Sleuth Kit Java Bindings (JNI)  4.8.0
Java bindings for using The Sleuth Kit
AbstractFile.java
Go to the documentation of this file.
1 /*
2  * SleuthKit Java Bindings
3  *
4  * Copyright 2011-2018 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.io.FileNotFoundException;
22 import java.io.IOException;
23 import java.io.RandomAccessFile;
24 import java.sql.SQLException;
25 import java.sql.Statement;
26 import java.text.MessageFormat;
27 import java.util.ArrayList;
28 import java.util.List;
29 import java.util.ResourceBundle;
30 import java.util.Set;
31 import java.util.SortedSet;
32 import java.util.TimeZone;
33 import java.util.logging.Level;
34 import java.util.logging.Logger;
35 import static org.sleuthkit.datamodel.SleuthkitCase.closeStatement;
41 
46 public abstract class AbstractFile extends AbstractContent {
47 
49  protected final TSK_FS_NAME_TYPE_ENUM dirType;
51  protected final TSK_FS_NAME_FLAG_ENUM dirFlag;
52  protected final Set<TSK_FS_META_FLAG_ENUM> metaFlags;
53  protected long size;
54  protected final long metaAddr, ctime, crtime, atime, mtime;
55  protected final int metaSeq;
56  protected final int uid, gid;
57  protected final int attrId;
59  protected final Set<TskData.TSK_FS_META_MODE_ENUM> modes;
60  //local file support
61  private boolean localPathSet = false;
62  private String localPath;
63  private String localAbsPath;
64  private volatile RandomAccessFile localFileHandle;
65  private volatile java.io.File localFile;
66  private TskData.EncodingType encodingType;
67  //range support
68  private List<TskFileRange> ranges;
69  /*
70  * path of parent directory
71  */
72  protected final String parentPath;
77  private boolean knownStateDirty = false;
78  /*
79  * md5 hash
80  */
81  protected String md5Hash;
82  private boolean md5HashDirty = false;
83  private String mimeType;
84  private boolean mimeTypeDirty = false;
85  private static final Logger LOGGER = Logger.getLogger(AbstractFile.class.getName());
86  private static final ResourceBundle BUNDLE = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle");
87  private long dataSourceObjectId;
88  private final String extension;
89 
126  long objId,
127  long dataSourceObjectId,
129  String name,
131  long metaAddr, int metaSeq,
133  TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags,
134  long size,
135  long ctime, long crtime, long atime, long mtime,
136  short modes,
137  int uid, int gid,
138  String md5Hash, FileKnown knownState,
139  String parentPath,
140  String mimeType,
141  String extension) {
142  super(db, objId, name);
143  this.dataSourceObjectId = dataSourceObjectId;
144  this.attrType = attrType;
145  this.attrId = attrId;
146  this.fileType = fileType;
147  this.metaAddr = metaAddr;
148  this.metaSeq = metaSeq;
149  this.dirType = dirType;
150  this.metaType = metaType;
151  this.dirFlag = dirFlag;
152  this.metaFlags = TSK_FS_META_FLAG_ENUM.valuesOf(metaFlags);
153  this.size = size;
154  this.ctime = ctime;
155  this.crtime = crtime;
156  this.atime = atime;
157  this.mtime = mtime;
158  this.uid = uid;
159  this.gid = gid;
160  this.modes = TskData.TSK_FS_META_MODE_ENUM.valuesOf(modes);
161 
162  this.md5Hash = md5Hash;
163  if (knownState == null) {
164  this.knownState = FileKnown.UNKNOWN;
165  } else {
166  this.knownState = knownState;
167  }
168  this.parentPath = parentPath;
169  this.mimeType = mimeType;
170  this.extension = extension == null ? "" : extension;
171  this.encodingType = TskData.EncodingType.NONE;
172  }
173 
180  return fileType;
181  }
182 
189  return attrType;
190  }
191 
197  public int getAttributeId() {
198  return attrId;
199  }
200 
206  public long getCtime() {
207  return ctime;
208  }
209 
215  public String getCtimeAsDate() {
216  return epochToTime(ctime);
217  }
218 
224  public long getCrtime() {
225  return crtime;
226  }
227 
233  public String getCrtimeAsDate() {
234  return epochToTime(crtime);
235  }
236 
242  public long getAtime() {
243  return atime;
244  }
245 
251  public String getAtimeAsDate() {
252  return epochToTime(atime);
253  }
254 
260  public long getMtime() {
261  return mtime;
262  }
263 
269  public String getMtimeAsDate() {
270  return epochToTime(mtime);
271  }
272 
278  public int getUid() {
279  return uid;
280  }
281 
287  public int getGid() {
288  return gid;
289  }
290 
296  public long getMetaAddr() {
297  return metaAddr;
298  }
299 
306  public long getMetaSeq() {
307  return metaSeq;
308  }
309 
315  public String getModesAsString() {
317  String result = "";
318 
319  short isuid = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_ISUID.getMode();
320  short isgid = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_ISGID.getMode();
321  short isvtx = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_ISVTX.getMode();
322 
323  short irusr = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IRUSR.getMode();
324  short iwusr = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IWUSR.getMode();
325  short ixusr = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IXUSR.getMode();
326 
327  short irgrp = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IRGRP.getMode();
328  short iwgrp = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IWGRP.getMode();
329  short ixgrp = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IXGRP.getMode();
330 
331  short iroth = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IROTH.getMode();
332  short iwoth = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IWOTH.getMode();
333  short ixoth = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IXOTH.getMode();
334 
335  // first character = the Meta Type
336  result += metaType.toString();
337 
338  // second and third characters = user permissions
339  if ((mode & irusr) == irusr) {
340  result += "r"; //NON-NLS
341  } else {
342  result += "-"; //NON-NLS
343  }
344  if ((mode & iwusr) == iwusr) {
345  result += "w"; //NON-NLS
346  } else {
347  result += "-"; //NON-NLS
348  }
349 
350  // fourth character = set uid
351  if ((mode & isuid) == isuid) {
352  if ((mode & ixusr) == ixusr) {
353  result += "s"; //NON-NLS
354  } else {
355  result += "S"; //NON-NLS
356  }
357  } else {
358  if ((mode & ixusr) == ixusr) {
359  result += "x"; //NON-NLS
360  } else {
361  result += "-"; //NON-NLS
362  }
363  }
364 
365  // fifth and sixth characters = group permissions
366  if ((mode & irgrp) == irgrp) {
367  result += "r"; //NON-NLS
368  } else {
369  result += "-"; //NON-NLS
370  }
371  if ((mode & iwgrp) == iwgrp) {
372  result += "w"; //NON-NLS
373  } else {
374  result += "-"; //NON-NLS
375  }
376 
377  // seventh character = set gid
378  if ((mode & isgid) == isgid) {
379  if ((mode & ixgrp) == ixgrp) {
380  result += "s"; //NON-NLS
381  } else {
382  result += "S"; //NON-NLS
383  }
384  } else {
385  if ((mode & ixgrp) == ixgrp) {
386  result += "x"; //NON-NLS
387  } else {
388  result += "-"; //NON-NLS
389  }
390  }
391 
392  // eighth and ninth character = other permissions
393  if ((mode & iroth) == iroth) {
394  result += "r"; //NON-NLS
395  } else {
396  result += "-"; //NON-NLS
397  }
398  if ((mode & iwoth) == iwoth) {
399  result += "w"; //NON-NLS
400  } else {
401  result += "-"; //NON-NLS
402  }
403 
404  // tenth character = sticky bit
405  if ((mode & isvtx) == isvtx) {
406  if ((mode & ixoth) == ixoth) {
407  result += "t"; //NON-NLS
408  } else {
409  result += "T"; //NON-NLS
410  }
411  } else {
412  if ((mode & ixoth) == ixoth) {
413  result += "x"; //NON-NLS
414  } else {
415  result += "-"; //NON-NLS
416  }
417  }
418 
419  // check the result
420  if (result.length() != 10) {
421  // throw error here
422  result = "ERROR"; //NON-NLS
423  }
424  return result;
425  }
426 
432  public String getMIMEType() {
433  return mimeType;
434  }
435 
444  public void setMIMEType(String mimeType) {
445  this.mimeType = mimeType;
446  this.mimeTypeDirty = true;
447  }
448 
449  public boolean isModeSet(TskData.TSK_FS_META_MODE_ENUM mode) {
450  return modes.contains(mode);
451  }
452 
461  public void setMd5Hash(String md5Hash) {
462  this.md5Hash = md5Hash;
463  this.md5HashDirty = true;
464  }
465 
471  public String getMd5Hash() {
472  return this.md5Hash;
473  }
474 
486  // don't allow them to downgrade the known state
487  if (this.knownState.compareTo(knownState) > 0) {
488  // ideally we'd return some kind of error, but
489  // the API doesn't allow it
490  return;
491  }
492  this.knownState = knownState;
493  this.knownStateDirty = true;
494  }
495 
503  return knownState;
504  }
505 
513  public String getNameExtension() {
514  return extension;
515  }
516 
522  @Override
523  public long getSize() {
524  return size;
525  }
526 
532  public String getParentPath() {
533  return parentPath;
534  }
535 
547  @Override
549  return getSleuthkitCase().getContentById(this.dataSourceObjectId);
550  }
551 
557  public long getDataSourceObjectId() {
558  return dataSourceObjectId;
559  }
560 
571  public List<TskFileRange> getRanges() throws TskCoreException {
572  if (ranges == null) {
573  ranges = getSleuthkitCase().getFileRanges(this.getId());
574  }
575  return ranges;
576  }
577 
591  public long convertToImgOffset(long fileOffset) throws TskCoreException {
592  long imgOffset = -1;
593  for (TskFileRange byteRange : getRanges()) {
594 
595  // if fileOffset is within the current byteRange, calculate the image
596  // offset and break
597  long rangeLength = byteRange.getByteLen();
598  if (fileOffset < rangeLength) {
599  imgOffset = byteRange.getByteStart() + fileOffset;
600  break;
601  }
602 
603  // otherwise, decrement fileOffset by the length of the current
604  // byte range and continue
605  fileOffset -= rangeLength;
606  }
607  return imgOffset;
608  }
609 
616  public boolean isVirtual() {
618  || dirType.equals(TskData.TSK_FS_NAME_TYPE_ENUM.VIRT)
620  }
621 
629  public boolean isFile() {
630  return metaType.equals(TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG)
631  || (metaType.equals(TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_UNDEF)
632  && dirType.equals(TSK_FS_NAME_TYPE_ENUM.REG));
633 
634  }
635 
642  public boolean isDir() {
643  return (metaType.equals(TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR)
645  }
646 
652  public abstract boolean isRoot();
653 
662  public static String createNonUniquePath(String uniquePath) {
663 
664  // split the path into parts
665  String[] pathSegments = uniquePath.split("/");
666 
667  // see if uniquePath had an image and/or volume name
668  int index = 0;
669  if (pathSegments[0].startsWith("img_")) { //NON-NLS
670  ++index;
671  }
672  if (pathSegments[1].startsWith("vol_")) { //NON-NLS
673  ++index;
674  }
675 
676  // Assemble the non-unique path (skipping over the image and volume
677  // name, if they exist).
678  StringBuilder strbuf = new StringBuilder();
679  for (; index < pathSegments.length; ++index) {
680  if (!pathSegments[index].isEmpty()) {
681  strbuf.append("/").append(pathSegments[index]);
682  }
683  }
684 
685  return strbuf.toString();
686  }
687 
694  public List<AbstractFile> listFiles() throws TskCoreException {
695  // first, get all children
696  List<Content> children = getChildren();
697 
698  // only keep those that are of type AbstractFile
699  List<AbstractFile> files = new ArrayList<AbstractFile>();
700  for (Content child : children) {
701  if (child instanceof AbstractFile) {
702  AbstractFile afChild = (AbstractFile) child;
703  files.add(afChild);
704  }
705  }
706  return files;
707  }
708 
715  return metaType;
716  }
717 
718  public String getMetaTypeAsString() {
719  return metaType.toString();
720  }
721 
728  return dirType;
729  }
730 
731  public String getDirTypeAsString() {
732  return dirType.toString();
733  }
734 
741  return dirFlag == flag;
742  }
743 
748  public String getDirFlagAsString() {
749  return dirFlag.toString();
750  }
751 
755  public String getMetaFlagsAsString() {
756  String str = "";
757  if (metaFlags.contains(TSK_FS_META_FLAG_ENUM.ALLOC)) {
758  str = TSK_FS_META_FLAG_ENUM.ALLOC.toString();
759  } else if (metaFlags.contains(TSK_FS_META_FLAG_ENUM.UNALLOC)) {
760  str = TSK_FS_META_FLAG_ENUM.UNALLOC.toString();
761  }
762  return str;
763  }
764 
770  public boolean isMetaFlagSet(TSK_FS_META_FLAG_ENUM metaFlag) {
771  return metaFlags.contains(metaFlag);
772  }
773 
774  @Override
775  public final int read(byte[] buf, long offset, long len) throws TskCoreException {
776  //template method
777  //if localPath is set, use local, otherwise, use readCustom() supplied by derived class
778  if (localPathSet) {
779  return readLocal(buf, offset, len);
780  } else {
781  return readInt(buf, offset, len);
782  }
783 
784  }
785 
797  protected int readInt(byte[] buf, long offset, long len) throws TskCoreException {
798  return 0;
799  }
800 
812  protected final int readLocal(byte[] buf, long offset, long len) throws TskCoreException {
813  if (!localPathSet) {
814  throw new TskCoreException(
815  BUNDLE.getString("AbstractFile.readLocal.exception.msg1.text"));
816  }
817 
818  if (isDir()) {
819  return 0;
820  }
821 
822  // If the file is empty, just return that zero bytes were read.
823  if (getSize() == 0) {
824  return 0;
825  }
826 
827  loadLocalFile();
828  if (!localFile.exists()) {
829  throw new TskCoreException(
830  MessageFormat.format(BUNDLE.getString("AbstractFile.readLocal.exception.msg2.text"), localAbsPath));
831  }
832  if (!localFile.canRead()) {
833  throw new TskCoreException(
834  MessageFormat.format(BUNDLE.getString("AbstractFile.readLocal.exception.msg3.text"), localAbsPath));
835  }
836 
837  int bytesRead = 0;
838 
839  if (localFileHandle == null) {
840  synchronized (this) {
841  if (localFileHandle == null) {
842  try {
843  localFileHandle = new RandomAccessFile(localFile, "r");
844  } catch (FileNotFoundException ex) {
845  final String msg = MessageFormat.format(BUNDLE.getString(
846  "AbstractFile.readLocal.exception.msg4.text"),
847  localAbsPath);
848  LOGGER.log(Level.SEVERE, msg, ex);
849  //file could have been deleted or moved
850  throw new TskCoreException(msg, ex);
851  }
852  }
853  }
854  }
855 
856  try {
857  if (!encodingType.equals(TskData.EncodingType.NONE)) {
858  // The file is encoded, so we need to alter the offset to read (since there's
859  // a header on the encoded file) and then decode each byte
860  long encodedOffset = offset + EncodedFileUtil.getHeaderLength();
861 
862  //move to the user request offset in the stream
863  long curOffset = localFileHandle.getFilePointer();
864  if (curOffset != encodedOffset) {
865  localFileHandle.seek(encodedOffset);
866  }
867  bytesRead = localFileHandle.read(buf, 0, (int) len);
868  for (int i = 0; i < bytesRead; i++) {
869  buf[i] = EncodedFileUtil.decodeByte(buf[i], encodingType);
870  }
871  return bytesRead;
872  } else {
873  //move to the user request offset in the stream
874  long curOffset = localFileHandle.getFilePointer();
875  if (curOffset != offset) {
876  localFileHandle.seek(offset);
877  }
878  //note, we are always writing at 0 offset of user buffer
879  return localFileHandle.read(buf, 0, (int) len);
880  }
881  } catch (IOException ex) {
882  final String msg = MessageFormat.format(BUNDLE.getString("AbstractFile.readLocal.exception.msg5.text"), localAbsPath);
883  LOGGER.log(Level.SEVERE, msg, ex);
884  //local file could have been deleted / moved
885  throw new TskCoreException(msg, ex);
886  }
887  }
888 
896  void setLocalFilePath(String localPath) {
897 
898  if (localPath == null || localPath.equals("")) {
899  this.localPath = "";
900  localAbsPath = null;
901  localPathSet = false;
902  } else {
903  // It should always be the case that absolute paths start with slashes or a windows drive letter
904  // and relative paths do not, but some older versions of modules created derived file paths
905  // starting with slashes. So we first check if this file is a DerivedFile before looking at the path.
906  this.localPath = localPath;
907  if (this instanceof DerivedFile) {
908  // DerivedFiles always have relative paths
909  this.localAbsPath = getSleuthkitCase().getDbDirPath() + java.io.File.separator + localPath;
910  } else {
911  // If a path starts with a slash or with a Windows drive letter, then it is
912  // absolute. Otherwise it is relative.
913  if (localPath.startsWith("/") || localPath.startsWith("\\")
914  || localPath.matches("[A-Za-z]:[/\\\\].*")) {
915  this.localAbsPath = localPath;
916  } else {
917  this.localAbsPath = getSleuthkitCase().getDbDirPath() + java.io.File.separator + localPath;
918  }
919  }
920  this.localPathSet = true;
921  }
922  }
923 
929  public String getLocalPath() {
930  return localPath;
931  }
932 
938  public String getLocalAbsPath() {
939  return localAbsPath;
940  }
941 
947  final void setEncodingType(TskData.EncodingType encodingType) {
948  this.encodingType = encodingType;
949  }
950 
957  public boolean exists() {
958  if (!localPathSet) {
959  return true;
960  } else {
961  try {
962  loadLocalFile();
963  return localFile.exists();
964  } catch (TskCoreException ex) {
965  LOGGER.log(Level.SEVERE, ex.getMessage());
966  return false;
967  }
968  }
969  }
970 
978  public boolean canRead() {
979  if (!localPathSet) {
980  return true;
981  } else {
982  try {
983  loadLocalFile();
984  return localFile.canRead();
985  } catch (TskCoreException ex) {
986  LOGGER.log(Level.SEVERE, ex.getMessage());
987  return false;
988  }
989  }
990  }
991 
998  private void loadLocalFile() throws TskCoreException {
999  if (!localPathSet) {
1000  throw new TskCoreException(
1001  BUNDLE.getString("AbstractFile.readLocal.exception.msg1.text"));
1002  }
1003 
1004  // already been set
1005  if (localFile != null) {
1006  return;
1007  }
1008 
1009  synchronized (this) {
1010  if (localFile == null) {
1011  localFile = new java.io.File(localAbsPath);
1012  }
1013  }
1014  }
1015 
1016  @Override
1017  public void close() {
1018 
1019  //close local file handle if set
1020  if (localFileHandle != null) {
1021  synchronized (this) {
1022  if (localFileHandle != null) {
1023  try {
1024  localFileHandle.close();
1025  } catch (IOException ex) {
1026  LOGGER.log(Level.SEVERE, "Could not close file handle for file: " + getParentPath() + getName(), ex); //NON-NLS
1027  }
1028  localFileHandle = null;
1029  }
1030  }
1031  }
1032 
1033  }
1034 
1035  @Override
1036  protected void finalize() throws Throwable {
1037  try {
1038  close();
1039  } finally {
1040  super.finalize();
1041  }
1042  }
1043 
1044  @Override
1045  public String toString(boolean preserveState) {
1046  return super.toString(preserveState) + "AbstractFile [\t" //NON-NLS
1047  + "\t" + "fileType " + fileType //NON-NLS
1048  + "\tctime " + ctime //NON-NLS
1049  + "\tcrtime " + crtime //NON-NLS
1050  + "\t" + "mtime " + mtime + "\t" + "atime " + atime //NON-NLS
1051  + "\t" + "attrId " + attrId //NON-NLS
1052  + "\t" + "attrType " + attrType //NON-NLS
1053  + "\t" + "dirFlag " + dirFlag + "\t" + "dirType " + dirType //NON-NLS
1054  + "\t" + "uid " + uid //NON-NLS
1055  + "\t" + "gid " + gid //NON-NLS
1056  + "\t" + "metaAddr " + metaAddr + "\t" + "metaSeq " + metaSeq + "\t" + "metaFlags " + metaFlags //NON-NLS
1057  + "\t" + "metaType " + metaType + "\t" + "modes " + modes //NON-NLS
1058  + "\t" + "parentPath " + parentPath + "\t" + "size " + size //NON-NLS
1059  + "\t" + "knownState " + knownState + "\t" + "md5Hash " + md5Hash //NON-NLS
1060  + "\t" + "localPathSet " + localPathSet + "\t" + "localPath " + localPath //NON-NLS
1061  + "\t" + "localAbsPath " + localAbsPath + "\t" + "localFile " + localFile //NON-NLS
1062  + "]\t";
1063  }
1064 
1068  public enum MimeMatchEnum {
1069 
1072  FALSE
1073  }
1074 
1083  public MimeMatchEnum isMimeType(SortedSet<String> mimeTypes) {
1084  if (this.mimeType == null) {
1085  return MimeMatchEnum.UNDEFINED;
1086  }
1087  if (mimeTypes.contains(this.mimeType)) {
1088  return MimeMatchEnum.TRUE;
1089  }
1090  return MimeMatchEnum.FALSE;
1091  }
1092 
1100  public void save() throws TskCoreException {
1101 
1102  // No fields have been updated
1103  if (!(md5HashDirty || mimeTypeDirty || knownStateDirty)) {
1104  return;
1105  }
1106 
1107  String queryStr = "";
1108  if (mimeTypeDirty) {
1109  queryStr = "mime_type = '" + this.getMIMEType() + "'";
1110  }
1111  if (md5HashDirty) {
1112  if (!queryStr.isEmpty()) {
1113  queryStr += ", ";
1114  }
1115  queryStr += "md5 = '" + this.getMd5Hash() + "'";
1116  }
1117  if (knownStateDirty) {
1118  if (!queryStr.isEmpty()) {
1119  queryStr += ", ";
1120  }
1121  queryStr += "known = '" + this.getKnown().getFileKnownValue() + "'";
1122  }
1123 
1124  queryStr = "UPDATE tsk_files SET " + queryStr + " WHERE obj_id = " + this.getId();
1125 
1127  try (SleuthkitCase.CaseDbConnection connection = getSleuthkitCase().getConnection();
1128  Statement statement = connection.createStatement();) {
1129 
1130  connection.executeUpdate(statement, queryStr);
1131  md5HashDirty = false;
1132  mimeTypeDirty = false;
1133  knownStateDirty = false;
1134  } catch (SQLException ex) {
1135  throw new TskCoreException(String.format("Error saving properties for file (obj_id = %s)", this.getId()), ex);
1136  } finally {
1138  }
1139  }
1140 
1172  @Deprecated
1173  @SuppressWarnings("deprecation")
1174  protected AbstractFile(SleuthkitCase db, long objId, TskData.TSK_FS_ATTR_TYPE_ENUM attrType, short attrId,
1175  String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq,
1176  TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags,
1177  long size, long ctime, long crtime, long atime, long mtime, short modes, int uid, int gid, String md5Hash, FileKnown knownState,
1178  String parentPath) {
1179  this(db, objId, db.getDataSourceObjectId(objId), attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
1180  }
1181 
1218  @Deprecated
1219  @SuppressWarnings("deprecation")
1220  AbstractFile(SleuthkitCase db, long objId, long dataSourceObjectId, TskData.TSK_FS_ATTR_TYPE_ENUM attrType, short attrId,
1221  String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType,
1222  TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, short modes,
1223  int uid, int gid, String md5Hash, FileKnown knownState, String parentPath, String mimeType) {
1224  this(db, objId, dataSourceObjectId, attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
1225  }
1226 
1235  @Deprecated
1236  @SuppressWarnings("deprecation")
1237  public short getAttrId() {
1238  /*
1239  * NOTE: previously attrId used to be stored in AbstractFile as (signed)
1240  * short even though it is stored as uint16 in TSK. In extremely rare
1241  * occurrences attrId can be larger than what a signed short can hold
1242  * (2^15). Changes were made to AbstractFile to store attrId as integer.
1243  * Therefore this method has been deprecated. For backwards
1244  * compatibility, attribute ids that are larger than 32K are converted
1245  * to a negative number.
1246  */
1247  return (short) attrId; // casting to signed short converts values over 32K to negative values
1248  }
1249 
1261  @Deprecated
1262  protected void setLocalPath(String localPath, boolean isAbsolute) {
1263  setLocalFilePath(localPath);
1264  }
1265 
1266  /*
1267  * -------------------------------------------------------------------------
1268  * Util methods to convert / map the data
1269  * -------------------------------------------------------------------------
1270  */
1280  @Deprecated
1281  public static String epochToTime(long epoch) {
1282  return TimeUtilities.epochToTime(epoch);
1283  }
1284 
1296  @Deprecated
1297  public static String epochToTime(long epoch, TimeZone tzone) {
1298  return TimeUtilities.epochToTime(epoch, tzone);
1299  }
1300 
1308  @Deprecated
1309  public static long timeToEpoch(String time) {
1310  return TimeUtilities.timeToEpoch(time);
1311  }
1312 }
VIRT
Special (TSK added "Virtual" files) NON-NLS.
Definition: TskData.java:50
boolean isModeSet(TskData.TSK_FS_META_MODE_ENUM mode)
final TSK_FS_NAME_TYPE_ENUM dirType
static long timeToEpoch(String time)
static String epochToTime(long epoch)
static String epochToTime(long epoch)
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
Definition: TskData.java:247
final int readLocal(byte[] buf, long offset, long len)
boolean isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM flag)
ALLOC
Metadata structure is currently in an allocated state.
Definition: TskData.java:206
final TSK_FS_NAME_FLAG_ENUM dirFlag
final TskData.TSK_DB_FILES_TYPE_ENUM fileType
UNALLOC
Metadata structure is currently in an unallocated state.
Definition: TskData.java:207
TskData.TSK_DB_FILES_TYPE_ENUM getType()
final TskData.TSK_FS_ATTR_TYPE_ENUM attrType
TSK_FS_META_TYPE_VIRT_DIR
"Virtual Directory" created by TSK for Orphan Files NON-NLS
Definition: TskData.java:114
long convertToImgOffset(long fileOffset)
TSK_FS_NAME_TYPE_ENUM getDirType()
MimeMatchEnum isMimeType(SortedSet< String > mimeTypes)
final Set< TSK_FS_META_FLAG_ENUM > metaFlags
String toString(boolean preserveState)
void setKnown(TskData.FileKnown knownState)
FALSE
file has a defined mime type and it is one of the given ones
final Set< TskData.TSK_FS_META_MODE_ENUM > modes
TSK_FS_META_TYPE_VIRT
"Virtual File" created by TSK for file system areas NON-NLS
Definition: TskData.java:113
TSK_FS_META_TYPE_ENUM getMetaType()
boolean isMetaFlagSet(TSK_FS_META_FLAG_ENUM metaFlag)
TRUE
file does not have a defined mime time in blackboard
static short toInt(Set< TSK_FS_META_MODE_ENUM > modes)
Definition: TskData.java:422
static String epochToTime(long epoch, TimeZone tzone)
static long timeToEpoch(String time)
int readInt(byte[] buf, long offset, long len)
UNKNOWN
File marked as unknown by hash db.
Definition: TskData.java:782
static Set< TSK_FS_META_MODE_ENUM > valuesOf(short modes)
Definition: TskData.java:403
void setLocalPath(String localPath, boolean isAbsolute)
static String createNonUniquePath(String uniquePath)
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
Definition: TskData.java:682
final int read(byte[] buf, long offset, long len)
final TSK_FS_META_TYPE_ENUM metaType
List< TskFileRange > getFileRanges(long id)
TskData.TSK_FS_ATTR_TYPE_ENUM getAttrType()

Copyright © 2011-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.