Sleuth Kit Java Bindings (JNI)
4.8.0
Java bindings for using The Sleuth Kit
|
Inherits org.sleuthkit.datamodel.VirtualDirectory, and org.sleuthkit.datamodel.DataSource.
Public Member Functions | |
LocalFilesDataSource (SleuthkitCase db, long objId, long dataSourceObjectId, String deviceId, String name, TskData.TSK_FS_NAME_TYPE_ENUM dirType, TskData.TSK_FS_META_TYPE_ENUM metaType, TskData.TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, String timezone, String md5Hash, TskData.FileKnown knownState, String parentPath) | |
String | getAcquisitionDetails () throws TskCoreException |
long | getContentSize (SleuthkitCase sleuthkitCase) throws TskCoreException |
String | getDeviceId () |
VirtualDirectory | getRootDirectory () |
String | getTimeZone () |
void | setAcquisitionDetails (String details) throws TskCoreException |
void | setDisplayName (String newName) throws TskCoreException |
Public Member Functions inherited from org.sleuthkit.datamodel.VirtualDirectory | |
Content | getDataSource () throws TskCoreException |
String | toString (boolean preserveState) |
Public Member Functions inherited from org.sleuthkit.datamodel.SpecialDirectory | |
void | close () |
List< TskFileRange > | getRanges () throws TskCoreException |
boolean | isDataSource () |
boolean | isRoot () |
Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile | |
boolean | canRead () |
void | close () |
long | convertToImgOffset (long fileOffset) throws TskCoreException |
boolean | exists () |
long | getAtime () |
String | getAtimeAsDate () |
int | getAttributeId () |
short | getAttrId () |
TskData.TSK_FS_ATTR_TYPE_ENUM | getAttrType () |
long | getCrtime () |
String | getCrtimeAsDate () |
long | getCtime () |
String | getCtimeAsDate () |
Content | getDataSource () throws TskCoreException |
long | getDataSourceObjectId () |
String | getDirFlagAsString () |
TSK_FS_NAME_TYPE_ENUM | getDirType () |
String | getDirTypeAsString () |
int | getGid () |
TskData.FileKnown | getKnown () |
String | getLocalAbsPath () |
String | getLocalPath () |
String | getMd5Hash () |
long | getMetaAddr () |
String | getMetaFlagsAsString () |
long | getMetaSeq () |
TSK_FS_META_TYPE_ENUM | getMetaType () |
String | getMetaTypeAsString () |
String | getMIMEType () |
String | getModesAsString () |
long | getMtime () |
String | getMtimeAsDate () |
String | getNameExtension () |
String | getParentPath () |
List< TskFileRange > | getRanges () throws TskCoreException |
long | getSize () |
TskData.TSK_DB_FILES_TYPE_ENUM | getType () |
int | getUid () |
boolean | isDir () |
boolean | isDirNameFlagSet (TSK_FS_NAME_FLAG_ENUM flag) |
boolean | isFile () |
boolean | isMetaFlagSet (TSK_FS_META_FLAG_ENUM metaFlag) |
MimeMatchEnum | isMimeType (SortedSet< String > mimeTypes) |
boolean | isModeSet (TskData.TSK_FS_META_MODE_ENUM mode) |
abstract boolean | isRoot () |
boolean | isVirtual () |
List< AbstractFile > | listFiles () throws TskCoreException |
final int | read (byte[] buf, long offset, long len) throws TskCoreException |
void | save () throws TskCoreException |
void | setKnown (TskData.FileKnown knownState) |
void | setMd5Hash (String md5Hash) |
void | setMIMEType (String mimeType) |
String | toString (boolean preserveState) |
Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent | |
boolean | equals (Object obj) |
ArrayList< BlackboardArtifact > | getAllArtifacts () throws TskCoreException |
long | getAllArtifactsCount () throws TskCoreException |
ArrayList< BlackboardArtifact > | getArtifacts (String artifactTypeName) throws TskCoreException |
ArrayList< BlackboardArtifact > | getArtifacts (int artifactTypeID) throws TskCoreException |
ArrayList< BlackboardArtifact > | getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
long | getArtifactsCount (String artifactTypeName) throws TskCoreException |
long | getArtifactsCount (int artifactTypeID) throws TskCoreException |
long | getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException |
List< Content > | getChildren () throws TskCoreException |
int | getChildrenCount () throws TskCoreException |
List< Long > | getChildrenIds () throws TskCoreException |
Content | getDataSource () throws TskCoreException |
BlackboardArtifact | getGenInfoArtifact () throws TskCoreException |
BlackboardArtifact | getGenInfoArtifact (boolean create) throws TskCoreException |
ArrayList< BlackboardAttribute > | getGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException |
Set< String > | getHashSetNames () throws TskCoreException |
long | getId () |
String | getName () |
synchronized Content | getParent () throws TskCoreException |
SleuthkitCase | getSleuthkitCase () |
synchronized String | getUniquePath () throws TskCoreException |
boolean | hasChildren () throws TskCoreException |
int | hashCode () |
BlackboardArtifact | newArtifact (int artifactTypeID) throws TskCoreException |
BlackboardArtifact | newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
String | toString () |
String | toString (boolean preserveState) |
Public Member Functions inherited from org.sleuthkit.datamodel.Content | |
long | getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
ArrayList< BlackboardAttribute > | getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException |
Additional Inherited Members | |
Static Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile | |
static String | createNonUniquePath (String uniquePath) |
static String | epochToTime (long epoch) |
static String | epochToTime (long epoch, TimeZone tzone) |
static long | timeToEpoch (String time) |
Static Public Attributes inherited from org.sleuthkit.datamodel.VirtualDirectory | |
static final String | NAME_CARVED = "$CarvedFiles" |
static final String | NAME_UNALLOC = "$Unalloc" |
Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent | |
static final long | UNKNOWN_ID = -1 |
Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractFile | |
AbstractFile (SleuthkitCase db, long objId, TskData.TSK_FS_ATTR_TYPE_ENUM attrType, short attrId, String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, short modes, int uid, int gid, String md5Hash, FileKnown knownState, String parentPath) | |
void | finalize () throws Throwable |
int | readInt (byte[] buf, long offset, long len) throws TskCoreException |
final int | readLocal (byte[] buf, long offset, long len) throws TskCoreException |
void | setLocalPath (String localPath, boolean isAbsolute) |
Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent | |
AbstractContent (SleuthkitCase db, long obj_id, String name) | |
Protected Attributes inherited from org.sleuthkit.datamodel.AbstractFile | |
final int | attrId |
final TskData.TSK_FS_ATTR_TYPE_ENUM | attrType |
final TSK_FS_NAME_FLAG_ENUM | dirFlag |
final TSK_FS_NAME_TYPE_ENUM | dirType |
final TskData.TSK_DB_FILES_TYPE_ENUM | fileType |
TskData.FileKnown | knownState |
String | md5Hash |
final long | metaAddr |
final Set< TSK_FS_META_FLAG_ENUM > | metaFlags |
final int | metaSeq |
final TSK_FS_META_TYPE_ENUM | metaType |
final Set< TskData.TSK_FS_META_MODE_ENUM > | modes |
final String | parentPath |
long | size |
final int | uid |
Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent | |
long | parentId |
A local/logical files and/or directories data source.
NOTE: The DataSource interface is an emerging feature and at present is only useful for obtaining the object id and the device id, an ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID). In the future, this interface will extend the Content interface and the AbstractDataSource will become an abstract superclass.
Definition at line 37 of file LocalFilesDataSource.java.
org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource | ( | SleuthkitCase | db, |
long | objId, | ||
long | dataSourceObjectId, | ||
String | deviceId, | ||
String | name, | ||
TskData.TSK_FS_NAME_TYPE_ENUM | dirType, | ||
TskData.TSK_FS_META_TYPE_ENUM | metaType, | ||
TskData.TSK_FS_NAME_FLAG_ENUM | dirFlag, | ||
short | metaFlags, | ||
String | timezone, | ||
String | md5Hash, | ||
TskData.FileKnown | knownState, | ||
String | parentPath | ||
) |
Constructs a local/logical files and/or directories data source.
db | The case database. |
objId | The object id of the virtual directory. |
dataSourceObjectId | The object id of the data source for the virtual directory; same as objId if the virtual directory is a data source. |
name | The name of the virtual directory. |
dirType | The TSK_FS_NAME_TYPE_ENUM for the virtual directory. |
deviceId | The device ID for the data source. |
metaType | The TSK_FS_META_TYPE_ENUM for the virtual directory. |
dirFlag | The TSK_FS_META_TYPE_ENUM for the virtual directory. |
metaFlags | The meta flags for the virtual directory. |
timezone | The timezone for the data source. |
md5Hash | The MD5 hash for the virtual directory. |
knownState | The known state for the virtual directory |
parentPath | The parent path for the virtual directory, should be "/" if the virtual directory is a data source. |
Definition at line 69 of file LocalFilesDataSource.java.
References org.sleuthkit.datamodel.AbstractFile.dirFlag, org.sleuthkit.datamodel.AbstractFile.dirType, org.sleuthkit.datamodel.AbstractFile.knownState, and org.sleuthkit.datamodel.AbstractFile.metaType.
String org.sleuthkit.datamodel.LocalFilesDataSource.getAcquisitionDetails | ( | ) | throws TskCoreException |
Gets the acquisition details field from the case database.
TskCoreException | Thrown if the data can not be read |
Implements org.sleuthkit.datamodel.DataSource.
Definition at line 203 of file LocalFilesDataSource.java.
References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().
long org.sleuthkit.datamodel.LocalFilesDataSource.getContentSize | ( | SleuthkitCase | sleuthkitCase | ) | throws TskCoreException |
Gets the size of the contents of the data source in bytes. This size can change as archive files within the data source are expanded, files are carved, etc., and is different from the size of the data source as returned by Content.getSize, which is the size of the data source as a file.
sleuthkitCase | The sleuthkit case instance from which to make calls to the database. |
TskCoreException | Thrown when there is an issue trying to retrieve data from the database. |
Implements org.sleuthkit.datamodel.DataSource.
Definition at line 139 of file LocalFilesDataSource.java.
String org.sleuthkit.datamodel.LocalFilesDataSource.getDeviceId | ( | ) |
Gets the ASCII-printable identifier for the device associated with the data source. This identifier is intended to be unique across multiple cases (e.g., a UUID).
Implements org.sleuthkit.datamodel.DataSource.
Definition at line 97 of file LocalFilesDataSource.java.
VirtualDirectory org.sleuthkit.datamodel.LocalFilesDataSource.getRootDirectory | ( | ) |
Returns the VirtualDirectory instance. /deprecated LocalFilesDataSource is already a VirtualDirectory.
Definition at line 85 of file LocalFilesDataSource.java.
String org.sleuthkit.datamodel.LocalFilesDataSource.getTimeZone | ( | ) |
Gets the time zone that was used to process the data source.
Implements org.sleuthkit.datamodel.DataSource.
Definition at line 107 of file LocalFilesDataSource.java.
void org.sleuthkit.datamodel.LocalFilesDataSource.setAcquisitionDetails | ( | String | details | ) | throws TskCoreException |
Sets the acquisition details field in the case database.
details | The acquisition details |
TskCoreException | Thrown if the data can not be written |
Implements org.sleuthkit.datamodel.DataSource.
Definition at line 191 of file LocalFilesDataSource.java.
References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().
void org.sleuthkit.datamodel.LocalFilesDataSource.setDisplayName | ( | String | newName | ) | throws TskCoreException |
Set the name for this data source.
newName | The new name for the data source |
TskCoreException | Thrown if an error occurs while updating the database |
Implements org.sleuthkit.datamodel.DataSource.
Definition at line 119 of file LocalFilesDataSource.java.
References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().
Copyright © 2011-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.