Sleuth Kit Java Bindings (JNI)
4.9.0
Java bindings for using The Sleuth Kit
|
Inherits org.sleuthkit.datamodel.SleuthkitVisitableItem.
Inherited by org.sleuthkit.datamodel.AbstractContent, org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.DataSource, and org.sleuthkit.datamodel.Report.
Public Member Functions | |
public< T > T | accept (ContentVisitor< T > v) |
void | close () |
ArrayList< BlackboardArtifact > | getAllArtifacts () throws TskCoreException |
long | getAllArtifactsCount () throws TskCoreException |
ArrayList< BlackboardArtifact > | getArtifacts (String artifactTypeName) throws TskCoreException |
ArrayList< BlackboardArtifact > | getArtifacts (int artifactTypeID) throws TskCoreException |
ArrayList< BlackboardArtifact > | getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
long | getArtifactsCount (String artifactTypeName) throws TskCoreException |
long | getArtifactsCount (int artifactTypeID) throws TskCoreException |
long | getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
List< Content > | getChildren () throws TskCoreException |
int | getChildrenCount () throws TskCoreException |
List< Long > | getChildrenIds () throws TskCoreException |
Content | getDataSource () throws TskCoreException |
BlackboardArtifact | getGenInfoArtifact () throws TskCoreException |
BlackboardArtifact | getGenInfoArtifact (boolean create) throws TskCoreException |
ArrayList< BlackboardAttribute > | getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException |
Set< String > | getHashSetNames () throws TskCoreException |
long | getId () |
String | getName () |
Content | getParent () throws TskCoreException |
long | getSize () |
String | getUniquePath () throws TskCoreException |
boolean | hasChildren () throws TskCoreException |
BlackboardArtifact | newArtifact (int artifactTypeID) throws TskCoreException |
BlackboardArtifact | newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
int | read (byte[] buf, long offset, long len) throws TskCoreException |
![]() | |
public< T > T | accept (SleuthkitItemVisitor< T > v) |
Interface for all datatypes that can be found in the database. Content objects make up a tree and each object can have a parent and children. For example, the child of an Image object is a Volume or File System. This interface defines the basic methods for reading the content associated with this object, the parent and children, and adding artifacts.
Definition at line 32 of file Content.java.
public<T> T org.sleuthkit.datamodel.Content.accept | ( | ContentVisitor< T > | v | ) |
Visitor pattern support
v | visitor supplying an algorithm to run on the content object |
void org.sleuthkit.datamodel.Content.close | ( | ) |
Free native resources after read is done on the Content object. After closing, read can be called again on the same Content object, which should result in re-opening of new native resources.
Implemented in org.sleuthkit.datamodel.AbstractFile, org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.FsContent, org.sleuthkit.datamodel.Report, org.sleuthkit.datamodel.Image, org.sleuthkit.datamodel.LayoutFile, org.sleuthkit.datamodel.Pool, org.sleuthkit.datamodel.VolumeSystem, org.sleuthkit.datamodel.Volume, org.sleuthkit.datamodel.SpecialDirectory, and org.sleuthkit.datamodel.FileSystem.
Referenced by org.sleuthkit.datamodel.SleuthkitCase.getDataSources().
ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.Content.getAllArtifacts | ( | ) | throws TskCoreException |
Get all artifacts associated with this content
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.
long org.sleuthkit.datamodel.Content.getAllArtifactsCount | ( | ) | throws TskCoreException |
Get count of all artifacts associated with this content
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.
ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.Content.getArtifacts | ( | String | artifactTypeName | ) | throws TskCoreException |
Get all artifacts associated with this content that have the given type name
artifactTypeName | name of the type to look up |
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.
ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.Content.getArtifacts | ( | int | artifactTypeID | ) | throws TskCoreException |
Get all artifacts associated with this content that have the given type id
artifactTypeID | type id to look up |
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.
ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.Content.getArtifacts | ( | BlackboardArtifact.ARTIFACT_TYPE | type | ) | throws TskCoreException |
Get all artifacts associated with this content that have the given type
type | type to look up |
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.
long org.sleuthkit.datamodel.Content.getArtifactsCount | ( | String | artifactTypeName | ) | throws TskCoreException |
Get count of all artifacts associated with this content that have the given type name
artifactTypeName | name of the type to look up |
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.
long org.sleuthkit.datamodel.Content.getArtifactsCount | ( | int | artifactTypeID | ) | throws TskCoreException |
Get count of all artifacts associated with this content that have the given type id
artifactTypeID | type id to look up |
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.
long org.sleuthkit.datamodel.Content.getArtifactsCount | ( | BlackboardArtifact.ARTIFACT_TYPE | type | ) | throws TskCoreException |
Get count of all artifacts associated with this content that have the given type
type | type to look up |
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, and org.sleuthkit.datamodel.Report.
List<Content> org.sleuthkit.datamodel.Content.getChildren | ( | ) | throws TskCoreException |
Gets the child content objects of this content.
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.Image, org.sleuthkit.datamodel.Volume, org.sleuthkit.datamodel.Report, org.sleuthkit.datamodel.AbstractContent, org.sleuthkit.datamodel.Pool, and org.sleuthkit.datamodel.VolumeSystem.
Referenced by org.sleuthkit.datamodel.SleuthkitCase.addCarvedFiles(), and org.sleuthkit.datamodel.Examples.Sample.run().
int org.sleuthkit.datamodel.Content.getChildrenCount | ( | ) | throws TskCoreException |
Returns count of children objects. Note, this should be more efficient than getting children and counting them.
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.Report, and org.sleuthkit.datamodel.AbstractContent.
List<Long> org.sleuthkit.datamodel.Content.getChildrenIds | ( | ) | throws TskCoreException |
Gets the child content ids of this content.
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.Image, org.sleuthkit.datamodel.Volume, org.sleuthkit.datamodel.Report, org.sleuthkit.datamodel.AbstractContent, org.sleuthkit.datamodel.Pool, and org.sleuthkit.datamodel.VolumeSystem.
Content org.sleuthkit.datamodel.Content.getDataSource | ( | ) | throws TskCoreException |
Gets the root data source (image, virtual directory, etc.) of this content.
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractFile, org.sleuthkit.datamodel.FsContent, org.sleuthkit.datamodel.Report, org.sleuthkit.datamodel.AbstractContent, org.sleuthkit.datamodel.Image, and org.sleuthkit.datamodel.VirtualDirectory.
Referenced by org.sleuthkit.datamodel.AbstractContent.getDataSource(), and org.sleuthkit.datamodel.Report.getDataSource().
BlackboardArtifact org.sleuthkit.datamodel.Content.getGenInfoArtifact | ( | ) | throws TskCoreException |
Return the TSK_GEN_INFO artifact for the file so that individual attributes can be added to it. Creates one if it does not already exist.
TskCoreException |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.
BlackboardArtifact org.sleuthkit.datamodel.Content.getGenInfoArtifact | ( | boolean | create | ) | throws TskCoreException |
Return the TSK_GEN_INFO artifact for the file so that individual attributes can be added to it. If one does not create, behavior depends on the create argument.
create | If true, an artifact will be created if it does not already exist. |
TskCoreException |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.
ArrayList<BlackboardAttribute> org.sleuthkit.datamodel.Content.getGenInfoAttributes | ( | BlackboardAttribute.ATTRIBUTE_TYPE | attr_type | ) | throws TskCoreException |
Return attributes of a given type from TSK_GEN_INFO.
attr_type | Attribute type to find inside of the TSK_GEN_INFO artifact. |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, and org.sleuthkit.datamodel.Report.
Set<String> org.sleuthkit.datamodel.Content.getHashSetNames | ( | ) | throws TskCoreException |
Get the names of all the hashsets that this content is in.
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.
long org.sleuthkit.datamodel.Content.getId | ( | ) |
Returns the unique object ID that was assigned to it in the database. This is a Sleuth Kit database-assigned number.
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.
Referenced by org.sleuthkit.datamodel.SleuthkitCase.addCarvedFiles(), org.sleuthkit.datamodel.SleuthkitCase.addDerivedFile(), org.sleuthkit.datamodel.ReadContentInputStream.read(), org.sleuthkit.datamodel.AbstractContent.toString(), and org.sleuthkit.datamodel.SleuthkitCase.updateDerivedFile().
String org.sleuthkit.datamodel.Content.getName | ( | ) |
Get the name of this content object (does not include parent path)
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.Report, and org.sleuthkit.datamodel.AbstractContent.
Referenced by org.sleuthkit.datamodel.SleuthkitCase.addDerivedFile(), org.sleuthkit.datamodel.ReadContentInputStream.read(), and org.sleuthkit.datamodel.SleuthkitCase.updateDerivedFile().
Content org.sleuthkit.datamodel.Content.getParent | ( | ) | throws TskCoreException |
TskCoreException |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.Report, and org.sleuthkit.datamodel.AbstractContent.
Referenced by org.sleuthkit.datamodel.SleuthkitCase.addCarvedFiles().
long org.sleuthkit.datamodel.Content.getSize | ( | ) |
Get the (reported) size of the content object and, in theory, how much you should be able to read from it. In some cases, data corruption may mean that you cannot read this much data.
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractFile, org.sleuthkit.datamodel.Image, org.sleuthkit.datamodel.Report, org.sleuthkit.datamodel.Volume, org.sleuthkit.datamodel.FileSystem, org.sleuthkit.datamodel.VolumeSystem, and org.sleuthkit.datamodel.Pool.
Referenced by org.sleuthkit.datamodel.Pool.getSize(), and org.sleuthkit.datamodel.ReadContentInputStream.ReadContentInputStream().
String org.sleuthkit.datamodel.Content.getUniquePath | ( | ) | throws TskCoreException |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.FsContent, org.sleuthkit.datamodel.Image, org.sleuthkit.datamodel.Report, org.sleuthkit.datamodel.Volume, and org.sleuthkit.datamodel.AbstractContent.
Referenced by org.sleuthkit.datamodel.SleuthkitCase.addDerivedFile(), org.sleuthkit.datamodel.AbstractContent.getUniquePath(), org.sleuthkit.datamodel.Volume.getUniquePath(), org.sleuthkit.datamodel.BlackboardArtifact.getUniquePath(), and org.sleuthkit.datamodel.SleuthkitCase.updateDerivedFile().
boolean org.sleuthkit.datamodel.Content.hasChildren | ( | ) | throws TskCoreException |
Returns true if the content object has children objects. Note, this should be more efficient than getting children and checking it empty.
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.Report, and org.sleuthkit.datamodel.AbstractContent.
BlackboardArtifact org.sleuthkit.datamodel.Content.newArtifact | ( | int | artifactTypeID | ) | throws TskCoreException |
Create and add an artifact associated with this content to the blackboard
artifactTypeID | id of the artifact type (if the id doesn't already exist an exception will be thrown) |
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.
BlackboardArtifact org.sleuthkit.datamodel.Content.newArtifact | ( | BlackboardArtifact.ARTIFACT_TYPE | type | ) | throws TskCoreException |
Create and add an artifact associated with this content to the blackboard
type | artifact enum tyoe |
TskCoreException | if critical error occurred within tsk core |
Implemented in org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.AbstractContent, and org.sleuthkit.datamodel.Report.
int org.sleuthkit.datamodel.Content.read | ( | byte[] | buf, |
long | offset, | ||
long | len | ||
) | throws TskCoreException |
Reads data that this content object is associated with (file contents, volume contents, etc.).
buf | a character array of data (in bytes) to copy read data to |
offset | byte offset in the content to start reading from |
len | number of bytes to read into buf. |
TskCoreException | if critical error occurred during read in the tsk core |
Implemented in org.sleuthkit.datamodel.AbstractFile, org.sleuthkit.datamodel.BlackboardArtifact, org.sleuthkit.datamodel.Image, org.sleuthkit.datamodel.Report, org.sleuthkit.datamodel.FileSystem, org.sleuthkit.datamodel.Volume, org.sleuthkit.datamodel.VolumeSystem, and org.sleuthkit.datamodel.Pool.
Referenced by org.sleuthkit.datamodel.ReadContentInputStream.read().
Copyright © 2011-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.