19 package org.sleuthkit.datamodel;
21 import java.io.BufferedReader;
22 import java.io.FileReader;
23 import java.io.IOException;
24 import java.text.DateFormat;
25 import java.text.SimpleDateFormat;
26 import java.util.ArrayList;
27 import java.util.Arrays;
28 import java.util.GregorianCalendar;
29 import java.util.HashMap;
30 import java.util.HashSet;
31 import java.util.List;
34 import java.util.TimeZone;
35 import java.util.UUID;
36 import java.util.concurrent.locks.ReadWriteLock;
37 import java.util.concurrent.locks.ReentrantReadWriteLock;
56 private static final ReadWriteLock tskLock =
new ReentrantReadWriteLock();
75 private static class CaseHandles {
80 private final Map<String, Long> imageHandleCache =
new HashMap<>();
86 private final Map<Long, Map<Long, Long>> fsHandleCache =
new HashMap<>();
92 private final Set<Long> fileHandleCache =
new HashSet<>();
94 private final Map<Long, List<Long>> fileSystemToFileHandles =
new HashMap<>();
96 private final Map<Long, Map<Long, Long>> poolHandleCache =
new HashMap<>();
99 private final List<Long> poolImgCache =
new ArrayList<>();
108 private final List<Long> poolFsList =
new ArrayList<>();
110 private CaseHandles() {
121 private static class HandleCache {
126 private static final Object cacheLock =
new Object();
128 private static final Map<Long, CaseHandles> caseHandlesCache =
new HashMap<>();
130 private static final String INVALID_FILE_HANDLE =
"Invalid file handle.";
141 private static final List<Long> poolFileHandles =
new ArrayList<>();
148 private static void createCaseHandleCache(
long caseDbPointer) {
149 caseHandlesCache.put(caseDbPointer,
new CaseHandles());
161 synchronized (cacheLock) {
162 if (caseHandlesCache.keySet().size() > 1) {
163 throw new TskCoreException(
"Can not get default case handle with multiple open cases");
164 }
else if (caseHandlesCache.keySet().isEmpty()) {
165 throw new TskCoreException(
"Can not get default case handle with no open case");
168 return (caseHandlesCache.keySet().iterator().next());
179 private static CaseHandles getCaseHandles(
long caseDbPointer) {
180 synchronized (cacheLock) {
181 return caseHandlesCache.get(caseDbPointer);
190 private static void removeCaseHandlesCache(
long caseDbPointer) {
191 synchronized (cacheLock) {
192 if (caseHandlesCache.containsKey(caseDbPointer)) {
193 caseHandlesCache.get(caseDbPointer).fsHandleCache.clear();
194 caseHandlesCache.get(caseDbPointer).imageHandleCache.clear();
195 caseHandlesCache.get(caseDbPointer).fileHandleCache.clear();
196 caseHandlesCache.get(caseDbPointer).fileSystemToFileHandles.clear();
197 caseHandlesCache.get(caseDbPointer).poolHandleCache.clear();
198 caseHandlesCache.remove(caseDbPointer);
210 private static boolean isImageInAnyCache(
long imgHandle) {
211 synchronized (cacheLock) {
212 for (
long caseDbPointer:caseHandlesCache.keySet()) {
213 if (caseHandlesCache.get(caseDbPointer).fsHandleCache.keySet().contains(imgHandle)) {
227 private static void addFileHandle(
long caseDbPointer,
long fileHandle,
long fsHandle) {
228 synchronized (cacheLock) {
230 getCaseHandles(caseDbPointer).fileHandleCache.add(fileHandle);
233 if (getCaseHandles(caseDbPointer).fileSystemToFileHandles.containsKey(fsHandle)) {
234 getCaseHandles(caseDbPointer).fileSystemToFileHandles.get(fsHandle).add(fileHandle);
236 getCaseHandles(caseDbPointer).fileSystemToFileHandles.put(fsHandle,
new ArrayList<Long>(Arrays.asList(fileHandle)));
247 private static void removeFileHandle(
long fileHandle,
SleuthkitCase skCase) {
248 synchronized (cacheLock) {
250 if (skCase != null) {
252 getCaseHandles(skCase.getCaseDbPointer()).fileHandleCache.remove(fileHandle);
259 for (
long caseDbPointer:caseHandlesCache.keySet()) {
260 if (caseHandlesCache.get(caseDbPointer).fileHandleCache.contains(fileHandle)) {
261 caseHandlesCache.get(caseDbPointer).fileHandleCache.remove(fileHandle);
276 private static boolean isValidFileHandle(
long fileHandle) {
277 synchronized (cacheLock) {
278 for (
long caseDbPointer:caseHandlesCache.keySet()) {
279 if (caseHandlesCache.get(caseDbPointer).fileHandleCache.contains(fileHandle)) {
287 private static void closeHandlesAndClearCache(
long caseDbPointer)
throws TskCoreException {
288 synchronized (cacheLock) {
292 for (Map<Long, Long> imageToFsMap : getCaseHandles(caseDbPointer).fsHandleCache.values()) {
293 for (Long fsHandle : imageToFsMap.values()) {
295 if (getCaseHandles(caseDbPointer).fileSystemToFileHandles.containsKey(fsHandle)) {
296 for (Long fileHandle : getCaseHandles(caseDbPointer).fileSystemToFileHandles.get(fsHandle)) {
298 if (poolFileHandles.contains(fileHandle)) {
299 poolFileHandles.remove(fileHandle);
305 closeFsNat(fsHandle);
312 getCaseHandles(caseDbPointer).poolFsList.clear();
317 for (Long imgHandle : getCaseHandles(caseDbPointer).poolHandleCache.keySet()) {
318 for (Long poolHandle : getCaseHandles(caseDbPointer).poolHandleCache.get(imgHandle).values()) {
319 closePoolNat(poolHandle);
326 for (Long imageHandle : getCaseHandles(caseDbPointer).poolImgCache) {
327 closeImgNat(imageHandle);
333 for (Long imageHandle : getCaseHandles(caseDbPointer).imageHandleCache.values()) {
334 closeImgNat(imageHandle);
337 removeCaseHandlesCache(caseDbPointer);
352 private final long caseDbPointer;
361 this.caseDbPointer = caseDbPointer;
362 HandleCache.createCaseHandleCache(caseDbPointer);
370 long getCaseDbPointer() {
371 return caseDbPointer;
381 tskLock.writeLock().lock();
383 HandleCache.closeHandlesAndClearCache(caseDbPointer);
386 tskLock.writeLock().unlock();
415 long tskAutoDbPointer = initializeAddImgNat(caseDbPointer, timezoneLongToShort(timeZone),
false,
false,
false);
416 runOpenAndAddImgNat(tskAutoDbPointer, UUID.randomUUID().toString(), imageFilePaths.toArray(
new String[0]), imageFilePaths.size(), timeZone);
417 long id = commitAddImgNat(tskAutoDbPointer);
418 skCase.addDataSourceToHasChildrenMap();
441 AddImageProcess initAddImageProcess(String timeZone,
boolean addUnallocSpace,
boolean skipFatFsOrphans, String imageCopyPath,
SleuthkitCase skCase) {
442 return new AddImageProcess(timeZone, addUnallocSpace, skipFatFsOrphans, imageCopyPath, skCase);
451 private final String timeZone;
452 private final boolean addUnallocSpace;
453 private final boolean skipFatFsOrphans;
454 private final String imageWriterPath;
455 private volatile long tskAutoDbPointer;
456 private boolean isCanceled;
472 private AddImageProcess(String timeZone,
boolean addUnallocSpace,
boolean skipFatFsOrphans, String imageWriterPath,
SleuthkitCase skCase) {
473 this.timeZone = timeZone;
474 this.addUnallocSpace = addUnallocSpace;
475 this.skipFatFsOrphans = skipFatFsOrphans;
476 this.imageWriterPath = imageWriterPath;
477 tskAutoDbPointer = 0;
478 this.isCanceled =
false;
479 this.skCase = skCase;
503 long imageHandle = 0;
505 synchronized (
this) {
506 if (0 != tskAutoDbPointer) {
507 throw new TskCoreException(
"Add image process already started");
510 imageHandle =
openImage(imageFilePaths, sectorSize,
false, caseDbPointer);
511 tskAutoDbPointer = initAddImgNat(caseDbPointer, timezoneLongToShort(timeZone), addUnallocSpace, skipFatFsOrphans);
513 if (0 == tskAutoDbPointer) {
514 throw new TskCoreException(
"initAddImgNat returned a NULL TskAutoDb pointer");
517 if (imageHandle != 0) {
518 runAddImgNat(tskAutoDbPointer, deviceId, imageHandle, timeZone, imageWriterPath);
521 releaseTSKReadLock();
534 public synchronized void stop() throws TskCoreException {
538 if (tskAutoDbPointer != 0) {
539 stopAddImgNat(tskAutoDbPointer);
542 releaseTSKReadLock();
553 public synchronized void revert() throws TskCoreException {
556 if (tskAutoDbPointer == 0) {
557 throw new TskCoreException(
"AddImgProcess::revert: AutoDB pointer is NULL");
560 revertAddImgNat(tskAutoDbPointer);
562 tskAutoDbPointer = 0;
564 releaseTSKReadLock();
577 public synchronized long commit() throws TskCoreException {
580 if (tskAutoDbPointer == 0) {
581 throw new TskCoreException(
"AddImgProcess::commit: AutoDB pointer is NULL");
584 long id = commitAddImgNat(tskAutoDbPointer);
586 skCase.addDataSourceToHasChildrenMap();
589 tskAutoDbPointer = 0;
592 releaseTSKReadLock();
603 return tskAutoDbPointer == 0 ?
"" : getCurDirNat(tskAutoDbPointer);
623 run(null, imageFilePaths, 0);
644 run(deviceId, imageFilePaths, 0);
662 return new CaseDbHandle(newCaseDbNat(path));
677 static CaseDbHandle newCaseDb(String databaseName, CaseDbConnectionInfo info)
throws TskCoreException {
678 return new CaseDbHandle(newCaseDbMultiNat(info.getHost(), info.getPort(), info.getUserName(), info.getPassword(), info.getDbType().ordinal(), databaseName));
692 static CaseDbHandle openCaseDb(String path)
throws TskCoreException {
693 return new CaseDbHandle(openCaseDbNat(path));
708 static CaseDbHandle openCaseDb(String databaseName, CaseDbConnectionInfo info)
throws TskCoreException {
709 return new CaseDbHandle(openCaseDbMultiNat(info.getHost(), info.getPort(), info.getUserName(), info.getPassword(), info.getDbType().ordinal(), databaseName));
718 return getVersionNat();
727 startVerboseLoggingNat(logPath);
742 if (skCase == null) {
745 return openImage(imageFiles, 0,
true, skCase.getCaseDbPointer());
762 if (skCase == null) {
765 return openImage(imageFiles, sSize,
true, skCase.getCaseDbPointer());
785 private static long openImage(String[] imageFiles,
int sSize,
boolean useCache, Long caseDbPointer)
throws TskCoreException {
791 StringBuilder keyBuilder =
new StringBuilder();
792 for (
int i = 0; i < imageFiles.length; ++i) {
793 keyBuilder.append(imageFiles[i]);
795 final String imageKey = keyBuilder.toString();
797 synchronized (HandleCache.cacheLock) {
798 Long nonNullCaseDbPointer = caseDbPointer;
799 if (nonNullCaseDbPointer == null) {
800 nonNullCaseDbPointer = HandleCache.getDefaultCaseDbPointer();
804 if (!useCache && HandleCache.getCaseHandles(nonNullCaseDbPointer).imageHandleCache.containsKey(imageKey)) {
805 long tempImageHandle = HandleCache.getCaseHandles(nonNullCaseDbPointer).imageHandleCache.get(imageKey);
806 HandleCache.getCaseHandles(nonNullCaseDbPointer).fsHandleCache.remove(tempImageHandle);
807 HandleCache.getCaseHandles(nonNullCaseDbPointer).imageHandleCache.remove(imageKey);
810 if (useCache && HandleCache.getCaseHandles(nonNullCaseDbPointer).imageHandleCache.containsKey(imageKey))
812 imageHandle = HandleCache.getCaseHandles(nonNullCaseDbPointer).imageHandleCache.get(imageKey);
815 imageHandle = openImgNat(imageFiles, imageFiles.length, sSize);
816 HandleCache.getCaseHandles(nonNullCaseDbPointer).fsHandleCache.put(imageHandle,
new HashMap<Long, Long>());
817 HandleCache.getCaseHandles(nonNullCaseDbPointer).imageHandleCache.put(imageKey, imageHandle);
822 releaseTSKReadLock();
841 if(! imgHandleIsValid(imgHandle)) {
844 return openVsNat(imgHandle, vsOffset);
846 releaseTSKReadLock();
866 return openVolNat(vsHandle, volId);
868 releaseTSKReadLock();
886 if(! imgHandleIsValid(imgHandle)) {
890 synchronized (HandleCache.cacheLock) {
892 if (skCase == null) {
893 caseDbPointer = HandleCache.getDefaultCaseDbPointer();
895 caseDbPointer = skCase.getCaseDbPointer();
899 if (! HandleCache.getCaseHandles(caseDbPointer).poolHandleCache.containsKey(imgHandle)) {
900 HandleCache.getCaseHandles(caseDbPointer).poolHandleCache.put(imgHandle,
new HashMap<>());
904 Map<Long, Long> poolCacheForImage = HandleCache.getCaseHandles(caseDbPointer).poolHandleCache.get(imgHandle);
906 if (poolCacheForImage.containsKey(offset)) {
907 return poolCacheForImage.get(offset);
910 long poolHandle = openPoolNat(imgHandle, offset);
911 poolCacheForImage.put(offset, poolHandle);
916 releaseTSKReadLock();
937 synchronized (HandleCache.cacheLock) {
939 if (skCase == null) {
940 caseDbPointer = HandleCache.getDefaultCaseDbPointer();
942 caseDbPointer = skCase.getCaseDbPointer();
944 final Map<Long, Long> imgOffSetToFsHandle = HandleCache.getCaseHandles(caseDbPointer).fsHandleCache.get(imgHandle);
945 if (imgOffSetToFsHandle == null) {
946 throw new TskCoreException(
"Missing image offset to file system handle cache for image handle " + imgHandle);
948 if (imgOffSetToFsHandle.containsKey(fsOffset)) {
950 fsHandle = imgOffSetToFsHandle.get(fsOffset);
952 fsHandle = openFsNat(imgHandle, fsOffset);
954 imgOffSetToFsHandle.put(fsOffset, fsHandle);
959 releaseTSKReadLock();
988 synchronized (HandleCache.cacheLock) {
990 if (skCase == null) {
991 caseDbPointer = HandleCache.getDefaultCaseDbPointer();
993 caseDbPointer = skCase.getCaseDbPointer();
995 final Map<Long, Long> imgOffSetToFsHandle = HandleCache.getCaseHandles(caseDbPointer).fsHandleCache.get(imgHandle);
996 if (imgOffSetToFsHandle == null) {
997 throw new TskCoreException(
"Missing image offset to file system handle cache for image handle " + imgHandle);
1000 if (imgOffSetToFsHandle.containsKey(poolBlock)) {
1002 fsHandle = imgOffSetToFsHandle.get(poolBlock);
1004 long poolImgHandle = getImgInfoForPoolNat(poolHandle, poolBlock);
1005 HandleCache.getCaseHandles(caseDbPointer).poolImgCache.add(poolImgHandle);
1006 fsHandle = openFsNat(poolImgHandle, fsOffset);
1008 imgOffSetToFsHandle.put(poolBlock, fsHandle);
1009 HandleCache.getCaseHandles(caseDbPointer).poolFsList.add(fsHandle);
1014 releaseTSKWriteLock();
1044 boolean withinPool =
false;
1045 synchronized (HandleCache.cacheLock) {
1047 if (skCase == null) {
1048 caseDbPointer = HandleCache.getDefaultCaseDbPointer();
1050 caseDbPointer = skCase.getCaseDbPointer();
1052 if (HandleCache.getCaseHandles(caseDbPointer).poolFsList.contains(fsHandle)) {
1068 long fileHandle = openFileNat(fsHandle, fileId, attrType.getValue(), convertSignedToUnsigned(attrId));
1069 synchronized (HandleCache.cacheLock) {
1071 if (skCase == null) {
1072 caseDbPointer = HandleCache.getDefaultCaseDbPointer();
1074 caseDbPointer = skCase.getCaseDbPointer();
1076 HandleCache.addFileHandle(caseDbPointer, fileHandle, fsHandle);
1081 HandleCache.poolFileHandles.add(fileHandle);
1087 releaseTSKWriteLock();
1089 releaseTSKReadLock();
1101 private static int convertSignedToUnsigned(
int val) {
1106 return val & 0xffff;
1114 private static boolean imgHandleIsValid(
long imgHandle) {
1115 synchronized(HandleCache.cacheLock) {
1116 return HandleCache.isImageInAnyCache(imgHandle);
1138 if(! imgHandleIsValid(imgHandle)) {
1142 return readImgNat(imgHandle, readBuffer, offset, len);
1144 releaseTSKReadLock();
1165 return readVsNat(vsHandle, readBuffer, offset, len);
1167 releaseTSKReadLock();
1183 static int readPool(
long poolHandle, byte[] readBuffer,
long offset,
long len)
throws TskCoreException {
1186 return readPoolNat(poolHandle, readBuffer, offset, len);
1188 releaseTSKReadLock();
1210 return readVolNat(volHandle, readBuffer, offset, len);
1212 releaseTSKReadLock();
1234 return readFsNat(fsHandle, readBuffer, offset, len);
1236 releaseTSKReadLock();
1244 private enum TSK_FS_FILE_READ_OFFSET_TYPE_ENUM {
1248 private final int val;
1250 TSK_FS_FILE_READ_OFFSET_TYPE_ENUM(
int val) {
1274 boolean withinPool =
false;
1275 synchronized (HandleCache.cacheLock) {
1276 if (HandleCache.poolFileHandles.contains(fileHandle)) {
1292 if (!HandleCache.isValidFileHandle(fileHandle)) {
1296 return readFileNat(fileHandle, readBuffer, offset, TSK_FS_FILE_READ_OFFSET_TYPE_ENUM.START_OF_FILE.getValue(), len);
1299 releaseTSKWriteLock();
1301 releaseTSKReadLock();
1323 if (!HandleCache.isValidFileHandle(fileHandle)) {
1327 return readFileNat(fileHandle, readBuffer, offset, TSK_FS_FILE_READ_OFFSET_TYPE_ENUM.START_OF_SLACK.getValue(), len);
1329 releaseTSKReadLock();
1346 if (!HandleCache.isValidFileHandle(fileHandle)) {
1351 java.io.File tmp = java.io.File.createTempFile(
"tsk",
".txt");
1353 saveFileMetaDataTextNat(fileHandle, tmp.getAbsolutePath());
1355 FileReader fr =
new FileReader(tmp.getAbsolutePath());
1356 BufferedReader textReader =
new BufferedReader(fr);
1358 List<String> lines =
new ArrayList<String>();
1360 String line = textReader.readLine();
1370 }
catch (IOException ex) {
1371 throw new TskCoreException(
"Error reading istat output: " + ex.getLocalizedMessage());
1374 releaseTSKReadLock();
1394 boolean withinPool =
false;
1395 synchronized (HandleCache.cacheLock) {
1396 if (HandleCache.poolFileHandles.contains(fileHandle)) {
1412 synchronized (HandleCache.cacheLock) {
1413 if (!HandleCache.isValidFileHandle(fileHandle)) {
1417 closeFileNat(fileHandle);
1418 HandleCache.removeFileHandle(fileHandle, skCase);
1419 if (HandleCache.poolFileHandles.contains(fileHandle)) {
1420 HandleCache.poolFileHandles.remove(fileHandle);
1425 releaseTSKWriteLock();
1427 releaseTSKReadLock();
1440 hashDbCreateIndexNat(dbHandle);
1453 return hashDbIndexExistsNat(dbHandle);
1467 return hashDbIsReindexableNat(dbHandle);
1480 return hashDbPathNat(dbHandle);
1493 return hashDbIndexPathNat(dbHandle);
1503 return hashDbOpenNat(path);
1516 return hashDbNewNat(path);
1539 hashDbClose(dbHandle);
1552 return hashDbGetDisplayName(dbHandle);
1566 return hashDbLookup(hash, dbHandle);
1581 return hashDbLookupVerbose(hash, dbHandle);
1597 hashDbAddEntryNat(filename, md5, sha1, sha256, comment, dbHandle);
1601 hashDbBeginTransactionNat(dbHandle);
1604 hashDbAddEntryNat(entry.getFileName(), entry.getMd5Hash(), entry.getSha1Hash(), entry.getSha256Hash(), entry.getComment(), dbHandle);
1606 hashDbCommitTransactionNat(dbHandle);
1609 hashDbRollbackTransactionNat(dbHandle);
1619 return hashDbIsUpdateableNat(dbHandle);
1623 return hashDbIsIdxOnlyNat(dbHandle);
1635 private static String timezoneLongToShort(String timezoneLongForm) {
1636 if (timezoneLongForm == null || timezoneLongForm.isEmpty()) {
1640 String timezoneShortForm;
1641 TimeZone zone = TimeZone.getTimeZone(timezoneLongForm);
1642 int offset = zone.getRawOffset() / 1000;
1643 int hour = offset / 3600;
1644 int min = (offset % 3600) / 60;
1645 DateFormat dfm =
new SimpleDateFormat(
"z");
1646 dfm.setTimeZone(zone);
1647 boolean hasDaylight = zone.useDaylightTime();
1648 String first = dfm.format(
new GregorianCalendar(2010, 1, 1).getTime()).substring(0, 3);
1649 String second = dfm.format(
new GregorianCalendar(2011, 6, 6).getTime()).substring(0, 3);
1650 int mid = hour * -1;
1651 timezoneShortForm = first + Integer.toString(mid);
1653 timezoneShortForm = timezoneShortForm +
":" + (min < 10 ?
"0" :
"") + Integer.toString(min);
1656 timezoneShortForm += second;
1658 return timezoneShortForm;
1674 if(! imgHandleIsValid(imgHandle)) {
1677 return finishImageWriterNat(imgHandle);
1679 releaseTSKReadLock();
1693 if (imgHandleIsValid(imgHandle)) {
1694 return getFinishImageProgressNat(imgHandle);
1699 releaseTSKReadLock();
1711 if (imgHandleIsValid(imgHandle)) {
1712 cancelFinishImageNat(imgHandle);
1715 releaseTSKReadLock();
1731 return findDeviceSizeNat(devPath);
1735 return isImageSupportedNat(imagePath);
1742 private static void getTSKReadLock() {
1743 tskLock.readLock().lock();
1749 private static void releaseTSKReadLock() {
1750 tskLock.readLock().unlock();
1760 private static void getTSKWriteLock() {
1761 tskLock.writeLock().lock();
1767 private static void releaseTSKWriteLock() {
1768 tskLock.writeLock().unlock();
1818 return openImage(imageFiles, 0,
true, null);
1836 return openImage(imageFiles, sSize,
true, null);
1855 return openFs(imgHandle, fsOffset, null);
1874 return openFile(fsHandle, fileId, attrType, attrId, null);
1878 private static native String getVersionNat();
1880 private static native
void startVerboseLoggingNat(String logPath);
1882 private static native
long newCaseDbNat(String dbPath)
throws TskCoreException;
1884 private static native
long newCaseDbMultiNat(String hostNameOrIP, String portNumber, String userName, String password,
int dbTypeOrdinal, String databaseName);
1886 private static native
long openCaseDbMultiNat(String hostNameOrIP, String portNumber, String userName, String password,
int dbTypeOrdinal, String databaseName);
1888 private static native
long openCaseDbNat(String path)
throws TskCoreException;
1890 private static native
void closeCaseDbNat(
long db)
throws TskCoreException;
1892 private static native
int hashDbOpenNat(String hashDbPath)
throws TskCoreException;
1894 private static native
int hashDbNewNat(String hashDbPath)
throws TskCoreException;
1896 private static native
int hashDbBeginTransactionNat(
int dbHandle)
throws TskCoreException;
1898 private static native
int hashDbCommitTransactionNat(
int dbHandle)
throws TskCoreException;
1900 private static native
int hashDbRollbackTransactionNat(
int dbHandle)
throws TskCoreException;
1902 private static native
int hashDbAddEntryNat(String filename, String hashMd5, String hashSha1, String hashSha256, String comment,
int dbHandle)
throws TskCoreException;
1904 private static native
boolean hashDbIsUpdateableNat(
int dbHandle);
1906 private static native
boolean hashDbIsReindexableNat(
int dbHandle);
1908 private static native String hashDbPathNat(
int dbHandle);
1910 private static native String hashDbIndexPathNat(
int dbHandle);
1912 private static native String hashDbGetDisplayName(
int dbHandle)
throws TskCoreException;
1914 private static native
void hashDbCloseAll() throws TskCoreException;
1916 private static native
void hashDbClose(
int dbHandle) throws TskCoreException;
1918 private static native
void hashDbCreateIndexNat(
int dbHandle) throws TskCoreException;
1920 private static native
boolean hashDbIndexExistsNat(
int dbHandle) throws TskCoreException;
1922 private static native
boolean hashDbIsIdxOnlyNat(
int dbHandle) throws TskCoreException;
1924 private static native
boolean hashDbLookup(String hash,
int dbHandle) throws TskCoreException;
1926 private static native
HashHitInfo hashDbLookupVerbose(String hash,
int dbHandle) throws TskCoreException;
1928 private static native
long initAddImgNat(
long db, String timezone,
boolean addUnallocSpace,
boolean skipFatFsOrphans) throws TskCoreException;
1930 private static native
long initializeAddImgNat(
long db, String timezone,
boolean addFileSystems,
boolean addUnallocSpace,
boolean skipFatFsOrphans) throws TskCoreException;
1932 private static native
void runOpenAndAddImgNat(
long process, String deviceId, String[] imgPath,
int splits, String timezone) throws TskCoreException,
TskDataException;
1934 private static native
void runAddImgNat(
long process, String deviceId,
long a_img_info, String timeZone, String imageWriterPath) throws TskCoreException, TskDataException;
1936 private static native
void stopAddImgNat(
long process) throws TskCoreException;
1938 private static native
void revertAddImgNat(
long process) throws TskCoreException;
1940 private static native
long commitAddImgNat(
long process) throws TskCoreException;
1942 private static native
long openImgNat(String[] imgPath,
int splits,
int sSize) throws TskCoreException;
1944 private static native
long openVsNat(
long imgHandle,
long vsOffset) throws TskCoreException;
1946 private static native
long openVolNat(
long vsHandle,
long volId) throws TskCoreException;
1948 private static native
long openPoolNat(
long imgHandle,
long offset) throws TskCoreException;
1950 private static native
long getImgInfoForPoolNat(
long poolHandle,
long poolOffset) throws TskCoreException;
1952 private static native
long openFsNat(
long imgHandle,
long fsId) throws TskCoreException;
1954 private static native
long openFileNat(
long fsHandle,
long fileId,
int attrType,
int attrId) throws TskCoreException;
1956 private static native
int readImgNat(
long imgHandle, byte[] readBuffer,
long offset,
long len) throws TskCoreException;
1958 private static native
int readVsNat(
long vsHandle, byte[] readBuffer,
long offset,
long len) throws TskCoreException;
1960 private static native
int readPoolNat(
long poolHandle, byte[] readBuffer,
long offset,
long len) throws TskCoreException;
1962 private static native
int readVolNat(
long volHandle, byte[] readBuffer,
long offset,
long len) throws TskCoreException;
1964 private static native
int readFsNat(
long fsHandle, byte[] readBuffer,
long offset,
long len) throws TskCoreException;
1966 private static native
int readFileNat(
long fileHandle, byte[] readBuffer,
long offset,
int offset_type,
long len) throws TskCoreException;
1968 private static native
int saveFileMetaDataTextNat(
long fileHandle, String fileName) throws TskCoreException;
1970 private static native
void closeImgNat(
long imgHandle);
1972 private static native
void closePoolNat(
long poolHandle);
1974 private static native
void closeVsNat(
long vsHandle);
1976 private static native
void closeFsNat(
long fsHandle);
1978 private static native
void closeFileNat(
long fileHandle);
1980 private static native
long findDeviceSizeNat(String devicePath) throws TskCoreException;
1982 private static native String getCurDirNat(
long process);
1984 private static native
boolean isImageSupportedNat(String imagePath);
1986 private static native
int finishImageWriterNat(
long a_img_info);
1988 private static native
int getFinishImageProgressNat(
long a_img_info);
1990 private static native
void cancelFinishImageNat(
long a_img_info);
static int readImg(long imgHandle, byte[] readBuffer, long offset, long len)
static String getHashDatabaseIndexPath(int dbHandle)
static int readVs(long vsHandle, byte[] readBuffer, long offset, long len)
static void createLookupIndexForHashDatabase(int dbHandle)
static void addToHashDatabase(String filename, String md5, String sha1, String sha256, String comment, int dbHandle)
static long openFile(long fsHandle, long fileId, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, SleuthkitCase skCase)
static int createHashDatabase(String path)
static void closeFs(long fsHandle)
static void cancelFinishImage(long imgHandle)
static long openFile(long fsHandle, long fileId, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId)
void run(String deviceId, String[] imageFilePaths)
static int readFile(long fileHandle, byte[] readBuffer, long offset, long len)
static int finishImageWriter(long imgHandle)
static HashHitInfo lookupInHashDatabaseVerbose(String hash, int dbHandle)
static long openVs(long imgHandle, long vsOffset)
synchronized long commit()
static long openImage(String[] imageFiles, SleuthkitCase skCase)
static boolean hashDatabaseIsIndexOnly(int dbHandle)
synchronized void revert()
static boolean isImageSupported(String imagePath)
static int readVsPart(long volHandle, byte[] readBuffer, long offset, long len)
static boolean loadSleuthkitJNI()
static void closeFile(long fileHandle, SleuthkitCase skCase)
static long openImage(String[] imageFiles, int sSize)
static void closeVs(long vsHandle)
static long openImage(String[] imageFiles)
static long openFs(long imgHandle, long fsOffset, SleuthkitCase skCase)
static long openImage(String[] imageFiles, int sSize, SleuthkitCase skCase)
void run(String deviceId, String[] imageFilePaths, int sectorSize)
static long findDeviceSize(String devPath)
static String getHashDatabaseDisplayName(int dbHandle)
static List< String > getFileMetaDataText(long fileHandle)
static void closeImg(long imgHandle)
static long openFs(long imgHandle, long fsOffset)
void run(String[] imageFilePaths)
synchronized String currentDirectory()
static int getFinishImageProgress(long imgHandle)
static int openHashDatabase(String path)
static void closeFile(long fileHandle)
static boolean lookupInHashDatabase(String hash, int dbHandle)
static boolean hashDatabaseHasLookupIndex(int dbHandle)
static long openVsPart(long vsHandle, long volId)
static int readFileSlack(long fileHandle, byte[] readBuffer, long offset, long len)
static boolean isUpdateableHashDatabase(int dbHandle)
static void addToHashDatabase(List< HashEntry > hashes, int dbHandle)
static void closeAllHashDatabases()
static boolean hashDatabaseCanBeReindexed(int dbHandle)
static String getVersion()
static void startVerboseLogging(String logPath)
static int readFs(long fsHandle, byte[] readBuffer, long offset, long len)
static String getHashDatabasePath(int dbHandle)
static void closeHashDatabase(int dbHandle)