Sleuth Kit Java Bindings (JNI)  4.3
Java bindings for using The Sleuth Kit
org.sleuthkit.datamodel.FsContent Class Referenceabstract

Inherits org.sleuthkit.datamodel.AbstractFile.

Inherited by org.sleuthkit.datamodel.Directory, org.sleuthkit.datamodel.File, and org.sleuthkit.datamodel.SlackFile.

Public Member Functions

void close ()
 
void finalize () throws Throwable
 
Content getDataSource () throws TskCoreException
 
FileSystem getFileSystem () throws TskCoreException
 
long getFileSystemId ()
 
synchronized List< String > getMetaDataText () throws TskCoreException
 
AbstractFile getParentDirectory () throws TskCoreException
 
synchronized String getUniquePath () throws TskCoreException
 
boolean isRoot ()
 
String toString (boolean preserveState)
 
- Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
boolean canRead ()
 
void close ()
 
long convertToImgOffset (long fileOffset) throws TskCoreException
 
boolean exists ()
 
long getAtime ()
 
String getAtimeAsDate ()
 
int getAttributeId ()
 
short getAttrId ()
 
TskData.TSK_FS_ATTR_TYPE_ENUM getAttrType ()
 
long getCrtime ()
 
String getCrtimeAsDate ()
 
long getCtime ()
 
String getCtimeAsDate ()
 
Content getDataSource () throws TskCoreException
 
String getDirFlagAsString ()
 
TSK_FS_NAME_TYPE_ENUM getDirType ()
 
String getDirTypeAsString ()
 
int getGid ()
 
TskData.FileKnown getKnown ()
 
String getLocalAbsPath ()
 
String getLocalPath ()
 
String getMd5Hash ()
 
long getMetaAddr ()
 
String getMetaFlagsAsString ()
 
long getMetaSeq ()
 
TSK_FS_META_TYPE_ENUM getMetaType ()
 
String getMetaTypeAsString ()
 
String getMIMEType ()
 
String getModesAsString ()
 
long getMtime ()
 
String getMtimeAsDate ()
 
String getNameExtension ()
 
String getParentPath ()
 
List< TskFileRangegetRanges () throws TskCoreException
 
long getSize ()
 
TskData.TSK_DB_FILES_TYPE_ENUM getType ()
 
int getUid ()
 
boolean isDir ()
 
boolean isDirNameFlagSet (TSK_FS_NAME_FLAG_ENUM flag)
 
boolean isFile ()
 
boolean isMetaFlagSet (TSK_FS_META_FLAG_ENUM metaFlag)
 
MimeMatchEnum isMimeType (SortedSet< String > mimeTypes)
 
boolean isModeSet (TskData.TSK_FS_META_MODE_ENUM mode)
 
abstract boolean isRoot ()
 
boolean isVirtual ()
 
List< AbstractFilelistFiles () throws TskCoreException
 
final int read (byte[] buf, long offset, long len) throws TskCoreException
 
String toString (boolean preserveState)
 
- Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean equals (Object obj)
 
ArrayList< BlackboardArtifactgetAllArtifacts () throws TskCoreException
 
long getAllArtifactsCount () throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (String artifactTypeName) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (int artifactTypeID) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
long getArtifactsCount (String artifactTypeName) throws TskCoreException
 
long getArtifactsCount (int artifactTypeID) throws TskCoreException
 
long getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException
 
int getChildrenCount () throws TskCoreException
 
Content getDataSource () throws TskCoreException
 
BlackboardArtifact getGenInfoArtifact () throws TskCoreException
 
BlackboardArtifact getGenInfoArtifact (boolean create) throws TskCoreException
 
ArrayList< BlackboardAttributegetGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException
 
Set< String > getHashSetNames () throws TskCoreException
 
long getId ()
 
String getName ()
 
synchronized Content getParent () throws TskCoreException
 
SleuthkitCase getSleuthkitCase ()
 
synchronized String getUniquePath () throws TskCoreException
 
boolean hasChildren () throws TskCoreException
 
int hashCode ()
 
BlackboardArtifact newArtifact (int artifactTypeID) throws TskCoreException
 
BlackboardArtifact newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
String toString ()
 
String toString (boolean preserveState)
 
- Public Member Functions inherited from org.sleuthkit.datamodel.Content
public< T > T accept (ContentVisitor< T > v)
 
long getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
List< ContentgetChildren () throws TskCoreException
 
List< Long > getChildrenIds () throws TskCoreException
 
ArrayList< BlackboardAttributegetGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException
 
- Public Member Functions inherited from org.sleuthkit.datamodel.SleuthkitVisitableItem
public< T > T accept (SleuthkitItemVisitor< T > v)
 

Protected Member Functions

int readInt (byte[] buf, long offset, long len) throws TskCoreException
 
- Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
 AbstractFile (SleuthkitCase db, long objId, TskData.TSK_FS_ATTR_TYPE_ENUM attrType, short attrId, String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, short modes, int uid, int gid, String md5Hash, FileKnown knownState, String parentPath)
 
void finalize () throws Throwable
 
int readInt (byte[] buf, long offset, long len) throws TskCoreException
 
final int readLocal (byte[] buf, long offset, long len) throws TskCoreException
 
void setLocalPath (String localPath, boolean isAbsolute)
 
- Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
 AbstractContent (SleuthkitCase db, long obj_id, String name)
 

Protected Attributes

volatile long fileHandle = 0
 
final long fsObjId
 
- Protected Attributes inherited from org.sleuthkit.datamodel.AbstractFile
final int attrId
 
final TskData.TSK_FS_ATTR_TYPE_ENUM attrType
 
final TSK_FS_NAME_FLAG_ENUM dirFlag
 
final TSK_FS_NAME_TYPE_ENUM dirType
 
final TskData.TSK_DB_FILES_TYPE_ENUM fileType
 
TskData.FileKnown knownState
 
String md5Hash
 
final long metaAddr
 
final Set< TSK_FS_META_FLAG_ENUMmetaFlags
 
final int metaSeq
 
final TSK_FS_META_TYPE_ENUM metaType
 
final Set< TskData.TSK_FS_META_MODE_ENUM > modes
 
final String parentPath
 
long size
 
final int uid
 
- Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long parentId
 

Private Attributes

List< String > metaDataText = null
 
volatile FileSystem parentFileSystem
 
final SleuthkitCase tskCase
 
String uniquePath
 

Static Private Attributes

static final ResourceBundle bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle")
 
static final Logger logger = Logger.getLogger(AbstractFile.class.getName())
 

Additional Inherited Members

- Static Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
static String createNonUniquePath (String uniquePath)
 
static String epochToTime (long epoch)
 
static long timeToEpoch (String time)
 
- Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long UNKNOWN_ID = -1
 

Detailed Description

An abstract base class for representations of a file system files or directories that have been added to a case.

TODO move common getters to AbstractFile class

Definition at line 39 of file FsContent.java.

Member Function Documentation

void org.sleuthkit.datamodel.FsContent.close ( )

Closes the JNI file handle for this file or directory.

Implements org.sleuthkit.datamodel.Content.

Definition at line 303 of file FsContent.java.

References org.sleuthkit.datamodel.SleuthkitJNI.closeFile().

Referenced by org.sleuthkit.datamodel.FsContent.finalize().

void org.sleuthkit.datamodel.FsContent.finalize ( ) throws Throwable

Closes the JNI file handle for this file or directory when the FsContent object is garbage-collected.

Definition at line 320 of file FsContent.java.

References org.sleuthkit.datamodel.FsContent.close().

Content org.sleuthkit.datamodel.FsContent.getDataSource ( ) throws TskCoreException

Gets the data source (image) for this file or directory directory.

Returns
The data source.
Exceptions
TskCoreExceptionif there is an error querying the case database.

Implements org.sleuthkit.datamodel.Content.

Definition at line 250 of file FsContent.java.

References org.sleuthkit.datamodel.AbstractContent.getDataSource(), and org.sleuthkit.datamodel.FsContent.getFileSystem().

long org.sleuthkit.datamodel.FsContent.getFileSystemId ( )

Get the object id of the parent file system of this file or directory.

Returns
the parent file system id

Definition at line 138 of file FsContent.java.

References org.sleuthkit.datamodel.FsContent.fsObjId.

Referenced by org.sleuthkit.datamodel.OSUtility.getOSInfoInternal().

synchronized List<String> org.sleuthkit.datamodel.FsContent.getMetaDataText ( ) throws TskCoreException

Gets a text-based description of the file's metadata. This is the same content as the TSK istat tool produces and is different information for each type of file system.

Returns
List of text, one element per line.
Exceptions
TskCoreException

Definition at line 281 of file FsContent.java.

References org.sleuthkit.datamodel.SleuthkitJNI.getFileMetaDataText(), org.sleuthkit.datamodel.AbstractFile.metaAddr, and org.sleuthkit.datamodel.FsContent.metaDataText.

AbstractFile org.sleuthkit.datamodel.FsContent.getParentDirectory ( ) throws TskCoreException

Gets the parent directory of this file or directory.

Returns
The parent directory
Exceptions
TskCoreExceptionif there was an error querying the case database.

Definition at line 238 of file FsContent.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

synchronized String org.sleuthkit.datamodel.FsContent.getUniquePath ( ) throws TskCoreException

Get the full path to this file or directory, starting with a "/" and the image name and then all the other segments in the path.

Exceptions
TskCoreExceptionif there is an error querying the case database.

Implements org.sleuthkit.datamodel.Content.

Definition at line 261 of file FsContent.java.

References org.sleuthkit.datamodel.FsContent.getFileSystem(), org.sleuthkit.datamodel.AbstractContent.getName(), org.sleuthkit.datamodel.AbstractFile.getParentPath(), and org.sleuthkit.datamodel.FsContent.uniquePath.

int org.sleuthkit.datamodel.FsContent.readInt ( byte[]  buf,
long  offset,
long  len 
) throws TskCoreException
protected

Reads bytes from this file or directory.

Parameters
bufBuffer to read into.
offsetStart position in the file.
lenNumber of bytes to read.
Returns
Number of bytes read.
Exceptions
TskCoreExceptionif there is a problem reading the file.

Definition at line 210 of file FsContent.java.

References org.sleuthkit.datamodel.SleuthkitJNI.readFile(), and org.sleuthkit.datamodel.AbstractFile.size.

String org.sleuthkit.datamodel.FsContent.toString ( boolean  preserveState)

Provides a string representation of this file or directory.

Parameters
preserveStateTrue if state should be included in the string representation of this object.
Exceptions
TskCoreExceptionif there was an error querying the case database.

Definition at line 339 of file FsContent.java.

Member Data Documentation

final ResourceBundle org.sleuthkit.datamodel.FsContent.bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle")
staticprivate

Definition at line 42 of file FsContent.java.

volatile long org.sleuthkit.datamodel.FsContent.fileHandle = 0
protected
Deprecated:
Use getFileHandle instead.

Definition at line 61 of file FsContent.java.

Referenced by org.sleuthkit.datamodel.SlackFile.readInt().

final long org.sleuthkit.datamodel.FsContent.fsObjId
protected
final Logger org.sleuthkit.datamodel.FsContent.logger = Logger.getLogger(AbstractFile.class.getName())
staticprivate

Definition at line 41 of file FsContent.java.

List<String> org.sleuthkit.datamodel.FsContent.metaDataText = null
private

Definition at line 45 of file FsContent.java.

Referenced by org.sleuthkit.datamodel.FsContent.getMetaDataText().

volatile FileSystem org.sleuthkit.datamodel.FsContent.parentFileSystem
private

Definition at line 46 of file FsContent.java.

Referenced by org.sleuthkit.datamodel.FsContent.getFileSystem().

final SleuthkitCase org.sleuthkit.datamodel.FsContent.tskCase
private

Definition at line 44 of file FsContent.java.

String org.sleuthkit.datamodel.FsContent.uniquePath
private

Definition at line 43 of file FsContent.java.

Referenced by org.sleuthkit.datamodel.FsContent.getUniquePath().


The documentation for this class was generated from the following file:

Copyright © 2011-2015 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.