Sleuth Kit Java Bindings (JNI)  4.6.0
Java bindings for using The Sleuth Kit
AbstractFile.java
Go to the documentation of this file.
1 /*
2  * SleuthKit Java Bindings
3  *
4  * Copyright 2011-2018 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.io.FileNotFoundException;
22 import java.io.IOException;
23 import java.io.RandomAccessFile;
24 import java.sql.SQLException;
25 import java.sql.Statement;
26 import java.text.MessageFormat;
27 import java.util.ArrayList;
28 import java.util.List;
29 import java.util.ResourceBundle;
30 import java.util.Set;
31 import java.util.SortedSet;
32 import java.util.TimeZone;
33 import java.util.logging.Level;
34 import java.util.logging.Logger;
35 import static org.sleuthkit.datamodel.SleuthkitCase.closeStatement;
41 
46 public abstract class AbstractFile extends AbstractContent {
47 
49  protected final TSK_FS_NAME_TYPE_ENUM dirType;
51  protected final TSK_FS_NAME_FLAG_ENUM dirFlag;
52  protected final Set<TSK_FS_META_FLAG_ENUM> metaFlags;
53  protected long size;
54  protected final long metaAddr, ctime, crtime, atime, mtime;
55  protected final int metaSeq;
56  protected final int uid, gid;
57  protected final int attrId;
59  protected final Set<TskData.TSK_FS_META_MODE_ENUM> modes;
60  //local file support
61  private boolean localPathSet = false;
62  private String localPath;
63  private String localAbsPath;
64  private volatile RandomAccessFile localFileHandle;
65  private volatile java.io.File localFile;
66  private TskData.EncodingType encodingType;
67  //range support
68  private List<TskFileRange> ranges;
69  /*
70  * path of parent directory
71  */
72  protected final String parentPath;
77  private boolean knownStateDirty = false;
78  /*
79  * md5 hash
80  */
81  protected String md5Hash;
82  private boolean md5HashDirty = false;
83  private String mimeType;
84  private boolean mimeTypeDirty = false;
85  private static final Logger LOGGER = Logger.getLogger(AbstractFile.class.getName());
86  private static final ResourceBundle BUNDLE = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle");
87  private long dataSourceObjectId;
88  private final String extension;
89 
126  long objId,
127  long dataSourceObjectId,
129  String name,
131  long metaAddr, int metaSeq,
133  TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags,
134  long size,
135  long ctime, long crtime, long atime, long mtime,
136  short modes,
137  int uid, int gid,
138  String md5Hash, FileKnown knownState,
139  String parentPath,
140  String mimeType,
141  String extension) {
142  super(db, objId, name);
143  this.dataSourceObjectId = dataSourceObjectId;
144  this.attrType = attrType;
145  this.attrId = attrId;
146  this.fileType = fileType;
147  this.metaAddr = metaAddr;
148  this.metaSeq = metaSeq;
149  this.dirType = dirType;
150  this.metaType = metaType;
151  this.dirFlag = dirFlag;
152  this.metaFlags = TSK_FS_META_FLAG_ENUM.valuesOf(metaFlags);
153  this.size = size;
154  this.ctime = ctime;
155  this.crtime = crtime;
156  this.atime = atime;
157  this.mtime = mtime;
158  this.uid = uid;
159  this.gid = gid;
160  this.modes = TskData.TSK_FS_META_MODE_ENUM.valuesOf(modes);
161 
162  this.md5Hash = md5Hash;
163  if (knownState == null) {
164  this.knownState = FileKnown.UNKNOWN;
165  } else {
166  this.knownState = knownState;
167  }
168  this.parentPath = parentPath;
169  this.mimeType = mimeType;
170  this.extension = extension == null ? "" : extension;
171  this.encodingType = TskData.EncodingType.NONE;
172  }
173 
180  return fileType;
181  }
182 
189  return attrType;
190  }
191 
197  public int getAttributeId() {
198  return attrId;
199  }
200 
206  public long getCtime() {
207  return ctime;
208  }
209 
215  public String getCtimeAsDate() {
216  return epochToTime(ctime);
217  }
218 
224  public long getCrtime() {
225  return crtime;
226  }
227 
233  public String getCrtimeAsDate() {
234  return epochToTime(crtime);
235  }
236 
242  public long getAtime() {
243  return atime;
244  }
245 
251  public String getAtimeAsDate() {
252  return epochToTime(atime);
253  }
254 
260  public long getMtime() {
261  return mtime;
262  }
263 
269  public String getMtimeAsDate() {
270  return epochToTime(mtime);
271  }
272 
278  public int getUid() {
279  return uid;
280  }
281 
287  public int getGid() {
288  return gid;
289  }
290 
296  public long getMetaAddr() {
297  return metaAddr;
298  }
299 
306  public long getMetaSeq() {
307  return metaSeq;
308  }
309 
315  public String getModesAsString() {
317  String result = "";
318 
319  short isuid = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_ISUID.getMode();
320  short isgid = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_ISGID.getMode();
321  short isvtx = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_ISVTX.getMode();
322 
323  short irusr = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IRUSR.getMode();
324  short iwusr = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IWUSR.getMode();
325  short ixusr = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IXUSR.getMode();
326 
327  short irgrp = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IRGRP.getMode();
328  short iwgrp = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IWGRP.getMode();
329  short ixgrp = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IXGRP.getMode();
330 
331  short iroth = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IROTH.getMode();
332  short iwoth = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IWOTH.getMode();
333  short ixoth = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IXOTH.getMode();
334 
335  // first character = the Meta Type
336  result += metaType.toString();
337 
338  // second and third characters = user permissions
339  if ((mode & irusr) == irusr) {
340  result += "r"; //NON-NLS
341  } else {
342  result += "-"; //NON-NLS
343  }
344  if ((mode & iwusr) == iwusr) {
345  result += "w"; //NON-NLS
346  } else {
347  result += "-"; //NON-NLS
348  }
349 
350  // fourth character = set uid
351  if ((mode & isuid) == isuid) {
352  if ((mode & ixusr) == ixusr) {
353  result += "s"; //NON-NLS
354  } else {
355  result += "S"; //NON-NLS
356  }
357  } else {
358  if ((mode & ixusr) == ixusr) {
359  result += "x"; //NON-NLS
360  } else {
361  result += "-"; //NON-NLS
362  }
363  }
364 
365  // fifth and sixth characters = group permissions
366  if ((mode & irgrp) == irgrp) {
367  result += "r"; //NON-NLS
368  } else {
369  result += "-"; //NON-NLS
370  }
371  if ((mode & iwgrp) == iwgrp) {
372  result += "w"; //NON-NLS
373  } else {
374  result += "-"; //NON-NLS
375  }
376 
377  // seventh character = set gid
378  if ((mode & isgid) == isgid) {
379  if ((mode & ixgrp) == ixgrp) {
380  result += "s"; //NON-NLS
381  } else {
382  result += "S"; //NON-NLS
383  }
384  } else {
385  if ((mode & ixgrp) == ixgrp) {
386  result += "x"; //NON-NLS
387  } else {
388  result += "-"; //NON-NLS
389  }
390  }
391 
392  // eighth and ninth character = other permissions
393  if ((mode & iroth) == iroth) {
394  result += "r"; //NON-NLS
395  } else {
396  result += "-"; //NON-NLS
397  }
398  if ((mode & iwoth) == iwoth) {
399  result += "w"; //NON-NLS
400  } else {
401  result += "-"; //NON-NLS
402  }
403 
404  // tenth character = sticky bit
405  if ((mode & isvtx) == isvtx) {
406  if ((mode & ixoth) == ixoth) {
407  result += "t"; //NON-NLS
408  } else {
409  result += "T"; //NON-NLS
410  }
411  } else {
412  if ((mode & ixoth) == ixoth) {
413  result += "x"; //NON-NLS
414  } else {
415  result += "-"; //NON-NLS
416  }
417  }
418 
419  // check the result
420  if (result.length() != 10) {
421  // throw error here
422  result = "ERROR"; //NON-NLS
423  }
424  return result;
425  }
426 
432  public String getMIMEType() {
433  return mimeType;
434  }
435 
444  public void setMIMEType(String mimeType) {
445  this.mimeType = mimeType;
446  this.mimeTypeDirty = true;
447  }
448 
449  public boolean isModeSet(TskData.TSK_FS_META_MODE_ENUM mode) {
450  return modes.contains(mode);
451  }
452 
461  public void setMd5Hash(String md5Hash) {
462  this.md5Hash = md5Hash;
463  this.md5HashDirty = true;
464  }
465 
471  public String getMd5Hash() {
472  return this.md5Hash;
473  }
474 
484  this.knownState = knownState;
485  this.knownStateDirty = true;
486  }
487 
495  return knownState;
496  }
497 
505  public String getNameExtension() {
506  return extension;
507  }
508 
514  @Override
515  public long getSize() {
516  return size;
517  }
518 
524  public String getParentPath() {
525  return parentPath;
526  }
527 
536  @Override
538  return getSleuthkitCase().getContentById(this.dataSourceObjectId);
539  }
540 
546  long getDataSourceObjectId() {
547  return dataSourceObjectId;
548  }
549 
560  public List<TskFileRange> getRanges() throws TskCoreException {
561  if (ranges == null) {
562  ranges = getSleuthkitCase().getFileRanges(this.getId());
563  }
564  return ranges;
565  }
566 
580  public long convertToImgOffset(long fileOffset) throws TskCoreException {
581  long imgOffset = -1;
582  for (TskFileRange byteRange : getRanges()) {
583 
584  // if fileOffset is within the current byteRange, calculate the image
585  // offset and break
586  long rangeLength = byteRange.getByteLen();
587  if (fileOffset < rangeLength) {
588  imgOffset = byteRange.getByteStart() + fileOffset;
589  break;
590  }
591 
592  // otherwise, decrement fileOffset by the length of the current
593  // byte range and continue
594  fileOffset -= rangeLength;
595  }
596  return imgOffset;
597  }
598 
605  public boolean isVirtual() {
607  || dirType.equals(TskData.TSK_FS_NAME_TYPE_ENUM.VIRT)
609  }
610 
618  public boolean isFile() {
619  return metaType.equals(TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG)
620  || (metaType.equals(TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_UNDEF)
621  && dirType.equals(TSK_FS_NAME_TYPE_ENUM.REG));
622 
623  }
624 
631  public boolean isDir() {
632  return (metaType.equals(TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR)
634  }
635 
641  public abstract boolean isRoot();
642 
651  public static String createNonUniquePath(String uniquePath) {
652 
653  // split the path into parts
654  String[] pathSegments = uniquePath.split("/");
655 
656  // see if uniquePath had an image and/or volume name
657  int index = 0;
658  if (pathSegments[0].startsWith("img_")) { //NON-NLS
659  ++index;
660  }
661  if (pathSegments[1].startsWith("vol_")) { //NON-NLS
662  ++index;
663  }
664 
665  // Assemble the non-unique path (skipping over the image and volume
666  // name, if they exist).
667  StringBuilder strbuf = new StringBuilder();
668  for (; index < pathSegments.length; ++index) {
669  if (!pathSegments[index].isEmpty()) {
670  strbuf.append("/").append(pathSegments[index]);
671  }
672  }
673 
674  return strbuf.toString();
675  }
676 
683  public List<AbstractFile> listFiles() throws TskCoreException {
684  // first, get all children
685  List<Content> children = getChildren();
686 
687  // only keep those that are of type AbstractFile
688  List<AbstractFile> files = new ArrayList<AbstractFile>();
689  for (Content child : children) {
690  if (child instanceof AbstractFile) {
691  AbstractFile afChild = (AbstractFile) child;
692  files.add(afChild);
693  }
694  }
695  return files;
696  }
697 
704  return metaType;
705  }
706 
707  public String getMetaTypeAsString() {
708  return metaType.toString();
709  }
710 
717  return dirType;
718  }
719 
720  public String getDirTypeAsString() {
721  return dirType.toString();
722  }
723 
730  return dirFlag == flag;
731  }
732 
737  public String getDirFlagAsString() {
738  return dirFlag.toString();
739  }
740 
744  public String getMetaFlagsAsString() {
745  String str = "";
746  if (metaFlags.contains(TSK_FS_META_FLAG_ENUM.ALLOC)) {
747  str = TSK_FS_META_FLAG_ENUM.ALLOC.toString();
748  } else if (metaFlags.contains(TSK_FS_META_FLAG_ENUM.UNALLOC)) {
749  str = TSK_FS_META_FLAG_ENUM.UNALLOC.toString();
750  }
751  return str;
752  }
753 
759  public boolean isMetaFlagSet(TSK_FS_META_FLAG_ENUM metaFlag) {
760  return metaFlags.contains(metaFlag);
761  }
762 
763  @Override
764  public final int read(byte[] buf, long offset, long len) throws TskCoreException {
765  //template method
766  //if localPath is set, use local, otherwise, use readCustom() supplied by derived class
767  if (localPathSet) {
768  return readLocal(buf, offset, len);
769  } else {
770  return readInt(buf, offset, len);
771  }
772 
773  }
774 
786  protected int readInt(byte[] buf, long offset, long len) throws TskCoreException {
787  return 0;
788  }
789 
801  protected final int readLocal(byte[] buf, long offset, long len) throws TskCoreException {
802  if (!localPathSet) {
803  throw new TskCoreException(
804  BUNDLE.getString("AbstractFile.readLocal.exception.msg1.text"));
805  }
806 
807  if (isDir()) {
808  return 0;
809  }
810 
811  loadLocalFile();
812  if (!localFile.exists()) {
813  throw new TskCoreException(
814  MessageFormat.format(BUNDLE.getString("AbstractFile.readLocal.exception.msg2.text"), localAbsPath));
815  }
816  if (!localFile.canRead()) {
817  throw new TskCoreException(
818  MessageFormat.format(BUNDLE.getString("AbstractFile.readLocal.exception.msg3.text"), localAbsPath));
819  }
820 
821  int bytesRead = 0;
822 
823  if (localFileHandle == null) {
824  synchronized (this) {
825  if (localFileHandle == null) {
826  try {
827  localFileHandle = new RandomAccessFile(localFile, "r");
828  } catch (FileNotFoundException ex) {
829  final String msg = MessageFormat.format(BUNDLE.getString(
830  "AbstractFile.readLocal.exception.msg4.text"),
831  localAbsPath);
832  LOGGER.log(Level.SEVERE, msg, ex);
833  //file could have been deleted or moved
834  throw new TskCoreException(msg, ex);
835  }
836  }
837  }
838  }
839 
840  try {
841  if (!encodingType.equals(TskData.EncodingType.NONE)) {
842  // The file is encoded, so we need to alter the offset to read (since there's
843  // a header on the encoded file) and then decode each byte
844  long encodedOffset = offset + EncodedFileUtil.getHeaderLength();
845 
846  //move to the user request offset in the stream
847  long curOffset = localFileHandle.getFilePointer();
848  if (curOffset != encodedOffset) {
849  localFileHandle.seek(encodedOffset);
850  }
851  bytesRead = localFileHandle.read(buf, 0, (int) len);
852  for (int i = 0; i < bytesRead; i++) {
853  buf[i] = EncodedFileUtil.decodeByte(buf[i], encodingType);
854  }
855  return bytesRead;
856  } else {
857  //move to the user request offset in the stream
858  long curOffset = localFileHandle.getFilePointer();
859  if (curOffset != offset) {
860  localFileHandle.seek(offset);
861  }
862  //note, we are always writing at 0 offset of user buffer
863  return localFileHandle.read(buf, 0, (int) len);
864  }
865  } catch (IOException ex) {
866  final String msg = MessageFormat.format(BUNDLE.getString("AbstractFile.readLocal.exception.msg5.text"), localAbsPath);
867  LOGGER.log(Level.SEVERE, msg, ex);
868  //local file could have been deleted / moved
869  throw new TskCoreException(msg, ex);
870  }
871  }
872 
882  void setLocalFilePath(String localPath, boolean isAbsolute) {
883 
884  if (localPath == null || localPath.equals("")) {
885  this.localPath = "";
886  localAbsPath = null;
887  localPathSet = false;
888  } else {
889  this.localPath = localPath;
890  if (isAbsolute) {
891  this.localAbsPath = localPath;
892  } else {
893  this.localAbsPath = getSleuthkitCase().getDbDirPath() + java.io.File.separator + this.localPath;
894  }
895  this.localPathSet = true;
896  }
897  }
898 
904  public String getLocalPath() {
905  return localPath;
906  }
907 
913  public String getLocalAbsPath() {
914  return localAbsPath;
915  }
916 
922  final void setEncodingType(TskData.EncodingType encodingType) {
923  this.encodingType = encodingType;
924  }
925 
932  public boolean exists() {
933  if (!localPathSet) {
934  return true;
935  } else {
936  try {
937  loadLocalFile();
938  return localFile.exists();
939  } catch (TskCoreException ex) {
940  LOGGER.log(Level.SEVERE, ex.getMessage());
941  return false;
942  }
943  }
944  }
945 
953  public boolean canRead() {
954  if (!localPathSet) {
955  return true;
956  } else {
957  try {
958  loadLocalFile();
959  return localFile.canRead();
960  } catch (TskCoreException ex) {
961  LOGGER.log(Level.SEVERE, ex.getMessage());
962  return false;
963  }
964  }
965  }
966 
973  private void loadLocalFile() throws TskCoreException {
974  if (!localPathSet) {
975  throw new TskCoreException(
976  BUNDLE.getString("AbstractFile.readLocal.exception.msg1.text"));
977  }
978 
979  // already been set
980  if (localFile != null) {
981  return;
982  }
983 
984  synchronized (this) {
985  if (localFile == null) {
986  localFile = new java.io.File(localAbsPath);
987  }
988  }
989  }
990 
991  @Override
992  public void close() {
993 
994  //close local file handle if set
995  if (localFileHandle != null) {
996  synchronized (this) {
997  if (localFileHandle != null) {
998  try {
999  localFileHandle.close();
1000  } catch (IOException ex) {
1001  LOGGER.log(Level.SEVERE, "Could not close file handle for file: " + getParentPath() + getName(), ex); //NON-NLS
1002  }
1003  localFileHandle = null;
1004  }
1005  }
1006  }
1007 
1008  }
1009 
1010  @Override
1011  protected void finalize() throws Throwable {
1012  try {
1013  close();
1014  } finally {
1015  super.finalize();
1016  }
1017  }
1018 
1019  @Override
1020  public String toString(boolean preserveState) {
1021  return super.toString(preserveState) + "AbstractFile [\t" //NON-NLS
1022  + "\t" + "fileType " + fileType //NON-NLS
1023  + "\tctime " + ctime //NON-NLS
1024  + "\tcrtime " + crtime //NON-NLS
1025  + "\t" + "mtime " + mtime + "\t" + "atime " + atime //NON-NLS
1026  + "\t" + "attrId " + attrId //NON-NLS
1027  + "\t" + "attrType " + attrType //NON-NLS
1028  + "\t" + "dirFlag " + dirFlag + "\t" + "dirType " + dirType //NON-NLS
1029  + "\t" + "uid " + uid //NON-NLS
1030  + "\t" + "gid " + gid //NON-NLS
1031  + "\t" + "metaAddr " + metaAddr + "\t" + "metaSeq " + metaSeq + "\t" + "metaFlags " + metaFlags //NON-NLS
1032  + "\t" + "metaType " + metaType + "\t" + "modes " + modes //NON-NLS
1033  + "\t" + "parentPath " + parentPath + "\t" + "size " + size //NON-NLS
1034  + "\t" + "knownState " + knownState + "\t" + "md5Hash " + md5Hash //NON-NLS
1035  + "\t" + "localPathSet " + localPathSet + "\t" + "localPath " + localPath //NON-NLS
1036  + "\t" + "localAbsPath " + localAbsPath + "\t" + "localFile " + localFile //NON-NLS
1037  + "]\t";
1038  }
1039 
1043  public enum MimeMatchEnum {
1044 
1047  FALSE
1048  }
1049 
1058  public MimeMatchEnum isMimeType(SortedSet<String> mimeTypes) {
1059  if (this.mimeType == null) {
1060  return MimeMatchEnum.UNDEFINED;
1061  }
1062  if (mimeTypes.contains(this.mimeType)) {
1063  return MimeMatchEnum.TRUE;
1064  }
1065  return MimeMatchEnum.FALSE;
1066  }
1067 
1075  public void save() throws TskCoreException {
1076 
1077  // No fields have been updated
1078  if (!(md5HashDirty || mimeTypeDirty || knownStateDirty)) {
1079  return;
1080  }
1081 
1082  String queryStr = "";
1083  if (mimeTypeDirty) {
1084  queryStr = "mime_type = '" + this.getMIMEType() + "'";
1085  }
1086  if (md5HashDirty) {
1087  if (!queryStr.isEmpty()) {
1088  queryStr += ", ";
1089  }
1090  queryStr += "md5 = '" + this.getMd5Hash() + "'";
1091  }
1092  if (knownStateDirty) {
1093  if (!queryStr.isEmpty()) {
1094  queryStr += ", ";
1095  }
1096  queryStr += "known = '" + this.getKnown().getFileKnownValue() + "'";
1097  }
1098 
1099  queryStr = "UPDATE tsk_files SET " + queryStr + " WHERE obj_id = " + this.getId();
1100 
1101  SleuthkitCase.CaseDbConnection connection = getSleuthkitCase().getConnection();
1102  Statement statement = null;
1103 
1105  try {
1106  statement = connection.createStatement();
1107  connection.executeUpdate(statement, queryStr);
1108 
1109  md5HashDirty = false;
1110  mimeTypeDirty = false;
1111  knownStateDirty = false;
1112  } catch (SQLException ex) {
1113  throw new TskCoreException(String.format("Error saving properties for file (obj_id = %s)", this.getId()), ex);
1114  } finally {
1115  closeStatement(statement);
1116  connection.close();
1118  }
1119  }
1120 
1152  @Deprecated
1153  @SuppressWarnings("deprecation")
1154  protected AbstractFile(SleuthkitCase db, long objId, TskData.TSK_FS_ATTR_TYPE_ENUM attrType, short attrId,
1155  String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq,
1156  TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags,
1157  long size, long ctime, long crtime, long atime, long mtime, short modes, int uid, int gid, String md5Hash, FileKnown knownState,
1158  String parentPath) {
1159  this(db, objId, db.getDataSourceObjectId(objId), attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
1160  }
1161 
1198  @Deprecated
1199  @SuppressWarnings("deprecation")
1200  AbstractFile(SleuthkitCase db, long objId, long dataSourceObjectId, TskData.TSK_FS_ATTR_TYPE_ENUM attrType, short attrId,
1201  String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType,
1202  TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, short modes,
1203  int uid, int gid, String md5Hash, FileKnown knownState, String parentPath, String mimeType) {
1204  this(db, objId, dataSourceObjectId, attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
1205  }
1206 
1215  @Deprecated
1216  @SuppressWarnings("deprecation")
1217  public short getAttrId() {
1218  /*
1219  * NOTE: previously attrId used to be stored in AbstractFile as (signed)
1220  * short even though it is stored as uint16 in TSK. In extremely rare
1221  * occurrences attrId can be larger than what a signed short can hold
1222  * (2^15). Changes were made to AbstractFile to store attrId as integer.
1223  * Therefore this method has been deprecated. For backwards
1224  * compatibility, attribute ids that are larger than 32K are converted
1225  * to a negative number.
1226  */
1227  return (short) attrId; // casting to signed short converts values over 32K to negative values
1228  }
1229 
1241  @Deprecated
1242  protected void setLocalPath(String localPath, boolean isAbsolute) {
1243  setLocalFilePath(localPath, isAbsolute);
1244  }
1245 
1246  /*
1247  * -------------------------------------------------------------------------
1248  * Util methods to convert / map the data
1249  * -------------------------------------------------------------------------
1250  */
1260  @Deprecated
1261  public static String epochToTime(long epoch) {
1262  return TimeUtilities.epochToTime(epoch);
1263  }
1264 
1276  @Deprecated
1277  public static String epochToTime(long epoch, TimeZone tzone) {
1278  return TimeUtilities.epochToTime(epoch, tzone);
1279  }
1280 
1288  @Deprecated
1289  public static long timeToEpoch(String time) {
1290  return TimeUtilities.timeToEpoch(time);
1291  }
1292 }
VIRT
Special (TSK added "Virtual" files) NON-NLS.
Definition: TskData.java:50
boolean isModeSet(TskData.TSK_FS_META_MODE_ENUM mode)
final TSK_FS_NAME_TYPE_ENUM dirType
static long timeToEpoch(String time)
static String epochToTime(long epoch)
static String epochToTime(long epoch)
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
Definition: TskData.java:247
final int readLocal(byte[] buf, long offset, long len)
boolean isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM flag)
ALLOC
Metadata structure is currently in an allocated state.
Definition: TskData.java:206
final TSK_FS_NAME_FLAG_ENUM dirFlag
final TskData.TSK_DB_FILES_TYPE_ENUM fileType
UNALLOC
Metadata structure is currently in an unallocated state.
Definition: TskData.java:207
TskData.TSK_DB_FILES_TYPE_ENUM getType()
final TskData.TSK_FS_ATTR_TYPE_ENUM attrType
TSK_FS_META_TYPE_VIRT_DIR
"Virtual Directory" created by TSK for Orphan Files NON-NLS
Definition: TskData.java:114
long convertToImgOffset(long fileOffset)
TSK_FS_NAME_TYPE_ENUM getDirType()
MimeMatchEnum isMimeType(SortedSet< String > mimeTypes)
final Set< TSK_FS_META_FLAG_ENUM > metaFlags
String toString(boolean preserveState)
void setKnown(TskData.FileKnown knownState)
FALSE
file has a defined mime type and it is one of the given ones
final Set< TskData.TSK_FS_META_MODE_ENUM > modes
TSK_FS_META_TYPE_VIRT
"Virtual File" created by TSK for file system areas NON-NLS
Definition: TskData.java:113
TSK_FS_META_TYPE_ENUM getMetaType()
boolean isMetaFlagSet(TSK_FS_META_FLAG_ENUM metaFlag)
TRUE
file does not have a defined mime time in blackboard
static short toInt(Set< TSK_FS_META_MODE_ENUM > modes)
Definition: TskData.java:422
static String epochToTime(long epoch, TimeZone tzone)
static long timeToEpoch(String time)
int readInt(byte[] buf, long offset, long len)
UNKNOWN
File marked as unknown by hash db.
Definition: TskData.java:726
static Set< TSK_FS_META_MODE_ENUM > valuesOf(short modes)
Definition: TskData.java:403
void setLocalPath(String localPath, boolean isAbsolute)
static String createNonUniquePath(String uniquePath)
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
Definition: TskData.java:676
final int read(byte[] buf, long offset, long len)
final TSK_FS_META_TYPE_ENUM metaType
List< TskFileRange > getFileRanges(long id)
TskData.TSK_FS_ATTR_TYPE_ENUM getAttrType()

Copyright © 2011-2018 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.