Sleuth Kit Java Bindings (JNI)  4.6.0
Java bindings for using The Sleuth Kit
Image.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2017 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.text.MessageFormat;
22 import java.util.ResourceBundle;
23 import java.util.ArrayList;
24 import java.util.Arrays;
25 import java.util.List;
26 import java.util.logging.Level;
27 import java.util.logging.Logger;
28 import java.io.File;
29 import java.sql.ResultSet;
30 import java.sql.SQLException;
31 import java.sql.Statement;
32 
39 public class Image extends AbstractContent implements DataSource {
40  //data about image
41 
42  private final long type, ssize;
43  private long size;
44  private final String[] paths;
45  private volatile long imageHandle = 0;
46  private final String deviceId, timezone, md5;
47  private static ResourceBundle bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle");
48 
49  private static final Logger LOGGER = Logger.getLogger(Image.class.getName());
50 
69  @Deprecated
70  protected Image(SleuthkitCase db, long obj_id, long type, long ssize, String name, String[] paths, String timezone, String md5) throws TskCoreException {
71  super(db, obj_id, name);
72  this.deviceId = "";
73  this.type = type;
74  this.ssize = ssize;
75  this.paths = paths;
76  this.timezone = timezone;
77  this.size = 0;
78  this.md5 = md5;
79  }
80 
97  Image(SleuthkitCase db, long obj_id, long type, String deviceId, long ssize, String name, String[] paths, String timezone, String md5, long size) throws TskCoreException {
98  super(db, obj_id, name);
99  this.deviceId = deviceId;
100  this.type = type;
101  this.ssize = ssize;
102  this.paths = paths;
103  this.timezone = timezone;
104  this.size = size;
105  this.md5 = md5;
106  }
107 
115  public synchronized long getImageHandle() throws TskCoreException {
116  if (imageHandle == 0) {
117  imageHandle = SleuthkitJNI.openImage(paths);
118  }
119 
120  return imageHandle;
121  }
122 
123  @Override
125  return this;
126  }
127 
128  @Override
129  public void close() {
130  //frees nothing, as we are caching image handles
131  }
132 
133  @Override
134  public void finalize() throws Throwable {
135  try {
136  if (imageHandle != 0) {
137  SleuthkitJNI.closeImg(imageHandle);
138  imageHandle = 0;
139  }
140  } finally {
141  super.finalize();
142  }
143  }
144 
145  @Override
146  public int read(byte[] buf, long offset, long len) throws TskCoreException {
147  // read from the image
148  return SleuthkitJNI.readImg(getImageHandle(), buf, offset, len);
149  }
150 
151  @Override
152  public long getSize() {
153  if (size == 0) {
154  try {
155  if (paths.length > 0) {
156  //should always had at least one path
157  size = SleuthkitJNI.findDeviceSize(paths[0]);
158  }
159  } catch (TskCoreException ex) {
160  Logger.getLogger(Image.class.getName()).log(Level.SEVERE, "Could not find image size, image: " + this.getId(), ex); //NON-NLS
161  }
162  }
163  return size;
164  }
165 
166  //Methods for retrieval of meta-data attributes
173  return TskData.TSK_IMG_TYPE_ENUM.valueOf(type);
174  }
175 
181  public long getSsize() {
182  return ssize;
183  }
184 
185  @Override
186  public String getUniquePath() throws TskCoreException {
187  return "/img_" + getName(); //NON-NLS
188  }
189 
195  public String[] getPaths() {
196  return paths;
197  }
198 
204  public List<VolumeSystem> getVolumeSystems() throws TskCoreException {
205 
206  List<Content> children = getChildren();
207  List<VolumeSystem> vs = new ArrayList<VolumeSystem>();
208  for (Content child : children) {
209  if (child instanceof VolumeSystem) {
210  vs.add((VolumeSystem) child);
211  }
212  }
213 
214  return vs;
215  }
216 
222  public List<Volume> getVolumes() throws TskCoreException {
223 
224  List<Content> children = getChildren();
225  List<Volume> volumes = new ArrayList<Volume>();
226  for (Content child : children) {
227  if (child instanceof Volume) {
228  volumes.add((Volume) child);
229  }
230  }
231 
232  return volumes;
233  }
234 
242  public List<FileSystem> getFileSystems() throws TskCoreException {
243  List<FileSystem> fs = new ArrayList<FileSystem>();
244  fs.addAll(getSleuthkitCase().getFileSystems(this));
245  return fs;
246  }
247 
253  @Override
254  public String getTimeZone() {
255  return timezone;
256  }
257 
258  @Override
259  public <T> T accept(SleuthkitItemVisitor<T> v) {
260  return v.visit(this);
261  }
262 
263  @Override
264  public <T> T accept(ContentVisitor<T> v) {
265  return v.visit(this);
266  }
267 
268  @Override
269  public List<Content> getChildren() throws TskCoreException {
270  return getSleuthkitCase().getImageChildren(this);
271  }
272 
273  @Override
274  public List<Long> getChildrenIds() throws TskCoreException {
275  return getSleuthkitCase().getImageChildrenIds(this);
276  }
277 
278  @Override
279  public String toString(boolean preserveState) {
280  return super.toString(preserveState) + "Image [\t" + "\t" + "paths " + Arrays.toString(paths) + "\t" + "size " + size + "\t" + "ssize " + ssize + "\t" + "timezone " + timezone + "\t" + "type " + type + "]\t"; //NON-NLS
281  }
282 
289  public Boolean imageFileExists() {
290  if (paths.length > 0) {
291  File imageFile = new File(paths[0]);
292  return imageFile.exists();
293  }
294 
295  return false;
296  }
297 
305  public String verifyImageSize() {
306  Logger logger1 = Logger.getLogger("verifyImageSizes"); //NON-NLS
307  String errorString = "";
308  try {
309  List<VolumeSystem> volumeSystems = getVolumeSystems();
310  for (VolumeSystem vs : volumeSystems) {
311  List<Volume> volumes = vs.getVolumes();
312  for (Volume v : volumes) {
313  byte[] buf = new byte[512];
314  long endOffset = (v.getStart() + v.getLength()) * 512 - 512;
315  try {
316  int readBytes = read(buf, endOffset, 512);
317  if (readBytes < 0) {
318  logger1.log(Level.WARNING, "Possible Incomplete Image: Error reading volume at offset {0}", endOffset); //NON-NLS
319  errorString = MessageFormat.format(bundle.getString("Image.verifyImageSize.errStr1.text"), endOffset);
320  }
321  } catch (TskCoreException ex) {
322  logger1.log(Level.WARNING, "Possible Incomplete Image: Error reading volume at offset {0}: {1}", new Object[]{endOffset, ex.getLocalizedMessage()}); //NON-NLS
323  errorString = MessageFormat.format(bundle.getString("Image.verifyImageSize.errStr2.text"), endOffset);
324  }
325  }
326  }
327 
328  List<FileSystem> fileSystems = getFileSystems();
329  for (FileSystem fs : fileSystems) {
330  long block_size = fs.getBlock_size();
331  long endOffset = fs.getImageOffset() + fs.getSize() - block_size;
332  try {
333  byte[] buf = new byte[(int) block_size];
334  int readBytes = read(buf, endOffset, block_size);
335  if (readBytes < 0) {
336  logger1.log(Level.WARNING, "Possible Incomplete Image: Error reading file system at offset {0}", endOffset); //NON-NLS
337  errorString = MessageFormat.format(bundle.getString("Image.verifyImageSize.errStr3.text"), endOffset);
338  }
339  } catch (TskCoreException ex) {
340  logger1.log(Level.WARNING, "Possible Incomplete Image: Error reading file system at offset {0}: {1}", new Object[]{endOffset, ex.getLocalizedMessage()}); //NON-NLS
341  errorString = MessageFormat.format(bundle.getString("Image.verifyImageSize.errStr4.text"), endOffset);
342  }
343  }
344  } catch (TskException ex) {
345  // do nothing if we got an exception from trying to get file systems and volume systems
346  }
347  return errorString;
348  }
349 
355  public String getMd5() {
356  return md5;
357  }
358 
366  @Override
367  public String getDeviceId() {
368  return deviceId;
369  }
370 
386  @Override
387  public long getContentSize(SleuthkitCase sleuthkitCase) throws TskCoreException {
388  SleuthkitCase.CaseDbConnection connection;
389  Statement statement = null;
390  ResultSet resultSet = null;
391  long contentSize = 0;
392 
393  connection = sleuthkitCase.getConnection();
394 
395  try {
396  statement = connection.createStatement();
397  resultSet = connection.executeQuery(statement, "SELECT SUM (size) FROM tsk_image_info WHERE tsk_image_info.obj_id = " + getId());
398  if (resultSet.next()) {
399  contentSize = resultSet.getLong("sum");
400  }
401  } catch (SQLException ex) {
402  throw new TskCoreException(String.format("There was a problem while querying the database for size data for object ID %d.", getId()), ex);
403  } finally {
404  closeResultSet(resultSet);
405  closeStatement(statement);
406  connection.close();
407  }
408 
409  return contentSize;
410  }
411 
417  private static void closeResultSet(ResultSet resultSet) {
418  if (resultSet != null) {
419  try {
420  resultSet.close();
421  } catch (SQLException ex) {
422  LOGGER.log(Level.SEVERE, "Error closing ResultSet", ex); //NON-NLS
423  }
424  }
425  }
426 
432  private static void closeStatement(Statement statement) {
433  if (statement != null) {
434  try {
435  statement.close();
436  } catch (SQLException ex) {
437  LOGGER.log(Level.SEVERE, "Error closing Statement", ex); //NON-NLS
438  }
439  }
440  }
441 }
static int readImg(long imgHandle, byte[] readBuffer, long offset, long len)
List< Volume > getVolumes()
Definition: Image.java:222
List< FileSystem > getFileSystems()
Definition: Image.java:242
Image(SleuthkitCase db, long obj_id, long type, long ssize, String name, String[] paths, String timezone, String md5)
Definition: Image.java:70
TskData.TSK_IMG_TYPE_ENUM getType()
Definition: Image.java:172
List< Long > getChildrenIds()
Definition: Image.java:274
int read(byte[] buf, long offset, long len)
Definition: Image.java:146
static long openImage(String[] imageFiles)
static long findDeviceSize(String devPath)
static void closeImg(long imgHandle)
List< Content > getChildren()
Definition: Image.java:269
List< VolumeSystem > getVolumeSystems()
Definition: Image.java:204
static TSK_IMG_TYPE_ENUM valueOf(long imgType)
Definition: TskData.java:537
String toString(boolean preserveState)
Definition: Image.java:279
long getContentSize(SleuthkitCase sleuthkitCase)
Definition: Image.java:387
synchronized long getImageHandle()
Definition: Image.java:115

Copyright © 2011-2018 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.