Sleuth Kit Java Bindings (JNI)  4.8.0
Java bindings for using The Sleuth Kit
org.sleuthkit.datamodel.Content Interface Reference

Inherits org.sleuthkit.datamodel.SleuthkitVisitableItem.

Inherited by org.sleuthkit.datamodel.AbstractContent, org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.DataSource, and org.sleuthkit.datamodel.Report.

Public Member Functions

public< T > T accept (ContentVisitor< T > v)
 
void close ()
 
ArrayList< BlackboardArtifactgetAllArtifacts () throws TskCoreException
 
long getAllArtifactsCount () throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (String artifactTypeName) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (int artifactTypeID) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
long getArtifactsCount (String artifactTypeName) throws TskCoreException
 
long getArtifactsCount (int artifactTypeID) throws TskCoreException
 
long getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
List< ContentgetChildren () throws TskCoreException
 
int getChildrenCount () throws TskCoreException
 
List< Long > getChildrenIds () throws TskCoreException
 
Content getDataSource () throws TskCoreException
 
BlackboardArtifact getGenInfoArtifact () throws TskCoreException
 
BlackboardArtifact getGenInfoArtifact (boolean create) throws TskCoreException
 
ArrayList< BlackboardAttributegetGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException
 
Set< String > getHashSetNames () throws TskCoreException
 
long getId ()
 
String getName ()
 
Content getParent () throws TskCoreException
 
long getSize ()
 
String getUniquePath () throws TskCoreException
 
boolean hasChildren () throws TskCoreException
 
BlackboardArtifact newArtifact (int artifactTypeID) throws TskCoreException
 
BlackboardArtifact newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
int read (byte[] buf, long offset, long len) throws TskCoreException
 
- Public Member Functions inherited from org.sleuthkit.datamodel.SleuthkitVisitableItem
public< T > T accept (SleuthkitItemVisitor< T > v)
 

Detailed Description

Interface for all datatypes that can be found in the database. Content objects make up a tree and each object can have a parent and children. For example, the child of an Image object is a Volume or File System. This interface defines the basic methods for reading the content associated with this object, the parent and children, and adding artifacts.

Definition at line 32 of file Content.java.

Member Function Documentation

public<T> T org.sleuthkit.datamodel.Content.accept ( ContentVisitor< T >  v)

Visitor pattern support

Parameters
vvisitor supplying an algorithm to run on the content object
Returns
visitor return value resulting from running the algorithm
ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.Content.getAllArtifacts ( ) throws TskCoreException

Get all artifacts associated with this content

Returns
a list of blackboard artifacts
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.

long org.sleuthkit.datamodel.Content.getAllArtifactsCount ( ) throws TskCoreException

Get count of all artifacts associated with this content

Returns
count of all blackboard artifacts for this content
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.

ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.Content.getArtifacts ( String  artifactTypeName) throws TskCoreException

Get all artifacts associated with this content that have the given type name

Parameters
artifactTypeNamename of the type to look up
Returns
a list of blackboard artifacts matching the type
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.

ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.Content.getArtifacts ( int  artifactTypeID) throws TskCoreException

Get all artifacts associated with this content that have the given type id

Parameters
artifactTypeIDtype id to look up
Returns
a list of blackboard artifacts matching the type
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.

ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.Content.getArtifacts ( BlackboardArtifact.ARTIFACT_TYPE  type) throws TskCoreException

Get all artifacts associated with this content that have the given type

Parameters
typetype to look up
Returns
a list of blackboard artifacts matching the type
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.

long org.sleuthkit.datamodel.Content.getArtifactsCount ( String  artifactTypeName) throws TskCoreException

Get count of all artifacts associated with this content that have the given type name

Parameters
artifactTypeNamename of the type to look up
Returns
count of blackboard artifacts matching the type
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.

long org.sleuthkit.datamodel.Content.getArtifactsCount ( int  artifactTypeID) throws TskCoreException

Get count of all artifacts associated with this content that have the given type id

Parameters
artifactTypeIDtype id to look up
Returns
count of blackboard artifacts matching the type
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.

long org.sleuthkit.datamodel.Content.getArtifactsCount ( BlackboardArtifact.ARTIFACT_TYPE  type) throws TskCoreException

Get count of all artifacts associated with this content that have the given type

Parameters
typetype to look up
Returns
count of blackboard artifacts matching the type
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, and org.sleuthkit.datamodel.Report.

int org.sleuthkit.datamodel.Content.getChildrenCount ( ) throws TskCoreException

Returns count of children objects. Note, this should be more efficient than getting children and counting them.

Returns
children count
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.Report, and org.sleuthkit.datamodel.AbstractContent.

List<Long> org.sleuthkit.datamodel.Content.getChildrenIds ( ) throws TskCoreException
Content org.sleuthkit.datamodel.Content.getDataSource ( ) throws TskCoreException

Gets the root data source (image, virtual directory, etc.) of this content.

Returns
Content associated with data source or null if one can't be found
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractFile, org.sleuthkit.datamodel.FsContent, org.sleuthkit.datamodel.Report, org.sleuthkit.datamodel.AbstractContent, org.sleuthkit.datamodel.Image, and org.sleuthkit.datamodel.VirtualDirectory.

Referenced by org.sleuthkit.datamodel.AbstractContent.getDataSource(), and org.sleuthkit.datamodel.Report.getDataSource().

BlackboardArtifact org.sleuthkit.datamodel.Content.getGenInfoArtifact ( ) throws TskCoreException

Return the TSK_GEN_INFO artifact for the file so that individual attributes can be added to it. Creates one if it does not already exist.

Returns
Instance of the TSK_GEN_INFO artifact
Exceptions
TskCoreException

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.

BlackboardArtifact org.sleuthkit.datamodel.Content.getGenInfoArtifact ( boolean  create) throws TskCoreException

Return the TSK_GEN_INFO artifact for the file so that individual attributes can be added to it. If one does not create, behavior depends on the create argument.

Parameters
createIf true, an artifact will be created if it does not already exist.
Returns
Instance of the TSK_GEN_INFO artifact or null if artifact does not already exist and create was set to false
Exceptions
TskCoreException

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.

ArrayList<BlackboardAttribute> org.sleuthkit.datamodel.Content.getGenInfoAttributes ( BlackboardAttribute.ATTRIBUTE_TYPE  attr_type) throws TskCoreException

Return attributes of a given type from TSK_GEN_INFO.

Parameters
attr_typeAttribute type to find inside of the TSK_GEN_INFO artifact.
Returns
Attributes

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, and org.sleuthkit.datamodel.Report.

Set<String> org.sleuthkit.datamodel.Content.getHashSetNames ( ) throws TskCoreException

Get the names of all the hashsets that this content is in.

Returns
the names of the hashsets that this content is in
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.

String org.sleuthkit.datamodel.Content.getName ( )
Content org.sleuthkit.datamodel.Content.getParent ( ) throws TskCoreException
Returns
returns the parent of this Content object or null if there isn't one as is the case for Image.
Exceptions
TskCoreException

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.Report, and org.sleuthkit.datamodel.AbstractContent.

Referenced by org.sleuthkit.datamodel.SleuthkitCase.addCarvedFiles().

long org.sleuthkit.datamodel.Content.getSize ( )

Get the (reported) size of the content object and, in theory, how much you should be able to read from it. In some cases, data corruption may mean that you cannot read this much data.

Returns
size of the content in bytes

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractFile, org.sleuthkit.datamodel.Image, org.sleuthkit.datamodel.Report, org.sleuthkit.datamodel.Volume, org.sleuthkit.datamodel.FileSystem, org.sleuthkit.datamodel.VolumeSystem, and org.sleuthkit.datamodel.Pool.

Referenced by org.sleuthkit.datamodel.Pool.getSize(), and org.sleuthkit.datamodel.ReadContentInputStream.ReadContentInputStream().

boolean org.sleuthkit.datamodel.Content.hasChildren ( ) throws TskCoreException

Returns true if the content object has children objects. Note, this should be more efficient than getting children and checking it empty.

Returns
true if has children, false otherwise.
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.Report, and org.sleuthkit.datamodel.AbstractContent.

BlackboardArtifact org.sleuthkit.datamodel.Content.newArtifact ( int  artifactTypeID) throws TskCoreException

Create and add an artifact associated with this content to the blackboard

Parameters
artifactTypeIDid of the artifact type (if the id doesn't already exist an exception will be thrown)
Returns
the blackboard artifact created (the artifact type id can be looked up from this)
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.

BlackboardArtifact org.sleuthkit.datamodel.Content.newArtifact ( BlackboardArtifact.ARTIFACT_TYPE  type) throws TskCoreException

Create and add an artifact associated with this content to the blackboard

Parameters
typeartifact enum tyoe
Returns
the blackboard artifact created (the artifact type id can be looked up from this)
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.

int org.sleuthkit.datamodel.Content.read ( byte[]  buf,
long  offset,
long  len 
) throws TskCoreException

Reads data that this content object is associated with (file contents, volume contents, etc.).

Parameters
bufa character array of data (in bytes) to copy read data to
offsetbyte offset in the content to start reading from
lennumber of bytes to read into buf.
Returns
num of bytes read, or -1 on error
Exceptions
TskCoreExceptionif critical error occurred during read in the tsk core

Implemented in org.sleuthkit.datamodel.AbstractFile, org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.Image, org.sleuthkit.datamodel.Report, org.sleuthkit.datamodel.FileSystem, org.sleuthkit.datamodel.Volume, org.sleuthkit.datamodel.VolumeSystem, and org.sleuthkit.datamodel.Pool.

Referenced by org.sleuthkit.datamodel.ReadContentInputStream.read().


The documentation for this interface was generated from the following file:

Copyright © 2011-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.