Sleuth Kit Java Bindings (JNI)  4.4.1
Java bindings for using The Sleuth Kit
org.sleuthkit.datamodel.Image Class Reference

Inherits org.sleuthkit.datamodel.AbstractContent.

Public Member Functions

void close ()
 
void finalize () throws Throwable
 
List< ContentgetChildren () throws TskCoreException
 
List< Long > getChildrenIds () throws TskCoreException
 
Content getDataSource ()
 
List< FileSystemgetFileSystems () throws TskCoreException
 
synchronized long getImageHandle () throws TskCoreException
 
String getMd5 ()
 
String[] getPaths ()
 
long getSize ()
 
long getSsize ()
 
String getTimeZone ()
 
TskData.TSK_IMG_TYPE_ENUM getType ()
 
String getUniquePath () throws TskCoreException
 
List< VolumegetVolumes () throws TskCoreException
 
List< VolumeSystemgetVolumeSystems () throws TskCoreException
 
Boolean imageFileExists ()
 
int read (byte[] buf, long offset, long len) throws TskCoreException
 
String toString (boolean preserveState)
 
String verifyImageSize ()
 
- Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean equals (Object obj)
 
ArrayList< BlackboardArtifactgetAllArtifacts () throws TskCoreException
 
long getAllArtifactsCount () throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (String artifactTypeName) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (int artifactTypeID) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
long getArtifactsCount (String artifactTypeName) throws TskCoreException
 
long getArtifactsCount (int artifactTypeID) throws TskCoreException
 
long getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException
 
List< ContentgetChildren () throws TskCoreException
 
int getChildrenCount () throws TskCoreException
 
List< Long > getChildrenIds () throws TskCoreException
 
Content getDataSource () throws TskCoreException
 
BlackboardArtifact getGenInfoArtifact () throws TskCoreException
 
BlackboardArtifact getGenInfoArtifact (boolean create) throws TskCoreException
 
ArrayList< BlackboardAttributegetGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException
 
Set< String > getHashSetNames () throws TskCoreException
 
long getId ()
 
String getName ()
 
synchronized Content getParent () throws TskCoreException
 
SleuthkitCase getSleuthkitCase ()
 
synchronized String getUniquePath () throws TskCoreException
 
boolean hasChildren () throws TskCoreException
 
int hashCode ()
 
BlackboardArtifact newArtifact (int artifactTypeID) throws TskCoreException
 
BlackboardArtifact newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
String toString ()
 
String toString (boolean preserveState)
 
- Public Member Functions inherited from org.sleuthkit.datamodel.Content
long getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
ArrayList< BlackboardAttributegetGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException
 

Protected Member Functions

 Image (SleuthkitCase db, long obj_id, long type, long ssize, String name, String[] paths, String timezone, String md5) throws TskCoreException
 
- Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
 AbstractContent (SleuthkitCase db, long obj_id, String name)
 

Private Attributes

volatile long imageHandle = 0
 
String[] paths
 
String timezone
 
long type
 

Static Private Attributes

static ResourceBundle bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle")
 

Additional Inherited Members

- Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long UNKNOWN_ID = -1
 
- Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long parentId
 

Detailed Description

Represents a disk image file, stored in tsk_image_info. Populated based on data in database.

Caches internal tsk image handle and reuses it for reads

Definition at line 36 of file Image.java.

Constructor & Destructor Documentation

org.sleuthkit.datamodel.Image.Image ( SleuthkitCase  db,
long  obj_id,
long  type,
long  ssize,
String  name,
String[]  paths,
String  timezone,
String  md5 
) throws TskCoreException
protected

constructor most inputs are from the database

Parameters
dbdatabase object
obj_id
type
ssizeSector Size
nameDisplay Name
paths
timezone
md5
Deprecated:
Use the constructor that takes a size.

Definition at line 60 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.db, org.sleuthkit.datamodel.AbstractContent.name, org.sleuthkit.datamodel.Image.paths, org.sleuthkit.datamodel.Image.timezone, and org.sleuthkit.datamodel.Image.type.

Member Function Documentation

void org.sleuthkit.datamodel.Image.close ( )

Free native resources after read is done on the Content object. After closing, read can be called again on the same Content object, which should result in re-opening of new native resources.

Implements org.sleuthkit.datamodel.Content.

Definition at line 112 of file Image.java.

void org.sleuthkit.datamodel.Image.finalize ( ) throws Throwable

Definition at line 117 of file Image.java.

References org.sleuthkit.datamodel.SleuthkitJNI.closeImg().

List<Content> org.sleuthkit.datamodel.Image.getChildren ( ) throws TskCoreException

Gets the child content objects of this content.

Returns
List of children
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 251 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.getVolumes(), and org.sleuthkit.datamodel.Image.getVolumeSystems().

List<Long> org.sleuthkit.datamodel.Image.getChildrenIds ( ) throws TskCoreException

Gets the child content ids of this content.

Returns
List of children ids
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 256 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Content org.sleuthkit.datamodel.Image.getDataSource ( )

Gets the root data source (image, virtual directory, etc.) of this content.

Returns
Content associated with data source or null if one can't be found
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 107 of file Image.java.

List<FileSystem> org.sleuthkit.datamodel.Image.getFileSystems ( ) throws TskCoreException
Returns
a list of FileSystems in this Image. This includes FileSystems that are both children of this Image as well as children of Volumes in this image.
Exceptions
TskCoreException

Definition at line 225 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.verifyImageSize().

synchronized long org.sleuthkit.datamodel.Image.getImageHandle ( ) throws TskCoreException
String org.sleuthkit.datamodel.Image.getMd5 ( )

gets the md5 hash value

Returns
md5 hash if attained(from database). returns null if not set.

Definition at line 337 of file Image.java.

String [] org.sleuthkit.datamodel.Image.getPaths ( )

Get the image path

Returns
image path

Definition at line 178 of file Image.java.

References org.sleuthkit.datamodel.Image.paths.

long org.sleuthkit.datamodel.Image.getSize ( )

Get the (reported) size of the content object and, in theory, how much you should be able to read from it. In some cases, data corruption may mean that you cannot read this much data.

Returns
size of the content in bytes

Implements org.sleuthkit.datamodel.Content.

Definition at line 135 of file Image.java.

References org.sleuthkit.datamodel.SleuthkitJNI.findDeviceSize(), and org.sleuthkit.datamodel.AbstractContent.getName().

long org.sleuthkit.datamodel.Image.getSsize ( )

Get the sector size

Returns
sector size

Definition at line 164 of file Image.java.

String org.sleuthkit.datamodel.Image.getTimeZone ( )

Get the timezone set for the image

Returns
timezone string representation

Definition at line 236 of file Image.java.

References org.sleuthkit.datamodel.Image.timezone.

Referenced by org.sleuthkit.datamodel.BlackboardAttribute.getDisplayString().

TskData.TSK_IMG_TYPE_ENUM org.sleuthkit.datamodel.Image.getType ( )

Get the image type

Returns
image type

Definition at line 155 of file Image.java.

References org.sleuthkit.datamodel.TskData.TSK_IMG_TYPE_ENUM.valueOf().

String org.sleuthkit.datamodel.Image.getUniquePath ( ) throws TskCoreException
Returns
returns the full path to this Content object starting with a "/" followed by the Image name and similarly for all other segments in the hierarchy.

Implements org.sleuthkit.datamodel.Content.

Definition at line 169 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getName().

List<Volume> org.sleuthkit.datamodel.Image.getVolumes ( ) throws TskCoreException
Returns
a list of Volume associated with this Image.
Exceptions
TskCoreException

Definition at line 205 of file Image.java.

References org.sleuthkit.datamodel.Image.getChildren().

List<VolumeSystem> org.sleuthkit.datamodel.Image.getVolumeSystems ( ) throws TskCoreException
Returns
a list of VolumeSystem associated with this Image.
Exceptions
TskCoreException

Definition at line 187 of file Image.java.

References org.sleuthkit.datamodel.Image.getChildren().

Referenced by org.sleuthkit.datamodel.Image.verifyImageSize().

Boolean org.sleuthkit.datamodel.Image.imageFileExists ( )

Test if the file that created this image exists on disk. Does not work on local disks - will always return false

Returns
True if the file still exists

Definition at line 271 of file Image.java.

References org.sleuthkit.datamodel.AbstractFile.exists().

int org.sleuthkit.datamodel.Image.read ( byte[]  buf,
long  offset,
long  len 
) throws TskCoreException

Reads data that this content object is associated with (file contents, volume contents, etc.).

Parameters
bufa character array of data (in bytes) to copy read data to
offsetbyte offset in the content to start reading from
lennumber of bytes to read into buf.
Returns
num of bytes read, or -1 on error
Exceptions
TskCoreExceptionif critical error occurred during read in the tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 129 of file Image.java.

References org.sleuthkit.datamodel.Image.getImageHandle(), and org.sleuthkit.datamodel.SleuthkitJNI.readImg().

Referenced by org.sleuthkit.datamodel.Image.verifyImageSize().

String org.sleuthkit.datamodel.Image.toString ( boolean  preserveState)

Definition at line 261 of file Image.java.

String org.sleuthkit.datamodel.Image.verifyImageSize ( )

Perform some sanity checks on the bounds of the image contents to determine if we could be missing some pieces of the image.

Returns
String of error messages to display to user or empty string if there are no errors

Definition at line 287 of file Image.java.

References org.sleuthkit.datamodel.Image.getFileSystems(), org.sleuthkit.datamodel.Image.getVolumeSystems(), and org.sleuthkit.datamodel.Image.read().

Member Data Documentation

ResourceBundle org.sleuthkit.datamodel.Image.bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle")
staticprivate

Definition at line 43 of file Image.java.

volatile long org.sleuthkit.datamodel.Image.imageHandle = 0
private

Definition at line 41 of file Image.java.

Referenced by org.sleuthkit.datamodel.Image.getImageHandle().

String [] org.sleuthkit.datamodel.Image.paths
private
String org.sleuthkit.datamodel.Image.timezone
private
long org.sleuthkit.datamodel.Image.type
private

Definition at line 39 of file Image.java.

Referenced by org.sleuthkit.datamodel.Image.Image().


The documentation for this class was generated from the following file:

Copyright © 2011-2015 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.