19 package org.sleuthkit.datamodel;
21 import java.io.BufferedReader;
22 import java.io.FileReader;
23 import java.io.IOException;
24 import java.text.DateFormat;
25 import java.text.SimpleDateFormat;
26 import java.util.ArrayList;
27 import java.util.Arrays;
28 import java.util.GregorianCalendar;
29 import java.util.HashMap;
30 import java.util.HashSet;
31 import java.util.List;
34 import java.util.TimeZone;
35 import java.util.UUID;
36 import java.util.concurrent.locks.ReadWriteLock;
37 import java.util.concurrent.locks.ReentrantReadWriteLock;
56 private static final ReadWriteLock tskLock =
new ReentrantReadWriteLock();
75 private static class CaseHandles {
80 private final Map<String, Long> imageHandleCache =
new HashMap<>();
86 private final Map<Long, Map<Long, Long>> fsHandleCache =
new HashMap<>();
92 private final Set<Long> fileHandleCache =
new HashSet<>();
94 private final Map<Long, List<Long>> fileSystemToFileHandles =
new HashMap<>();
96 private final Map<Long, Map<Long, Long>> poolHandleCache =
new HashMap<>();
99 private final List<Long> poolImgCache =
new ArrayList<>();
108 private final List<Long> poolFsList =
new ArrayList<>();
110 private CaseHandles() {
121 private static class HandleCache {
126 private static final Object cacheLock =
new Object();
128 private static final Map<Long, CaseHandles> caseHandlesCache =
new HashMap<>();
130 private static final String INVALID_FILE_HANDLE =
"Invalid file handle.";
141 private static final List<Long> poolFileHandles =
new ArrayList<>();
148 private static void createCaseHandleCache(
long caseDbPointer) {
149 caseHandlesCache.put(caseDbPointer,
new CaseHandles());
161 synchronized (cacheLock) {
162 if (caseHandlesCache.keySet().size() > 1) {
163 throw new TskCoreException(
"Can not get default case handle with multiple open cases");
164 }
else if (caseHandlesCache.keySet().isEmpty()) {
165 throw new TskCoreException(
"Can not get default case handle with no open case");
168 return (caseHandlesCache.keySet().iterator().next());
179 private static CaseHandles getCaseHandles(
long caseDbPointer) {
180 synchronized (cacheLock) {
181 return caseHandlesCache.get(caseDbPointer);
190 private static void removeCaseHandlesCache(
long caseDbPointer) {
191 synchronized (cacheLock) {
192 if (caseHandlesCache.containsKey(caseDbPointer)) {
193 caseHandlesCache.get(caseDbPointer).fsHandleCache.clear();
194 caseHandlesCache.get(caseDbPointer).imageHandleCache.clear();
195 caseHandlesCache.get(caseDbPointer).fileHandleCache.clear();
196 caseHandlesCache.get(caseDbPointer).fileSystemToFileHandles.clear();
197 caseHandlesCache.get(caseDbPointer).poolHandleCache.clear();
198 caseHandlesCache.remove(caseDbPointer);
210 private static boolean isImageInAnyCache(
long imgHandle) {
211 synchronized (cacheLock) {
212 for (
long caseDbPointer:caseHandlesCache.keySet()) {
213 if (caseHandlesCache.get(caseDbPointer).fsHandleCache.keySet().contains(imgHandle)) {
227 private static void addFileHandle(
long caseDbPointer,
long fileHandle,
long fsHandle) {
228 synchronized (cacheLock) {
230 getCaseHandles(caseDbPointer).fileHandleCache.add(fileHandle);
233 if (getCaseHandles(caseDbPointer).fileSystemToFileHandles.containsKey(fsHandle)) {
234 getCaseHandles(caseDbPointer).fileSystemToFileHandles.get(fsHandle).add(fileHandle);
236 getCaseHandles(caseDbPointer).fileSystemToFileHandles.put(fsHandle,
new ArrayList<Long>(Arrays.asList(fileHandle)));
247 private static void removeFileHandle(
long fileHandle,
SleuthkitCase skCase) {
248 synchronized (cacheLock) {
250 if (skCase != null) {
252 getCaseHandles(skCase.getCaseDbPointer()).fileHandleCache.remove(fileHandle);
259 for (
long caseDbPointer:caseHandlesCache.keySet()) {
260 if (caseHandlesCache.get(caseDbPointer).fileHandleCache.contains(fileHandle)) {
261 caseHandlesCache.get(caseDbPointer).fileHandleCache.remove(fileHandle);
276 private static boolean isValidFileHandle(
long fileHandle) {
277 synchronized (cacheLock) {
278 for (
long caseDbPointer:caseHandlesCache.keySet()) {
279 if (caseHandlesCache.get(caseDbPointer).fileHandleCache.contains(fileHandle)) {
287 private static void closeHandlesAndClearCache(
long caseDbPointer)
throws TskCoreException {
288 synchronized (cacheLock) {
292 for (Map<Long, Long> imageToFsMap : getCaseHandles(caseDbPointer).fsHandleCache.values()) {
293 for (Long fsHandle : imageToFsMap.values()) {
295 if (getCaseHandles(caseDbPointer).fileSystemToFileHandles.containsKey(fsHandle)) {
296 for (Long fileHandle : getCaseHandles(caseDbPointer).fileSystemToFileHandles.get(fsHandle)) {
298 if (poolFileHandles.contains(fileHandle)) {
299 poolFileHandles.remove(fileHandle);
305 closeFsNat(fsHandle);
312 getCaseHandles(caseDbPointer).poolFsList.clear();
317 for (Long imgHandle : getCaseHandles(caseDbPointer).poolHandleCache.keySet()) {
318 for (Long poolHandle : getCaseHandles(caseDbPointer).poolHandleCache.get(imgHandle).values()) {
319 closePoolNat(poolHandle);
326 for (Long imageHandle : getCaseHandles(caseDbPointer).poolImgCache) {
327 closeImgNat(imageHandle);
333 for (Long imageHandle : getCaseHandles(caseDbPointer).imageHandleCache.values()) {
334 closeImgNat(imageHandle);
337 removeCaseHandlesCache(caseDbPointer);
352 private final long caseDbPointer;
361 this.caseDbPointer = caseDbPointer;
362 HandleCache.createCaseHandleCache(caseDbPointer);
370 long getCaseDbPointer() {
371 return caseDbPointer;
381 tskLock.writeLock().lock();
383 HandleCache.closeHandlesAndClearCache(caseDbPointer);
386 tskLock.writeLock().unlock();
415 long tskAutoDbPointer = initializeAddImgNat(caseDbPointer, timezoneLongToShort(timeZone),
false,
false,
false);
416 runOpenAndAddImgNat(tskAutoDbPointer, UUID.randomUUID().toString(), imageFilePaths.toArray(
new String[0]), imageFilePaths.size(), timeZone);
417 long id = commitAddImgNat(tskAutoDbPointer);
418 skCase.addDataSourceToHasChildrenMap();
441 AddImageProcess initAddImageProcess(String timeZone,
boolean addUnallocSpace,
boolean skipFatFsOrphans, String imageCopyPath,
SleuthkitCase skCase) {
442 return new AddImageProcess(timeZone, addUnallocSpace, skipFatFsOrphans, imageCopyPath, skCase);
451 private final String timeZone;
452 private final boolean addUnallocSpace;
453 private final boolean skipFatFsOrphans;
454 private final String imageWriterPath;
455 private volatile long tskAutoDbPointer;
456 private boolean isCanceled;
472 private AddImageProcess(String timeZone,
boolean addUnallocSpace,
boolean skipFatFsOrphans, String imageWriterPath,
SleuthkitCase skCase) {
473 this.timeZone = timeZone;
474 this.addUnallocSpace = addUnallocSpace;
475 this.skipFatFsOrphans = skipFatFsOrphans;
476 this.imageWriterPath = imageWriterPath;
477 tskAutoDbPointer = 0;
478 this.isCanceled =
false;
479 this.skCase = skCase;
503 long imageHandle = 0;
505 synchronized (
this) {
506 if (0 != tskAutoDbPointer) {
507 throw new TskCoreException(
"Add image process already started");
510 imageHandle =
openImage(imageFilePaths, sectorSize,
false, caseDbPointer);
511 tskAutoDbPointer = initAddImgNat(caseDbPointer, timezoneLongToShort(timeZone), addUnallocSpace, skipFatFsOrphans);
513 if (0 == tskAutoDbPointer) {
514 throw new TskCoreException(
"initAddImgNat returned a NULL TskAutoDb pointer");
517 if (imageHandle != 0) {
518 runAddImgNat(tskAutoDbPointer, deviceId, imageHandle, timeZone, imageWriterPath);
521 releaseTSKReadLock();
534 public synchronized void stop() throws TskCoreException {
538 if (tskAutoDbPointer != 0) {
539 stopAddImgNat(tskAutoDbPointer);
542 releaseTSKReadLock();
553 public synchronized void revert() throws TskCoreException {
556 if (tskAutoDbPointer == 0) {
557 throw new TskCoreException(
"AddImgProcess::revert: AutoDB pointer is NULL");
560 revertAddImgNat(tskAutoDbPointer);
562 tskAutoDbPointer = 0;
564 releaseTSKReadLock();
577 public synchronized long commit() throws TskCoreException {
580 if (tskAutoDbPointer == 0) {
581 throw new TskCoreException(
"AddImgProcess::commit: AutoDB pointer is NULL");
584 long id = commitAddImgNat(tskAutoDbPointer);
586 skCase.addDataSourceToHasChildrenMap();
589 tskAutoDbPointer = 0;
592 releaseTSKReadLock();
603 return tskAutoDbPointer == 0 ?
"" : getCurDirNat(tskAutoDbPointer);
623 run(null, imageFilePaths, 0);
644 run(deviceId, imageFilePaths, 0);
662 return new CaseDbHandle(newCaseDbNat(path));
677 static CaseDbHandle newCaseDb(String databaseName, CaseDbConnectionInfo info)
throws TskCoreException {
678 return new CaseDbHandle(newCaseDbMultiNat(info.getHost(), info.getPort(), info.getUserName(), info.getPassword(), info.getDbType().ordinal(), databaseName));
692 static CaseDbHandle openCaseDb(String path)
throws TskCoreException {
693 return new CaseDbHandle(openCaseDbNat(path));
708 static CaseDbHandle openCaseDb(String databaseName, CaseDbConnectionInfo info)
throws TskCoreException {
709 return new CaseDbHandle(openCaseDbMultiNat(info.getHost(), info.getPort(), info.getUserName(), info.getPassword(), info.getDbType().ordinal(), databaseName));
718 return getVersionNat();
727 startVerboseLoggingNat(logPath);
742 if (skCase == null) {
745 return openImage(imageFiles, 0,
true, skCase.getCaseDbPointer());
762 if (skCase == null) {
765 return openImage(imageFiles, sSize,
true, skCase.getCaseDbPointer());
785 private static long openImage(String[] imageFiles,
int sSize,
boolean useCache, Long caseDbPointer)
throws TskCoreException {
791 StringBuilder keyBuilder =
new StringBuilder();
792 for (
int i = 0; i < imageFiles.length; ++i) {
793 keyBuilder.append(imageFiles[i]);
795 final String imageKey = keyBuilder.toString();
797 synchronized (HandleCache.cacheLock) {
798 Long nonNullCaseDbPointer = caseDbPointer;
799 if (nonNullCaseDbPointer == null) {
800 nonNullCaseDbPointer = HandleCache.getDefaultCaseDbPointer();
808 if (!useCache && HandleCache.getCaseHandles(nonNullCaseDbPointer).imageHandleCache.containsKey(imageKey)) {
809 long tempImageHandle = HandleCache.getCaseHandles(nonNullCaseDbPointer).imageHandleCache.get(imageKey);
813 String newPath =
"Image_" + UUID.randomUUID().toString();
814 HandleCache.getCaseHandles(nonNullCaseDbPointer).imageHandleCache.put(newPath, tempImageHandle);
815 HandleCache.getCaseHandles(nonNullCaseDbPointer).imageHandleCache.remove(imageKey);
818 if (useCache && HandleCache.getCaseHandles(nonNullCaseDbPointer).imageHandleCache.containsKey(imageKey))
820 imageHandle = HandleCache.getCaseHandles(nonNullCaseDbPointer).imageHandleCache.get(imageKey);
823 imageHandle = openImgNat(imageFiles, imageFiles.length, sSize);
824 HandleCache.getCaseHandles(nonNullCaseDbPointer).fsHandleCache.put(imageHandle,
new HashMap<>());
825 HandleCache.getCaseHandles(nonNullCaseDbPointer).imageHandleCache.put(imageKey, imageHandle);
830 releaseTSKReadLock();
849 if(! imgHandleIsValid(imgHandle)) {
852 return openVsNat(imgHandle, vsOffset);
854 releaseTSKReadLock();
874 return openVolNat(vsHandle, volId);
876 releaseTSKReadLock();
894 if(! imgHandleIsValid(imgHandle)) {
898 synchronized (HandleCache.cacheLock) {
900 if (skCase == null) {
901 caseDbPointer = HandleCache.getDefaultCaseDbPointer();
903 caseDbPointer = skCase.getCaseDbPointer();
907 if (! HandleCache.getCaseHandles(caseDbPointer).poolHandleCache.containsKey(imgHandle)) {
908 HandleCache.getCaseHandles(caseDbPointer).poolHandleCache.put(imgHandle,
new HashMap<>());
912 Map<Long, Long> poolCacheForImage = HandleCache.getCaseHandles(caseDbPointer).poolHandleCache.get(imgHandle);
914 if (poolCacheForImage.containsKey(offset)) {
915 return poolCacheForImage.get(offset);
918 long poolHandle = openPoolNat(imgHandle, offset);
919 poolCacheForImage.put(offset, poolHandle);
924 releaseTSKReadLock();
945 synchronized (HandleCache.cacheLock) {
947 if (skCase == null) {
948 caseDbPointer = HandleCache.getDefaultCaseDbPointer();
950 caseDbPointer = skCase.getCaseDbPointer();
952 final Map<Long, Long> imgOffSetToFsHandle = HandleCache.getCaseHandles(caseDbPointer).fsHandleCache.get(imgHandle);
953 if (imgOffSetToFsHandle == null) {
954 throw new TskCoreException(
"Missing image offset to file system handle cache for image handle " + imgHandle);
956 if (imgOffSetToFsHandle.containsKey(fsOffset)) {
958 fsHandle = imgOffSetToFsHandle.get(fsOffset);
960 fsHandle = openFsNat(imgHandle, fsOffset);
962 imgOffSetToFsHandle.put(fsOffset, fsHandle);
967 releaseTSKReadLock();
996 synchronized (HandleCache.cacheLock) {
998 if (skCase == null) {
999 caseDbPointer = HandleCache.getDefaultCaseDbPointer();
1001 caseDbPointer = skCase.getCaseDbPointer();
1003 final Map<Long, Long> imgOffSetToFsHandle = HandleCache.getCaseHandles(caseDbPointer).fsHandleCache.get(imgHandle);
1004 if (imgOffSetToFsHandle == null) {
1005 throw new TskCoreException(
"Missing image offset to file system handle cache for image handle " + imgHandle);
1008 if (imgOffSetToFsHandle.containsKey(poolBlock)) {
1010 fsHandle = imgOffSetToFsHandle.get(poolBlock);
1012 long poolImgHandle = getImgInfoForPoolNat(poolHandle, poolBlock);
1013 HandleCache.getCaseHandles(caseDbPointer).poolImgCache.add(poolImgHandle);
1014 fsHandle = openFsNat(poolImgHandle, fsOffset);
1016 imgOffSetToFsHandle.put(poolBlock, fsHandle);
1017 HandleCache.getCaseHandles(caseDbPointer).poolFsList.add(fsHandle);
1022 releaseTSKWriteLock();
1052 boolean withinPool =
false;
1053 synchronized (HandleCache.cacheLock) {
1055 if (skCase == null) {
1056 caseDbPointer = HandleCache.getDefaultCaseDbPointer();
1058 caseDbPointer = skCase.getCaseDbPointer();
1060 if (HandleCache.getCaseHandles(caseDbPointer).poolFsList.contains(fsHandle)) {
1076 long fileHandle = openFileNat(fsHandle, fileId, attrType.getValue(), convertSignedToUnsigned(attrId));
1077 synchronized (HandleCache.cacheLock) {
1079 if (skCase == null) {
1080 caseDbPointer = HandleCache.getDefaultCaseDbPointer();
1082 caseDbPointer = skCase.getCaseDbPointer();
1084 HandleCache.addFileHandle(caseDbPointer, fileHandle, fsHandle);
1089 HandleCache.poolFileHandles.add(fileHandle);
1095 releaseTSKWriteLock();
1097 releaseTSKReadLock();
1109 private static int convertSignedToUnsigned(
int val) {
1114 return val & 0xffff;
1122 private static boolean imgHandleIsValid(
long imgHandle) {
1123 synchronized(HandleCache.cacheLock) {
1124 return HandleCache.isImageInAnyCache(imgHandle);
1146 if(! imgHandleIsValid(imgHandle)) {
1150 return readImgNat(imgHandle, readBuffer, offset, len);
1152 releaseTSKReadLock();
1173 return readVsNat(vsHandle, readBuffer, offset, len);
1175 releaseTSKReadLock();
1191 static int readPool(
long poolHandle, byte[] readBuffer,
long offset,
long len)
throws TskCoreException {
1194 return readPoolNat(poolHandle, readBuffer, offset, len);
1196 releaseTSKReadLock();
1218 return readVolNat(volHandle, readBuffer, offset, len);
1220 releaseTSKReadLock();
1242 return readFsNat(fsHandle, readBuffer, offset, len);
1244 releaseTSKReadLock();
1252 private enum TSK_FS_FILE_READ_OFFSET_TYPE_ENUM {
1256 private final int val;
1258 TSK_FS_FILE_READ_OFFSET_TYPE_ENUM(
int val) {
1282 boolean withinPool =
false;
1283 synchronized (HandleCache.cacheLock) {
1284 if (HandleCache.poolFileHandles.contains(fileHandle)) {
1300 if (!HandleCache.isValidFileHandle(fileHandle)) {
1304 return readFileNat(fileHandle, readBuffer, offset, TSK_FS_FILE_READ_OFFSET_TYPE_ENUM.START_OF_FILE.getValue(), len);
1307 releaseTSKWriteLock();
1309 releaseTSKReadLock();
1331 if (!HandleCache.isValidFileHandle(fileHandle)) {
1335 return readFileNat(fileHandle, readBuffer, offset, TSK_FS_FILE_READ_OFFSET_TYPE_ENUM.START_OF_SLACK.getValue(), len);
1337 releaseTSKReadLock();
1354 if (!HandleCache.isValidFileHandle(fileHandle)) {
1359 java.io.File tmp = java.io.File.createTempFile(
"tsk",
".txt");
1361 saveFileMetaDataTextNat(fileHandle, tmp.getAbsolutePath());
1363 FileReader fr =
new FileReader(tmp.getAbsolutePath());
1364 BufferedReader textReader =
new BufferedReader(fr);
1366 List<String> lines =
new ArrayList<String>();
1368 String line = textReader.readLine();
1378 }
catch (IOException ex) {
1379 throw new TskCoreException(
"Error reading istat output: " + ex.getLocalizedMessage());
1382 releaseTSKReadLock();
1402 boolean withinPool =
false;
1403 synchronized (HandleCache.cacheLock) {
1404 if (HandleCache.poolFileHandles.contains(fileHandle)) {
1420 synchronized (HandleCache.cacheLock) {
1421 if (!HandleCache.isValidFileHandle(fileHandle)) {
1425 closeFileNat(fileHandle);
1426 HandleCache.removeFileHandle(fileHandle, skCase);
1427 if (HandleCache.poolFileHandles.contains(fileHandle)) {
1428 HandleCache.poolFileHandles.remove(fileHandle);
1433 releaseTSKWriteLock();
1435 releaseTSKReadLock();
1448 hashDbCreateIndexNat(dbHandle);
1461 return hashDbIndexExistsNat(dbHandle);
1475 return hashDbIsReindexableNat(dbHandle);
1488 return hashDbPathNat(dbHandle);
1501 return hashDbIndexPathNat(dbHandle);
1511 return hashDbOpenNat(path);
1524 return hashDbNewNat(path);
1547 hashDbClose(dbHandle);
1560 return hashDbGetDisplayName(dbHandle);
1574 return hashDbLookup(hash, dbHandle);
1589 return hashDbLookupVerbose(hash, dbHandle);
1605 hashDbAddEntryNat(filename, md5, sha1, sha256, comment, dbHandle);
1609 hashDbBeginTransactionNat(dbHandle);
1612 hashDbAddEntryNat(entry.getFileName(), entry.getMd5Hash(), entry.getSha1Hash(), entry.getSha256Hash(), entry.getComment(), dbHandle);
1614 hashDbCommitTransactionNat(dbHandle);
1617 hashDbRollbackTransactionNat(dbHandle);
1627 return hashDbIsUpdateableNat(dbHandle);
1631 return hashDbIsIdxOnlyNat(dbHandle);
1643 private static String timezoneLongToShort(String timezoneLongForm) {
1644 if (timezoneLongForm == null || timezoneLongForm.isEmpty()) {
1648 String timezoneShortForm;
1649 TimeZone zone = TimeZone.getTimeZone(timezoneLongForm);
1650 int offset = zone.getRawOffset() / 1000;
1651 int hour = offset / 3600;
1652 int min = (offset % 3600) / 60;
1653 DateFormat dfm =
new SimpleDateFormat(
"z");
1654 dfm.setTimeZone(zone);
1655 boolean hasDaylight = zone.useDaylightTime();
1656 String first = dfm.format(
new GregorianCalendar(2010, 1, 1).getTime()).substring(0, 3);
1657 String second = dfm.format(
new GregorianCalendar(2011, 6, 6).getTime()).substring(0, 3);
1658 int mid = hour * -1;
1659 timezoneShortForm = first + Integer.toString(mid);
1661 timezoneShortForm = timezoneShortForm +
":" + (min < 10 ?
"0" :
"") + Integer.toString(min);
1664 timezoneShortForm += second;
1666 return timezoneShortForm;
1682 if(! imgHandleIsValid(imgHandle)) {
1685 return finishImageWriterNat(imgHandle);
1687 releaseTSKReadLock();
1701 if (imgHandleIsValid(imgHandle)) {
1702 return getFinishImageProgressNat(imgHandle);
1707 releaseTSKReadLock();
1719 if (imgHandleIsValid(imgHandle)) {
1720 cancelFinishImageNat(imgHandle);
1723 releaseTSKReadLock();
1739 return findDeviceSizeNat(devPath);
1743 return isImageSupportedNat(imagePath);
1750 private static void getTSKReadLock() {
1751 tskLock.readLock().lock();
1757 private static void releaseTSKReadLock() {
1758 tskLock.readLock().unlock();
1768 private static void getTSKWriteLock() {
1769 tskLock.writeLock().lock();
1775 private static void releaseTSKWriteLock() {
1776 tskLock.writeLock().unlock();
1826 return openImage(imageFiles, 0,
true, null);
1844 return openImage(imageFiles, sSize,
true, null);
1863 return openFs(imgHandle, fsOffset, null);
1882 return openFile(fsHandle, fileId, attrType, attrId, null);
1886 private static native String getVersionNat();
1888 private static native
void startVerboseLoggingNat(String logPath);
1890 private static native
long newCaseDbNat(String dbPath)
throws TskCoreException;
1892 private static native
long newCaseDbMultiNat(String hostNameOrIP, String portNumber, String userName, String password,
int dbTypeOrdinal, String databaseName);
1894 private static native
long openCaseDbMultiNat(String hostNameOrIP, String portNumber, String userName, String password,
int dbTypeOrdinal, String databaseName);
1896 private static native
long openCaseDbNat(String path)
throws TskCoreException;
1898 private static native
void closeCaseDbNat(
long db)
throws TskCoreException;
1900 private static native
int hashDbOpenNat(String hashDbPath)
throws TskCoreException;
1902 private static native
int hashDbNewNat(String hashDbPath)
throws TskCoreException;
1904 private static native
int hashDbBeginTransactionNat(
int dbHandle)
throws TskCoreException;
1906 private static native
int hashDbCommitTransactionNat(
int dbHandle)
throws TskCoreException;
1908 private static native
int hashDbRollbackTransactionNat(
int dbHandle)
throws TskCoreException;
1910 private static native
int hashDbAddEntryNat(String filename, String hashMd5, String hashSha1, String hashSha256, String comment,
int dbHandle)
throws TskCoreException;
1912 private static native
boolean hashDbIsUpdateableNat(
int dbHandle);
1914 private static native
boolean hashDbIsReindexableNat(
int dbHandle);
1916 private static native String hashDbPathNat(
int dbHandle);
1918 private static native String hashDbIndexPathNat(
int dbHandle);
1920 private static native String hashDbGetDisplayName(
int dbHandle)
throws TskCoreException;
1922 private static native
void hashDbCloseAll() throws TskCoreException;
1924 private static native
void hashDbClose(
int dbHandle) throws TskCoreException;
1926 private static native
void hashDbCreateIndexNat(
int dbHandle) throws TskCoreException;
1928 private static native
boolean hashDbIndexExistsNat(
int dbHandle) throws TskCoreException;
1930 private static native
boolean hashDbIsIdxOnlyNat(
int dbHandle) throws TskCoreException;
1932 private static native
boolean hashDbLookup(String hash,
int dbHandle) throws TskCoreException;
1934 private static native
HashHitInfo hashDbLookupVerbose(String hash,
int dbHandle) throws TskCoreException;
1936 private static native
long initAddImgNat(
long db, String timezone,
boolean addUnallocSpace,
boolean skipFatFsOrphans) throws TskCoreException;
1938 private static native
long initializeAddImgNat(
long db, String timezone,
boolean addFileSystems,
boolean addUnallocSpace,
boolean skipFatFsOrphans) throws TskCoreException;
1940 private static native
void runOpenAndAddImgNat(
long process, String deviceId, String[] imgPath,
int splits, String timezone) throws TskCoreException,
TskDataException;
1942 private static native
void runAddImgNat(
long process, String deviceId,
long a_img_info, String timeZone, String imageWriterPath) throws TskCoreException, TskDataException;
1944 private static native
void stopAddImgNat(
long process) throws TskCoreException;
1946 private static native
void revertAddImgNat(
long process) throws TskCoreException;
1948 private static native
long commitAddImgNat(
long process) throws TskCoreException;
1950 private static native
long openImgNat(String[] imgPath,
int splits,
int sSize) throws TskCoreException;
1952 private static native
long openVsNat(
long imgHandle,
long vsOffset) throws TskCoreException;
1954 private static native
long openVolNat(
long vsHandle,
long volId) throws TskCoreException;
1956 private static native
long openPoolNat(
long imgHandle,
long offset) throws TskCoreException;
1958 private static native
long getImgInfoForPoolNat(
long poolHandle,
long poolOffset) throws TskCoreException;
1960 private static native
long openFsNat(
long imgHandle,
long fsId) throws TskCoreException;
1962 private static native
long openFileNat(
long fsHandle,
long fileId,
int attrType,
int attrId) throws TskCoreException;
1964 private static native
int readImgNat(
long imgHandle, byte[] readBuffer,
long offset,
long len) throws TskCoreException;
1966 private static native
int readVsNat(
long vsHandle, byte[] readBuffer,
long offset,
long len) throws TskCoreException;
1968 private static native
int readPoolNat(
long poolHandle, byte[] readBuffer,
long offset,
long len) throws TskCoreException;
1970 private static native
int readVolNat(
long volHandle, byte[] readBuffer,
long offset,
long len) throws TskCoreException;
1972 private static native
int readFsNat(
long fsHandle, byte[] readBuffer,
long offset,
long len) throws TskCoreException;
1974 private static native
int readFileNat(
long fileHandle, byte[] readBuffer,
long offset,
int offset_type,
long len) throws TskCoreException;
1976 private static native
int saveFileMetaDataTextNat(
long fileHandle, String fileName) throws TskCoreException;
1978 private static native
void closeImgNat(
long imgHandle);
1980 private static native
void closePoolNat(
long poolHandle);
1982 private static native
void closeVsNat(
long vsHandle);
1984 private static native
void closeFsNat(
long fsHandle);
1986 private static native
void closeFileNat(
long fileHandle);
1988 private static native
long findDeviceSizeNat(String devicePath) throws TskCoreException;
1990 private static native String getCurDirNat(
long process);
1992 private static native
boolean isImageSupportedNat(String imagePath);
1994 private static native
int finishImageWriterNat(
long a_img_info);
1996 private static native
int getFinishImageProgressNat(
long a_img_info);
1998 private static native
void cancelFinishImageNat(
long a_img_info);
static int readImg(long imgHandle, byte[] readBuffer, long offset, long len)
static String getHashDatabaseIndexPath(int dbHandle)
static int readVs(long vsHandle, byte[] readBuffer, long offset, long len)
static void createLookupIndexForHashDatabase(int dbHandle)
static void addToHashDatabase(String filename, String md5, String sha1, String sha256, String comment, int dbHandle)
static long openFile(long fsHandle, long fileId, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, SleuthkitCase skCase)
static int createHashDatabase(String path)
static void closeFs(long fsHandle)
static void cancelFinishImage(long imgHandle)
static long openFile(long fsHandle, long fileId, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId)
void run(String deviceId, String[] imageFilePaths)
static int readFile(long fileHandle, byte[] readBuffer, long offset, long len)
static int finishImageWriter(long imgHandle)
static HashHitInfo lookupInHashDatabaseVerbose(String hash, int dbHandle)
static long openVs(long imgHandle, long vsOffset)
synchronized long commit()
static long openImage(String[] imageFiles, SleuthkitCase skCase)
static boolean hashDatabaseIsIndexOnly(int dbHandle)
synchronized void revert()
static boolean isImageSupported(String imagePath)
static int readVsPart(long volHandle, byte[] readBuffer, long offset, long len)
static boolean loadSleuthkitJNI()
static void closeFile(long fileHandle, SleuthkitCase skCase)
static long openImage(String[] imageFiles, int sSize)
static void closeVs(long vsHandle)
static long openImage(String[] imageFiles)
static long openFs(long imgHandle, long fsOffset, SleuthkitCase skCase)
static long openImage(String[] imageFiles, int sSize, SleuthkitCase skCase)
void run(String deviceId, String[] imageFilePaths, int sectorSize)
static long findDeviceSize(String devPath)
static String getHashDatabaseDisplayName(int dbHandle)
static List< String > getFileMetaDataText(long fileHandle)
static void closeImg(long imgHandle)
static long openFs(long imgHandle, long fsOffset)
void run(String[] imageFilePaths)
synchronized String currentDirectory()
static int getFinishImageProgress(long imgHandle)
static int openHashDatabase(String path)
static void closeFile(long fileHandle)
static boolean lookupInHashDatabase(String hash, int dbHandle)
static boolean hashDatabaseHasLookupIndex(int dbHandle)
static long openVsPart(long vsHandle, long volId)
static int readFileSlack(long fileHandle, byte[] readBuffer, long offset, long len)
static boolean isUpdateableHashDatabase(int dbHandle)
static void addToHashDatabase(List< HashEntry > hashes, int dbHandle)
static void closeAllHashDatabases()
static boolean hashDatabaseCanBeReindexed(int dbHandle)
static String getVersion()
static void startVerboseLogging(String logPath)
static int readFs(long fsHandle, byte[] readBuffer, long offset, long len)
static String getHashDatabasePath(int dbHandle)
static void closeHashDatabase(int dbHandle)