Sleuth Kit Java Bindings (JNI)  4.4.1
Java bindings for using The Sleuth Kit
AbstractFile.java
Go to the documentation of this file.
1 /*
2  * SleuthKit Java Bindings
3  *
4  * Copyright 2011-2017 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.io.FileNotFoundException;
22 import java.io.IOException;
23 import java.io.RandomAccessFile;
24 import java.text.MessageFormat;
25 import java.util.ArrayList;
26 import java.util.List;
27 import java.util.ResourceBundle;
28 import java.util.Set;
29 import java.util.SortedSet;
30 import java.util.TimeZone;
31 import java.util.logging.Level;
32 import java.util.logging.Logger;
38 
43 public abstract class AbstractFile extends AbstractContent {
44 
46  protected final TSK_FS_NAME_TYPE_ENUM dirType;
48  protected final TSK_FS_NAME_FLAG_ENUM dirFlag;
49  protected final Set<TSK_FS_META_FLAG_ENUM> metaFlags;
50  protected long size;
51  protected final long metaAddr, ctime, crtime, atime, mtime;
52  protected final int metaSeq;
53  protected final int uid, gid;
54  protected final int attrId;
56  protected final Set<TskData.TSK_FS_META_MODE_ENUM> modes;
57  //local file support
58  private boolean localPathSet = false;
59  private String localPath;
60  private String localAbsPath;
61  private volatile RandomAccessFile localFileHandle;
62  private volatile java.io.File localFile;
64  //range support
65  private List<TskFileRange> ranges;
66  /*
67  * path of parent directory
68  */
69  protected final String parentPath;
74  /*
75  * md5 hash
76  */
77  protected String md5Hash;
78  private String mimeType;
79  private static final Logger logger = Logger.getLogger(AbstractFile.class.getName());
80  private static final ResourceBundle bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle");
81  private long dataSourceObjectId;
82  private final String extension;
83 
120  long objId,
121  long dataSourceObjectId,
123  String name,
125  long metaAddr, int metaSeq,
127  TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags,
128  long size,
129  long ctime, long crtime, long atime, long mtime,
130  short modes,
131  int uid, int gid,
132  String md5Hash, FileKnown knownState,
133  String parentPath,
134  String mimeType,
135  String extension) {
136  super(db, objId, name);
137  this.dataSourceObjectId = dataSourceObjectId;
138  this.attrType = attrType;
139  this.attrId = attrId;
140  this.fileType = fileType;
141  this.metaAddr = metaAddr;
142  this.metaSeq = metaSeq;
143  this.dirType = dirType;
144  this.metaType = metaType;
145  this.dirFlag = dirFlag;
146  this.metaFlags = TSK_FS_META_FLAG_ENUM.valuesOf(metaFlags);
147  this.size = size;
148  this.ctime = ctime;
149  this.crtime = crtime;
150  this.atime = atime;
151  this.mtime = mtime;
152  this.uid = uid;
153  this.gid = gid;
154  this.modes = TskData.TSK_FS_META_MODE_ENUM.valuesOf(modes);
155 
156  this.md5Hash = md5Hash;
157  if (knownState == null) {
158  this.knownState = FileKnown.UNKNOWN;
159  } else {
160  this.knownState = knownState;
161  }
162  this.parentPath = parentPath;
163  this.mimeType = mimeType;
164  this.extension = extension == null?"":extension;
166  }
167 
174  return fileType;
175  }
176 
183  return attrType;
184  }
185 
191  public int getAttributeId() {
192  return attrId;
193  }
194 
200  public long getCtime() {
201  return ctime;
202  }
203 
209  public String getCtimeAsDate() {
210  return epochToTime(ctime);
211  }
212 
218  public long getCrtime() {
219  return crtime;
220  }
221 
227  public String getCrtimeAsDate() {
228  return epochToTime(crtime);
229  }
230 
236  public long getAtime() {
237  return atime;
238  }
239 
245  public String getAtimeAsDate() {
246  return epochToTime(atime);
247  }
248 
254  public long getMtime() {
255  return mtime;
256  }
257 
263  public String getMtimeAsDate() {
264  return epochToTime(mtime);
265  }
266 
272  public int getUid() {
273  return uid;
274  }
275 
281  public int getGid() {
282  return gid;
283  }
284 
290  public long getMetaAddr() {
291  return metaAddr;
292  }
293 
300  public long getMetaSeq() {
301  return metaSeq;
302  }
303 
309  public String getModesAsString() {
311  String result = "";
312 
313  short isuid = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_ISUID.getMode();
314  short isgid = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_ISGID.getMode();
315  short isvtx = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_ISVTX.getMode();
316 
317  short irusr = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IRUSR.getMode();
318  short iwusr = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IWUSR.getMode();
319  short ixusr = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IXUSR.getMode();
320 
321  short irgrp = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IRGRP.getMode();
322  short iwgrp = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IWGRP.getMode();
323  short ixgrp = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IXGRP.getMode();
324 
325  short iroth = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IROTH.getMode();
326  short iwoth = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IWOTH.getMode();
327  short ixoth = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IXOTH.getMode();
328 
329  // first character = the Meta Type
330  result += metaType.toString();
331 
332  // second and third characters = user permissions
333  if ((mode & irusr) == irusr) {
334  result += "r"; //NON-NLS
335  } else {
336  result += "-"; //NON-NLS
337  }
338  if ((mode & iwusr) == iwusr) {
339  result += "w"; //NON-NLS
340  } else {
341  result += "-"; //NON-NLS
342  }
343 
344  // fourth character = set uid
345  if ((mode & isuid) == isuid) {
346  if ((mode & ixusr) == ixusr) {
347  result += "s"; //NON-NLS
348  } else {
349  result += "S"; //NON-NLS
350  }
351  } else {
352  if ((mode & ixusr) == ixusr) {
353  result += "x"; //NON-NLS
354  } else {
355  result += "-"; //NON-NLS
356  }
357  }
358 
359  // fifth and sixth characters = group permissions
360  if ((mode & irgrp) == irgrp) {
361  result += "r"; //NON-NLS
362  } else {
363  result += "-"; //NON-NLS
364  }
365  if ((mode & iwgrp) == iwgrp) {
366  result += "w"; //NON-NLS
367  } else {
368  result += "-"; //NON-NLS
369  }
370 
371  // seventh character = set gid
372  if ((mode & isgid) == isgid) {
373  if ((mode & ixgrp) == ixgrp) {
374  result += "s"; //NON-NLS
375  } else {
376  result += "S"; //NON-NLS
377  }
378  } else {
379  if ((mode & ixgrp) == ixgrp) {
380  result += "x"; //NON-NLS
381  } else {
382  result += "-"; //NON-NLS
383  }
384  }
385 
386  // eighth and ninth character = other permissions
387  if ((mode & iroth) == iroth) {
388  result += "r"; //NON-NLS
389  } else {
390  result += "-"; //NON-NLS
391  }
392  if ((mode & iwoth) == iwoth) {
393  result += "w"; //NON-NLS
394  } else {
395  result += "-"; //NON-NLS
396  }
397 
398  // tenth character = sticky bit
399  if ((mode & isvtx) == isvtx) {
400  if ((mode & ixoth) == ixoth) {
401  result += "t"; //NON-NLS
402  } else {
403  result += "T"; //NON-NLS
404  }
405  } else {
406  if ((mode & ixoth) == ixoth) {
407  result += "x"; //NON-NLS
408  } else {
409  result += "-"; //NON-NLS
410  }
411  }
412 
413  // check the result
414  if (result.length() != 10) {
415  // throw error here
416  result = "ERROR"; //NON-NLS
417  }
418  return result;
419  }
420 
426  public String getMIMEType() {
427  return mimeType;
428  }
429 
435  void setMIMEType(String mimeType) {
436  this.mimeType = mimeType;
437  }
438 
439  public boolean isModeSet(TskData.TSK_FS_META_MODE_ENUM mode) {
440  return modes.contains(mode);
441  }
442 
450  void setMd5Hash(String md5Hash) {
451  this.md5Hash = md5Hash;
452  }
453 
459  public String getMd5Hash() {
460  return this.md5Hash;
461  }
462 
470  void setKnown(TskData.FileKnown known) {
471  this.knownState = known;
472  }
473 
481  return knownState;
482  }
483 
491  public String getNameExtension() {
492  return extension;
493  }
494 
500  @Override
501  public long getSize() {
502  return size;
503  }
504 
510  public String getParentPath() {
511  return parentPath;
512  }
513 
522  @Override
524  return getSleuthkitCase().getContentById(this.dataSourceObjectId);
525  }
526 
532  long getDataSourceObjectId() {
533  return dataSourceObjectId;
534  }
535 
546  public List<TskFileRange> getRanges() throws TskCoreException {
547  if (ranges == null) {
548  ranges = getSleuthkitCase().getFileRanges(this.getId());
549  }
550  return ranges;
551  }
552 
566  public long convertToImgOffset(long fileOffset) throws TskCoreException {
567  long imgOffset = -1;
568  for (TskFileRange byteRange : getRanges()) {
569 
570  // if fileOffset is within the current byteRange, calculate the image
571  // offset and break
572  long rangeLength = byteRange.getByteLen();
573  if (fileOffset < rangeLength) {
574  imgOffset = byteRange.getByteStart() + fileOffset;
575  break;
576  }
577 
578  // otherwise, decrement fileOffset by the length of the current
579  // byte range and continue
580  fileOffset -= rangeLength;
581  }
582  return imgOffset;
583  }
584 
591  public boolean isVirtual() {
593  || dirType.equals(TskData.TSK_FS_NAME_TYPE_ENUM.VIRT)
595  }
596 
604  public boolean isFile() {
605  return metaType.equals(TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG)
606  || (metaType.equals(TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_UNDEF)
607  && dirType.equals(TSK_FS_NAME_TYPE_ENUM.REG));
608 
609  }
610 
617  public boolean isDir() {
618  return (metaType.equals(TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR)
620  }
621 
627  public abstract boolean isRoot();
628 
637  public static String createNonUniquePath(String uniquePath) {
638 
639  // split the path into parts
640  String[] pathSegments = uniquePath.split("/");
641 
642  // see if uniquePath had an image and/or volume name
643  int index = 0;
644  if (pathSegments[0].startsWith("img_")) { //NON-NLS
645  ++index;
646  }
647  if (pathSegments[1].startsWith("vol_")) { //NON-NLS
648  ++index;
649  }
650 
651  // Assemble the non-unique path (skipping over the image and volume
652  // name, if they exist).
653  StringBuilder strbuf = new StringBuilder();
654  for (; index < pathSegments.length; ++index) {
655  if (!pathSegments[index].isEmpty()) {
656  strbuf.append("/").append(pathSegments[index]);
657  }
658  }
659 
660  return strbuf.toString();
661  }
662 
669  public List<AbstractFile> listFiles() throws TskCoreException {
670  // first, get all children
671  List<Content> children = getChildren();
672 
673  // only keep those that are of type AbstractFile
674  List<AbstractFile> files = new ArrayList<AbstractFile>();
675  for (Content child : children) {
676  if (child instanceof AbstractFile) {
677  AbstractFile afChild = (AbstractFile) child;
678  files.add(afChild);
679  }
680  }
681  return files;
682  }
683 
690  return metaType;
691  }
692 
693  public String getMetaTypeAsString() {
694  return metaType.toString();
695  }
696 
703  return dirType;
704  }
705 
706  public String getDirTypeAsString() {
707  return dirType.toString();
708  }
709 
716  return dirFlag == flag;
717  }
718 
723  public String getDirFlagAsString() {
724  return dirFlag.toString();
725  }
726 
730  public String getMetaFlagsAsString() {
731  String str = "";
732  if (metaFlags.contains(TSK_FS_META_FLAG_ENUM.ALLOC)) {
733  str = TSK_FS_META_FLAG_ENUM.ALLOC.toString();
734  } else if (metaFlags.contains(TSK_FS_META_FLAG_ENUM.UNALLOC)) {
735  str = TSK_FS_META_FLAG_ENUM.UNALLOC.toString();
736  }
737  return str;
738  }
739 
745  public boolean isMetaFlagSet(TSK_FS_META_FLAG_ENUM metaFlag) {
746  return metaFlags.contains(metaFlag);
747  }
748 
749  @Override
750  public final int read(byte[] buf, long offset, long len) throws TskCoreException {
751  //template method
752  //if localPath is set, use local, otherwise, use readCustom() supplied by derived class
753  if (localPathSet) {
754  return readLocal(buf, offset, len);
755  } else {
756  return readInt(buf, offset, len);
757  }
758 
759  }
760 
772  protected int readInt(byte[] buf, long offset, long len) throws TskCoreException {
773  return 0;
774  }
775 
787  protected final int readLocal(byte[] buf, long offset, long len) throws TskCoreException {
788  if (!localPathSet) {
789  throw new TskCoreException(
790  bundle.getString("AbstractFile.readLocal.exception.msg1.text"));
791  }
792 
793  if (isDir()) {
794  return 0;
795  }
796 
797  loadLocalFile();
798  if (!localFile.exists()) {
799  throw new TskCoreException(
800  MessageFormat.format(bundle.getString("AbstractFile.readLocal.exception.msg2.text"), localAbsPath));
801  }
802  if (!localFile.canRead()) {
803  throw new TskCoreException(
804  MessageFormat.format(bundle.getString("AbstractFile.readLocal.exception.msg3.text"), localAbsPath));
805  }
806 
807  int bytesRead = 0;
808 
809  if (localFileHandle == null) {
810  synchronized (this) {
811  if (localFileHandle == null) {
812  try {
813  localFileHandle = new RandomAccessFile(localFile, "r");
814  } catch (FileNotFoundException ex) {
815  final String msg = MessageFormat.format(bundle.getString(
816  "AbstractFile.readLocal.exception.msg4.text"),
817  localAbsPath);
818  logger.log(Level.SEVERE, msg, ex);
819  //file could have been deleted or moved
820  throw new TskCoreException(msg, ex);
821  }
822  }
823  }
824  }
825 
826  try {
827  if (!encodingType.equals(TskData.EncodingType.NONE)) {
828  // The file is encoded, so we need to alter the offset to read (since there's
829  // a header on the encoded file) and then decode each byte
830  long encodedOffset = offset + EncodedFileUtil.getHeaderLength();
831 
832  //move to the user request offset in the stream
833  long curOffset = localFileHandle.getFilePointer();
834  if (curOffset != encodedOffset) {
835  localFileHandle.seek(encodedOffset);
836  }
837  bytesRead = localFileHandle.read(buf, 0, (int) len);
838  for (int i = 0; i < bytesRead; i++) {
839  buf[i] = EncodedFileUtil.decodeByte(buf[i], encodingType);
840  }
841  return bytesRead;
842  } else {
843  //move to the user request offset in the stream
844  long curOffset = localFileHandle.getFilePointer();
845  if (curOffset != offset) {
846  localFileHandle.seek(offset);
847  }
848  //note, we are always writing at 0 offset of user buffer
849  return localFileHandle.read(buf, 0, (int) len);
850  }
851  } catch (IOException ex) {
852  final String msg = MessageFormat.format(bundle.getString("AbstractFile.readLocal.exception.msg5.text"), localAbsPath);
853  logger.log(Level.SEVERE, msg, ex);
854  //local file could have been deleted / moved
855  throw new TskCoreException(msg, ex);
856  }
857  }
858 
868  void setLocalFilePath(String localPath, boolean isAbsolute) {
869 
870  if (localPath == null || localPath.equals("")) {
871  this.localPath = "";
872  localAbsPath = null;
873  localPathSet = false;
874  } else {
875  this.localPath = localPath;
876  if (isAbsolute) {
877  this.localAbsPath = localPath;
878  } else {
879  this.localAbsPath = getSleuthkitCase().getDbDirPath() + java.io.File.separator + this.localPath;
880  }
881  this.localPathSet = true;
882  }
883  }
884 
890  public String getLocalPath() {
891  return localPath;
892  }
893 
899  public String getLocalAbsPath() {
900  return localAbsPath;
901  }
902 
908  final void setEncodingType(TskData.EncodingType encodingType) {
909  this.encodingType = encodingType;
910  }
911 
918  public boolean exists() {
919  if (!localPathSet) {
920  return true;
921  } else {
922  try {
923  loadLocalFile();
924  return localFile.exists();
925  } catch (TskCoreException ex) {
926  logger.log(Level.SEVERE, ex.getMessage());
927  return false;
928  }
929  }
930  }
931 
939  public boolean canRead() {
940  if (!localPathSet) {
941  return true;
942  } else {
943  try {
944  loadLocalFile();
945  return localFile.canRead();
946  } catch (TskCoreException ex) {
947  logger.log(Level.SEVERE, ex.getMessage());
948  return false;
949  }
950  }
951  }
952 
959  private void loadLocalFile() throws TskCoreException {
960  if (!localPathSet) {
961  throw new TskCoreException(
962  bundle.getString("AbstractFile.readLocal.exception.msg1.text"));
963  }
964 
965  // already been set
966  if (localFile != null) {
967  return;
968  }
969 
970  synchronized (this) {
971  if (localFile == null) {
972  localFile = new java.io.File(localAbsPath);
973  }
974  }
975  }
976 
977  @Override
978  public void close() {
979 
980  //close local file handle if set
981  if (localFileHandle != null) {
982  synchronized (this) {
983  if (localFileHandle != null) {
984  try {
985  localFileHandle.close();
986  } catch (IOException ex) {
987  logger.log(Level.SEVERE, "Could not close file handle for file: " + getParentPath() + "/" + getName(), ex); //NON-NLS
988  }
989  localFileHandle = null;
990  }
991  }
992  }
993 
994  }
995 
996  @Override
997  protected void finalize() throws Throwable {
998  try {
999  close();
1000  } finally {
1001  super.finalize();
1002  }
1003  }
1004 
1005  @Override
1006  public String toString(boolean preserveState) {
1007  return super.toString(preserveState) + "AbstractFile [\t" //NON-NLS
1008  + "\t" + "fileType " + fileType //NON-NLS
1009  + "\tctime " + ctime //NON-NLS
1010  + "\tcrtime " + crtime //NON-NLS
1011  + "\t" + "mtime " + mtime + "\t" + "atime " + atime //NON-NLS
1012  + "\t" + "attrId " + attrId //NON-NLS
1013  + "\t" + "attrType " + attrType //NON-NLS
1014  + "\t" + "dirFlag " + dirFlag + "\t" + "dirType " + dirType //NON-NLS
1015  + "\t" + "uid " + uid //NON-NLS
1016  + "\t" + "gid " + gid //NON-NLS
1017  + "\t" + "metaAddr " + metaAddr + "\t" + "metaSeq " + metaSeq + "\t" + "metaFlags " + metaFlags //NON-NLS
1018  + "\t" + "metaType " + metaType + "\t" + "modes " + modes //NON-NLS
1019  + "\t" + "parentPath " + parentPath + "\t" + "size " + size //NON-NLS
1020  + "\t" + "knownState " + knownState + "\t" + "md5Hash " + md5Hash //NON-NLS
1021  + "\t" + "localPathSet " + localPathSet + "\t" + "localPath " + localPath //NON-NLS
1022  + "\t" + "localAbsPath " + localAbsPath + "\t" + "localFile " + localFile //NON-NLS
1023  + "]\t";
1024  }
1025 
1026 
1027 
1028 
1032  public enum MimeMatchEnum {
1033 
1036  FALSE
1037  }
1038 
1047  public MimeMatchEnum isMimeType(SortedSet<String> mimeTypes) {
1048  if (this.mimeType == null) {
1049  return MimeMatchEnum.UNDEFINED;
1050  }
1051  if (mimeTypes.contains(this.mimeType)) {
1052  return MimeMatchEnum.TRUE;
1053  }
1054  return MimeMatchEnum.FALSE;
1055  }
1056 
1088  @Deprecated
1089  @SuppressWarnings("deprecation")
1091  String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq,
1092  TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags,
1093  long size, long ctime, long crtime, long atime, long mtime, short modes, int uid, int gid, String md5Hash, FileKnown knownState,
1094  String parentPath) {
1095  this(db, objId, db.getDataSourceObjectId(objId), attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
1096  }
1097 
1134  @Deprecated
1135  @SuppressWarnings("deprecation")
1136  AbstractFile(SleuthkitCase db, long objId, long dataSourceObjectId, TskData.TSK_FS_ATTR_TYPE_ENUM attrType, short attrId,
1137  String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType,
1138  TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, short modes,
1139  int uid, int gid, String md5Hash, FileKnown knownState, String parentPath, String mimeType) {
1140  this(db, objId, dataSourceObjectId, attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
1141  }
1142 
1151  @Deprecated
1152  @SuppressWarnings("deprecation")
1153  public short getAttrId() {
1154  /*
1155  * NOTE: previously attrId used to be stored in AbstractFile as (signed)
1156  * short even though it is stored as uint16 in TSK. In extremely rare
1157  * occurrences attrId can be larger than what a signed short can hold
1158  * (2^15). Changes were made to AbstractFile to store attrId as integer.
1159  * Therefore this method has been deprecated. For backwards
1160  * compatibility, attribute ids that are larger than 32K are converted
1161  * to a negative number.
1162  */
1163  return (short) attrId; // casting to signed short converts values over 32K to negative values
1164  }
1165 
1177  @Deprecated
1178  protected void setLocalPath(String localPath, boolean isAbsolute) {
1179  setLocalFilePath(localPath, isAbsolute);
1180  }
1181 
1182  /*
1183  * -------------------------------------------------------------------------
1184  * Util methods to convert / map the data
1185  * -------------------------------------------------------------------------
1186  */
1187 
1197  @Deprecated
1198  public static String epochToTime(long epoch) {
1199  return TimeUtilities.epochToTime(epoch);
1200  }
1201 
1213  @Deprecated
1214  public static String epochToTime(long epoch, TimeZone tzone) {
1215  return TimeUtilities.epochToTime(epoch, tzone);
1216  }
1217 
1225  @Deprecated
1226  public static long timeToEpoch(String time) {
1227  return TimeUtilities.timeToEpoch(time);
1228  }
1229 }
VIRT
Special (TSK added "Virtual" files) NON-NLS.
Definition: TskData.java:50
boolean isModeSet(TskData.TSK_FS_META_MODE_ENUM mode)
final TSK_FS_NAME_TYPE_ENUM dirType
static long timeToEpoch(String time)
static String epochToTime(long epoch)
static String epochToTime(long epoch)
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
Definition: TskData.java:247
final int readLocal(byte[] buf, long offset, long len)
boolean isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM flag)
ALLOC
Metadata structure is currently in an allocated state.
Definition: TskData.java:206
final TSK_FS_NAME_FLAG_ENUM dirFlag
final TskData.TSK_DB_FILES_TYPE_ENUM fileType
UNALLOC
Metadata structure is currently in an unallocated state.
Definition: TskData.java:207
TskData.TSK_DB_FILES_TYPE_ENUM getType()
boolean localPathSet
if set by setLocalPath(), reads are done on local file
final TskData.TSK_FS_ATTR_TYPE_ENUM attrType
TSK_FS_META_TYPE_VIRT_DIR
"Virtual Directory" created by TSK for Orphan Files NON-NLS
Definition: TskData.java:114
long convertToImgOffset(long fileOffset)
TSK_FS_NAME_TYPE_ENUM getDirType()
MimeMatchEnum isMimeType(SortedSet< String > mimeTypes)
final Set< TSK_FS_META_FLAG_ENUM > metaFlags
String toString(boolean preserveState)
static final ResourceBundle bundle
FALSE
file has a defined mime type and it is one of the given ones
final Set< TskData.TSK_FS_META_MODE_ENUM > modes
TSK_FS_META_TYPE_VIRT
"Virtual File" created by TSK for file system areas NON-NLS
Definition: TskData.java:113
TSK_FS_META_TYPE_ENUM getMetaType()
String localPath
local path as stored in db tsk_files_path, is relative to the db,
boolean isMetaFlagSet(TSK_FS_META_FLAG_ENUM metaFlag)
TRUE
file does not have a defined mime time in blackboard
static short toInt(Set< TSK_FS_META_MODE_ENUM > modes)
Definition: TskData.java:422
static String epochToTime(long epoch, TimeZone tzone)
static long timeToEpoch(String time)
int readInt(byte[] buf, long offset, long len)
volatile RandomAccessFile localFileHandle
UNKNOWN
File marked as unknown by hash db.
Definition: TskData.java:726
static Set< TSK_FS_META_MODE_ENUM > valuesOf(short modes)
Definition: TskData.java:403
void setLocalPath(String localPath, boolean isAbsolute)
static String createNonUniquePath(String uniquePath)
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
Definition: TskData.java:676
final int read(byte[] buf, long offset, long len)
final TSK_FS_META_TYPE_ENUM metaType
List< TskFileRange > getFileRanges(long id)
String localAbsPath
absolute path representation of the local path
TskData.TSK_FS_ATTR_TYPE_ENUM getAttrType()

Copyright © 2011-2015 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.