org.sleuthkit.datamodel.Image Class Reference

Inherits org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.DataSource.

Public Member Functions
void	close ()
void	finalize () throws Throwable
String	getAcquisitionDetails () throws TskCoreException
List< Content >	getChildren () throws TskCoreException
List< Long >	getChildrenIds () throws TskCoreException
long	getContentSize (SleuthkitCase sleuthkitCase) throws TskCoreException
Content	getDataSource ()
String	getDeviceId ()
List< FileSystem >	getFileSystems () throws TskCoreException
synchronized long	getImageHandle () throws TskCoreException
String	getMd5 () throws TskCoreException
String[]	getPaths ()
String	getSha1 () throws TskCoreException
String	getSha256 () throws TskCoreException
long	getSize ()
long	getSsize ()
String	getTimeZone ()
TskData.TSK_IMG_TYPE_ENUM	getType ()
String	getUniquePath () throws TskCoreException
List< Volume >	getVolumes () throws TskCoreException
List< VolumeSystem >	getVolumeSystems () throws TskCoreException
Boolean	imageFileExists ()
int	read (byte[] buf, long offset, long len) throws TskCoreException
void	setAcquisitionDetails (String details) throws TskCoreException
void	setDisplayName (String newName) throws TskCoreException
void	setMD5 (String md5) throws TskCoreException, TskDataException
void	setSha1 (String sha1) throws TskCoreException, TskDataException
void	setSha256 (String sha256) throws TskCoreException, TskDataException
String	toString (boolean preserveState)
String	verifyImageSize ()
Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean	equals (Object obj)
ArrayList< BlackboardArtifact >	getAllArtifacts () throws TskCoreException
long	getAllArtifactsCount () throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (String artifactTypeName) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (int artifactTypeID) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
long	getArtifactsCount (String artifactTypeName) throws TskCoreException
long	getArtifactsCount (int artifactTypeID) throws TskCoreException
long	getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException
List< Content >	getChildren () throws TskCoreException
int	getChildrenCount () throws TskCoreException
List< Long >	getChildrenIds () throws TskCoreException
Content	getDataSource () throws TskCoreException
BlackboardArtifact	getGenInfoArtifact () throws TskCoreException
BlackboardArtifact	getGenInfoArtifact (boolean create) throws TskCoreException
ArrayList< BlackboardAttribute >	getGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException
Set< String >	getHashSetNames () throws TskCoreException
long	getId ()
String	getName ()
synchronized Content	getParent () throws TskCoreException
SleuthkitCase	getSleuthkitCase ()
synchronized String	getUniquePath () throws TskCoreException
boolean	hasChildren () throws TskCoreException
int	hashCode ()
BlackboardArtifact	newArtifact (int artifactTypeID) throws TskCoreException
BlackboardArtifact	newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
String	toString ()
String	toString (boolean preserveState)
Public Member Functions inherited from org.sleuthkit.datamodel.Content
long	getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
ArrayList< BlackboardAttribute >	getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException

Protected Member Functions
	Image (SleuthkitCase db, long obj_id, long type, long ssize, String name, String[] paths, String timezone, String md5) throws TskCoreException
Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
	AbstractContent (SleuthkitCase db, long obj_id, String name)

Additional Inherited Members
Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long	UNKNOWN_ID = -1
Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long	parentId

Detailed Description

Represents a disk image file, stored in tsk_image_info. Populated based on data in database.

Caches internal tsk image handle and reuses it for reads

Definition at line 39 of file Image.java.

Constructor & Destructor Documentation

org.sleuthkit.datamodel.Image.Image ( SleuthkitCase  db, long  obj_id, long  type, long  ssize, String  name, String[]  paths, String  timezone, String  md5  ) throws TskCoreException

protected

Create a disk image.

Note: Most inputs originate from the database.

Parameters

db	Case database.
obj_id	Object ID.
type	Image type.
ssize	Sector size.
name	Display name.
paths	Image paths.
timezone	Timezone.
md5	MD5 hash.

Exceptions

TskCoreException

Deprecated:

Use the constructor that takes a device ID and size.

Definition at line 71 of file Image.java.

Member Function Documentation

void org.sleuthkit.datamodel.Image.close

(

)

Free native resources after read is done on the Content object. After closing, read can be called again on the same Content object, which should result in re-opening of new native resources.

Implements org.sleuthkit.datamodel.Content.

Definition at line 139 of file Image.java.

void org.sleuthkit.datamodel.Image.finalize

(

)

throws Throwable

Definition at line 144 of file Image.java.

String org.sleuthkit.datamodel.Image.getAcquisitionDetails

(

)

throws TskCoreException

Gets the acquisition details field from the case database.

Returns

The acquisition details

Exceptions

TskCoreException

Thrown if the data can not be read

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 534 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

List<Content> org.sleuthkit.datamodel.Image.getChildren

(

)

throws TskCoreException

Gets the child content objects of this content.

Returns

List of children

Exceptions

TskCoreException

if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 284 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.getVolumes(), and org.sleuthkit.datamodel.Image.getVolumeSystems().

List<Long> org.sleuthkit.datamodel.Image.getChildrenIds

(

)

throws TskCoreException

Gets the child content ids of this content.

Returns

List of children ids

Exceptions

TskCoreException

if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 289 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

long org.sleuthkit.datamodel.Image.getContentSize

(

SleuthkitCase

sleuthkitCase

)

throws TskCoreException

Gets the size of the contents of the data source in bytes. This size can change as archive files within the data source are expanded, files are carved, etc., and is different from the size of the data source as returned by Content.getSize, which is the size of the data source as a file.

Parameters

sleuthkitCase

The sleuthkit case instance from which to make calls to the database.

Returns

The size in bytes.

Exceptions

TskCoreException

Thrown when there is an issue trying to retrieve data from the database.

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 489 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getId().

Content org.sleuthkit.datamodel.Image.getDataSource

(

)

Gets the root data source (image, virtual directory, etc.) of this content.

Returns

Content associated with data source or null if one can't be found

Exceptions

TskCoreException

if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 134 of file Image.java.

String org.sleuthkit.datamodel.Image.getDeviceId

(

)

Gets the ASCII-printable identifier for the device associated with the data source. This identifier is intended to be unique across multiple cases (e.g., a UUID).

Returns

The device id.

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 457 of file Image.java.

List<FileSystem> org.sleuthkit.datamodel.Image.getFileSystems

(

)

throws TskCoreException

Returns

a list of FileSystems in this Image. This includes FileSystems that are both children of this Image as well as children of Volumes in this image.

Exceptions

TskCoreException

Definition at line 257 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.verifyImageSize().

synchronized long org.sleuthkit.datamodel.Image.getImageHandle

(

)

throws TskCoreException

Get the handle to the sleuthkit image info object

Returns

the object pointer

Exceptions

TskCoreException

Definition at line 121 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase(), and org.sleuthkit.datamodel.SleuthkitJNI.openImage().

Referenced by org.sleuthkit.datamodel.VolumeSystem.getVolumeSystemHandle(), org.sleuthkit.datamodel.Image.read(), and org.sleuthkit.datamodel.LayoutFile.readInt().

String org.sleuthkit.datamodel.Image.getMd5

(

)

throws TskCoreException

Gets the md5 hash value

Returns

md5 hash if attained(from database), empty string otherwise

Exceptions

TskCoreException

Definition at line 372 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.setMD5().

String [] org.sleuthkit.datamodel.Image.getPaths

(

)

Get the image path

Returns

image path

Definition at line 210 of file Image.java.

String org.sleuthkit.datamodel.Image.getSha1

(

)

throws TskCoreException

gets the SHA1 hash value

Returns

SHA1 hash if attained(from database), empty string otherwise

Exceptions

TskCoreException

on DB error.

Definition at line 386 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.setSha1().

String org.sleuthkit.datamodel.Image.getSha256

(

)

throws TskCoreException

gets the SHA256 hash value

Returns

SHA256 hash if attained(from database), empty string otherwise

Exceptions

TskCoreException

Definition at line 400 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Image.setSha256().

long org.sleuthkit.datamodel.Image.getSize

(

)

Get the (reported) size of the content object and, in theory, how much you should be able to read from it. In some cases, data corruption may mean that you cannot read this much data.

Returns

size of the content in bytes

Implements org.sleuthkit.datamodel.Content.

Definition at line 167 of file Image.java.

References org.sleuthkit.datamodel.SleuthkitJNI.findDeviceSize(), and org.sleuthkit.datamodel.AbstractContent.getName().

long org.sleuthkit.datamodel.Image.getSsize

(

)

Get the sector size

Returns

sector size

Definition at line 196 of file Image.java.

String org.sleuthkit.datamodel.Image.getTimeZone

(

)

Get the timezone set for the image

Returns

timezone string representation

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 269 of file Image.java.

Referenced by org.sleuthkit.datamodel.BlackboardAttribute.getDisplayString().

TskData.TSK_IMG_TYPE_ENUM org.sleuthkit.datamodel.Image.getType

(

)

Get the image type

Returns

image type

Definition at line 187 of file Image.java.

References org.sleuthkit.datamodel.TskData.TSK_IMG_TYPE_ENUM.valueOf().

String org.sleuthkit.datamodel.Image.getUniquePath

(

)

throws TskCoreException

Returns

returns the full path to this Content object starting with a "/" followed by the Image name and similarly for all other segments in the hierarchy.

Implements org.sleuthkit.datamodel.Content.

Definition at line 201 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getName().

List<Volume> org.sleuthkit.datamodel.Image.getVolumes

(

)

throws TskCoreException

Returns

a list of Volume associated with this Image.

Exceptions

TskCoreException

Definition at line 237 of file Image.java.

References org.sleuthkit.datamodel.Image.getChildren().

List<VolumeSystem> org.sleuthkit.datamodel.Image.getVolumeSystems

(

)

throws TskCoreException

Returns

a list of VolumeSystem associated with this Image.

Exceptions

TskCoreException

Definition at line 219 of file Image.java.

References org.sleuthkit.datamodel.Image.getChildren().

Referenced by org.sleuthkit.datamodel.Image.verifyImageSize().

Boolean org.sleuthkit.datamodel.Image.imageFileExists

(

)

Test if the file that created this image exists on disk. Does not work on local disks - will always return false

Returns

True if the file still exists

Definition at line 304 of file Image.java.

References org.sleuthkit.datamodel.AbstractFile.exists().

int org.sleuthkit.datamodel.Image.read	(	byte[]	buf,
		long	offset,
		long	len
	)		throws TskCoreException

Reads data that this content object is associated with (file contents, volume contents, etc.).

Parameters

buf	a character array of data (in bytes) to copy read data to
offset	byte offset in the content to start reading from
len	number of bytes to read into buf.

Returns

num of bytes read, or -1 on error

Exceptions

TskCoreException

if critical error occurred during read in the tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 156 of file Image.java.

References org.sleuthkit.datamodel.Image.getImageHandle(), and org.sleuthkit.datamodel.SleuthkitJNI.readImg().

Referenced by org.sleuthkit.datamodel.Image.verifyImageSize().

void org.sleuthkit.datamodel.Image.setAcquisitionDetails

(

String

details

)

throws TskCoreException

Sets the acquisition details field in the case database.

Parameters

details

The acquisition details

Exceptions

TskCoreException

Thrown if the data can not be written

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 522 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

void org.sleuthkit.datamodel.Image.setDisplayName

(

String

newName

)

throws TskCoreException

Set the name for this data source.

Parameters

newName

The new name for the data source

Exceptions

TskCoreException

Thrown if an error occurs while updating the database

Implements org.sleuthkit.datamodel.DataSource.

Definition at line 469 of file Image.java.

References org.sleuthkit.datamodel.AbstractContent.getId(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

void org.sleuthkit.datamodel.Image.setMD5

(

String

md5

)

throws TskCoreException, TskDataException

Parameters

md5

Exceptions

TskCoreException	On DB errors
TskDataException	If hash has already been set

Definition at line 413 of file Image.java.

References org.sleuthkit.datamodel.Image.getMd5(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

void org.sleuthkit.datamodel.Image.setSha1

(

String

sha1

)

throws TskCoreException, TskDataException

Parameters

sha1

Exceptions

TskCoreException	On DB errors
TskDataException	If hash has already been set

Definition at line 427 of file Image.java.

References org.sleuthkit.datamodel.Image.getSha1(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

void org.sleuthkit.datamodel.Image.setSha256

(

String

sha256

)

throws TskCoreException, TskDataException

Parameters

sha256

Exceptions

TskCoreException	On DB errors
TskDataException	If hash has already been set

Definition at line 441 of file Image.java.

References org.sleuthkit.datamodel.Image.getSha256(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

String org.sleuthkit.datamodel.Image.toString

(

boolean

preserveState

)

Definition at line 294 of file Image.java.

String org.sleuthkit.datamodel.Image.verifyImageSize

(

)

Perform some sanity checks on the bounds of the image contents to determine if we could be missing some pieces of the image.

Returns

String of error messages to display to user or empty string if there are no errors

Definition at line 320 of file Image.java.

References org.sleuthkit.datamodel.Image.getFileSystems(), org.sleuthkit.datamodel.Image.getVolumeSystems(), and org.sleuthkit.datamodel.Image.read().

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/sleuthkit/bindings/java/src/org/sleuthkit/datamodel/Image.java