Inherits org.sleuthkit.datamodel.AbstractFile.

Inherited by org.sleuthkit.datamodel.Directory, and org.sleuthkit.datamodel.File.

Public Member Functions
void	close ()

void	finalize () throws Throwable

Content	getDataSource () throws TskCoreException

FileSystem	getFileSystem () throws TskCoreException

long	getFileSystemId ()

synchronized List< String >	getMetaDataText () throws TskCoreException

AbstractFile	getParentDirectory () throws TskCoreException

synchronized String	getUniquePath () throws TskCoreException

boolean	isRoot ()

String	toString (boolean preserveState)

Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
boolean	canRead ()

void	close ()

long	convertToImgOffset (long fileOffset) throws TskCoreException

boolean	exists ()

long	getAtime ()

String	getAtimeAsDate ()

short	getAttrId ()

TskData.TSK_FS_ATTR_TYPE_ENUM	getAttrType ()

long	getCrtime ()

String	getCrtimeAsDate ()

long	getCtime ()

String	getCtimeAsDate ()

String	getDirFlagAsString ()

TSK_FS_NAME_TYPE_ENUM	getDirType ()

String	getDirTypeAsString ()

int	getGid ()

TskData.FileKnown	getKnown ()

String	getLocalAbsPath ()

String	getLocalPath ()

String	getMd5Hash ()

long	getMetaAddr ()

String	getMetaFlagsAsString ()

long	getMetaSeq ()

TSK_FS_META_TYPE_ENUM	getMetaType ()

String	getMetaTypeAsString ()

String	getModesAsString ()

long	getMtime ()

String	getMtimeAsDate ()

String	getNameExtension ()

String	getParentPath ()

List< TskFileRange >	getRanges () throws TskCoreException

long	getSize ()

TskData.TSK_DB_FILES_TYPE_ENUM	getType ()

int	getUid ()

boolean	isDir ()

boolean	isDirNameFlagSet (TSK_FS_NAME_FLAG_ENUM flag)

boolean	isFile ()

boolean	isMetaFlagSet (TSK_FS_META_FLAG_ENUM metaFlag)

MimeMatchEnum	isMimeType (SortedSet< String > mimeTypes)

boolean	isModeSet (TskData.TSK_FS_META_MODE_ENUM mode)

abstract boolean	isRoot ()

boolean	isVirtual ()

List< AbstractFile >	listFiles () throws TskCoreException

final int	read (byte[] buf, long offset, long len) throws TskCoreException

String	toString (boolean preserveState)

Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean	equals (Object obj)

ArrayList< BlackboardArtifact >	getAllArtifacts () throws TskCoreException

long	getAllArtifactsCount () throws TskCoreException

ArrayList< BlackboardArtifact >	getArtifacts (String artifactTypeName) throws TskCoreException

ArrayList< BlackboardArtifact >	getArtifacts (int artifactTypeID) throws TskCoreException

ArrayList< BlackboardArtifact >	getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException

long	getArtifactsCount (String artifactTypeName) throws TskCoreException

long	getArtifactsCount (int artifactTypeID) throws TskCoreException

long	getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException

int	getChildrenCount () throws TskCoreException

Content	getDataSource () throws TskCoreException

BlackboardArtifact	getGenInfoArtifact () throws TskCoreException

BlackboardArtifact	getGenInfoArtifact (boolean create) throws TskCoreException

ArrayList< BlackboardAttribute >	getGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException

Set< String >	getHashSetNames () throws TskCoreException

long	getId ()

String	getName ()

synchronized Content	getParent () throws TskCoreException

SleuthkitCase	getSleuthkitCase ()

synchronized String	getUniquePath () throws TskCoreException

boolean	hasChildren () throws TskCoreException

int	hashCode ()

BlackboardArtifact	newArtifact (int artifactTypeID) throws TskCoreException

BlackboardArtifact	newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException

String	toString ()

String	toString (boolean preserveState)

Public Member Functions inherited from org.sleuthkit.datamodel.Content
public< T > T	accept (ContentVisitor< T > v)

long	getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException

List< Content >	getChildren () throws TskCoreException

List< Long >	getChildrenIds () throws TskCoreException

ArrayList< BlackboardAttribute >	getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException

Public Member Functions inherited from org.sleuthkit.datamodel.SleuthkitVisitableItem
public< T > T	accept (SleuthkitItemVisitor< T > v)

Protected Member Functions
int	readInt (byte[] buf, long offset, long len) throws TskCoreException

Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
	AbstractFile (SleuthkitCase db, long objId, TskData.TSK_FS_ATTR_TYPE_ENUM attrType, short attrId, String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, short modes, int uid, int gid, String md5Hash, FileKnown knownState, String parentPath)

void	finalize () throws Throwable

int	readInt (byte[] buf, long offset, long len) throws TskCoreException

final int	readLocal (byte[] buf, long offset, long len) throws TskCoreException

void	setLocalPath (String localPath, boolean isAbsolute)

Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
	AbstractContent (SleuthkitCase db, long obj_id, String name)

Protected Attributes
volatile long	fileHandle = 0
	other members More...

final long	fsObjId
	read only database tsk_files fields More...

Protected Attributes inherited from org.sleuthkit.datamodel.AbstractFile
final short	attrId

final TskData.TSK_FS_ATTR_TYPE_ENUM	attrType

final TSK_FS_NAME_FLAG_ENUM	dirFlag

final TSK_FS_NAME_TYPE_ENUM	dirType

final TskData.TSK_DB_FILES_TYPE_ENUM	fileType

TskData.FileKnown	knownState

String	md5Hash

final long	metaAddr

final Set< TSK_FS_META_FLAG_ENUM >	metaFlags

final int	metaSeq

final TSK_FS_META_TYPE_ENUM	metaType

final Set< TskData.TSK_FS_META_MODE_ENUM >	modes

final String	parentPath

long	size

final int	uid

Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long	parentId

Private Member Functions
void	loadFileHandle () throws TskCoreException

Private Attributes
List< String >	metaDataText = null

volatile FileSystem	parentFileSystem

final SleuthkitCase	tskCase
	read-write database tsk_files fields More...

String	uniquePath

Static Private Attributes
static final ResourceBundle	bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle")

static final Logger	logger = Logger.getLogger(AbstractFile.class.getName())

Additional Inherited Members
Static Public Member Functions inherited from org.sleuthkit.datamodel.AbstractFile
static String	createNonUniquePath (String uniquePath)

static String	epochToTime (long epoch)

static long	timeToEpoch (String time)

Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long	UNKNOWN_ID = -1

Detailed Description

Generalized class that stores metadata that are common to both File and Directory objects stored in tsk_files table Caches internal tsk file handle and reuses it for reads

TODO move common getters to AbstractFile class

Definition at line 39 of file FsContent.java.

Member Function Documentation

void org.sleuthkit.datamodel.FsContent.close ( )

Free native resources after read is done on the Content object. After closing, read can be called again on the same Content object, which should result in re-opening of new native resources.

Implements org.sleuthkit.datamodel.Content.

Definition at line 239 of file FsContent.java.

References org.sleuthkit.datamodel.SleuthkitJNI.closeFile().

Referenced by org.sleuthkit.datamodel.FsContent.finalize().

void org.sleuthkit.datamodel.FsContent.finalize ( ) throws Throwable

Definition at line 252 of file FsContent.java.

References org.sleuthkit.datamodel.FsContent.close().

Content org.sleuthkit.datamodel.FsContent.getDataSource ( ) throws TskCoreException

Get the root data source of this content (image, virtual directory, etc.)

Returns: Content associated with data source or null if one can't be found

Exceptions

TskCoreException if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 197 of file FsContent.java.

References org.sleuthkit.datamodel.AbstractContent.getDataSource(), and org.sleuthkit.datamodel.FsContent.getFileSystem().

Referenced by org.sleuthkit.datamodel.FsContent.readInt().

FileSystem org.sleuthkit.datamodel.FsContent.getFileSystem ( ) throws TskCoreException

Get the parent file system

Returns: the file system object of the parent

Exceptions

org.sleuthkit.datamodel.TskCoreException

Definition at line 121 of file FsContent.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase(), org.sleuthkit.datamodel.FsContent.parentFileSystem, and org.sleuthkit.datamodel.AbstractContent.UNKNOWN_ID.

Referenced by org.sleuthkit.datamodel.FsContent.getDataSource(), org.sleuthkit.datamodel.FsContent.getUniquePath(), org.sleuthkit.datamodel.FsContent.isRoot(), and org.sleuthkit.datamodel.FsContent.loadFileHandle().

long org.sleuthkit.datamodel.FsContent.getFileSystemId ( )

Get the parent file system id

Returns: the parent file system id

Definition at line 102 of file FsContent.java.

References org.sleuthkit.datamodel.FsContent.fsObjId.

Referenced by org.sleuthkit.datamodel.OSUtility.getOSInfoInternal().

synchronized List<String> org.sleuthkit.datamodel.FsContent.getMetaDataText ( ) throws TskCoreException

Return a text-based description of the file's metadata. This is the same content as the TSK istat tool produces. Is different information for each type of file system.

Returns: List of text, one string per line.

Exceptions

TskCoreException

Definition at line 221 of file FsContent.java.

References org.sleuthkit.datamodel.SleuthkitJNI.getFileMetaDataText(), org.sleuthkit.datamodel.FsContent.loadFileHandle(), org.sleuthkit.datamodel.AbstractFile.metaAddr, and org.sleuthkit.datamodel.FsContent.metaDataText.

AbstractFile org.sleuthkit.datamodel.FsContent.getParentDirectory ( ) throws TskCoreException

Gets parent directory

Returns: the parent Directory

Exceptions

TskCoreException exception thrown if error occurred in tsk core

Definition at line 192 of file FsContent.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

synchronized String org.sleuthkit.datamodel.FsContent.getUniquePath ( ) throws TskCoreException

Returns: returns the full path to this Content object starting with a "/" followed by the Image name and similarly for all other segments in the hierarchy.

Implements org.sleuthkit.datamodel.Content.

Definition at line 202 of file FsContent.java.

References org.sleuthkit.datamodel.FsContent.getFileSystem(), org.sleuthkit.datamodel.AbstractContent.getName(), org.sleuthkit.datamodel.AbstractFile.getParentPath(), and org.sleuthkit.datamodel.FsContent.uniquePath.

boolean org.sleuthkit.datamodel.FsContent.isRoot ( )

Definition at line 171 of file FsContent.java.

References org.sleuthkit.datamodel.FsContent.getFileSystem(), org.sleuthkit.datamodel.AbstractFile.getMetaAddr(), and org.sleuthkit.datamodel.FileSystem.getRoot_inum().

void org.sleuthkit.datamodel.FsContent.loadFileHandle ( ) throws TskCoreException

private

Open JNI file handle if it is not open already

Exceptions

TskCoreException

Definition at line 137 of file FsContent.java.