Sleuth Kit Java Bindings (JNI)  4.12.1
Java bindings for using The Sleuth Kit
org.sleuthkit.datamodel.File Class Reference

Inherits org.sleuthkit.datamodel.FsContent.

Public Member Functions

String toString (boolean preserveState)
 
- Public Member Functions inherited from org.sleuthkit.datamodel.FsContent
synchronized void close ()
 
void finalize () throws Throwable
 
Content getDataSource () throws TskCoreException
 
long getFileSystemId ()
 
synchronized List< String > getMetaDataText () throws TskCoreException
 
AbstractFile getParentDirectory () throws TskCoreException
 
boolean isRoot ()
 
String toString (boolean preserveState)
 
- Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
void addAttributes (Collection< Attribute > attributes, final SleuthkitCase.CaseDbTransaction caseDbTransaction) throws TskCoreException
 
boolean canRead ()
 
void close ()
 
long convertToImgOffset (long fileOffset) throws TskCoreException
 
List< TskFileRangeconvertToImgRanges (long fileOffset, long length) throws TskCoreException
 
boolean exists ()
 
long getAtime ()
 
String getAtimeAsDate ()
 
int getAttributeId ()
 
List< AttributegetAttributes () throws TskCoreException
 
short getAttrId ()
 
TskData.TSK_FS_ATTR_TYPE_ENUM getAttrType ()
 
TskData.CollectedStatus getCollected ()
 
long getCrtime ()
 
String getCrtimeAsDate ()
 
long getCtime ()
 
String getCtimeAsDate ()
 
Content getDataSource () throws TskCoreException
 
long getDataSourceObjectId ()
 
String getDirFlagAsString ()
 
TSK_FS_NAME_TYPE_ENUM getDirType ()
 
String getDirTypeAsString ()
 
FileSystem getFileSystem () throws TskCoreException
 
Optional< Long > getFileSystemObjectId ()
 
int getGid ()
 
TskData.FileKnown getKnown ()
 
String getLocalAbsPath ()
 
String getLocalPath ()
 
String getMd5Hash ()
 
long getMetaAddr ()
 
String getMetaFlagsAsString ()
 
long getMetaSeq ()
 
TSK_FS_META_TYPE_ENUM getMetaType ()
 
String getMetaTypeAsString ()
 
String getMIMEType ()
 
String getModesAsString ()
 
long getMtime ()
 
String getMtimeAsDate ()
 
String getNameExtension ()
 
Optional< Long > getOsAccountObjectId ()
 
Optional< String > getOwnerUid ()
 
String getParentPath ()
 
List< TskFileRangegetRanges () throws TskCoreException
 
String getSha1Hash ()
 
String getSha256Hash ()
 
long getSize ()
 
TskData.TSK_DB_FILES_TYPE_ENUM getType ()
 
int getUid ()
 
String getUniquePath () throws TskCoreException
 
boolean hasFileSystem ()
 
boolean isDir ()
 
boolean isDirNameFlagSet (TSK_FS_NAME_FLAG_ENUM flag)
 
boolean isFile ()
 
boolean isMetaFlagSet (TSK_FS_META_FLAG_ENUM metaFlag)
 
MimeMatchEnum isMimeType (SortedSet< String > mimeTypes)
 
boolean isModeSet (TskData.TSK_FS_META_MODE_ENUM mode)
 
abstract boolean isRoot ()
 
boolean isVirtual ()
 
List< AbstractFilelistFiles () throws TskCoreException
 
BlackboardArtifact newArtifact (int artifactTypeID) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException
 
final int read (byte[] buf, long offset, long len) throws TskCoreException
 
void save () throws TskCoreException
 
void save (CaseDbTransaction transaction) throws TskCoreException
 
void setCollected (TskData.CollectedStatus collected)
 
void setKnown (TskData.FileKnown knownState)
 
void setMd5Hash (String md5Hash)
 
void setMIMEType (String mimeType)
 
void setSha1Hash (String sha1Hash)
 
void setSha256Hash (String sha256Hash)
 
String toString (boolean preserveState)
 
- Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean equals (Object obj)
 
Score getAggregateScore () throws TskCoreException
 
List< AnalysisResultgetAllAnalysisResults () throws TskCoreException
 
ArrayList< BlackboardArtifactgetAllArtifacts () throws TskCoreException
 
long getAllArtifactsCount () throws TskCoreException
 
List< DataArtifactgetAllDataArtifacts () throws TskCoreException
 
List< AnalysisResultgetAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (String artifactTypeName) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (int artifactTypeID) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
long getArtifactsCount (String artifactTypeName) throws TskCoreException
 
long getArtifactsCount (int artifactTypeID) throws TskCoreException
 
long getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException
 
List< ContentgetChildren () throws TskCoreException
 
int getChildrenCount () throws TskCoreException
 
List< Long > getChildrenIds () throws TskCoreException
 
Content getDataSource () throws TskCoreException
 
BlackboardArtifact getGenInfoArtifact () throws TskCoreException
 
BlackboardArtifact getGenInfoArtifact (boolean create) throws TskCoreException
 
ArrayList< BlackboardAttributegetGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException
 
Set< String > getHashSetNames () throws TskCoreException
 
long getId ()
 
String getName ()
 
Content getParent () throws TskCoreException
 
Optional< Long > getParentId () throws TskCoreException
 
SleuthkitCase getSleuthkitCase ()
 
String getUniquePath () throws TskCoreException
 
boolean hasChildren () throws TskCoreException
 
int hashCode ()
 
AnalysisResultAdded newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException
 
AnalysisResultAdded newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException
 
BlackboardArtifact newArtifact (int artifactTypeID) throws TskCoreException
 
BlackboardArtifact newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException
 
String toString ()
 
String toString (boolean preserveState)
 
- Public Member Functions inherited from org.sleuthkit.datamodel.Content
long getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
ArrayList< BlackboardAttributegetGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException
 

Protected Member Functions

 File (SleuthkitCase db, long objId, long fsObjId, TSK_FS_ATTR_TYPE_ENUM attrType, short attrId, String name, long metaAddr, int metaSeq, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, short modes, int uid, int gid, String md5Hash, FileKnown knownState, String parentPath)
 
- Protected Member Functions inherited from org.sleuthkit.datamodel.FsContent
synchronized int readInt (byte[] buf, long offset, long len) throws TskCoreException
 
- Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
void finalize () throws Throwable
 
int readInt (byte[] buf, long offset, long len) throws TskCoreException
 
final int readLocal (byte[] buf, long offset, long len) throws TskCoreException
 
void setLocalPath (String localPath, boolean isAbsolute)
 
- Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
 AbstractContent (SleuthkitCase db, long obj_id, String name)
 

Additional Inherited Members

- Static Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
static String createNonUniquePath (String uniquePath)
 
static String epochToTime (long epoch)
 
static String epochToTime (long epoch, TimeZone tzone)
 
static long timeToEpoch (String time)
 
- Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long UNKNOWN_ID = -1
 
- Protected Attributes inherited from org.sleuthkit.datamodel.FsContent
volatile long fileHandle = 0
 
- Protected Attributes inherited from org.sleuthkit.datamodel.AbstractFile
final int attrId
 
final TskData.TSK_FS_ATTR_TYPE_ENUM attrType
 
TSK_FS_NAME_FLAG_ENUM dirFlag
 
final TSK_FS_NAME_TYPE_ENUM dirType
 
final Long fileSystemObjectId
 
final TskData.TSK_DB_FILES_TYPE_ENUM fileType
 
TskData.FileKnown knownState
 
String md5Hash
 
final long metaAddr
 
Set< TSK_FS_META_FLAG_ENUMmetaFlags
 
final int metaSeq
 
final TSK_FS_META_TYPE_ENUM metaType
 
final Set< TskData.TSK_FS_META_MODE_ENUM > modes
 
final String parentPath
 
String sha1Hash
 
String sha256Hash
 
long size
 
final int uid
 
- Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long parentId
 

Detailed Description

A representation of a file system file that has been added to a case.

Definition at line 32 of file File.java.

Constructor & Destructor Documentation

org.sleuthkit.datamodel.File.File ( SleuthkitCase  db,
long  objId,
long  fsObjId,
TSK_FS_ATTR_TYPE_ENUM  attrType,
short  attrId,
String  name,
long  metaAddr,
int  metaSeq,
TSK_FS_NAME_TYPE_ENUM  dirType,
TSK_FS_META_TYPE_ENUM  metaType,
TSK_FS_NAME_FLAG_ENUM  dirFlag,
short  metaFlags,
long  size,
long  ctime,
long  crtime,
long  atime,
long  mtime,
short  modes,
int  uid,
int  gid,
String  md5Hash,
FileKnown  knownState,
String  parentPath 
)
protected

Constructs a representation of a file system file that has been added to the case.

Parameters
dbThe case database to which the file has been added.
objIdThe object id of the file in the case database.
fsObjIdThe object id of the file system to which this file belongs.
attrTypeThe type attribute given to the file by the file system.
attrIdThe type id given to the file by the file system.
nameThe name of the file.
metaAddrThe meta address of the file.
metaSeqThe meta sequence number of the file.
dirTypeThe type of the file, usually as reported in the name structure of the file system. May be set to TSK_FS_NAME_TYPE_ENUM.UNDEF.
metaTypeThe type of the file, usually as reported in the metadata structure of the file system. May be set to TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_UNDEF.
dirFlagThe allocated status of the file, usually as reported in the name structure of the file system.
metaFlagsThe allocated status of the file, usually as reported in the metadata structure of the file system.
sizeThe size of the file.
ctimeThe changed time of the file.
crtimeThe created time of the file.
atimeThe accessed time of the file.
mtimeThe modified time of the file.
modesThe modes for the file.
uidThe UID for the file.
gidThe GID for the file.
md5HashThe MD5 hash of the file, null if not yet calculated.
knownStateThe known state of the file from a hash database lookup, null if not yet looked up.
parentPathThe path of the parent of the file.
Deprecated:
Do not make subclasses outside of this package.

Definition at line 193 of file File.java.

References org.sleuthkit.datamodel.AbstractFile.attrId, org.sleuthkit.datamodel.AbstractFile.attrType, org.sleuthkit.datamodel.AbstractFile.dirFlag, org.sleuthkit.datamodel.AbstractFile.dirType, org.sleuthkit.datamodel.AbstractFile.knownState, org.sleuthkit.datamodel.AbstractFile.md5Hash, org.sleuthkit.datamodel.AbstractFile.metaAddr, org.sleuthkit.datamodel.AbstractFile.metaFlags, org.sleuthkit.datamodel.AbstractFile.metaSeq, org.sleuthkit.datamodel.AbstractFile.metaType, org.sleuthkit.datamodel.AbstractFile.modes, org.sleuthkit.datamodel.AbstractFile.parentPath, org.sleuthkit.datamodel.AbstractFile.size, and org.sleuthkit.datamodel.AbstractFile.uid.

Member Function Documentation

String org.sleuthkit.datamodel.File.toString ( boolean  preserveState)

Provides a string representation of this file.

Parameters
preserveStateTrue if state should be included in the string representation of this object.
Exceptions
TskCoreExceptionif there was an error querying the case database.

Definition at line 148 of file File.java.


The documentation for this class was generated from the following file:

Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.