19 package org.sleuthkit.datamodel;
21 import java.io.FileNotFoundException;
22 import java.io.IOException;
23 import java.io.RandomAccessFile;
24 import java.text.MessageFormat;
25 import java.util.ArrayList;
26 import java.util.List;
27 import java.util.ResourceBundle;
29 import java.util.SortedSet;
30 import java.util.TimeZone;
31 import java.util.logging.Level;
32 import java.util.logging.Logger;
49 protected final Set<TSK_FS_META_FLAG_ENUM>
metaFlags;
51 protected final long metaAddr, ctime, crtime, atime, mtime;
53 protected final int uid, gid;
80 private static final ResourceBundle
bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
121 long dataSourceObjectId,
125 long metaAddr,
int metaSeq,
129 long ctime,
long crtime,
long atime,
long mtime,
136 super(db, objId, name);
149 this.crtime = crtime;
157 if (knownState == null) {
164 this.extension = extension == null?
"":
extension;
333 if ((mode & irusr) == irusr) {
338 if ((mode & iwusr) == iwusr) {
345 if ((mode & isuid) == isuid) {
346 if ((mode & ixusr) == ixusr) {
352 if ((mode & ixusr) == ixusr) {
360 if ((mode & irgrp) == irgrp) {
365 if ((mode & iwgrp) == iwgrp) {
372 if ((mode & isgid) == isgid) {
373 if ((mode & ixgrp) == ixgrp) {
379 if ((mode & ixgrp) == ixgrp) {
387 if ((mode & iroth) == iroth) {
392 if ((mode & iwoth) == iwoth) {
399 if ((mode & isvtx) == isvtx) {
400 if ((mode & ixoth) == ixoth) {
406 if ((mode & ixoth) == ixoth) {
414 if (result.length() != 10) {
435 void setMIMEType(String mimeType) {
440 return modes.contains(mode);
450 void setMd5Hash(String md5Hash) {
532 long getDataSourceObjectId() {
547 if (ranges == null) {
572 long rangeLength = byteRange.getByteLen();
573 if (fileOffset < rangeLength) {
574 imgOffset = byteRange.getByteStart() + fileOffset;
580 fileOffset -= rangeLength;
627 public abstract boolean isRoot();
640 String[] pathSegments = uniquePath.split(
"/");
644 if (pathSegments[0].startsWith(
"img_")) {
647 if (pathSegments[1].startsWith(
"vol_")) {
653 StringBuilder strbuf =
new StringBuilder();
654 for (; index < pathSegments.length; ++index) {
655 if (!pathSegments[index].isEmpty()) {
656 strbuf.append(
"/").append(pathSegments[index]);
660 return strbuf.toString();
674 List<AbstractFile> files =
new ArrayList<AbstractFile>();
675 for (
Content child : children) {
677 AbstractFile afChild = (AbstractFile) child;
707 return dirType.toString();
716 return dirFlag == flag;
746 return metaFlags.contains(metaFlag);
756 return readInt(buf, offset, len);
790 bundle.getString(
"AbstractFile.readLocal.exception.msg1.text"));
800 MessageFormat.format(bundle.getString(
"AbstractFile.readLocal.exception.msg2.text"),
localAbsPath));
804 MessageFormat.format(bundle.getString(
"AbstractFile.readLocal.exception.msg3.text"),
localAbsPath));
809 if (localFileHandle == null) {
810 synchronized (
this) {
811 if (localFileHandle == null) {
813 localFileHandle =
new RandomAccessFile(
localFile,
"r");
814 }
catch (FileNotFoundException ex) {
815 final String msg = MessageFormat.format(bundle.getString(
816 "AbstractFile.readLocal.exception.msg4.text"),
818 logger.log(Level.SEVERE, msg, ex);
830 long encodedOffset = offset + EncodedFileUtil.getHeaderLength();
833 long curOffset = localFileHandle.getFilePointer();
834 if (curOffset != encodedOffset) {
835 localFileHandle.seek(encodedOffset);
837 bytesRead = localFileHandle.read(buf, 0, (
int) len);
838 for (
int i = 0; i < bytesRead; i++) {
839 buf[i] = EncodedFileUtil.decodeByte(buf[i],
encodingType);
844 long curOffset = localFileHandle.getFilePointer();
845 if (curOffset != offset) {
846 localFileHandle.seek(offset);
849 return localFileHandle.read(buf, 0, (
int) len);
851 }
catch (IOException ex) {
852 final String msg = MessageFormat.format(bundle.getString(
"AbstractFile.readLocal.exception.msg5.text"),
localAbsPath);
853 logger.log(Level.SEVERE, msg, ex);
868 void setLocalFilePath(String localPath,
boolean isAbsolute) {
870 if (localPath == null || localPath.equals(
"")) {
873 localPathSet =
false;
881 this.localPathSet =
true;
926 logger.log(Level.SEVERE, ex.getMessage());
947 logger.log(Level.SEVERE, ex.getMessage());
961 throw new TskCoreException(
962 bundle.getString(
"AbstractFile.readLocal.exception.msg1.text"));
970 synchronized (
this) {
972 localFile =
new java.io.File(localAbsPath);
981 if (localFileHandle != null) {
982 synchronized (
this) {
983 if (localFileHandle != null) {
985 localFileHandle.close();
986 }
catch (IOException ex) {
987 logger.log(Level.SEVERE,
"Could not close file handle for file: " +
getParentPath() +
"/" +
getName(), ex);
989 localFileHandle = null;
1007 return super.toString(preserveState) +
"AbstractFile [\t"
1009 +
"\tctime " + ctime
1010 +
"\tcrtime " + crtime
1011 +
"\t" +
"mtime " + mtime +
"\t" +
"atime " + atime
1012 +
"\t" +
"attrId " + attrId
1014 +
"\t" +
"dirFlag " + dirFlag +
"\t" +
"dirType " + dirType
1015 +
"\t" +
"uid " + uid
1016 +
"\t" +
"gid " + gid
1017 +
"\t" +
"metaAddr " + metaAddr +
"\t" +
"metaSeq " + metaSeq +
"\t" +
"metaFlags " + metaFlags
1018 +
"\t" +
"metaType " + metaType +
"\t" +
"modes " +
modes
1019 +
"\t" +
"parentPath " + parentPath +
"\t" +
"size " + size
1020 +
"\t" +
"knownState " +
knownState +
"\t" +
"md5Hash " + md5Hash
1021 +
"\t" +
"localPathSet " + localPathSet +
"\t" +
"localPath " + localPath
1022 +
"\t" +
"localAbsPath " + localAbsPath +
"\t" +
"localFile " +
localFile
1048 if (this.mimeType == null) {
1051 if (mimeTypes.contains(
this.mimeType)) {
1089 @SuppressWarnings(
"deprecation")
1093 long size,
long ctime,
long crtime,
long atime,
long mtime,
short modes,
int uid,
int gid, String md5Hash,
FileKnown knownState,
1094 String parentPath) {
1095 this(
db,
objId, db.getDataSourceObjectId(objId),
attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
1135 @SuppressWarnings(
"deprecation")
1139 int uid,
int gid, String md5Hash,
FileKnown knownState, String parentPath, String mimeType) {
1140 this(
db,
objId,
dataSourceObjectId,
attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
1152 @SuppressWarnings(
"deprecation")
1179 setLocalFilePath(localPath, isAbsolute);
VIRT
Special (TSK added "Virtual" files) NON-NLS.
boolean isModeSet(TskData.TSK_FS_META_MODE_ENUM mode)
final TSK_FS_NAME_TYPE_ENUM dirType
static long timeToEpoch(String time)
static String epochToTime(long epoch)
static String epochToTime(long epoch)
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
String getMetaFlagsAsString()
final int readLocal(byte[] buf, long offset, long len)
boolean isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM flag)
List< Content > getChildren()
ALLOC
Metadata structure is currently in an allocated state.
final TSK_FS_NAME_FLAG_ENUM dirFlag
TskData.EncodingType encodingType
TSK_FS_META_TYPE_DIR
Directory file NON-NLS.
TSK_FS_META_MODE_ISVTX
sticky bit
final TskData.TSK_DB_FILES_TYPE_ENUM fileType
UNALLOC
Metadata structure is currently in an unallocated state.
static final Logger logger
TskData.TSK_DB_FILES_TYPE_ENUM getType()
boolean localPathSet
if set by setLocalPath(), reads are done on local file
final TskData.TSK_FS_ATTR_TYPE_ENUM attrType
TSK_FS_META_MODE_IXOTH
X for other.
TSK_FS_META_TYPE_VIRT_DIR
"Virtual Directory" created by TSK for Orphan Files NON-NLS
long convertToImgOffset(long fileOffset)
TSK_FS_META_MODE_ISUID
set user id on execution
TSK_FS_NAME_TYPE_ENUM getDirType()
Content getContentById(long id)
String getDirFlagAsString()
TSK_FS_META_MODE_IXGRP
X for group.
String getNameExtension()
TSK_FS_META_MODE_IWOTH
W for other.
TSK_FS_META_MODE_IRGRP
R for group.
TSK_FS_META_MODE_IWUSR
W for owner.
MimeMatchEnum isMimeType(SortedSet< String > mimeTypes)
String getDirTypeAsString()
final Set< TSK_FS_META_FLAG_ENUM > metaFlags
TSK_FS_META_MODE_IROTH
R for other.
String toString(boolean preserveState)
static final ResourceBundle bundle
TskData.FileKnown getKnown()
FALSE
file has a defined mime type and it is one of the given ones
final Set< TskData.TSK_FS_META_MODE_ENUM > modes
List< AbstractFile > listFiles()
TskData.FileKnown knownState
TSK_FS_META_TYPE_VIRT
"Virtual File" created by TSK for file system areas NON-NLS
TSK_FS_META_TYPE_ENUM getMetaType()
TSK_FS_META_MODE_IRUSR
R for owner.
SleuthkitCase getSleuthkitCase()
String localPath
local path as stored in db tsk_files_path, is relative to the db,
boolean isMetaFlagSet(TSK_FS_META_FLAG_ENUM metaFlag)
TRUE
file does not have a defined mime time in blackboard
static short toInt(Set< TSK_FS_META_MODE_ENUM > modes)
static String epochToTime(long epoch, TimeZone tzone)
static long timeToEpoch(String time)
String getModesAsString()
int readInt(byte[] buf, long offset, long len)
volatile RandomAccessFile localFileHandle
volatile java.io.File localFile
UNKNOWN
File marked as unknown by hash db.
static Set< TSK_FS_META_MODE_ENUM > valuesOf(short modes)
List< TskFileRange > ranges
void setLocalPath(String localPath, boolean isAbsolute)
static String createNonUniquePath(String uniquePath)
TSK_FS_META_MODE_IWGRP
W for group.
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
List< TskFileRange > getRanges()
final int read(byte[] buf, long offset, long len)
String getMetaTypeAsString()
final TSK_FS_META_TYPE_ENUM metaType
TSK_FS_META_TYPE_REG
Regular file NON-NLS.
TSK_FS_META_MODE_ISGID
set group id on execution
List< TskFileRange > getFileRanges(long id)
String localAbsPath
absolute path representation of the local path
TSK_FS_META_MODE_IXUSR
X for owner.
TskData.TSK_FS_ATTR_TYPE_ENUM getAttrType()
abstract boolean isRoot()