org.sleuthkit.datamodel.SleuthkitJNI Class Reference

Classes
class	CaseDbHandle

Static Public Member Functions
static void	addToHashDatabase (String filename, String md5, String sha1, String sha256, String comment, int dbHandle) throws TskCoreException
static void	addToHashDatabase (List< HashEntry > hashes, int dbHandle) throws TskCoreException
static void	cancelFinishImage (long imgHandle)
static void	closeAllHashDatabases () throws TskCoreException
static void	closeFile (long fileHandle)
static void	closeFile (long fileHandle, SleuthkitCase skCase)
static void	closeFs (long fsHandle)
static void	closeHashDatabase (int dbHandle) throws TskCoreException
static void	closeImg (long imgHandle)
static void	closeVs (long vsHandle)
static int	createHashDatabase (String path) throws TskCoreException
static void	createLookupIndexForHashDatabase (int dbHandle) throws TskCoreException
static long	findDeviceSize (String devPath) throws TskCoreException
static int	finishImageWriter (long imgHandle) throws TskCoreException
static List< String >	getFileMetaDataText (long fileHandle) throws TskCoreException
static int	getFinishImageProgress (long imgHandle)
static String	getHashDatabaseDisplayName (int dbHandle) throws TskCoreException
static String	getHashDatabaseIndexPath (int dbHandle) throws TskCoreException
static String	getHashDatabasePath (int dbHandle) throws TskCoreException
static String	getVersion ()
static boolean	hashDatabaseCanBeReindexed (int dbHandle) throws TskCoreException
static boolean	hashDatabaseHasLookupIndex (int dbHandle) throws TskCoreException
static boolean	hashDatabaseIsIndexOnly (int dbHandle) throws TskCoreException
static boolean	isImageSupported (String imagePath)
static boolean	isUpdateableHashDatabase (int dbHandle) throws TskCoreException
static boolean	lookupInHashDatabase (String hash, int dbHandle) throws TskCoreException
static HashHitInfo	lookupInHashDatabaseVerbose (String hash, int dbHandle) throws TskCoreException
static long	openFile (long fsHandle, long fileId, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, SleuthkitCase skCase) throws TskCoreException
static long	openFile (long fsHandle, long fileId, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId) throws TskCoreException
static long	openFs (long imgHandle, long fsOffset, SleuthkitCase skCase) throws TskCoreException
static long	openFs (long imgHandle, long fsOffset) throws TskCoreException
static int	openHashDatabase (String path) throws TskCoreException
static long	openImage (String[] imageFiles, SleuthkitCase skCase) throws TskCoreException
static long	openImage (String[] imageFiles, int sSize, SleuthkitCase skCase) throws TskCoreException
static long	openImage (String[] imageFiles) throws TskCoreException
static long	openImage (String[] imageFiles, int sSize) throws TskCoreException
static long	openVs (long imgHandle, long vsOffset) throws TskCoreException
static long	openVsPart (long vsHandle, long volId) throws TskCoreException
static int	readFile (long fileHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static int	readFileSlack (long fileHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static int	readFs (long fsHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static int	readImg (long imgHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static int	readVs (long vsHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static int	readVsPart (long volHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static void	startVerboseLogging (String logPath)

Detailed Description

A utility class that provides a interface to the SleuthKit via JNI. Supports case management, add image process, reading data off content objects Setting up Hash database parameters and updating / reading values

Caches image and filesystem handles and reuses them for the duration of the application

Definition at line 48 of file SleuthkitJNI.java.

Member Function Documentation

static void org.sleuthkit.datamodel.SleuthkitJNI.addToHashDatabase ( String  filename, String  md5, String  sha1, String  sha256, String  comment, int  dbHandle  ) throws TskCoreException

static

Adds a hash value to a hash database.

Parameters

filename	Name of file (can be null)
md5	Text of MD5 hash (can be null)
sha1	Text of SHA1 hash (can be null)
sha256	Text of SHA256 hash (can be null)
comment	A comment (can be null)
dbHandle	Handle to DB

Exceptions

TskCoreException

Definition at line 1596 of file SleuthkitJNI.java.

static void org.sleuthkit.datamodel.SleuthkitJNI.addToHashDatabase ( List< HashEntry >  hashes, int  dbHandle  ) throws TskCoreException

static

Definition at line 1600 of file SleuthkitJNI.java.

static void org.sleuthkit.datamodel.SleuthkitJNI.cancelFinishImage ( long  imgHandle )

static

Cancel the finish image process

Parameters

imgHandle

Definition at line 1708 of file SleuthkitJNI.java.

static void org.sleuthkit.datamodel.SleuthkitJNI.closeAllHashDatabases ( ) throws TskCoreException

static

Close the currently open lookup databases. Resets the handle counting.

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 1525 of file SleuthkitJNI.java.

static void org.sleuthkit.datamodel.SleuthkitJNI.closeFile ( long  fileHandle )

static

frees the fileHandle pointer

Parameters

fileHandle

pointer to file structure in sleuthkit

Definition at line 1383 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.FsContent.close().

static void org.sleuthkit.datamodel.SleuthkitJNI.closeFile ( long  fileHandle, SleuthkitCase  skCase  )

static

frees the fileHandle pointer

Parameters

fileHandle	pointer to file structure in sleuthkit
skCase	the case containing the file

Definition at line 1393 of file SleuthkitJNI.java.

static void org.sleuthkit.datamodel.SleuthkitJNI.closeFs ( long  fsHandle )

static

frees the fsHandle pointer Currently does not do anything - fsHandle should only be freed as part of CaseDbHandle.free().

Parameters

fsHandle

pointer to file system structure in sleuthkit

Definition at line 1800 of file SleuthkitJNI.java.

static void org.sleuthkit.datamodel.SleuthkitJNI.closeHashDatabase ( int  dbHandle ) throws TskCoreException

static

Close a particular open lookup database. Existing handles are not affected.

Parameters

dbHandle

Handle of database to close.

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 1538 of file SleuthkitJNI.java.

static void org.sleuthkit.datamodel.SleuthkitJNI.closeImg ( long  imgHandle )

static

frees the imgHandle pointer currently does not close the image - imgHandle should only be freed as part of CaseDbHandle.free().

Parameters

imgHandle

to close the image

Definition at line 1779 of file SleuthkitJNI.java.

static void org.sleuthkit.datamodel.SleuthkitJNI.closeVs ( long  vsHandle )

static

frees the vsHandle pointer - currently does nothing

Parameters

vsHandle

pointer to volume system structure in sleuthkit

Definition at line 1789 of file SleuthkitJNI.java.

static int org.sleuthkit.datamodel.SleuthkitJNI.createHashDatabase ( String  path ) throws TskCoreException

static

Creates a hash database. Will be of the default TSK hash database type.

Parameters

path	The path to the database

Returns

a handle for that database

Exceptions

TskCoreException

if a critical error occurs within TSK core

Definition at line 1515 of file SleuthkitJNI.java.

static void org.sleuthkit.datamodel.SleuthkitJNI.createLookupIndexForHashDatabase ( int  dbHandle ) throws TskCoreException

static

Create an index for a hash database.

Parameters

dbHandle

A hash database handle.

Exceptions

TskCoreException

if a critical error occurs within TSK core

Definition at line 1439 of file SleuthkitJNI.java.

static long org.sleuthkit.datamodel.SleuthkitJNI.findDeviceSize ( String  devPath ) throws TskCoreException

static

Get size of a device (physical, logical device, image) pointed to by devPath

Parameters

devPath

device path pointing to the device

Returns

size of the device in bytes

Exceptions

TskCoreException

exception thrown if the device size could not be queried

Definition at line 1730 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.Image.getSize().

static int org.sleuthkit.datamodel.SleuthkitJNI.finishImageWriter ( long  imgHandle ) throws TskCoreException

static

Fills in any gaps in the image created by image writer.

Parameters

imgHandle

The image handle.

Returns

0 if no errors occurred; 1 otherwise.

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 1671 of file SleuthkitJNI.java.

static List<String> org.sleuthkit.datamodel.SleuthkitJNI.getFileMetaDataText ( long  fileHandle ) throws TskCoreException

static

Get human readable (some what) details about a file. This is the same as the 'istat' TSK tool

Parameters

fileHandle

pointer to file structure in the sleuthkit

Returns

text

Exceptions

TskCoreException

if errors occurred

Definition at line 1343 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.FsContent.getMetaDataText().

static int org.sleuthkit.datamodel.SleuthkitJNI.getFinishImageProgress ( long  imgHandle )

static

Get the current progress of the finish image process (0-100)

Parameters

imgHandle

Returns

Percentage of blocks completed (0-100)

Definition at line 1690 of file SleuthkitJNI.java.

static String org.sleuthkit.datamodel.SleuthkitJNI.getHashDatabaseDisplayName ( int  dbHandle ) throws TskCoreException

static

Get the name of the database

Parameters

dbHandle

Previously opened hash db handle.

Returns

The display name.

Exceptions

TskCoreException

if a critical error occurs within TSK core

Definition at line 1551 of file SleuthkitJNI.java.

static String org.sleuthkit.datamodel.SleuthkitJNI.getHashDatabaseIndexPath ( int  dbHandle ) throws TskCoreException

static

getHashDatabaseIndexPath

Parameters

dbHandle

previously opened hash db handle

Returns

Index file path

Exceptions

TskCoreException

if a critical error occurs within TSK core

Definition at line 1492 of file SleuthkitJNI.java.

static String org.sleuthkit.datamodel.SleuthkitJNI.getHashDatabasePath ( int  dbHandle ) throws TskCoreException

static

getHashDatabasePath

Parameters

dbHandle

previously opened hash db handle

Returns

Hash db file path

Exceptions

TskCoreException

if a critical error occurs within TSK core

Definition at line 1479 of file SleuthkitJNI.java.

static String org.sleuthkit.datamodel.SleuthkitJNI.getVersion ( )

static

get the Sleuth Kit version string

Returns

the version string

Definition at line 717 of file SleuthkitJNI.java.

static boolean org.sleuthkit.datamodel.SleuthkitJNI.hashDatabaseCanBeReindexed ( int  dbHandle ) throws TskCoreException

static

hashDatabaseCanBeReindexed

Parameters

dbHandle

previously opened hash db handle

Returns

Does this database have a source database that is different than the index?

Exceptions

TskCoreException

if a critical error occurs within TSK core

Definition at line 1466 of file SleuthkitJNI.java.

static boolean org.sleuthkit.datamodel.SleuthkitJNI.hashDatabaseHasLookupIndex ( int  dbHandle ) throws TskCoreException

static

Check if an index exists for a hash database.

Parameters

dbHandle

A hash database handle.

Returns

true if index exists

Exceptions

TskCoreException

if a critical error occurs within TSK core

Definition at line 1452 of file SleuthkitJNI.java.

static boolean org.sleuthkit.datamodel.SleuthkitJNI.hashDatabaseIsIndexOnly ( int  dbHandle ) throws TskCoreException

static

Definition at line 1622 of file SleuthkitJNI.java.

static boolean org.sleuthkit.datamodel.SleuthkitJNI.isImageSupported ( String  imagePath )

static

Definition at line 1734 of file SleuthkitJNI.java.

static boolean org.sleuthkit.datamodel.SleuthkitJNI.isUpdateableHashDatabase ( int  dbHandle ) throws TskCoreException

static

Definition at line 1618 of file SleuthkitJNI.java.

static boolean org.sleuthkit.datamodel.SleuthkitJNI.lookupInHashDatabase ( String  hash, int  dbHandle  ) throws TskCoreException

static

Lookup the given hash value and get basic answer

Parameters

hash	Hash value to search for.
dbHandle	Handle of database to lookup in.

Returns

True if hash was found in database.

Exceptions

TskCoreException

Definition at line 1565 of file SleuthkitJNI.java.

static HashHitInfo org.sleuthkit.datamodel.SleuthkitJNI.lookupInHashDatabaseVerbose ( String  hash, int  dbHandle  ) throws TskCoreException

static

Lookup hash value in DB and return details on results (more time consuming than basic lookup)

Parameters

hash	Hash value to search for
dbHandle	Handle of database to lookup in.

Returns

Details on hash if it was in DB or null if it was not found.

Exceptions

TskCoreException

Definition at line 1580 of file SleuthkitJNI.java.

static long org.sleuthkit.datamodel.SleuthkitJNI.openFile ( long  fsHandle, long  fileId, TSK_FS_ATTR_TYPE_ENUM  attrType, int  attrId, SleuthkitCase  skCase  ) throws TskCoreException

static

Get file Handle

Parameters

fsHandle	fsHandle pointer in the sleuthkit
fileId	id of the file
attrType	file attribute type to open
attrId	file attribute id to open
skCase	the case associated with this file

Returns

pointer to a file structure in the sleuthkit

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 1032 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.openFile().

static long org.sleuthkit.datamodel.SleuthkitJNI.openFile ( long  fsHandle, long  fileId, TSK_FS_ATTR_TYPE_ENUM  attrType, int  attrId  ) throws TskCoreException

static

Get file Handle

Parameters

fsHandle	fsHandle pointer in the sleuthkit
fileId	id of the file
attrType	file attribute type to open
attrId	file attribute id to open

Returns

pointer to a file structure in the sleuthkit

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Deprecated:

Use the version with the SleuthkitCase argument

Definition at line 1873 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.openFile().

static long org.sleuthkit.datamodel.SleuthkitJNI.openFs ( long  imgHandle, long  fsOffset, SleuthkitCase  skCase  ) throws TskCoreException

static

Get file system Handle Opened handle is cached (transparently) so it does not need be reopened next time for the duration of the application

Parameters

imgHandle	pointer to imgHandle in sleuthkit
fsOffset	byte offset to the file system
skCase	the case containing the file system

Returns

pointer to a fsHandle structure in the sleuthkit

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 933 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.openFs().

static long org.sleuthkit.datamodel.SleuthkitJNI.openFs ( long  imgHandle, long  fsOffset  ) throws TskCoreException

static

Get file system Handle Opened handle is cached (transparently) so it does not need be reopened next time for the duration of the application

Parameters

imgHandle	pointer to imgHandle in sleuthkit
fsOffset	byte offset to the file system

Returns

pointer to a fsHandle structure in the sleuthkit

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Deprecated:

Use the version with the SleuthkitCase argument

Definition at line 1854 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.openFs().

static int org.sleuthkit.datamodel.SleuthkitJNI.openHashDatabase ( String  path ) throws TskCoreException

static

Open a hash database for lookups

Parameters

path	Path to Hash DB or index file

Returns

Handle open db

Exceptions

TskCoreException

if there is an error opening the DB

Definition at line 1502 of file SleuthkitJNI.java.

static long org.sleuthkit.datamodel.SleuthkitJNI.openImage ( String[]  imageFiles, SleuthkitCase  skCase  ) throws TskCoreException

static

Open the image and return the image info pointer.

Parameters

imageFiles	the paths to the images
skCase	the case this image belongs to

Returns

the image info pointer

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 741 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.Image.getImageHandle(), org.sleuthkit.datamodel.SleuthkitJNI.openImage(), and org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.AddImageProcess.run().

static long org.sleuthkit.datamodel.SleuthkitJNI.openImage ( String[]  imageFiles, int  sSize, SleuthkitCase  skCase  ) throws TskCoreException

static

Open the image with a specified sector size and return the image info pointer.

Parameters

imageFiles	the paths to the images
sSize	the sector size (use '0' for autodetect)
skCase	the case this image belongs to

Returns

the image info pointer

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 761 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.openImage().

static long org.sleuthkit.datamodel.SleuthkitJNI.openImage ( String[]  imageFiles ) throws TskCoreException

static

Open the image and return the image info pointer.

Parameters

imageFiles

the paths to the images

Returns

the image info pointer

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Deprecated:

Use the version with the SleuthkitCase argument

Definition at line 1816 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.openImage().

static long org.sleuthkit.datamodel.SleuthkitJNI.openImage ( String[]  imageFiles, int  sSize  ) throws TskCoreException

static

Open the image with a specified sector size and return the image info pointer.

Parameters

imageFiles	the paths to the images
sSize	the sector size (use '0' for autodetect)

Returns

the image info pointer

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Deprecated:

Use the version with the SleuthkitCase argument

Definition at line 1835 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.openImage().

static long org.sleuthkit.datamodel.SleuthkitJNI.openVs ( long  imgHandle, long  vsOffset  ) throws TskCoreException

static

Get volume system Handle

Parameters

imgHandle	a handle to previously opened image
vsOffset	byte offset in the image to the volume system (usually 0)

Returns

pointer to a vsHandle structure in the sleuthkit

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 838 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.VolumeSystem.getVolumeSystemHandle().

static long org.sleuthkit.datamodel.SleuthkitJNI.openVsPart ( long  vsHandle, long  volId  ) throws TskCoreException

static

Get volume Handle

Parameters

vsHandle	pointer to the volume system structure in the sleuthkit
volId	id of the volume

Returns

pointer to a volHandle structure in the sleuthkit

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 862 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.Volume.read().

static int org.sleuthkit.datamodel.SleuthkitJNI.readFile ( long  fileHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

static

reads data from an file

Parameters

fileHandle	pointer to a file structure in the sleuthkit
readBuffer	pre-allocated buffer to read to
offset	byte offset in the image to start at
len	amount of data to read

Returns

the number of characters read, or -1 if the end of the stream has been reached

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 1273 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.FsContent.readInt().

static int org.sleuthkit.datamodel.SleuthkitJNI.readFileSlack ( long  fileHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

static

reads data from the slack space of a file

Parameters

fileHandle	pointer to a file structure in the sleuthkit
readBuffer	pre-allocated buffer to read to
offset	byte offset in the slack to start at
len	amount of data to read

Returns

the number of characters read, or -1 if the end of the stream has been reached

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 1320 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.SlackFile.readInt().

static int org.sleuthkit.datamodel.SleuthkitJNI.readFs ( long  fsHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

static

reads data from an file system

Parameters

fsHandle	pointer to a file system structure in the sleuthkit
readBuffer	buffer to read to
offset	byte offset in the image to start at
len	amount of data to read

Returns

the number of characters read, or -1 if the end of the stream has been reached

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 1230 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.FileSystem.read().

static int org.sleuthkit.datamodel.SleuthkitJNI.readImg ( long  imgHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

static

reads data from an image

Parameters

imgHandle
readBuffer	buffer to read to
offset	byte offset in the image to start at
len	amount of data to read

Returns

the number of characters read, or -1 if the end of the stream has been reached

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 1135 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.Image.read().

static int org.sleuthkit.datamodel.SleuthkitJNI.readVs ( long  vsHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

static

reads data from an volume system

Parameters

vsHandle	pointer to a volume system structure in the sleuthkit
readBuffer	buffer to read to
offset	sector offset in the image to start at
len	amount of data to read

Returns

the number of characters read, or -1 if the end of the stream has been reached

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 1162 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.VolumeSystem.read().

static int org.sleuthkit.datamodel.SleuthkitJNI.readVsPart ( long  volHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

static

reads data from an volume

Parameters

volHandle	pointer to a volume structure in the sleuthkit
readBuffer	buffer to read to
offset	byte offset in the image to start at
len	amount of data to read

Returns

the number of characters read, or -1 if the end of the stream has been reached

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 1206 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.Volume.read().

static void org.sleuthkit.datamodel.SleuthkitJNI.startVerboseLogging ( String  logPath )

static

Enable verbose logging and redirect stderr to the given log file.

Parameters

logPath

the log file path

Definition at line 726 of file SleuthkitJNI.java.

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/sleuthkit/bindings/java/src/org/sleuthkit/datamodel/SleuthkitJNI.java