Inherits org.sleuthkit.datamodel.AbstractContent.

Inherited by org.sleuthkit.datamodel.DerivedFile, org.sleuthkit.datamodel.FsContent, org.sleuthkit.datamodel.LayoutFile, org.sleuthkit.datamodel.LocalFile, and org.sleuthkit.datamodel.VirtualDirectory.

Classes
enum	MimeMatchEnum

Public Member Functions
boolean	canRead ()

void	close ()

long	convertToImgOffset (long fileOffset) throws TskCoreException

boolean	exists ()

long	getAtime ()

String	getAtimeAsDate ()

short	getAttrId ()

TskData.TSK_FS_ATTR_TYPE_ENUM	getAttrType ()

long	getCrtime ()

String	getCrtimeAsDate ()

long	getCtime ()

String	getCtimeAsDate ()

String	getDirFlagAsString ()

TSK_FS_NAME_TYPE_ENUM	getDirType ()

String	getDirTypeAsString ()

int	getGid ()

TskData.FileKnown	getKnown ()

String	getLocalAbsPath ()

String	getLocalPath ()

String	getMd5Hash ()

long	getMetaAddr ()

String	getMetaFlagsAsString ()

long	getMetaSeq ()

TSK_FS_META_TYPE_ENUM	getMetaType ()

String	getMetaTypeAsString ()

String	getModesAsString ()

long	getMtime ()

String	getMtimeAsDate ()

String	getNameExtension ()

String	getParentPath ()

List< TskFileRange >	getRanges () throws TskCoreException

long	getSize ()

TskData.TSK_DB_FILES_TYPE_ENUM	getType ()

int	getUid ()

boolean	isDir ()

boolean	isDirNameFlagSet (TSK_FS_NAME_FLAG_ENUM flag)

boolean	isFile ()

boolean	isMetaFlagSet (TSK_FS_META_FLAG_ENUM metaFlag)

MimeMatchEnum	isMimeType (SortedSet< String > mimeTypes)

boolean	isModeSet (TskData.TSK_FS_META_MODE_ENUM mode)

abstract boolean	isRoot ()

boolean	isVirtual ()

List< AbstractFile >	listFiles () throws TskCoreException

final int	read (byte[] buf, long offset, long len) throws TskCoreException

String	toString (boolean preserveState)

Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean	equals (Object obj)

ArrayList< BlackboardArtifact >	getAllArtifacts () throws TskCoreException

long	getAllArtifactsCount () throws TskCoreException

ArrayList< BlackboardArtifact >	getArtifacts (String artifactTypeName) throws TskCoreException

ArrayList< BlackboardArtifact >	getArtifacts (int artifactTypeID) throws TskCoreException

ArrayList< BlackboardArtifact >	getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException

long	getArtifactsCount (String artifactTypeName) throws TskCoreException

long	getArtifactsCount (int artifactTypeID) throws TskCoreException

long	getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException

int	getChildrenCount () throws TskCoreException

Content	getDataSource () throws TskCoreException

BlackboardArtifact	getGenInfoArtifact () throws TskCoreException

BlackboardArtifact	getGenInfoArtifact (boolean create) throws TskCoreException

ArrayList< BlackboardAttribute >	getGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException

Set< String >	getHashSetNames () throws TskCoreException

long	getId ()

String	getName ()

synchronized Content	getParent () throws TskCoreException

SleuthkitCase	getSleuthkitCase ()

synchronized String	getUniquePath () throws TskCoreException

boolean	hasChildren () throws TskCoreException

int	hashCode ()

BlackboardArtifact	newArtifact (int artifactTypeID) throws TskCoreException

BlackboardArtifact	newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException

String	toString ()

String	toString (boolean preserveState)

Public Member Functions inherited from org.sleuthkit.datamodel.Content
public< T > T	accept (ContentVisitor< T > v)

long	getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException

List< Content >	getChildren () throws TskCoreException

List< Long >	getChildrenIds () throws TskCoreException

ArrayList< BlackboardAttribute >	getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException

Public Member Functions inherited from org.sleuthkit.datamodel.SleuthkitVisitableItem
public< T > T	accept (SleuthkitItemVisitor< T > v)

Static Public Member Functions
static String	createNonUniquePath (String uniquePath)

static String	epochToTime (long epoch)

static long	timeToEpoch (String time)

Protected Member Functions
	AbstractFile (SleuthkitCase db, long objId, TskData.TSK_FS_ATTR_TYPE_ENUM attrType, short attrId, String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, short modes, int uid, int gid, String md5Hash, FileKnown knownState, String parentPath)

void	finalize () throws Throwable

int	readInt (byte[] buf, long offset, long len) throws TskCoreException

final int	readLocal (byte[] buf, long offset, long len) throws TskCoreException

void	setLocalPath (String localPath, boolean isAbsolute)

Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
	AbstractContent (SleuthkitCase db, long obj_id, String name)

Protected Attributes
final short	attrId

final TskData.TSK_FS_ATTR_TYPE_ENUM	attrType

final TSK_FS_NAME_FLAG_ENUM	dirFlag

final TSK_FS_NAME_TYPE_ENUM	dirType

final TskData.TSK_DB_FILES_TYPE_ENUM	fileType

TskData.FileKnown	knownState

String	md5Hash

final long	metaAddr

final Set< TSK_FS_META_FLAG_ENUM >	metaFlags

final int	metaSeq

final TSK_FS_META_TYPE_ENUM	metaType

final Set< TskData.TSK_FS_META_MODE_ENUM >	modes

final String	parentPath

long	size

final int	uid

Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long	parentId

Private Member Functions
void	loadLocalFile () throws TskCoreException

Private Attributes
String	localAbsPath
	absolute path representation of the local path More...

volatile java.io.File	localFile

volatile RandomAccessFile	localFileHandle

String	localPath
	local path as stored in db tsk_files_path, is relative to the db, More...

boolean	localPathSet = false
	if set by setLocalPath(), reads are done on local file More...

List< TskFileRange >	ranges

Static Private Attributes
static final ResourceBundle	bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle")

static final Logger	logger = Logger.getLogger(AbstractFile.class.getName())

Additional Inherited Members
Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long	UNKNOWN_ID = -1

Detailed Description

Common fields methods for objects stored in tsk_files table Abstract files are divided into subtypes defined in TSK_DB_FILES_TYPE_ENUM and further divided into files and directories

Definition at line 43 of file AbstractFile.java.

Constructor & Destructor Documentation

org.sleuthkit.datamodel.AbstractFile.AbstractFile	(	SleuthkitCase	db,
		long	objId,
		TskData.TSK_FS_ATTR_TYPE_ENUM	attrType,
		short	attrId,
		String	name,
		TskData.TSK_DB_FILES_TYPE_ENUM	fileType,
		long	metaAddr,
		int	metaSeq,
		TSK_FS_NAME_TYPE_ENUM	dirType,
		TSK_FS_META_TYPE_ENUM	metaType,
		TSK_FS_NAME_FLAG_ENUM	dirFlag,
		short	metaFlags,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		short	modes,
		int	uid,
		int	gid,
		String	md5Hash,
		FileKnown	knownState,
		String	parentPath
	)

protected

Initializes common fields used by AbstactFile implementations (objects in tsk_files table)

Parameters

db	case / db handle where this file belongs to
objId	object id in tsk_objects table
attrType
attrId
name	name field of the file
fileType	type of the file
metaAddr
metaSeq
dirType
metaType
dirFlag
metaFlags
size
ctime
crtime
atime
mtime
modes
uid
gid
md5Hash	md5sum of the file, or null or "NULL" if not present
knownState	knownState status of the file, or null if unknown (default)
parentPath

Definition at line 109 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.AbstractFile.listFiles().

Member Function Documentation

boolean org.sleuthkit.datamodel.AbstractFile.canRead ( )

Check if the file exists and is readable. If non-local (e.g. within an image), always true, if local, checks if actual local path exists and is readable

Returns: true if the file is readable

Definition at line 843 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.canRead(), org.sleuthkit.datamodel.AbstractFile.loadLocalFile(), and org.sleuthkit.datamodel.AbstractFile.localFile.

Referenced by org.sleuthkit.datamodel.AbstractFile.canRead(), and org.sleuthkit.datamodel.AbstractFile.readLocal().

void org.sleuthkit.datamodel.AbstractFile.close ( )

Free native resources after read is done on the Content object. After closing, read can be called again on the same Content object, which should result in re-opening of new native resources.

Implements org.sleuthkit.datamodel.Content.

Definition at line 880 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractContent.getName(), and org.sleuthkit.datamodel.AbstractFile.getParentPath().

Referenced by org.sleuthkit.datamodel.DerivedFile.finalize(), and org.sleuthkit.datamodel.AbstractFile.finalize().

long org.sleuthkit.datamodel.AbstractFile.convertToImgOffset ( long fileOffset ) throws TskCoreException

Convert an internal offset to an image offset

Parameters

fileOffset the byte offset in this layout file to map

Returns: the corresponding byte offset in the image where the file offset is located, or -1 if the file has no range layout information or if the fileOffset is larger than file size

Exceptions

TskCoreException exception thrown if critical error occurred within tsk core and offset could not be converted

Definition at line 512 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.getRanges().

static String org.sleuthkit.datamodel.AbstractFile.createNonUniquePath ( String uniquePath )

static

Parameters

uniquePath the unique path to an AbstractFile (or subclass) usually obtained by a call to AbstractFile.getUniquePath.

Returns: the path to to an AbstractFile (or subclass) with the image and volume path segments removed.

Definition at line 574 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.SleuthkitCase.openFiles().

static String org.sleuthkit.datamodel.AbstractFile.epochToTime ( long epoch )

static

Return the epoch into string in ISO 8601 dateTime format

Parameters

epoch time in seconds

Returns: formatted date time string as "yyyy-MM-dd HH:mm:ss"

Definition at line 939 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.AbstractFile.getAtimeAsDate(), org.sleuthkit.datamodel.AbstractFile.getCrtimeAsDate(), org.sleuthkit.datamodel.AbstractFile.getCtimeAsDate(), and org.sleuthkit.datamodel.AbstractFile.getMtimeAsDate().

boolean org.sleuthkit.datamodel.AbstractFile.exists ( )

Check if the file exists. If non-local always true, if local, checks if actual local path exists

Returns: true if the file exists, false otherwise

Definition at line 822 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.exists(), org.sleuthkit.datamodel.AbstractFile.loadLocalFile(), and org.sleuthkit.datamodel.AbstractFile.localFile.

Referenced by org.sleuthkit.datamodel.AbstractFile.exists(), org.sleuthkit.datamodel.Image.imageFileExists(), and org.sleuthkit.datamodel.AbstractFile.readLocal().

void org.sleuthkit.datamodel.AbstractFile.finalize ( ) throws Throwable

protected

Definition at line 899 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.close().

long org.sleuthkit.datamodel.AbstractFile.getAtime ( )

Get the access time

Returns: access time

Definition at line 210 of file AbstractFile.java.

String org.sleuthkit.datamodel.AbstractFile.getAtimeAsDate ( )

Get the access time as Date (in local timezone)

Returns: access time as Date

Definition at line 219 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.epochToTime().

short org.sleuthkit.datamodel.AbstractFile.getAttrId ( )

Get the attribute id

Returns: attribute id

Definition at line 165 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.attrId.

TskData.TSK_FS_ATTR_TYPE_ENUM org.sleuthkit.datamodel.AbstractFile.getAttrType ( )

Get the attribute type

Returns: attribute type

Definition at line 156 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.attrType.

long org.sleuthkit.datamodel.AbstractFile.getCrtime ( )

Get the creation time

Returns: creation time

Definition at line 192 of file AbstractFile.java.

String org.sleuthkit.datamodel.AbstractFile.getCrtimeAsDate ( )

Get the creation time as Date (in local timezone)

Returns: creation time as Date

Definition at line 201 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.epochToTime().

long org.sleuthkit.datamodel.AbstractFile.getCtime ( )

Get the change time

Returns: change time

Definition at line 174 of file AbstractFile.java.

String org.sleuthkit.datamodel.AbstractFile.getCtimeAsDate ( )

Get the change time as Date (in local timezone)

Returns: change time as Date

Definition at line 183 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.epochToTime().

String org.sleuthkit.datamodel.AbstractFile.getDirFlagAsString ( )

Returns: a string representation of the directory name flag (type TSK_FS_NAME_FLAG_ENUM)

Definition at line 656 of file AbstractFile.java.

References org.sleuthkit.datamodel.TskData.TSK_FS_NAME_FLAG_ENUM.toString().

TSK_FS_NAME_TYPE_ENUM org.sleuthkit.datamodel.AbstractFile.getDirType ( )

Get the directory type id

Returns: directory type id

Definition at line 636 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.dirType.

String org.sleuthkit.datamodel.AbstractFile.getDirTypeAsString ( )

Definition at line 640 of file AbstractFile.java.

int org.sleuthkit.datamodel.AbstractFile.getGid ( )

Get the group id

Returns: group id

Definition at line 255 of file AbstractFile.java.

TskData.FileKnown org.sleuthkit.datamodel.AbstractFile.getKnown ( )

Get "knownState" file status - after running a HashDB ingest on it As marked by a knownState file database, such as NSRL

Returns: file knownState status enum value

Definition at line 436 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.knownState.

String org.sleuthkit.datamodel.AbstractFile.getLocalAbsPath ( )

Get local absolute path of the file, if localPath has been set

Returns: local absolute file path if local path has been set, or null

Definition at line 812 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.localAbsPath.

String org.sleuthkit.datamodel.AbstractFile.getLocalPath ( )

Get local relative to case db path of the file

Returns: local file path if set

Definition at line 803 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.localPath.

String org.sleuthkit.datamodel.AbstractFile.getMd5Hash ( )

Get the md5 hash value as calculated, if present

Returns: md5 hash string, if it is present or null if it is not

Definition at line 415 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.md5Hash.

long org.sleuthkit.datamodel.AbstractFile.getMetaAddr ( )

Get the file meta address

Returns: Address of the meta data structure

Definition at line 264 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.metaAddr.

Referenced by org.sleuthkit.datamodel.FsContent.isRoot().

String org.sleuthkit.datamodel.AbstractFile.getMetaFlagsAsString ( )

Returns: a string representation of the meta flags

Definition at line 663 of file AbstractFile.java.

References org.sleuthkit.datamodel.TskData.TSK_FS_META_FLAG_ENUM.ALLOC, and org.sleuthkit.datamodel.TskData.TSK_FS_META_FLAG_ENUM.UNALLOC.

long org.sleuthkit.datamodel.AbstractFile.getMetaSeq ( )

Get the file meta address sequence. Only useful with NTFS. Incremented each time a structure is re-allocated.

Returns: Address of the meta data structure sequence.

Definition at line 274 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.metaSeq.

TSK_FS_META_TYPE_ENUM org.sleuthkit.datamodel.AbstractFile.getMetaType ( )

Get the meta data type

Returns: meta data type

Definition at line 623 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.metaType.

String org.sleuthkit.datamodel.AbstractFile.getMetaTypeAsString ( )

Definition at line 627 of file AbstractFile.java.

References org.sleuthkit.datamodel.TskData.TSK_FS_META_TYPE_ENUM.toString().

String org.sleuthkit.datamodel.AbstractFile.getModesAsString ( )

Get the file's mode as a user-displayable string

Returns: formatted user-displayable string for mode

Definition at line 283 of file AbstractFile.java.

long org.sleuthkit.datamodel.AbstractFile.getMtime ( )

Get the modified time

Returns: modified time

Definition at line 228 of file AbstractFile.java.

String org.sleuthkit.datamodel.AbstractFile.getMtimeAsDate ( )

Get the modified time as Date (in local timezone)

Returns: modified time as Date

Definition at line 237 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.epochToTime().

String org.sleuthkit.datamodel.AbstractFile.getNameExtension ( )

Figures out the extension from the filename, if there is one. We assume that extensions only have ASCII alphanumeric chars

Returns: filename extension in lowercase (not including the period) or empty string if there is no extension

Definition at line 447 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractContent.getName().

String org.sleuthkit.datamodel.AbstractFile.getParentPath ( )

Get path of the parent of this file

Returns: path string of the parent

Definition at line 482 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.parentPath.

Referenced by org.sleuthkit.datamodel.AbstractFile.close(), org.sleuthkit.datamodel.OSUtility.getOSInfoInternal(), and org.sleuthkit.datamodel.FsContent.getUniquePath().

List<TskFileRange> org.sleuthkit.datamodel.AbstractFile.getRanges ( ) throws TskCoreException

Gets file ranges associated with the file. File ranges are objects in tsk_file_layout table Any file type (especially unallocated) may have 1 or more block ranges associated with it

Returns: list of file layout ranges

Exceptions

TskCoreException exception thrown if critical error occurred within tsk core

Definition at line 495 of file AbstractFile.java.

References org.sleuthkit.datamodel.SleuthkitCase.getFileRanges(), org.sleuthkit.datamodel.AbstractContent.getId(), org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase(), and org.sleuthkit.datamodel.AbstractFile.ranges.

Referenced by org.sleuthkit.datamodel.LayoutFile.calcSize(), org.sleuthkit.datamodel.AbstractFile.convertToImgOffset(), org.sleuthkit.datamodel.LayoutFile.getNumParts(), and org.sleuthkit.datamodel.LayoutFile.readInt().

long org.sleuthkit.datamodel.AbstractFile.getSize ( )

Get size of the file

Returns: file size in bytes

Implements org.sleuthkit.datamodel.Content.

Definition at line 473 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.size.

TskData.TSK_DB_FILES_TYPE_ENUM org.sleuthkit.datamodel.AbstractFile.getType ( )

Gets type of the abstract file as defined in TSK_DB_FILES_TYPE_ENUM

Returns: the type of the abstract file

Definition at line 147 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.fileType.

int org.sleuthkit.datamodel.AbstractFile.getUid ( )

Get the user id

Returns: user id

Definition at line 246 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.uid.

boolean org.sleuthkit.datamodel.AbstractFile.isDir ( )

Is this object a directory

Returns: true if directory, false otherwise

Definition at line 557 of file AbstractFile.java.

References org.sleuthkit.datamodel.TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.

Referenced by org.sleuthkit.datamodel.AbstractFile.readLocal().

boolean org.sleuthkit.datamodel.AbstractFile.isDirNameFlagSet ( TSK_FS_NAME_FLAG_ENUM flag )

Parameters

flag	the TSK_FS_NAME_FLAG_ENUM to check

Returns: true if the given flag is set in this FsContent object.

Definition at line 648 of file AbstractFile.java.

boolean org.sleuthkit.datamodel.AbstractFile.isFile ( )

Is this object a file

Returns: true if a file, false otherwise

Definition at line 547 of file AbstractFile.java.

References org.sleuthkit.datamodel.TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG.

boolean org.sleuthkit.datamodel.AbstractFile.isMetaFlagSet ( TSK_FS_META_FLAG_ENUM metaFlag )

Parameters

metaFlag the TSK_FS_META_FLAG_ENUM to check

Returns: true if the given meta flag is set in this FsContent object.

Definition at line 677 of file AbstractFile.java.

MimeMatchEnum org.sleuthkit.datamodel.AbstractFile.isMimeType ( SortedSet< String > mimeTypes )

Determines if this file's type is one of the ones passed in. Uses the blackboard attribute for file type.

Parameters

mimeTypes Set of file types to compare against

Returns

Definition at line 980 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.MimeMatchEnum.FALSE, org.sleuthkit.datamodel.AbstractContent.getGenInfoAttributes(), org.sleuthkit.datamodel.AbstractFile.MimeMatchEnum.TRUE, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG, and org.sleuthkit.datamodel.AbstractFile.MimeMatchEnum.UNDEFINED.

boolean org.sleuthkit.datamodel.AbstractFile.isModeSet ( TskData.TSK_FS_META_MODE_ENUM mode )

Definition at line 395 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.modes.

abstract boolean org.sleuthkit.datamodel.AbstractFile.isRoot ( )

abstract

Is this a root of a file system

Returns: true if root of a file system, false otherwise

boolean org.sleuthkit.datamodel.AbstractFile.isVirtual ( )

is this a virtual file or directory

Returns: true if it's virtual, false otherwise

Definition at line 536 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.fileType, org.sleuthkit.datamodel.TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT, org.sleuthkit.datamodel.TskData.TSK_FS_NAME_TYPE_ENUM.VIRT, and org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.

List<AbstractFile> org.sleuthkit.datamodel.AbstractFile.listFiles ( ) throws TskCoreException

Returns: a list of AbstractFiles that are the children of this Directory. Only returns children of type TskData.TSK_DB_FILES_TYPE_ENUM.FS.

Exceptions

org.sleuthkit.datamodel.TskCoreException

Definition at line 603 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.AbstractFile(), and org.sleuthkit.datamodel.Content.getChildren().

void org.sleuthkit.datamodel.AbstractFile.loadLocalFile ( ) throws TskCoreException

private

Lazy load local file handle

Definition at line 861 of file AbstractFile.java.

References org.sleuthkit.datamodel.File.File(), and org.sleuthkit.datamodel.AbstractFile.localFile.

Referenced by org.sleuthkit.datamodel.AbstractFile.canRead(), org.sleuthkit.datamodel.AbstractFile.exists(), and org.sleuthkit.datamodel.AbstractFile.readLocal().

final int org.sleuthkit.datamodel.AbstractFile.read	(	byte[]	buf,
		long	offset,
		long	len
	)		throws TskCoreException

Reads data that this content object is associated with (file contents, volume contents, etc.).

Parameters

buf	a character array of data (in bytes) to copy read data to
offset	byte offset in the content to start reading from
len	number of bytes to read into buf.

Returns: num of bytes read, or -1 on error

Exceptions

TskCoreException if critical error occurred during read in the tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 682 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.readInt(), and org.sleuthkit.datamodel.AbstractFile.readLocal().

int org.sleuthkit.datamodel.AbstractFile.readInt	(	byte[]	buf,
		long	offset,
		long	len
	)		throws TskCoreException

protected

Internal custom read (non-local) method that child classes can implement

Parameters

buf	buffer to read into
offset	start reading position in the file
len	number of bytes to read

Returns: number of bytes read

Exceptions

TskCoreException exception thrown when file could not be read

Definition at line 702 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.AbstractFile.read().

final int org.sleuthkit.datamodel.AbstractFile.readLocal	(	byte[]	buf,
		long	offset,
		long	len
	)		throws TskCoreException

protected

Local file path read support

Parameters

buf	buffer to read into
offset	start reading position in the file
len	number of bytes to read

Returns: number of bytes read

Exceptions

TskCoreException exception thrown when file could not be read

Definition at line 715 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.canRead(), org.sleuthkit.datamodel.AbstractFile.exists(), org.sleuthkit.datamodel.AbstractFile.isDir(), org.sleuthkit.datamodel.AbstractFile.loadLocalFile(), org.sleuthkit.datamodel.AbstractFile.localAbsPath, and org.sleuthkit.datamodel.AbstractFile.localFile.

Referenced by org.sleuthkit.datamodel.AbstractFile.read().

void org.sleuthkit.datamodel.AbstractFile.setLocalPath	(	String	localPath,
		boolean	isAbsolute
	)

protected

Set local path for the file, as stored in db tsk_files_path, relative to the case db path or an absolute path. When set, subsequent invocations of read() will read the file in the local path.

Parameters