Autopsy
4.9.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
|
Inherits Serializable.
Classes | |
class | Rule |
Public Member Functions | |
FilesSet (String name, String description, boolean ignoreKnownFiles, boolean ignoreUnallocatedSpace, Map< String, Rule > rules) | |
String | fileIsMemberOf (AbstractFile file) |
String | getDescription () |
String | getName () |
Map< String, Rule > | getRules () |
boolean | ignoresKnownFiles () |
boolean | ingoresUnallocatedSpace () |
String | toString () |
Private Attributes | |
final String | description |
final boolean | ignoreKnownFiles |
final boolean | ignoreUnallocatedSpace |
final String | name |
final Map< String, Rule > | rules = new HashMap<>() |
Static Private Attributes | |
static final long | serialVersionUID = 1L |
A collection of set membership rules that define an interesting files set. The rules are independent, i.e., if any rule is satisfied by a file, the file belongs to the set.
Interesting files set definition objects are immutable, so they may be safely published to multiple threads.
Definition at line 40 of file FilesSet.java.
org.sleuthkit.autopsy.modules.interestingitems.FilesSet.FilesSet | ( | String | name, |
String | description, | ||
boolean | ignoreKnownFiles, | ||
boolean | ignoreUnallocatedSpace, | ||
Map< String, Rule > | rules | ||
) |
Constructs an interesting files set.
name | The name of the set. |
description | A description of the set, may be null. |
ignoreKnownFiles | Whether or not to exclude known files from the set. |
ignoreUnallocatedSpace | Whether or not to exclude unallocated space from the set. |
rules | The rules that define the set. May be null, but a set with no rules is the empty set. |
Definition at line 61 of file FilesSet.java.
References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreKnownFiles, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreUnallocatedSpace, and org.sleuthkit.autopsy.modules.interestingitems.FilesSet.name.
String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.fileIsMemberOf | ( | AbstractFile | file | ) |
Determines whether a file is a member of this interesting files set.
file | A file to test for set membership. |
Definition at line 132 of file FilesSet.java.
String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getDescription | ( | ) |
Gets the description of this interesting files set.
Definition at line 88 of file FilesSet.java.
References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.description.
Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.deleteRuleButtonActionPerformed(), org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.doFilesSetRuleDialog(), and org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.SetsListSelectionListener.valueChanged().
String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getName | ( | ) |
Gets the name of this interesting files set.
Definition at line 79 of file FilesSet.java.
References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.name.
Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.deleteRuleButtonActionPerformed(), org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.deleteSetButtonActionPerformed(), org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.doFilesSetRuleDialog(), org.sleuthkit.autopsy.ingest.IngestJobSettingsPanel.fileIngestFilterComboBoxActionPerformed(), org.sleuthkit.autopsy.ingest.IngestJobSettingsPanel.IngestJobSettingsPanel(), org.sleuthkit.autopsy.ingest.IngestJobSettings.load(), and org.sleuthkit.autopsy.ingest.IngestJobSettings.store().
Map<String, Rule> org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getRules | ( | ) |
Gets a copy of the set membership rules of this interesting files set.
Definition at line 120 of file FilesSet.java.
References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.rules.
Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.deleteRuleButtonActionPerformed(), org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.doFileSetsDialog(), org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.doFilesSetRuleDialog(), and org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.SetsListSelectionListener.valueChanged().
boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoresKnownFiles | ( | ) |
Returns whether or not this interesting files set ignores known files, i.e., files marked as known by a look up in a known files hash set such as the National Software Reference Library (NSRL). Note that the interesting files set does not do hash set look ups; it simply queries the known status of the files when testing them for set membership.
Definition at line 101 of file FilesSet.java.
References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreKnownFiles.
Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.deleteRuleButtonActionPerformed(), org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.doFilesSetRuleDialog(), and org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.SetsListSelectionListener.valueChanged().
boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ingoresUnallocatedSpace | ( | ) |
Returns whether or not this set of rules will process unallocated space.
Definition at line 111 of file FilesSet.java.
References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreUnallocatedSpace.
Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.deleteRuleButtonActionPerformed(), org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.doFilesSetRuleDialog(), org.sleuthkit.autopsy.ingest.IngestJobSettings.getProcessUnallocatedSpace(), and org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.SetsListSelectionListener.valueChanged().
String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.toString | ( | ) |
Definition at line 153 of file FilesSet.java.
References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.name.
|
private |
Definition at line 44 of file FilesSet.java.
Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getDescription().
|
private |
Definition at line 45 of file FilesSet.java.
Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSet.FilesSet(), and org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoresKnownFiles().
|
private |
Definition at line 46 of file FilesSet.java.
Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSet.FilesSet(), and org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ingoresUnallocatedSpace().
|
private |
Definition at line 43 of file FilesSet.java.
Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSet.FilesSet(), org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getName(), org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.FileSizeCondition.SIZE_UNIT.getName(), org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.FileSizeCondition.SIZE_UNIT.SIZE_UNIT(), and org.sleuthkit.autopsy.modules.interestingitems.FilesSet.toString().
|
private |
Definition at line 47 of file FilesSet.java.
Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getRules().
|
staticprivate |
Definition at line 42 of file FilesSet.java.
Copyright © 2012-2018 Basis Technology. Generated on: Tue Dec 18 2018
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.