Inherits org.sleuthkit.datamodel.AbstractFile.

Public Member Functions
List< Content >	getChildren () throws TskCoreException

List< Long >	getChildrenIds () throws TskCoreException

List< TskFileRange >	getRanges () throws TskCoreException

boolean	isRoot ()

String	toString (boolean preserveState)

Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
boolean	canRead ()

void	close ()

long	convertToImgOffset (long fileOffset) throws TskCoreException

boolean	exists ()

long	getAtime ()

String	getAtimeAsDate ()

int	getAttributeId ()

short	getAttrId ()

TskData.TSK_FS_ATTR_TYPE_ENUM	getAttrType ()

long	getCrtime ()

String	getCrtimeAsDate ()

long	getCtime ()

String	getCtimeAsDate ()

Content	getDataSource () throws TskCoreException

String	getDirFlagAsString ()

TSK_FS_NAME_TYPE_ENUM	getDirType ()

String	getDirTypeAsString ()

int	getGid ()

TskData.FileKnown	getKnown ()

String	getLocalAbsPath ()

String	getLocalPath ()

String	getMd5Hash ()

long	getMetaAddr ()

String	getMetaFlagsAsString ()

long	getMetaSeq ()

TSK_FS_META_TYPE_ENUM	getMetaType ()

String	getMetaTypeAsString ()

String	getMIMEType ()

String	getModesAsString ()

long	getMtime ()

String	getMtimeAsDate ()

String	getNameExtension ()

String	getParentPath ()

List< TskFileRange >	getRanges () throws TskCoreException

long	getSize ()

TskData.TSK_DB_FILES_TYPE_ENUM	getType ()

int	getUid ()

boolean	isDir ()

boolean	isDirNameFlagSet (TSK_FS_NAME_FLAG_ENUM flag)

boolean	isFile ()

boolean	isMetaFlagSet (TSK_FS_META_FLAG_ENUM metaFlag)

MimeMatchEnum	isMimeType (SortedSet< String > mimeTypes)

boolean	isModeSet (TskData.TSK_FS_META_MODE_ENUM mode)

abstract boolean	isRoot ()

boolean	isVirtual ()

List< AbstractFile >	listFiles () throws TskCoreException

final int	read (byte[] buf, long offset, long len) throws TskCoreException

String	toString (boolean preserveState)

Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean	equals (Object obj)

ArrayList< BlackboardArtifact >	getAllArtifacts () throws TskCoreException

long	getAllArtifactsCount () throws TskCoreException

ArrayList< BlackboardArtifact >	getArtifacts (String artifactTypeName) throws TskCoreException

ArrayList< BlackboardArtifact >	getArtifacts (int artifactTypeID) throws TskCoreException

ArrayList< BlackboardArtifact >	getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException

long	getArtifactsCount (String artifactTypeName) throws TskCoreException

long	getArtifactsCount (int artifactTypeID) throws TskCoreException

long	getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException

int	getChildrenCount () throws TskCoreException

Content	getDataSource () throws TskCoreException

BlackboardArtifact	getGenInfoArtifact () throws TskCoreException

BlackboardArtifact	getGenInfoArtifact (boolean create) throws TskCoreException

ArrayList< BlackboardAttribute >	getGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException

Set< String >	getHashSetNames () throws TskCoreException

long	getId ()

String	getName ()

synchronized Content	getParent () throws TskCoreException

SleuthkitCase	getSleuthkitCase ()

synchronized String	getUniquePath () throws TskCoreException

boolean	hasChildren () throws TskCoreException

int	hashCode ()

BlackboardArtifact	newArtifact (int artifactTypeID) throws TskCoreException

BlackboardArtifact	newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException

String	toString ()

String	toString (boolean preserveState)

Public Member Functions inherited from org.sleuthkit.datamodel.Content
long	getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException

ArrayList< BlackboardAttribute >	getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException

Protected Member Functions
	LocalFile (SleuthkitCase db, long objId, String name, TSK_DB_FILES_TYPE_ENUM fileType, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, String md5Hash, FileKnown knownState, String parentPath, String localPath)

	LocalFile (SleuthkitCase db, long objId, String name, TSK_DB_FILES_TYPE_ENUM fileType, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, String md5Hash, FileKnown knownState, String parentPath, String localPath, long parentId)

	LocalFile (SleuthkitCase db, long objId, String name, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, String md5Hash, FileKnown knownState, String parentPath, String localPath, long parentId)

Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
	AbstractFile (SleuthkitCase db, long objId, TskData.TSK_FS_ATTR_TYPE_ENUM attrType, short attrId, String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, short modes, int uid, int gid, String md5Hash, FileKnown knownState, String parentPath)

void	finalize () throws Throwable

int	readInt (byte[] buf, long offset, long len) throws TskCoreException

final int	readLocal (byte[] buf, long offset, long len) throws TskCoreException

void	setLocalPath (String localPath, boolean isAbsolute)

Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
	AbstractContent (SleuthkitCase db, long obj_id, String name)

Additional Inherited Members
Static Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
static String	createNonUniquePath (String uniquePath)

static String	epochToTime (long epoch)

static long	timeToEpoch (String time)

Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long	UNKNOWN_ID = -1

Protected Attributes inherited from org.sleuthkit.datamodel.AbstractFile
final int	attrId

final TskData.TSK_FS_ATTR_TYPE_ENUM	attrType

final TSK_FS_NAME_FLAG_ENUM	dirFlag

final TSK_FS_NAME_TYPE_ENUM	dirType

final TskData.TSK_DB_FILES_TYPE_ENUM	fileType

TskData.FileKnown	knownState

String	md5Hash

final long	metaAddr

final Set< TSK_FS_META_FLAG_ENUM >	metaFlags

final int	metaSeq

final TSK_FS_META_TYPE_ENUM	metaType

final Set< TskData.TSK_FS_META_MODE_ENUM >	modes

final String	parentPath

long	size

final int	uid

Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long	parentId

Detailed Description

A representation of a local/logical file (e.g., on a user's machine) that has been added to a case.

Definition at line 34 of file LocalFile.java.

Constructor & Destructor Documentation

org.sleuthkit.datamodel.LocalFile.LocalFile	(	SleuthkitCase	db,
		long	objId,
		String	name,
		TSK_DB_FILES_TYPE_ENUM	fileType,
		TSK_FS_NAME_TYPE_ENUM	dirType,
		TSK_FS_META_TYPE_ENUM	metaType,
		TSK_FS_NAME_FLAG_ENUM	dirFlag,
		short	metaFlags,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		String	md5Hash,
		FileKnown	knownState,
		String	parentPath,
		String	localPath
	)

protected

Constructs a representation of a local/logical file (e.g., on a user's machine) that has been added to the case database.

Parameters

db	The case database to which the file has been added.
objId	The object id of the file in the case database.
name	The name of the file.
fileType	The type of the file.
dirType	The type of the file, usually as reported in the name structure of the file system. May be set to TSK_FS_NAME_TYPE_ENUM.UNDEF.
metaType	The type of the file, usually as reported in the metadata structure of the file system. May be set to TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_UNDEF.
dirFlag	The allocated status of the file, usually as reported in the name structure of the file system.
metaFlags	The allocated status of the file, usually as reported in the metadata structure of the file system.
size	The size of the file.
ctime	The changed time of the file.
crtime	The created time of the file.
atime	The accessed time of the file.
mtime	The modified time of the file.
md5Hash	The MD5 hash of the file, null if not yet calculated.
knownState	The known state of the file from a hash database lookup, null if not yet looked up.
parentPath	The path of the parent of the file.
localPath	The absolute path of the file in secondary storage.

Deprecated:: Do not make subclasses outside of this package.

Definition at line 233 of file LocalFile.java.

org.sleuthkit.datamodel.LocalFile.LocalFile	(	SleuthkitCase	db,
		long	objId,
		String	name,
		TSK_DB_FILES_TYPE_ENUM	fileType,
		TSK_FS_NAME_TYPE_ENUM	dirType,
		TSK_FS_META_TYPE_ENUM	metaType,
		TSK_FS_NAME_FLAG_ENUM	dirFlag,
		short	metaFlags,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		String	md5Hash,
		FileKnown	knownState,
		String	parentPath,
		String	localPath,
		long	parentId
	)

protected

Constructs a representation of a local/logical file (e.g., on a user's machine) that has been added to the case database.

Parameters

db	The case database to which the file has been added.
objId	The object id of the file in the case database.
name	The name of the file.
fileType	The type of the file.
dirType	The type of the file, usually as reported in the name structure of the file system. May be set to TSK_FS_NAME_TYPE_ENUM.UNDEF.
metaType	The type of the file, usually as reported in the metadata structure of the file system. May be set to TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_UNDEF.
dirFlag	The allocated status of the file, usually as reported in the name structure of the file system.
metaFlags	The allocated status of the file, usually as reported in the metadata structure of the file system.
size	The size of the file.
ctime	The changed time of the file.
crtime	The created time of the file.
atime	The accessed time of the file.
mtime	The modified time of the file.
md5Hash	The MD5 hash of the file, null if not yet calculated.
knownState	The known state of the file from a hash database lookup, null if not yet looked up.
parentPath	The path of the parent of the file.
localPath	The absolute path of the file in secondary storage.
parentId	The object id of parent of the file.

Deprecated:: Do not make subclasses outside of this package.

Definition at line 292 of file LocalFile.java.

org.sleuthkit.datamodel.LocalFile.LocalFile	(	SleuthkitCase	db,
		long	objId,
		String	name,
		TSK_FS_NAME_TYPE_ENUM	dirType,
		TSK_FS_META_TYPE_ENUM	metaType,
		TSK_FS_NAME_FLAG_ENUM	dirFlag,
		short	metaFlags,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		String	md5Hash,
		FileKnown	knownState,
		String	parentPath,
		String	localPath,
		long	parentId
	)

protected

Constructs a representation of a local/logical file (e.g., on a user's machine) that has been added to the case.

Parameters

db	The case database to which the file has been added.
objId	The object id of the file in the case database.
name	The name of the file.
dirType	The type of the file, usually as reported in the name structure of the file system. May be set to TSK_FS_NAME_TYPE_ENUM.UNDEF.
metaType	The type of the file, usually as reported in the metadata structure of the file system. May be set to TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_UNDEF.
dirFlag	The allocated status of the file, usually as reported in the name structure of the file system.
metaFlags	The allocated status of the file, usually as reported in the metadata structure of the file system.
size	The size of the file.
ctime	The changed time of the file.
crtime	The created time of the file.
atime	The accessed time of the file.
mtime	The modified time of the file.
md5Hash	The MD5 hash of the file, null if not yet calculated.
knownState	The known state of the file from a hash database lookup, null if not yet looked up.
parentPath	The path of the parent of the file.
localPath	The absolute path of the file in secondary storage.
parentId	The object id of parent of the file.

Deprecated:: Do not make subclasses outside of this package.

Definition at line 337 of file LocalFile.java.

Member Function Documentation

List<Content> org.sleuthkit.datamodel.LocalFile.getChildren ( ) throws TskCoreException

Gets the derived or local files, if any, that are children of this local file.

Returns: A list of the children.

Exceptions

TskCoreException if there was an error querying the case database.

Implements org.sleuthkit.datamodel.Content.

Definition at line 136 of file LocalFile.java.

References org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM.DERIVED, org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase(), and org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM.LOCAL.

List<Long> org.sleuthkit.datamodel.LocalFile.getChildrenIds ( ) throws TskCoreException

Gets the object ids of the derived or local files, if any, that are children of this local file.

Returns: A list of the children.

Exceptions

TskCoreException if there was an error querying the case database.

Implements org.sleuthkit.datamodel.Content.

Definition at line 153 of file LocalFile.java.

References org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM.DERIVED, org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase(), and org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM.LOCAL.

List<TskFileRange> org.sleuthkit.datamodel.LocalFile.getRanges ( ) throws TskCoreException

Gets the extents in terms of byte addresses of this local file within its data source, an empty list.

Returns: An empty list of extents (TskFileRange objects)

Exceptions

TskCoreException if there was an error querying the case database.

Definition at line 111 of file LocalFile.java.

boolean org.sleuthkit.datamodel.LocalFile.isRoot ( )

Indicates whether or not this local file is the root of a file system, always returns false.

Returns: False.

Definition at line 122 of file LocalFile.java.

String org.sleuthkit.datamodel.LocalFile.toString ( boolean preserveState )

Provides a string representation of this local file.

Parameters

preserveState True if state should be included in the string representation of this object.

Exceptions

TskCoreException if there was an error querying the case database.

Definition at line 196 of file LocalFile.java.

The documentation for this class was generated from the following file:

/home/carriersleuth/repos/sleuthkit/bindings/java/src/org/sleuthkit/datamodel/LocalFile.java

Public Member Functions

Protected Member Functions

Additional Inherited Members

Detailed Description

Constructor & Destructor Documentation

Member Function Documentation