datamodel.Image.Image(), org.sleuthkit.datamodel.LayoutFile.LayoutFile(), and org.sleuthkit.datamodel.LocalFile.LocalFile().
|
private |
Definition at line 39 of file AbstractContent.java.
Referenced by org.sleuthkit.datamodel.AbstractFile.AbstractFile(), org.sleuthkit.datamodel.DerivedFile.DerivedFile(), org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.AbstractContent.equals(), org.sleuthkit.datamodel.File.File(), org.sleuthkit.datamodel.AbstractContent.getId(), org.sleuthkit.datamodel.LayoutFile.LayoutFile(), and org.sleuthkit.datamodel.LocalFile.LocalFile().
|
private |
Definition at line 41 of file AbstractContent.java.
Referenced by org.sleuthkit.datamodel.AbstractContent.getParent().
|
protected |
Definition at line 43 of file AbstractContent.java.
Referenced by org.sleuthkit.datamodel.DerivedFile.DerivedFile().
|
private |
Definition at line 42 of file AbstractContent.java.
Referenced by org.sleuthkit.datamodel.AbstractContent.getUniquePath(), and org.sleuthkit.datamodel.Volume.getUniquePath().
|
static |
Copyright © 2011-2015 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.