19 package org.sleuthkit.datamodel;
21 import java.io.FileNotFoundException;
22 import java.io.IOException;
23 import java.io.RandomAccessFile;
24 import java.sql.SQLException;
25 import java.sql.Statement;
26 import java.text.MessageFormat;
27 import java.util.ArrayList;
28 import java.util.List;
29 import java.util.ResourceBundle;
31 import java.util.SortedSet;
32 import java.util.TimeZone;
33 import java.util.logging.Level;
34 import java.util.logging.Logger;
52 protected final Set<TSK_FS_META_FLAG_ENUM>
metaFlags;
54 protected final long metaAddr, ctime, crtime, atime, mtime;
56 protected final int uid, gid;
61 private boolean localPathSet =
false;
62 private String localPath;
63 private String localAbsPath;
64 private volatile RandomAccessFile localFileHandle;
65 private volatile java.io.File localFile;
68 private List<TskFileRange> ranges;
77 private boolean knownStateDirty =
false;
82 private boolean md5HashDirty =
false;
83 private String mimeType;
84 private boolean mimeTypeDirty =
false;
86 private static final ResourceBundle BUNDLE = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
87 private long dataSourceObjectId;
88 private final String extension;
127 long dataSourceObjectId,
131 long metaAddr,
int metaSeq,
135 long ctime,
long crtime,
long atime,
long mtime,
142 super(db, objId, name);
143 this.dataSourceObjectId = dataSourceObjectId;
155 this.crtime = crtime;
163 if (knownState == null) {
169 this.mimeType = mimeType;
170 this.extension = extension == null ?
"" : extension;
339 if ((mode & irusr) == irusr) {
344 if ((mode & iwusr) == iwusr) {
351 if ((mode & isuid) == isuid) {
352 if ((mode & ixusr) == ixusr) {
358 if ((mode & ixusr) == ixusr) {
366 if ((mode & irgrp) == irgrp) {
371 if ((mode & iwgrp) == iwgrp) {
378 if ((mode & isgid) == isgid) {
379 if ((mode & ixgrp) == ixgrp) {
385 if ((mode & ixgrp) == ixgrp) {
393 if ((mode & iroth) == iroth) {
398 if ((mode & iwoth) == iwoth) {
405 if ((mode & isvtx) == isvtx) {
406 if ((mode & ixoth) == ixoth) {
412 if ((mode & ixoth) == ixoth) {
420 if (result.length() != 10) {
445 this.mimeType = mimeType;
446 this.mimeTypeDirty =
true;
450 return modes.contains(mode);
463 this.md5HashDirty =
true;
485 this.knownStateDirty =
true;
546 long getDataSourceObjectId() {
547 return dataSourceObjectId;
561 if (ranges == null) {
586 long rangeLength = byteRange.getByteLen();
587 if (fileOffset < rangeLength) {
588 imgOffset = byteRange.getByteStart() + fileOffset;
594 fileOffset -= rangeLength;
641 public abstract boolean isRoot();
654 String[] pathSegments = uniquePath.split(
"/");
658 if (pathSegments[0].startsWith(
"img_")) {
661 if (pathSegments[1].startsWith(
"vol_")) {
667 StringBuilder strbuf =
new StringBuilder();
668 for (; index < pathSegments.length; ++index) {
669 if (!pathSegments[index].isEmpty()) {
670 strbuf.append(
"/").append(pathSegments[index]);
674 return strbuf.toString();
688 List<AbstractFile> files =
new ArrayList<AbstractFile>();
689 for (
Content child : children) {
691 AbstractFile afChild = (AbstractFile) child;
721 return dirType.toString();
730 return dirFlag == flag;
760 return metaFlags.contains(metaFlag);
770 return readInt(buf, offset, len);
804 BUNDLE.getString(
"AbstractFile.readLocal.exception.msg1.text"));
812 if (!localFile.
exists()) {
814 MessageFormat.format(BUNDLE.getString(
"AbstractFile.readLocal.exception.msg2.text"), localAbsPath));
818 MessageFormat.format(BUNDLE.getString(
"AbstractFile.readLocal.exception.msg3.text"), localAbsPath));
823 if (localFileHandle == null) {
824 synchronized (
this) {
825 if (localFileHandle == null) {
827 localFileHandle =
new RandomAccessFile(localFile,
"r");
828 }
catch (FileNotFoundException ex) {
829 final String msg = MessageFormat.format(BUNDLE.getString(
830 "AbstractFile.readLocal.exception.msg4.text"),
832 LOGGER.log(Level.SEVERE, msg, ex);
844 long encodedOffset = offset + EncodedFileUtil.getHeaderLength();
847 long curOffset = localFileHandle.getFilePointer();
848 if (curOffset != encodedOffset) {
849 localFileHandle.seek(encodedOffset);
851 bytesRead = localFileHandle.read(buf, 0, (
int) len);
852 for (
int i = 0; i < bytesRead; i++) {
853 buf[i] = EncodedFileUtil.decodeByte(buf[i], encodingType);
858 long curOffset = localFileHandle.getFilePointer();
859 if (curOffset != offset) {
860 localFileHandle.seek(offset);
863 return localFileHandle.read(buf, 0, (
int) len);
865 }
catch (IOException ex) {
866 final String msg = MessageFormat.format(BUNDLE.getString(
"AbstractFile.readLocal.exception.msg5.text"), localAbsPath);
867 LOGGER.log(Level.SEVERE, msg, ex);
882 void setLocalFilePath(String localPath,
boolean isAbsolute) {
884 if (localPath == null || localPath.equals(
"")) {
887 localPathSet =
false;
889 this.localPath = localPath;
891 this.localAbsPath = localPath;
895 this.localPathSet =
true;
923 this.encodingType = encodingType;
938 return localFile.
exists();
940 LOGGER.log(Level.SEVERE, ex.getMessage());
961 LOGGER.log(Level.SEVERE, ex.getMessage());
975 throw new TskCoreException(
976 BUNDLE.getString(
"AbstractFile.readLocal.exception.msg1.text"));
980 if (localFile != null) {
984 synchronized (
this) {
985 if (localFile == null) {
986 localFile =
new java.io.File(localAbsPath);
995 if (localFileHandle != null) {
996 synchronized (
this) {
997 if (localFileHandle != null) {
999 localFileHandle.close();
1000 }
catch (IOException ex) {
1001 LOGGER.log(Level.SEVERE,
"Could not close file handle for file: " +
getParentPath() +
getName(), ex);
1003 localFileHandle = null;
1021 return super.toString(preserveState) +
"AbstractFile [\t"
1023 +
"\tctime " + ctime
1024 +
"\tcrtime " + crtime
1025 +
"\t" +
"mtime " + mtime +
"\t" +
"atime " + atime
1026 +
"\t" +
"attrId " + attrId
1028 +
"\t" +
"dirFlag " + dirFlag +
"\t" +
"dirType " + dirType
1029 +
"\t" +
"uid " + uid
1030 +
"\t" +
"gid " + gid
1031 +
"\t" +
"metaAddr " + metaAddr +
"\t" +
"metaSeq " + metaSeq +
"\t" +
"metaFlags " + metaFlags
1032 +
"\t" +
"metaType " + metaType +
"\t" +
"modes " +
modes
1033 +
"\t" +
"parentPath " + parentPath +
"\t" +
"size " + size
1034 +
"\t" +
"knownState " +
knownState +
"\t" +
"md5Hash " + md5Hash
1035 +
"\t" +
"localPathSet " + localPathSet +
"\t" +
"localPath " + localPath
1036 +
"\t" +
"localAbsPath " + localAbsPath +
"\t" +
"localFile " + localFile
1059 if (this.mimeType == null) {
1062 if (mimeTypes.contains(
this.mimeType)) {
1075 public void save() throws TskCoreException {
1078 if (!(md5HashDirty || mimeTypeDirty || knownStateDirty)) {
1082 String queryStr =
"";
1083 if (mimeTypeDirty) {
1084 queryStr =
"mime_type = '" + this.
getMIMEType() +
"'";
1087 if (!queryStr.isEmpty()) {
1090 queryStr +=
"md5 = '" + this.
getMd5Hash() +
"'";
1092 if (knownStateDirty) {
1093 if (!queryStr.isEmpty()) {
1096 queryStr +=
"known = '" + this.
getKnown().getFileKnownValue() +
"'";
1099 queryStr =
"UPDATE tsk_files SET " + queryStr +
" WHERE obj_id = " + this.
getId();
1102 Statement statement = null;
1106 statement = connection.createStatement();
1107 connection.executeUpdate(statement, queryStr);
1109 md5HashDirty =
false;
1110 mimeTypeDirty =
false;
1111 knownStateDirty =
false;
1112 }
catch (SQLException ex) {
1113 throw new TskCoreException(String.format(
"Error saving properties for file (obj_id = %s)",
this.getId()), ex);
1115 closeStatement(statement);
1153 @SuppressWarnings(
"deprecation")
1157 long size,
long ctime,
long crtime,
long atime,
long mtime,
short modes,
int uid,
int gid, String md5Hash,
FileKnown knownState,
1158 String parentPath) {
1159 this(db, objId, db.getDataSourceObjectId(objId),
attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
1199 @SuppressWarnings(
"deprecation")
1203 int uid,
int gid, String md5Hash,
FileKnown knownState, String parentPath, String mimeType) {
1204 this(db, objId, dataSourceObjectId,
attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
1216 @SuppressWarnings(
"deprecation")
1243 setLocalFilePath(localPath, isAbsolute);
VIRT
Special (TSK added "Virtual" files) NON-NLS.
boolean isModeSet(TskData.TSK_FS_META_MODE_ENUM mode)
final TSK_FS_NAME_TYPE_ENUM dirType
static long timeToEpoch(String time)
static String epochToTime(long epoch)
static String epochToTime(long epoch)
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
String getMetaFlagsAsString()
final int readLocal(byte[] buf, long offset, long len)
boolean isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM flag)
List< Content > getChildren()
ALLOC
Metadata structure is currently in an allocated state.
final TSK_FS_NAME_FLAG_ENUM dirFlag
TSK_FS_META_TYPE_DIR
Directory file NON-NLS.
void setMIMEType(String mimeType)
TSK_FS_META_MODE_ISVTX
sticky bit
final TskData.TSK_DB_FILES_TYPE_ENUM fileType
UNALLOC
Metadata structure is currently in an unallocated state.
TskData.TSK_DB_FILES_TYPE_ENUM getType()
final TskData.TSK_FS_ATTR_TYPE_ENUM attrType
TSK_FS_META_MODE_IXOTH
X for other.
TSK_FS_META_TYPE_VIRT_DIR
"Virtual Directory" created by TSK for Orphan Files NON-NLS
long convertToImgOffset(long fileOffset)
TSK_FS_META_MODE_ISUID
set user id on execution
TSK_FS_NAME_TYPE_ENUM getDirType()
Content getContentById(long id)
String getDirFlagAsString()
TSK_FS_META_MODE_IXGRP
X for group.
String getNameExtension()
TSK_FS_META_MODE_IWOTH
W for other.
TSK_FS_META_MODE_IRGRP
R for group.
TSK_FS_META_MODE_IWUSR
W for owner.
MimeMatchEnum isMimeType(SortedSet< String > mimeTypes)
String getDirTypeAsString()
final Set< TSK_FS_META_FLAG_ENUM > metaFlags
TSK_FS_META_MODE_IROTH
R for other.
String toString(boolean preserveState)
TskData.FileKnown getKnown()
void setKnown(TskData.FileKnown knownState)
FALSE
file has a defined mime type and it is one of the given ones
final Set< TskData.TSK_FS_META_MODE_ENUM > modes
List< AbstractFile > listFiles()
TskData.FileKnown knownState
TSK_FS_META_TYPE_VIRT
"Virtual File" created by TSK for file system areas NON-NLS
TSK_FS_META_TYPE_ENUM getMetaType()
TSK_FS_META_MODE_IRUSR
R for owner.
SleuthkitCase getSleuthkitCase()
boolean isMetaFlagSet(TSK_FS_META_FLAG_ENUM metaFlag)
TRUE
file does not have a defined mime time in blackboard
void acquireSingleUserCaseWriteLock()
static short toInt(Set< TSK_FS_META_MODE_ENUM > modes)
void releaseSingleUserCaseWriteLock()
static String epochToTime(long epoch, TimeZone tzone)
static long timeToEpoch(String time)
String getModesAsString()
int readInt(byte[] buf, long offset, long len)
UNKNOWN
File marked as unknown by hash db.
static Set< TSK_FS_META_MODE_ENUM > valuesOf(short modes)
void setLocalPath(String localPath, boolean isAbsolute)
void setMd5Hash(String md5Hash)
static String createNonUniquePath(String uniquePath)
TSK_FS_META_MODE_IWGRP
W for group.
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
List< TskFileRange > getRanges()
final int read(byte[] buf, long offset, long len)
String getMetaTypeAsString()
final TSK_FS_META_TYPE_ENUM metaType
TSK_FS_META_TYPE_REG
Regular file NON-NLS.
TSK_FS_META_MODE_ISGID
set group id on execution
List< TskFileRange > getFileRanges(long id)
TSK_FS_META_MODE_IXUSR
X for owner.
TskData.TSK_FS_ATTR_TYPE_ENUM getAttrType()
abstract boolean isRoot()