Sleuth Kit Java Bindings (JNI)  4.8.0
Java bindings for using The Sleuth Kit
org.sleuthkit.datamodel.FileSystem Class Reference

Inherits org.sleuthkit.datamodel.AbstractContent.

Public Member Functions

void close ()
 
void finalize () throws Throwable
 
long getBlock_count ()
 
long getBlock_size ()
 
long getFirst_inum ()
 
TskData.TSK_FS_TYPE_ENUM getFsType ()
 
long getImageOffset ()
 
long getLastInum ()
 
long getRoot_inum ()
 
Directory getRootDirectory () throws TskCoreException
 
long getSize ()
 
int read (byte[] buf, long offset, long len) throws TskCoreException
 
String toString (boolean preserveState)
 
- Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean equals (Object obj)
 
ArrayList< BlackboardArtifactgetAllArtifacts () throws TskCoreException
 
long getAllArtifactsCount () throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (String artifactTypeName) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (int artifactTypeID) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
long getArtifactsCount (String artifactTypeName) throws TskCoreException
 
long getArtifactsCount (int artifactTypeID) throws TskCoreException
 
long getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException
 
List< ContentgetChildren () throws TskCoreException
 
int getChildrenCount () throws TskCoreException
 
List< Long > getChildrenIds () throws TskCoreException
 
Content getDataSource () throws TskCoreException
 
BlackboardArtifact getGenInfoArtifact () throws TskCoreException
 
BlackboardArtifact getGenInfoArtifact (boolean create) throws TskCoreException
 
ArrayList< BlackboardAttributegetGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException
 
Set< String > getHashSetNames () throws TskCoreException
 
long getId ()
 
String getName ()
 
synchronized Content getParent () throws TskCoreException
 
SleuthkitCase getSleuthkitCase ()
 
synchronized String getUniquePath () throws TskCoreException
 
boolean hasChildren () throws TskCoreException
 
int hashCode ()
 
BlackboardArtifact newArtifact (int artifactTypeID) throws TskCoreException
 
BlackboardArtifact newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
String toString ()
 
String toString (boolean preserveState)
 
- Public Member Functions inherited from org.sleuthkit.datamodel.Content
long getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
ArrayList< BlackboardAttributegetGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException
 

Protected Member Functions

 FileSystem (SleuthkitCase db, long obj_id, String name, long img_offset, TskData.TSK_FS_TYPE_ENUM fs_type, long block_size, long block_count, long root_inum, long first_inum, long last_inum)
 
- Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
 AbstractContent (SleuthkitCase db, long obj_id, String name)
 

Additional Inherited Members

- Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long UNKNOWN_ID = -1
 
- Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long parentId
 

Detailed Description

Represents a file system object stored in tsk_fs_info table FileSystem has a parent content object (volume or image) and children content objects (files and directories) and fs-specific attributes. The object also maintains a handle to internal file-system structures and the handle is reused across reads.

Definition at line 30 of file FileSystem.java.

Constructor & Destructor Documentation

org.sleuthkit.datamodel.FileSystem.FileSystem ( SleuthkitCase  db,
long  obj_id,
String  name,
long  img_offset,
TskData.TSK_FS_TYPE_ENUM  fs_type,
long  block_size,
long  block_count,
long  root_inum,
long  first_inum,
long  last_inum 
)
protected

Constructor most inputs are from the database

Parameters
dbthe case handle
obj_idthe unique object id
namefilesystem name
img_offsetimage offset
fs_typefilesystem type
block_sizeblock size in this fs
block_countnumber of blocks in this fs
root_inumthe root inum
first_inumthe first inum
last_inumthe last inum

Definition at line 52 of file FileSystem.java.

Member Function Documentation

void org.sleuthkit.datamodel.FileSystem.close ( )

Free native resources after read is done on the Content object. After closing, read can be called again on the same Content object, which should result in re-opening of new native resources.

Implements org.sleuthkit.datamodel.Content.

Definition at line 66 of file FileSystem.java.

void org.sleuthkit.datamodel.FileSystem.finalize ( ) throws Throwable

Definition at line 199 of file FileSystem.java.

long org.sleuthkit.datamodel.FileSystem.getBlock_count ( )

Get the number of blocks

Returns
block count

Definition at line 167 of file FileSystem.java.

long org.sleuthkit.datamodel.FileSystem.getBlock_size ( )

Get the block size

Returns
block size

Definition at line 158 of file FileSystem.java.

long org.sleuthkit.datamodel.FileSystem.getFirst_inum ( )

Get the first inum in this file system

Returns
first inum

Definition at line 185 of file FileSystem.java.

TskData.TSK_FS_TYPE_ENUM org.sleuthkit.datamodel.FileSystem.getFsType ( )

Get the file system type

Returns
enum value of fs type

Definition at line 149 of file FileSystem.java.

long org.sleuthkit.datamodel.FileSystem.getImageOffset ( )

Get the byte offset of this file system in the image

Returns
offset

Definition at line 140 of file FileSystem.java.

long org.sleuthkit.datamodel.FileSystem.getLastInum ( )

Get the last inum

Returns
last inum

Definition at line 194 of file FileSystem.java.

long org.sleuthkit.datamodel.FileSystem.getRoot_inum ( )

Get the inum of the root directory

Returns
Root metadata address of the file system

Definition at line 176 of file FileSystem.java.

Referenced by org.sleuthkit.datamodel.FsContent.isRoot().

Directory org.sleuthkit.datamodel.FileSystem.getRootDirectory ( ) throws TskCoreException
long org.sleuthkit.datamodel.FileSystem.getSize ( )

Get the (reported) size of the content object and, in theory, how much you should be able to read from it. In some cases, data corruption may mean that you cannot read this much data.

Returns
size of the content in bytes

Implements org.sleuthkit.datamodel.Content.

Definition at line 76 of file FileSystem.java.

int org.sleuthkit.datamodel.FileSystem.read ( byte[]  buf,
long  offset,
long  len 
) throws TskCoreException

Reads data that this content object is associated with (file contents, volume contents, etc.).

Parameters
bufa character array of data (in bytes) to copy read data to
offsetbyte offset in the content to start reading from
lennumber of bytes to read into buf.
Returns
num of bytes read, or -1 on error
Exceptions
TskCoreExceptionif critical error occurred during read in the tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 71 of file FileSystem.java.

References org.sleuthkit.datamodel.SleuthkitJNI.readFs().

String org.sleuthkit.datamodel.FileSystem.toString ( boolean  preserveState)

Definition at line 221 of file FileSystem.java.


The documentation for this class was generated from the following file:

Copyright © 2011-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.