19 package org.sleuthkit.datamodel;
21 import java.io.FileNotFoundException;
22 import java.io.IOException;
23 import java.io.RandomAccessFile;
24 import java.text.MessageFormat;
25 import java.util.ArrayList;
26 import java.util.List;
27 import java.util.ResourceBundle;
29 import java.util.SortedSet;
30 import java.util.logging.Level;
31 import java.util.logging.Logger;
48 protected final Set<TSK_FS_META_FLAG_ENUM>
metaFlags;
50 protected final long metaAddr, ctime, crtime, atime, mtime;
52 protected final int uid, gid;
79 private static final ResourceBundle
bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
117 long dataSourceObjectId,
121 long metaAddr,
int metaSeq,
125 long ctime,
long crtime,
long atime,
long mtime,
131 super(db, objId, name);
144 this.crtime = crtime;
152 if (knownState == null) {
327 if ((mode & irusr) == irusr) {
332 if ((mode & iwusr) == iwusr) {
339 if ((mode & isuid) == isuid) {
340 if ((mode & ixusr) == ixusr) {
346 if ((mode & ixusr) == ixusr) {
354 if ((mode & irgrp) == irgrp) {
359 if ((mode & iwgrp) == iwgrp) {
366 if ((mode & isgid) == isgid) {
367 if ((mode & ixgrp) == ixgrp) {
373 if ((mode & ixgrp) == ixgrp) {
381 if ((mode & iroth) == iroth) {
386 if ((mode & iwoth) == iwoth) {
393 if ((mode & isvtx) == isvtx) {
394 if ((mode & ixoth) == ixoth) {
400 if ((mode & ixoth) == ixoth) {
408 if (result.length() != 10) {
427 void setMIMEType(String mimeType) {
432 return modes.contains(mode);
442 void setMd5Hash(String md5Hash) {
485 int i =
getName().lastIndexOf(
".");
487 if ((i > 0) && ((i + 1) <
getName().length())) {
488 ext =
getName().substring(i + 1);
500 return ext.toLowerCase();
540 long getDataSourceObjectId() {
555 if (ranges == null) {
580 long rangeLength = byteRange.getByteLen();
581 if (fileOffset < rangeLength) {
582 imgOffset = byteRange.getByteStart() + fileOffset;
588 fileOffset -= rangeLength;
634 public abstract boolean isRoot();
647 String[] pathSegments = uniquePath.split(
"/");
651 if (pathSegments[0].startsWith(
"img_")) {
654 if (pathSegments[1].startsWith(
"vol_")) {
660 StringBuilder strbuf =
new StringBuilder();
661 for (; index < pathSegments.length; ++index) {
662 if (!pathSegments[index].isEmpty()) {
663 strbuf.append(
"/").append(pathSegments[index]);
667 return strbuf.toString();
681 List<AbstractFile> files =
new ArrayList<AbstractFile>();
682 for (
Content child : children) {
684 AbstractFile afChild = (AbstractFile) child;
714 return dirType.toString();
723 return dirFlag == flag;
753 return metaFlags.contains(metaFlag);
763 return readInt(buf, offset, len);
797 bundle.getString(
"AbstractFile.readLocal.exception.msg1.text"));
807 MessageFormat.format(bundle.getString(
"AbstractFile.readLocal.exception.msg2.text"),
localAbsPath));
811 MessageFormat.format(bundle.getString(
"AbstractFile.readLocal.exception.msg3.text"),
localAbsPath));
816 if (localFileHandle == null) {
817 synchronized (
this) {
818 if (localFileHandle == null) {
820 localFileHandle =
new RandomAccessFile(
localFile,
"r");
821 }
catch (FileNotFoundException ex) {
822 final String msg = MessageFormat.format(bundle.getString(
823 "AbstractFile.readLocal.exception.msg4.text"),
825 logger.log(Level.SEVERE, msg, ex);
837 long encodedOffset = offset + EncodedFileUtil.getHeaderLength();
840 long curOffset = localFileHandle.getFilePointer();
841 if (curOffset != encodedOffset) {
842 localFileHandle.seek(encodedOffset);
844 bytesRead = localFileHandle.read(buf, 0, (
int) len);
845 for(
int i = 0;i < bytesRead;i++){
846 buf[i] = EncodedFileUtil.decodeByte(buf[i],
encodingType);
851 long curOffset = localFileHandle.getFilePointer();
852 if (curOffset != offset) {
853 localFileHandle.seek(offset);
856 return localFileHandle.read(buf, 0, (
int) len);
858 }
catch (IOException ex) {
859 final String msg = MessageFormat.format(bundle.getString(
"AbstractFile.readLocal.exception.msg5.text"),
localAbsPath);
860 logger.log(Level.SEVERE, msg, ex);
876 void setLocalFilePath(String localPath,
boolean isAbsolute) {
878 if (localPath == null || localPath.equals(
"")) {
881 localPathSet =
false;
889 this.localPathSet =
true;
933 logger.log(Level.SEVERE, ex.getMessage());
954 logger.log(Level.SEVERE, ex.getMessage());
966 throw new TskCoreException(
967 bundle.getString(
"AbstractFile.readLocal.exception.msg1.text"));
975 synchronized (
this) {
977 localFile =
new java.io.File(localAbsPath);
986 if (localFileHandle != null) {
987 synchronized (
this) {
988 if (localFileHandle != null) {
990 localFileHandle.close();
991 }
catch (IOException ex) {
992 logger.log(Level.SEVERE,
"Could not close file handle for file: " +
getParentPath() +
"/" +
getName(), ex);
994 localFileHandle = null;
1012 return super.toString(preserveState) +
"AbstractFile [\t"
1014 +
"\tctime " + ctime
1015 +
"\tcrtime " + crtime
1016 +
"\t" +
"mtime " + mtime +
"\t" +
"atime " + atime
1017 +
"\t" +
"attrId " + attrId
1019 +
"\t" +
"dirFlag " + dirFlag +
"\t" +
"dirType " + dirType
1020 +
"\t" +
"uid " + uid
1021 +
"\t" +
"gid " + gid
1022 +
"\t" +
"metaAddr " + metaAddr +
"\t" +
"metaSeq " + metaSeq +
"\t" +
"metaFlags " + metaFlags
1023 +
"\t" +
"metaType " + metaType +
"\t" +
"modes " +
modes
1024 +
"\t" +
"parentPath " + parentPath +
"\t" +
"size " + size
1025 +
"\t" +
"knownState " +
knownState +
"\t" +
"md5Hash " + md5Hash
1026 +
"\t" +
"localPathSet " + localPathSet +
"\t" +
"localPath " + localPath
1027 +
"\t" +
"localAbsPath " + localAbsPath +
"\t" +
"localFile " +
localFile
1044 String time =
"0000-00-00 00:00:00";
1046 time =
new java.text.SimpleDateFormat(
"yyyy-MM-dd HH:mm:ss z").format(
new java.util.Date(epoch * 1000));
1061 epoch =
new java.text.SimpleDateFormat(
"yyyy-MM-dd HH:mm:ss").parse(time).getTime() / 1000;
1062 }
catch (Exception e) {
1087 if (this.mimeType == null) {
1090 if (mimeTypes.contains(
this.mimeType)) {
1128 @SuppressWarnings(
"deprecation")
1132 long size,
long ctime,
long crtime,
long atime,
long mtime,
short modes,
int uid,
int gid, String md5Hash,
FileKnown knownState,
1133 String parentPath) {
1134 this(
db,
objId, db.getDataSourceObjectId(objId),
attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null);
1175 @SuppressWarnings(
"deprecation")
1179 int uid,
int gid, String md5Hash,
FileKnown knownState, String parentPath, String mimeType) {
1180 this(
db,
objId,
dataSourceObjectId,
attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null);
1191 @SuppressWarnings(
"deprecation")
1218 setLocalFilePath(localPath, isAbsolute);
VIRT
Special (TSK added "Virtual" files) NON-NLS.
boolean isModeSet(TskData.TSK_FS_META_MODE_ENUM mode)
final TSK_FS_NAME_TYPE_ENUM dirType
static String epochToTime(long epoch)
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
String getMetaFlagsAsString()
final int readLocal(byte[] buf, long offset, long len)
boolean isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM flag)
ALLOC
Metadata structure is currently in an allocated state.
final TSK_FS_NAME_FLAG_ENUM dirFlag
TskData.EncodingType encodingType
TSK_FS_META_TYPE_DIR
Directory file NON-NLS.
TSK_FS_META_MODE_ISVTX
sticky bit
final TskData.TSK_DB_FILES_TYPE_ENUM fileType
UNALLOC
Metadata structure is currently in an unallocated state.
static final Logger logger
TskData.TSK_DB_FILES_TYPE_ENUM getType()
boolean localPathSet
if set by setLocalPath(), reads are done on local file
final TskData.TSK_FS_ATTR_TYPE_ENUM attrType
TSK_FS_META_MODE_IXOTH
X for other.
long convertToImgOffset(long fileOffset)
TSK_FS_META_MODE_ISUID
set user id on execution
TSK_FS_NAME_TYPE_ENUM getDirType()
Content getContentById(long id)
String getDirFlagAsString()
TSK_FS_META_MODE_IXGRP
X for group.
String getNameExtension()
TSK_FS_META_MODE_IWOTH
W for other.
TSK_FS_META_MODE_IRGRP
R for group.
TSK_FS_META_MODE_IWUSR
W for owner.
MimeMatchEnum isMimeType(SortedSet< String > mimeTypes)
String getDirTypeAsString()
final Set< TSK_FS_META_FLAG_ENUM > metaFlags
TSK_FS_META_MODE_IROTH
R for other.
String toString(boolean preserveState)
static final ResourceBundle bundle
TskData.FileKnown getKnown()
List< Content > getChildren()
FALSE
file has a defined mime type and it is one of the given ones
final Set< TskData.TSK_FS_META_MODE_ENUM > modes
List< AbstractFile > listFiles()
TskData.FileKnown knownState
TSK_FS_META_TYPE_VIRT
"Virtual File" created by TSK for file system areas NON-NLS
TSK_FS_META_TYPE_ENUM getMetaType()
TSK_FS_META_MODE_IRUSR
R for owner.
SleuthkitCase getSleuthkitCase()
String localPath
local path as stored in db tsk_files_path, is relative to the db,
boolean isMetaFlagSet(TSK_FS_META_FLAG_ENUM metaFlag)
TRUE
file does not have a defined mime time in blackboard
static short toInt(Set< TSK_FS_META_MODE_ENUM > modes)
static long timeToEpoch(String time)
String getModesAsString()
int readInt(byte[] buf, long offset, long len)
volatile RandomAccessFile localFileHandle
volatile java.io.File localFile
UNKNOWN
File marked as unknown by hash db.
static Set< TSK_FS_META_MODE_ENUM > valuesOf(short modes)
List< TskFileRange > ranges
void setLocalPath(String localPath, boolean isAbsolute)
static String createNonUniquePath(String uniquePath)
TSK_FS_META_MODE_IWGRP
W for group.
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
List< TskFileRange > getRanges()
final int read(byte[] buf, long offset, long len)
String getMetaTypeAsString()
final TSK_FS_META_TYPE_ENUM metaType
TSK_FS_META_TYPE_REG
Regular file NON-NLS.
TSK_FS_META_MODE_ISGID
set group id on execution
List< TskFileRange > getFileRanges(long id)
String localAbsPath
absolute path representation of the local path
TSK_FS_META_MODE_IXUSR
X for owner.
TskData.TSK_FS_ATTR_TYPE_ENUM getAttrType()
abstract boolean isRoot()