Sleuth Kit Java Bindings (JNI)  4.6
Java bindings for using The Sleuth Kit
TskData.java
Go to the documentation of this file.
1 /*
2  * Sleuth Kit Data Model
3  *
4  * Copyright 2011 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.text.MessageFormat;
22 import java.util.ResourceBundle;
23 import java.util.EnumSet;
24 import java.util.Set;
25 
30 public class TskData {
31 
32  private static ResourceBundle bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle");
33 
38  public enum TSK_FS_NAME_TYPE_ENUM {
39 
40  UNDEF(0, "-"),
41  FIFO(1, "p"),
42  CHR(2, "c"),
43  DIR(3, "d"),
44  BLK(4, "b"),
45  REG(5, "r"),
46  LNK(6, "l"),
47  SOCK(7, "s"),
48  SHAD(8, "h"),
49  WHT(9, "w"),
50  VIRT(10, "v"),
51  VIRT_DIR(11, "V");
52 
53  private short dirType;
54  String label;
55 
56  private TSK_FS_NAME_TYPE_ENUM(int type, String label) {
57  this.dirType = (short) type;
58  this.label = label;
59  }
60 
66  public short getValue() {
67  return dirType;
68  }
69 
75  public String getLabel() {
76  return this.label;
77  }
78 
86  static public TSK_FS_NAME_TYPE_ENUM valueOf(short dir_type) {
87  for (TSK_FS_NAME_TYPE_ENUM v : TSK_FS_NAME_TYPE_ENUM.values()) {
88  if (v.dirType == dir_type) {
89  return v;
90  }
91  }
92  throw new IllegalArgumentException(
93  MessageFormat.format(bundle.getString("TskData.tskFsNameTypeEnum.exception.msg1.text"), dir_type));
94  }
95  }
96 
101  public enum TSK_FS_META_TYPE_ENUM {
102 
115 
116  private short metaType;
117  private String metaTypeStr;
118 
119  private TSK_FS_META_TYPE_ENUM(int type, String metaTypeStr) {
120  this.metaType = (short) type;
121  this.metaTypeStr = metaTypeStr;
122  }
123 
129  public short getValue() {
130  return metaType;
131  }
132 
133  @Override
134  public String toString() {
135  return metaTypeStr;
136  }
137 
138  public static TSK_FS_META_TYPE_ENUM valueOf(short metaType) {
139  for (TSK_FS_META_TYPE_ENUM type : TSK_FS_META_TYPE_ENUM.values()) {
140  if (type.getValue() == metaType) {
141  return type;
142  }
143  }
144  throw new IllegalArgumentException(
145  MessageFormat.format(bundle.getString("TskData.tskFsMetaTypeEnum.exception.msg1.text"), metaType));
146  }
147  }
148 
154  public enum TSK_FS_NAME_FLAG_ENUM {
155 
156  ALLOC(1, bundle.getString("TskData.tskFsNameFlagEnum.allocated")),
157  UNALLOC(2, bundle.getString("TskData.tskFsNameFlagEnum.unallocated"));
158 
159  private short dirFlag;
160  private String dirFlagStr;
161 
162  private TSK_FS_NAME_FLAG_ENUM(int flag, String dirFlagStr) {
163  this.dirFlag = (short) flag;
164  this.dirFlagStr = dirFlagStr;
165  }
166 
172  public short getValue() {
173  return dirFlag;
174  }
175 
176  @Override
177  public String toString() {
178  return dirFlagStr;
179  }
180 
188  public static TSK_FS_NAME_FLAG_ENUM valueOf(int dirFlag) {
189  for (TSK_FS_NAME_FLAG_ENUM flag : TSK_FS_NAME_FLAG_ENUM.values()) {
190  if (flag.dirFlag == dirFlag) {
191  return flag;
192  }
193  }
194  throw new IllegalArgumentException(
195  MessageFormat.format(bundle.getString("TskData.tskFsNameFlagEnum.exception.msg1.text"), dirFlag));
196  }
197  }
198 
204  public enum TSK_FS_META_FLAG_ENUM {
205 
206  ALLOC(1, bundle.getString("TskData.tskFsMetaFlagEnum.allocated")),
207  UNALLOC(2, bundle.getString("TskData.tskFsMetaFlagEnum.unallocated")),
208  USED(4, bundle.getString("TskData.tskFsMetaFlagEnum.used")),
209  UNUSED(8, bundle.getString("TskData.tskFsMetaFlagEnum.unused")),
210  COMP(16, bundle.getString("TskData.tskFsMetaFlagEnum.compressed")),
211  ORPHAN(32, bundle.getString("TskData.tskFsMetaFlagEnum.orphan"));
212 
213  private short meta_flag;
214  private String label;
215 
216  private TSK_FS_META_FLAG_ENUM(int flag, String label) {
217  this.meta_flag = (short) flag;
218  this.label = label;
219  }
220 
226  public short getValue() {
227  return meta_flag;
228  }
229 
235  @Override
236  public String toString() {
237  return label;
238  }
239 
247  public static Set<TSK_FS_META_FLAG_ENUM> valuesOf(short metaFlags) {
248  Set<TSK_FS_META_FLAG_ENUM> matchedFlags = EnumSet.noneOf(TSK_FS_META_FLAG_ENUM.class);
249 
250  for (TSK_FS_META_FLAG_ENUM v : TSK_FS_META_FLAG_ENUM.values()) {
251  long flag = v.getValue();
252 
253  if ((metaFlags & flag) == flag) {
254  matchedFlags.add(v);
255  }
256  }
257 
258  return matchedFlags;
259  }
260 
261  public static short toInt(Set<TSK_FS_META_FLAG_ENUM> metaFlags) {
262  short val = 0;
263  for (TSK_FS_META_FLAG_ENUM flag : metaFlags) {
264  val |= flag.getValue();
265  }
266  return val;
267  }
268 
269  }
270 
275  public enum TSK_FS_ATTR_TYPE_ENUM {
276 
282  TSK_FS_ATTR_TYPE_NTFS_VVER(0x40), // 64 (NT)
283  TSK_FS_ATTR_TYPE_NTFS_OBJID(0x40), // 64 (2K)
291  TSK_FS_ATTR_TYPE_NTFS_SYMLNK(0xC0), // 192 (NT)
292  TSK_FS_ATTR_TYPE_NTFS_REPARSE(0xC0), // 192 (2K)
297  TSK_FS_ATTR_TYPE_UNIX_INDIR(0x1001), // Indirect blocks for UFS and ExtX file systems
298 
299  // Types for HFS+ File Attributes
300  TSK_FS_ATTR_TYPE_HFS_DEFAULT(0x01), // 1 Data fork of fs special files and misc
301  TSK_FS_ATTR_TYPE_HFS_DATA(0x1100), // 4352 Data fork of regular files
302  TSK_FS_ATTR_TYPE_HFS_RSRC(0x1101), // 4353 Resource fork of regular files
303  TSK_FS_ATTR_TYPE_HFS_EXT_ATTR(0x1102), // 4354 Extended Attributes) except compression records
304  TSK_FS_ATTR_TYPE_HFS_COMP_REC(0x1103); // 4355 Compression records
305 
306  private int val;
307 
308  private TSK_FS_ATTR_TYPE_ENUM(int val) {
309  this.val = val;
310  }
311 
312  public int getValue() {
313  return val;
314  }
315 
316  public static TSK_FS_ATTR_TYPE_ENUM valueOf(int val) {
317  for (TSK_FS_ATTR_TYPE_ENUM type : TSK_FS_ATTR_TYPE_ENUM.values()) {
318  if (type.val == val) {
319  return type;
320  }
321  }
322  throw new IllegalArgumentException(
323  MessageFormat.format(bundle.getString("TskData.tskFsAttrTypeEnum.exception.msg1.text"), val));
324  }
325  };
326 
331  public enum TSK_VS_PART_FLAG_ENUM {
332 
337 
338  private long vs_flag;
339 
340  private TSK_VS_PART_FLAG_ENUM(long flag) {
341  vs_flag = flag;
342  }
343 
349  public long getVsFlag() {
350  return vs_flag;
351  }
352 
353  }
354 
359  public enum TSK_FS_META_MODE_ENUM {
360  /*
361  * The following describe the file permissions
362  */
363 
367 
371 
375 
379 
380  private short mode;
381 
382  private TSK_FS_META_MODE_ENUM(int mode) {
383  this.mode = (short) mode;
384  }
385 
391  public short getMode() {
392  return mode;
393  }
394 
403  public static Set<TSK_FS_META_MODE_ENUM> valuesOf(short modes) {
404  Set<TSK_FS_META_MODE_ENUM> matchedFlags = EnumSet.noneOf(TSK_FS_META_MODE_ENUM.class);
405 
406  for (TSK_FS_META_MODE_ENUM v : TSK_FS_META_MODE_ENUM.values()) {
407  long flag = v.getMode();
408 
409  if ((modes & flag) == flag) {
410  matchedFlags.add(v);
411  }
412  }
413 
414  return matchedFlags;
415  }
416 
422  public static short toInt(Set<TSK_FS_META_MODE_ENUM> modes) {
423  short modesInt = 0;
424  for (TSK_FS_META_MODE_ENUM mode : modes) {
425  modesInt |= mode.getMode();
426  }
427  return modesInt;
428  }
429  };
430 
435  public enum TSK_FS_TYPE_ENUM {
436 
437  TSK_FS_TYPE_DETECT(0x00000000, bundle.getString("TskData.tskFsTypeEnum.autoDetect")),
438  TSK_FS_TYPE_NTFS(0x00000001, "NTFS"),
439  TSK_FS_TYPE_NTFS_DETECT(0x00000001, bundle.getString("TskData.tskFsTypeEnum.NTFSautoDetect")),
440  TSK_FS_TYPE_FAT12(0x00000002, "FAT12"),
441  TSK_FS_TYPE_FAT16(0x00000004, "FAT16"),
442  TSK_FS_TYPE_FAT32(0x00000008, "FAT32"),
443  TSK_FS_TYPE_EXFAT(0x0000000A, "ExFAT"),
444  TSK_FS_TYPE_FAT_DETECT(0x0000000e, bundle.getString("TskData.tskFsTypeEnum.FATautoDetect")),
445  TSK_FS_TYPE_FFS1(0x00000010, "UFS1"),
446  TSK_FS_TYPE_FFS1B(0x00000020, "UFS1b"),
447  TSK_FS_TYPE_FFS2(0x00000040, "UFS2"),
448  TSK_FS_TYPE_FFS_DETECT(0x00000070, "UFS"),
449  TSK_FS_TYPE_EXT2(0x00000080, "Ext2"),
450  TSK_FS_TYPE_EXT3(0x00000100, "Ext3"),
451  TSK_FS_TYPE_EXT_DETECT(0x00000180, bundle.getString("TskData.tskFsTypeEnum.ExtXautoDetect")),
452  TSK_FS_TYPE_SWAP(0x00000200, "SWAP"),
453  TSK_FS_TYPE_SWAP_DETECT(0x00000200, bundle.getString("TskData.tskFsTypeEnum.SWAPautoDetect")),
454  TSK_FS_TYPE_RAW(0x00000400, "RAW"),
455  TSK_FS_TYPE_RAW_DETECT(0x00000400, bundle.getString("TskData.tskFsTypeEnum.RAWautoDetect")),
456  TSK_FS_TYPE_ISO9660(0x00000800, "ISO9660"),
457  TSK_FS_TYPE_ISO9660_DETECT(0x00000800, bundle.getString("TskData.tskFsTypeEnum.ISO9660autoDetect")),
458  TSK_FS_TYPE_HFS(0x00001000, "HFS"),
459  TSK_FS_TYPE_HFS_DETECT(0x00001000, bundle.getString("TskData.tskFsTypeEnum.HFSautoDetect")),
460  TSK_FS_TYPE_EXT4(0x00002000, "Ext4"),
461  TSK_FS_TYPE_YAFFS2(0x00004000, "YAFFS2"),
462  TSK_FS_TYPE_YAFFS2_DETECT(0x00004000, bundle.getString("TskData.tskFsTypeEnum.YAFFS2autoDetect")),
463  TSK_FS_TYPE_APFS(0x00010000, "APFS"),
464  TSK_FS_TYPE_APFS_DETECT(0x00010000, bundle.getString("TskData.tskFsTypeEnum.APFSautoDetect")),
465  TSK_FS_TYPE_UNSUPP(0xffffffff, bundle.getString("TskData.tskFsTypeEnum.unsupported"));
466 
467  private int value;
468  private String displayName;
469 
470  private TSK_FS_TYPE_ENUM(int value, String displayName) {
471  this.value = value;
472  this.displayName = displayName;
473  }
474 
480  public int getValue() {
481  return value;
482  }
483 
489  public String getDisplayName() {
490  return displayName;
491  }
492 
501  public static TSK_FS_TYPE_ENUM valueOf(int fsTypeValue) {
502  for (TSK_FS_TYPE_ENUM type : TSK_FS_TYPE_ENUM.values()) {
503  if (type.value == fsTypeValue) {
504  return type;
505  }
506  }
507  throw new IllegalArgumentException(
508  MessageFormat.format(bundle.getString("TskData.tskFsTypeEnum.exception.msg1.text"), fsTypeValue));
509  }
510 
511  };
512 
517  public enum TSK_IMG_TYPE_ENUM {
518 
519  TSK_IMG_TYPE_DETECT(0, bundle.getString("TskData.tskImgTypeEnum.autoDetect")), // Auto Detection
520  TSK_IMG_TYPE_RAW_SING(1, bundle.getString("TskData.tskImgTypeEnum.rawSingle")), // Single raw file (dd)
521  TSK_IMG_TYPE_RAW_SPLIT(2, bundle.getString("TskData.tskImgTypeEnum.rawSplit")), // Split raw files
522  TSK_IMG_TYPE_AFF_AFF(4, "AFF"), // Advanced Forensic Format NON-NLS
523  TSK_IMG_TYPE_AFF_AFD(8, "AFD"), // AFF Multiple File NON-NLS
524  TSK_IMG_TYPE_AFF_AFM(16, "AFM"), // AFF with external metadata NON-NLS
525  TSK_IMG_TYPE_AFF_ANY(32, "AFF"), // All AFFLIB image formats (including beta ones) NON-NLS
526  TSK_IMG_TYPE_EWF_EWF(64, "E01"), // Expert Witness format (encase) NON-NLS
527  TSK_IMG_TYPE_VMDK_VMDK(128, "VMDK"), // VMware Virtual Disk (VMDK) NON-NLS
528  TSK_IMG_TYPE_VHD_VHD(256, "VHD"), // Virtual Hard Disk (VHD) image format NON-NLS
529  TSK_IMG_TYPE_POOL_POOL(16384, "POOL"), // Pool (internal use) NON-NLS
530  TSK_IMG_TYPE_UNSUPP(65535, bundle.getString("TskData.tskImgTypeEnum.unknown")); // Unsupported Image Type
531 
532  private long imgType;
533  private String name;
534 
535  private TSK_IMG_TYPE_ENUM(long type, String name) {
536  this.imgType = type;
537  this.name = name;
538  }
539 
540  public static TSK_IMG_TYPE_ENUM valueOf(long imgType) {
541  for (TSK_IMG_TYPE_ENUM type : TSK_IMG_TYPE_ENUM.values()) {
542  if (type.getValue() == imgType) {
543  return type;
544  }
545  }
546  throw new IllegalArgumentException(
547  MessageFormat.format(bundle.getString("TskData.tskImgTypeEnum.exception.msg1.text"), imgType));
548  }
549 
555  public long getValue() {
556  return imgType;
557  }
558 
564  public String getName() {
565  return name;
566  }
567  };
568 
573  public enum TSK_VS_TYPE_ENUM {
574 
575  TSK_VS_TYPE_DETECT(0x0000, bundle.getString("TskData.tskVSTypeEnum.autoDetect")),
576  TSK_VS_TYPE_DOS(0x0001, "DOS"),
577  TSK_VS_TYPE_BSD(0x0002, "BSD"),
578  TSK_VS_TYPE_SUN(0x0004, "SUN VTOC"),
579  TSK_VS_TYPE_MAC(0x0008, "Mac"),
580  TSK_VS_TYPE_GPT(0x0010, "GPT"),
581  TSK_VS_TYPE_APFS(0x0020, "APFS"),
582  TSK_VS_TYPE_DBFILLER(0x00F0, bundle.getString("TskData.tskVSTypeEnum.fake")),
583  TSK_VS_TYPE_UNSUPP(0xFFFF, bundle.getString("TskData.tskVSTypeEnum.unsupported"));
584 
585  private long vsType;
586  private String name;
587 
588  private TSK_VS_TYPE_ENUM(long type, String name) {
589  this.vsType = type;
590  this.name = name;
591  }
592 
593  public static TSK_VS_TYPE_ENUM valueOf(long vsType) {
594  for (TSK_VS_TYPE_ENUM type : TSK_VS_TYPE_ENUM.values()) {
595  if (type.getVsType() == vsType) {
596  return type;
597  }
598  }
599  throw new IllegalArgumentException(
600  MessageFormat.format(bundle.getString("TskData.tskVSTypeEnum.exception.msg1.text"), vsType));
601  }
602 
608  public long getVsType() {
609  return vsType;
610  }
611 
617  public String getName() {
618  return name;
619  }
620  };
621 
626  public enum ObjectType {
627 
628  IMG(0),
629  VS(1),
630  VOL(2),
631  FS(3),
633  ARTIFACT(5),
634  REPORT(6),
635  POOL(7)
636  ;
637  private short objectType;
638 
639  private ObjectType(int objectType) {
640  this.objectType = (short) objectType;
641  }
642 
648  public short getObjectType() {
649  return objectType;
650  }
651 
659  public static ObjectType valueOf(short objectType) {
660  for (ObjectType v : ObjectType.values()) {
661  if (v.objectType == objectType) {
662  return v;
663  }
664  }
665  throw new IllegalArgumentException(
666  MessageFormat.format(bundle.getString("TskData.objectTypeEnum.exception.msg1.text"), objectType));
667  }
668  }
669 
675 
676  FS(0, "File System"),
677  CARVED(1, "Carved"),
678  DERIVED(2, "Derived"),
679  LOCAL(3, "Local"),
680  UNALLOC_BLOCKS(4, "Unallocated Blocks"),
681  UNUSED_BLOCKS(5, "Unused Blocks"),
682  VIRTUAL_DIR(6, "Virtual Directory"),
683  SLACK(7, "Slack"),
684  LOCAL_DIR(8, "Local Directory"),
685  LAYOUT_FILE(9, "Layout File"),
686  ;
687 
688  private final short fileType;
689  private final String name;
690 
691  private TSK_DB_FILES_TYPE_ENUM(int fileType, String name) {
692  this.fileType = (short) fileType;
693  this.name = name;
694  }
695 
703  public static TSK_DB_FILES_TYPE_ENUM valueOf(short fileType) {
704  for (TSK_DB_FILES_TYPE_ENUM type : TSK_DB_FILES_TYPE_ENUM.values()) {
705  if (type.fileType == fileType) {
706  return type;
707  }
708  }
709  throw new IllegalArgumentException(
710  MessageFormat.format(bundle.getString("TskData.tskDbFilesTypeEnum.exception.msg1.text"), fileType));
711  }
712 
718  public short getFileType() {
719  return fileType;
720  }
721 
722  public String getName() {
723  return name;
724  }
725  }
726 
731  public enum TSK_POOL_TYPE_ENUM {
732  TSK_POOL_TYPE_DETECT(0, "Auto detect"),
733  TSK_POOL_TYPE_APFS(1, "APFS Pool"),
734  TSK_POOL_TYPE_UNSUPP(0xffff, "Unsupported")
735  ;
736 
737  private final short poolType;
738  private final String name;
739 
740  TSK_POOL_TYPE_ENUM(int poolType, String name) {
741  this.poolType = (short) poolType;
742  this.name = name;
743  }
744 
752  public static TSK_POOL_TYPE_ENUM valueOf(long poolType) {
753  for (TSK_POOL_TYPE_ENUM type : TSK_POOL_TYPE_ENUM.values()) {
754  if (type.poolType == poolType) {
755  return type;
756  }
757  }
758  throw new IllegalArgumentException(
759  MessageFormat.format(bundle.getString("TskData.tskDbFilesTypeEnum.exception.msg1.text"), poolType)); // TODO
760  }
761 
767  public short getValue() {
768  return poolType;
769  }
770 
771  public String getName() {
772  return name;
773  }
774  }
775 
780  public enum FileKnown {
781 
782  UNKNOWN(0, bundle.getString("TskData.fileKnown.unknown")),
783  KNOWN(1, bundle.getString("TskData.fileKnown.known")),
784  BAD(2, bundle.getString("TskData.fileKnown.knownBad"));
785 
786  private byte known;
787  private String name;
788 
789  private FileKnown(int known, String name) {
790  this.known = (byte) known;
791  this.name = name;
792  }
793 
801  public static FileKnown valueOf(byte known) {
802  for (FileKnown v : FileKnown.values()) {
803  if (v.known == known) {
804  return v;
805  }
806  }
807  throw new IllegalArgumentException(
808  MessageFormat.format(bundle.getString("TskData.fileKnown.exception.msg1.text"), known));
809  }
810 
811  public String getName() {
812  return this.name;
813  }
814 
820  public byte getFileKnownValue() {
821  return this.known;
822  }
823  }
824 
829  public enum DbType {
830 
831  // Add any additional remote database types here, and keep it in sync
832  // with the Sleuthkit version of this enum located at:
833  // sleuthkit/tsk/auto/db_connection_info.h
834  // Be sure to add to settingsValid() if you add a type here.
835  SQLITE(0),
837 
838  private int value;
839 
840  DbType(int val) {
841  this.value = val;
842  }
843 
844  public int getValue() {
845  return this.value;
846  }
847  }
848 
856  public enum EncodingType{
857  // Update EncodedFileUtil.java to handle any new types
858  NONE(0),
859  XOR1(1);
860 
861  private final int type;
862 
863  private EncodingType(int type){
864  this.type = type;
865  }
866 
867  public int getType(){
868  return type;
869  }
870 
871  public static EncodingType valueOf(int type) {
872  for (EncodingType v : EncodingType.values()) {
873  if (v.type == type) {
874  return v;
875  }
876  }
877  throw new IllegalArgumentException(
878  MessageFormat.format(bundle.getString("TskData.encodingType.exception.msg1.text"), type));
879  }
880  }
881 }
VIRT
Special (TSK added "Virtual" files) NON-NLS.
Definition: TskData.java:50
FS
File that can be found in file system tree.
Definition: TskData.java:676
static FileKnown valueOf(byte known)
Definition: TskData.java:801
TSK_POOL_TYPE_ENUM(int poolType, String name)
Definition: TskData.java:740
TSK_VS_PART_FLAG_ALL
Show all sectors in the walk.
Definition: TskData.java:336
TSK_VS_TYPE_BSD
BSD Partition table NON-NLS.
Definition: TskData.java:577
TSK_VS_TYPE_MAC
Mac partition table NON-NLS.
Definition: TskData.java:579
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
Definition: TskData.java:247
TSK_VS_TYPE_DBFILLER
fake partition table type for loaddb (for images that do not have a volume system) ...
Definition: TskData.java:582
UNUSED
Metadata structure has never been allocated.
Definition: TskData.java:209
ALLOC
Metadata structure is currently in an allocated state.
Definition: TskData.java:206
TSK_VS_PART_FLAG_ALLOC
Sectors are allocated to a volume in the volume system.
Definition: TskData.java:333
static TSK_FS_TYPE_ENUM valueOf(int fsTypeValue)
Definition: TskData.java:501
UNALLOC
Metadata structure is currently in an unallocated state.
Definition: TskData.java:207
static TSK_FS_META_TYPE_ENUM valueOf(short metaType)
Definition: TskData.java:138
TSK_FS_META_TYPE_VIRT_DIR
"Virtual Directory" created by TSK for Orphan Files NON-NLS
Definition: TskData.java:114
COMP
The file contents are compressed.
Definition: TskData.java:210
LAYOUT_FILE
Set of blocks from an image that have been designated as a file.
Definition: TskData.java:685
TSK_FS_TYPE_YAFFS2_DETECT
YAFFS2 auto detection.
Definition: TskData.java:462
TSK_VS_PART_FLAG_META
Sectors contain volume system metadata and could also be ALLOC or UNALLOC.
Definition: TskData.java:335
TSK_FS_TYPE_FFS1B
UFS1b (Solaris - has no type)
Definition: TskData.java:446
TSK_FS_TYPE_FFS1
UFS1 (FreeBSD, OpenBSD, BSDI ...)
Definition: TskData.java:445
static TSK_FS_ATTR_TYPE_ENUM valueOf(int val)
Definition: TskData.java:316
LOCAL
Local file that was added (not from a disk image)
Definition: TskData.java:679
static TSK_POOL_TYPE_ENUM valueOf(long poolType)
Definition: TskData.java:752
CARVED
Set of blocks for a file found from carving. Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS ra...
Definition: TskData.java:677
static TSK_FS_NAME_FLAG_ENUM valueOf(int dirFlag)
Definition: TskData.java:188
TSK_FS_TYPE_ISO9660_DETECT
ISO9660 auto detection.
Definition: TskData.java:457
FS
File System - see tsk_fs_info for more details.
Definition: TskData.java:631
USED
Metadata structure has been allocated at least once.
Definition: TskData.java:208
VIRT_DIR
Special (TSK added "Virtual" directories) NON-NLS.
Definition: TskData.java:51
LOCAL_DIR
Local directory that was added (not from a disk image)
Definition: TskData.java:684
VOL
Volume - see tsk_vs_parts for more details.
Definition: TskData.java:630
static EncodingType valueOf(int type)
Definition: TskData.java:871
TSK_FS_META_TYPE_VIRT
"Virtual File" created by TSK for file system areas NON-NLS
Definition: TskData.java:113
TSK_VS_TYPE_GPT
GPT partition table NON-NLS.
Definition: TskData.java:580
TSK_FS_TYPE_DETECT
Use autodetection methods.
Definition: TskData.java:437
static TSK_FS_NAME_TYPE_ENUM valueOf(short dir_type)
Definition: TskData.java:86
REPORT
Artifact - see blackboard_artifacts for more details.
Definition: TskData.java:634
static short toInt(Set< TSK_FS_META_MODE_ENUM > modes)
Definition: TskData.java:422
BAD
File marked as known and bad/notable/interesting by hash db.
Definition: TskData.java:784
DERIVED
File derived from a parent file (i.e. from ZIP)
Definition: TskData.java:678
static TSK_DB_FILES_TYPE_ENUM valueOf(short fileType)
Definition: TskData.java:703
static short toInt(Set< TSK_FS_META_FLAG_ENUM > metaFlags)
Definition: TskData.java:261
static TSK_IMG_TYPE_ENUM valueOf(long imgType)
Definition: TskData.java:540
UNALLOC_BLOCKS
Set of blocks not allocated by file system. Parent should be image, volume, or file system...
Definition: TskData.java:680
TSK_FS_META_TYPE_SOCK
UNIX domain socket NON-NLS.
Definition: TskData.java:111
static ObjectType valueOf(short objectType)
Definition: TskData.java:659
TSK_POOL_TYPE_DETECT
Use autodetection methods.
Definition: TskData.java:732
UNKNOWN
File marked as unknown by hash db.
Definition: TskData.java:782
static Set< TSK_FS_META_MODE_ENUM > valuesOf(short modes)
Definition: TskData.java:403
TSK_VS_TYPE_DETECT
Use autodetection methods.
Definition: TskData.java:575
KNOWN
File marked as a known by hash db.
Definition: TskData.java:783
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
Definition: TskData.java:682
TSK_VS_PART_FLAG_UNALLOC
Sectors are not allocated to a volume.
Definition: TskData.java:334
static TSK_VS_TYPE_ENUM valueOf(long vsType)
Definition: TskData.java:593
ABSTRACTFILE
File - see tsk_files for more details.
Definition: TskData.java:632
TSK_VS_TYPE_DOS
DOS Partition table NON-NLS.
Definition: TskData.java:576
ORPHAN
Return only metadata structures that have no file name pointing to the (inode_walk flag only) ...
Definition: TskData.java:211
UNUSED_BLOCKS
Set of blocks that are unallocated AND not used by a carved or other file type. Parent should be UNAL...
Definition: TskData.java:681
VS
Volume System - see tsk_vs_info for more details.
Definition: TskData.java:629
IMG
Disk Image - see tsk_image_info for more details.
Definition: TskData.java:628
UNALLOC
Name is in an unallocated state.
Definition: TskData.java:157

Copyright © 2011-2018 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.