Inherits org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.DataSource.

Public Member Functions
void	close ()

void	finalize () throws Throwable

List< Content >	getChildren () throws TskCoreException

List< Long >	getChildrenIds () throws TskCoreException

long	getContentSize (SleuthkitCase sleuthkitCase) throws TskCoreException

Content	getDataSource ()

String	getDeviceId ()

List< FileSystem >	getFileSystems () throws TskCoreException

synchronized long	getImageHandle () throws TskCoreException

String	getMd5 ()

String[]	getPaths ()

long	getSize ()

long	getSsize ()

String	getTimeZone ()

TskData.TSK_IMG_TYPE_ENUM	getType ()

String	getUniquePath () throws TskCoreException

List< Volume >	getVolumes () throws TskCoreException

List< VolumeSystem >	getVolumeSystems () throws TskCoreException

Boolean	imageFileExists ()

int	read (byte[] buf, long offset, long len) throws TskCoreException

String	toString (boolean preserveState)

String	verifyImageSize ()

Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean	equals (Object obj)

ArrayList< BlackboardArtifact >	getAllArtifacts () throws TskCoreException

long	getAllArtifactsCount () throws TskCoreException

ArrayList< BlackboardArtifact >	getArtifacts (String artifactTypeName) throws TskCoreException

ArrayList< BlackboardArtifact >	getArtifacts (int artifactTypeID) throws TskCoreException

ArrayList< BlackboardArtifact >	getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException

long	getArtifactsCount (String artifactTypeName) throws TskCoreException

long	getArtifactsCount (int artifactTypeID) throws TskCoreException

long	getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException

List< Content >	getChildren () throws TskCoreException

int	getChildrenCount () throws TskCoreException

List< Long >	getChildrenIds () throws TskCoreException

Content	getDataSource () throws TskCoreException

BlackboardArtifact	getGenInfoArtifact () throws TskCoreException

BlackboardArtifact	getGenInfoArtifact (boolean create) throws TskCoreException

ArrayList< BlackboardAttribute >	getGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException

Set< String >	getHashSetNames () throws TskCoreException

long	getId ()

String	getName ()

synchronized Content	getParent () throws TskCoreException

SleuthkitCase	getSleuthkitCase ()

synchronized String	getUniquePath () throws TskCoreException

boolean	hasChildren () throws TskCoreException

int	hashCode ()

BlackboardArtifact	newArtifact (int artifactTypeID) throws TskCoreException

BlackboardArtifact	newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException

String	toString ()

String	toString (boolean preserveState)

Public Member Functions inherited from org.sleuthkit.datamodel.Content
long	getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException

ArrayList< BlackboardAttribute >	getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException

Public Member Functions inherited from org.sleuthkit.datamodel.DataSource
long	getId ()

Protected Member Functions
	Image (SleuthkitCase db, long obj_id, long type, long ssize, String name, String[] paths, String timezone, String md5) throws TskCoreException

Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
	AbstractContent (SleuthkitCase db, long obj_id, String name)

Additional Inherited Members
Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long	UNKNOWN_ID = -1

Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long	parentId

Detailed Description

Represents a disk image file, stored in tsk_image_info. Populated based on data in database.

Caches internal tsk image handle and reuses it for reads

Definition at line 39 of file Image.java.

Constructor & Destructor Documentation

org.sleuthkit.datamodel.Image.Image	(	SleuthkitCase	db,
		long	obj_id,
		long	type,
		long	ssize,
		String	name,
		String[]	paths,
		String	timezone,
		String	md5
	)		throws TskCoreException

protected

Create a disk image.

Note: Most inputs originate from the database.

Parameters

db	Case database.
obj_id	Object ID.
type	Image type.
ssize	Sector size.
name	Display name.
paths	Image paths.
timezone	Timezone.
md5	MD5 hash.

Exceptions

TskCoreException

Deprecated:: Use the constructor that takes a device ID and size.

Definition at line 70 of file Image.java.

Member Function Documentation

void org.sleuthkit.datamodel.Image.close ( )

Free native resources after read is done on the Content object. After closing, read can be called again on the same Content object, which should result in re-opening of new native resources.

Implements org.sleuthkit.datamodel.Content.

Definition at line 129 of file Image.java.

void org.sleuthkit.datamodel.Image.finalize ( ) throws Throwable

Definition at line 134 of file Image.java.

References org.sleuthkit.datamodel.SleuthkitJNI.closeImg().

List<Content> org.sleuthkit.datamodel.Image.getChildren ( ) throws TskCoreException

Gets the child content objects of this content.

Returns: List of children

Exceptions

TskCoreException if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 269 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.getVolumes(), and org.sleuthkit.datamodel.Image.getVolumeSystems().

List<Long> org.sleuthkit.datamodel.Image.getChildrenIds ( ) throws TskCoreException

Gets the child content ids of this content.

Returns: List of children ids

Exceptions

TskCoreException if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 274 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

long org.sleuthkit.datamodel.Image.getContentSize ( SleuthkitCase sleuthkitCase ) throws TskCoreException

Gets the size of the contents of the data source in bytes. This size can change as archive files within the data source are expanded, files are carved, etc., and is different from the size of the data source as returned by Content.getSize, which is the size of the data source as a file.

Parameters

sleuthkitCase The sleuthkit case instance from which to make calls to the database.

Returns: The size in bytes.

Exceptions

TskCoreException Thrown when there is an issue trying to retrieve data from the database.

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 387 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getId().

Content org.sleuthkit.datamodel.Image.getDataSource ( )

Gets the root data source (image, virtual directory, etc.) of this content.

Returns: Content associated with data source or null if one can't be found

Exceptions

TskCoreException if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 124 of file Image.java.

String org.sleuthkit.datamodel.Image.getDeviceId ( )

Gets the ASCII-printable identifier for the device associated with the data source. This identifier is intended to be unique across multiple cases (e.g., a UUID).

Returns: The device id.

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 367 of file Image.java.

List<FileSystem> org.sleuthkit.datamodel.Image.getFileSystems ( ) throws TskCoreException

Returns: a list of FileSystems in this Image. This includes FileSystems that are both children of this Image as well as children of Volumes in this image.

Exceptions

TskCoreException

Definition at line 242 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.verifyImageSize().

synchronized long org.sleuthkit.datamodel.Image.getImageHandle ( ) throws TskCoreException

Get the handle to the sleuthkit image info object

Returns: the object pointer

Exceptions

TskCoreException

Definition at line 115 of file Image.java.

References org.sleuthkit.datamodel.SleuthkitJNI.openImage().

Referenced by org.sleuthkit.datamodel.VolumeSystem.getVolumeSystemHandle(), org.sleuthkit.datamodel.Image.read(), and org.sleuthkit.datamodel.LayoutFile.readInt().

String org.sleuthkit.datamodel.Image.getMd5 ( )

gets the md5 hash value

Returns: md5 hash if attained(from database). returns null if not set.

Definition at line 355 of file Image.java.

String [] org.sleuthkit.datamodel.Image.getPaths ( )

Get the image path

Returns: image path

Definition at line 195 of file Image.java.

long org.sleuthkit.datamodel.Image.getSize ( )

Get the (reported) size of the content object and, in theory, how much you should be able to read from it. In some cases, data corruption may mean that you cannot read this much data.

Returns: size of the content in bytes

Implements org.sleuthkit.datamodel.Content.

Definition at line 152 of file Image.java.

References org.sleuthkit.datamodel.SleuthkitJNI.findDeviceSize(), and org.sleuthkit.datamodel.AbstractContent.getName().

long org.sleuthkit.datamodel.Image.getSsize ( )

Get the sector size

Returns: sector size

Definition at line 181 of file Image.java.

String org.sleuthkit.datamodel.Image.getTimeZone ( )

Get the timezone set for the image

Returns: timezone string representation

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 254 of file Image.java.

Referenced by org.sleuthkit.datamodel.BlackboardAttribute.getDisplayString().

TskData.TSK_IMG_TYPE_ENUM org.sleuthkit.datamodel.Image.getType ( )

Get the image type

Returns: image type

Definition at line 172 of file Image.java.

References org.sleuthkit.datamodel.TskData.TSK_IMG_TYPE_ENUM.valueOf().

String org.sleuthkit.datamodel.Image.getUniquePath ( ) throws TskCoreException

Returns: returns the full path to this Content object starting with a "/" followed by the Image name and similarly for all other segments in the hierarchy.

Implements org.sleuthkit.datamodel.Content.

Definition at line 186 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getName().

List<Volume> org.sleuthkit.datamodel.Image.getVolumes ( ) throws TskCoreException

Returns: a list of Volume associated with this Image.

Exceptions

TskCoreException

Definition at line 222 of file Image.java.

References org.sleuthkit.datamodel.Image.getChildren().

List<VolumeSystem> org.sleuthkit.datamodel.Image.getVolumeSystems ( ) throws TskCoreException

Returns: a list of VolumeSystem associated with this Image.

Exceptions

TskCoreException

Definition at line 204 of file Image.java.

References org.sleuthkit.datamodel.Image.getChildren().

Referenced by org.sleuthkit.datamodel.Image.verifyImageSize().

Boolean org.sleuthkit.datamodel.Image.imageFileExists ( )

Test if the file that created this image exists on disk. Does not work on local disks - will always return false

Returns: True if the file still exists

Definition at line 289 of file Image.java.

References org.sleuthkit.datamodel.AbstractFile.exists().

int org.sleuthkit.datamodel.Image.read	(	byte[]	buf,
		long	offset,
		long	len
	)		throws TskCoreException

Reads data that this content object is associated with (file contents, volume contents, etc.).

Parameters

buf	a character array of data (in bytes) to copy read data to
offset	byte offset in the content to start reading from
len	number of bytes to read into buf.