Sleuth Kit Java Bindings (JNI)  4.3
Java bindings for using The Sleuth Kit
AbstractFile.java
Go to the documentation of this file.
1 /*
2  * SleuthKit Java Bindings
3  *
4  * Copyright 2011-2016 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.io.FileNotFoundException;
22 import java.io.IOException;
23 import java.io.RandomAccessFile;
24 import java.text.MessageFormat;
25 import java.util.ArrayList;
26 import java.util.List;
27 import java.util.ResourceBundle;
28 import java.util.Set;
29 import java.util.SortedSet;
30 import java.util.logging.Level;
31 import java.util.logging.Logger;
37 
42 public abstract class AbstractFile extends AbstractContent {
43 
45  protected final TSK_FS_NAME_TYPE_ENUM dirType;
47  protected final TSK_FS_NAME_FLAG_ENUM dirFlag;
48  protected final Set<TSK_FS_META_FLAG_ENUM> metaFlags;
49  protected long size;
50  protected final long metaAddr, ctime, crtime, atime, mtime;
51  protected final int metaSeq;
52  protected final int uid, gid;
53  protected final int attrId;
55  protected final Set<TskData.TSK_FS_META_MODE_ENUM> modes;
56  //local file support
57  private boolean localPathSet = false;
58  private String localPath;
59  private String localAbsPath;
60  private volatile RandomAccessFile localFileHandle;
61  private volatile java.io.File localFile;
63  //range support
64  private List<TskFileRange> ranges;
65  /*
66  * path of parent directory
67  */
68  protected final String parentPath;
73  /*
74  * md5 hash
75  */
76  protected String md5Hash;
77  private String mimeType;
78  private static final Logger logger = Logger.getLogger(AbstractFile.class.getName());
79  private static final ResourceBundle bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle");
80  private long dataSourceObjectId;
81 
116  long objId,
117  long dataSourceObjectId,
119  String name,
121  long metaAddr, int metaSeq,
123  TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags,
124  long size,
125  long ctime, long crtime, long atime, long mtime,
126  short modes,
127  int uid, int gid,
128  String md5Hash, FileKnown knownState,
129  String parentPath,
130  String mimeType) {
131  super(db, objId, name);
132  this.dataSourceObjectId = dataSourceObjectId;
133  this.attrType = attrType;
134  this.attrId = attrId;
135  this.fileType = fileType;
136  this.metaAddr = metaAddr;
137  this.metaSeq = metaSeq;
138  this.dirType = dirType;
139  this.metaType = metaType;
140  this.dirFlag = dirFlag;
141  this.metaFlags = TSK_FS_META_FLAG_ENUM.valuesOf(metaFlags);
142  this.size = size;
143  this.ctime = ctime;
144  this.crtime = crtime;
145  this.atime = atime;
146  this.mtime = mtime;
147  this.uid = uid;
148  this.gid = gid;
149  this.modes = TskData.TSK_FS_META_MODE_ENUM.valuesOf(modes);
150 
151  this.md5Hash = md5Hash;
152  if (knownState == null) {
153  this.knownState = FileKnown.UNKNOWN;
154  } else {
155  this.knownState = knownState;
156  }
157  this.parentPath = parentPath;
158  this.mimeType = mimeType;
160  }
161 
168  return fileType;
169  }
170 
177  return attrType;
178  }
179 
185  public int getAttributeId() {
186  return attrId;
187  }
188 
194  public long getCtime() {
195  return ctime;
196  }
197 
203  public String getCtimeAsDate() {
204  return FsContent.epochToTime(ctime);
205  }
206 
212  public long getCrtime() {
213  return crtime;
214  }
215 
221  public String getCrtimeAsDate() {
222  return FsContent.epochToTime(crtime);
223  }
224 
230  public long getAtime() {
231  return atime;
232  }
233 
239  public String getAtimeAsDate() {
240  return FsContent.epochToTime(atime);
241  }
242 
248  public long getMtime() {
249  return mtime;
250  }
251 
257  public String getMtimeAsDate() {
258  return FsContent.epochToTime(mtime);
259  }
260 
266  public int getUid() {
267  return uid;
268  }
269 
275  public int getGid() {
276  return gid;
277  }
278 
284  public long getMetaAddr() {
285  return metaAddr;
286  }
287 
294  public long getMetaSeq() {
295  return metaSeq;
296  }
297 
303  public String getModesAsString() {
305  String result = "";
306 
307  short isuid = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_ISUID.getMode();
308  short isgid = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_ISGID.getMode();
309  short isvtx = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_ISVTX.getMode();
310 
311  short irusr = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IRUSR.getMode();
312  short iwusr = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IWUSR.getMode();
313  short ixusr = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IXUSR.getMode();
314 
315  short irgrp = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IRGRP.getMode();
316  short iwgrp = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IWGRP.getMode();
317  short ixgrp = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IXGRP.getMode();
318 
319  short iroth = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IROTH.getMode();
320  short iwoth = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IWOTH.getMode();
321  short ixoth = TskData.TSK_FS_META_MODE_ENUM.TSK_FS_META_MODE_IXOTH.getMode();
322 
323  // first character = the Meta Type
324  result += metaType.toString();
325 
326  // second and third characters = user permissions
327  if ((mode & irusr) == irusr) {
328  result += "r"; //NON-NLS
329  } else {
330  result += "-"; //NON-NLS
331  }
332  if ((mode & iwusr) == iwusr) {
333  result += "w"; //NON-NLS
334  } else {
335  result += "-"; //NON-NLS
336  }
337 
338  // fourth character = set uid
339  if ((mode & isuid) == isuid) {
340  if ((mode & ixusr) == ixusr) {
341  result += "s"; //NON-NLS
342  } else {
343  result += "S"; //NON-NLS
344  }
345  } else {
346  if ((mode & ixusr) == ixusr) {
347  result += "x"; //NON-NLS
348  } else {
349  result += "-"; //NON-NLS
350  }
351  }
352 
353  // fifth and sixth characters = group permissions
354  if ((mode & irgrp) == irgrp) {
355  result += "r"; //NON-NLS
356  } else {
357  result += "-"; //NON-NLS
358  }
359  if ((mode & iwgrp) == iwgrp) {
360  result += "w"; //NON-NLS
361  } else {
362  result += "-"; //NON-NLS
363  }
364 
365  // seventh character = set gid
366  if ((mode & isgid) == isgid) {
367  if ((mode & ixgrp) == ixgrp) {
368  result += "s"; //NON-NLS
369  } else {
370  result += "S"; //NON-NLS
371  }
372  } else {
373  if ((mode & ixgrp) == ixgrp) {
374  result += "x"; //NON-NLS
375  } else {
376  result += "-"; //NON-NLS
377  }
378  }
379 
380  // eighth and ninth character = other permissions
381  if ((mode & iroth) == iroth) {
382  result += "r"; //NON-NLS
383  } else {
384  result += "-"; //NON-NLS
385  }
386  if ((mode & iwoth) == iwoth) {
387  result += "w"; //NON-NLS
388  } else {
389  result += "-"; //NON-NLS
390  }
391 
392  // tenth character = sticky bit
393  if ((mode & isvtx) == isvtx) {
394  if ((mode & ixoth) == ixoth) {
395  result += "t"; //NON-NLS
396  } else {
397  result += "T"; //NON-NLS
398  }
399  } else {
400  if ((mode & ixoth) == ixoth) {
401  result += "x"; //NON-NLS
402  } else {
403  result += "-"; //NON-NLS
404  }
405  }
406 
407  // check the result
408  if (result.length() != 10) {
409  // throw error here
410  result = "ERROR"; //NON-NLS
411  }
412  return result;
413  }
414 
420  public String getMIMEType() {
421  return mimeType;
422  }
423 
427  void setMIMEType(String mimeType) {
428  this.mimeType = mimeType;
429  }
430 
431  public boolean isModeSet(TskData.TSK_FS_META_MODE_ENUM mode) {
432  return modes.contains(mode);
433  }
434 
442  void setMd5Hash(String md5Hash) {
443  this.md5Hash = md5Hash;
444  }
445 
451  public String getMd5Hash() {
452  return this.md5Hash;
453  }
454 
462  void setKnown(TskData.FileKnown known) {
463  this.knownState = known;
464  }
465 
473  return knownState;
474  }
475 
483  public String getNameExtension() {
484  String ext;
485  int i = getName().lastIndexOf(".");
486  // > 0 because we assume it's not an extension if period is the first character
487  if ((i > 0) && ((i + 1) < getName().length())) {
488  ext = getName().substring(i + 1);
489  } else {
490  return "";
491  }
492 
493  // we added this at one point to deal with files that had crazy names based on URLs
494  // it's too hard though to clean those up and not mess up basic extensions though.
495  // We need to add '-' to the below if we use it again
496 // String[] findNonAlphanumeric = ext.split("[^a-zA-Z0-9_]");
497 // if (findNonAlphanumeric.length > 1) {
498 // ext = findNonAlphanumeric[0];
499 // }
500  return ext.toLowerCase();
501  }
502 
508  @Override
509  public long getSize() {
510  return size;
511  }
512 
518  public String getParentPath() {
519  return parentPath;
520  }
521 
530  @Override
532  return getSleuthkitCase().getContentById(this.dataSourceObjectId);
533  }
534 
540  long getDataSourceObjectId() {
541  return dataSourceObjectId;
542  }
543 
554  public List<TskFileRange> getRanges() throws TskCoreException {
555  if (ranges == null) {
556  ranges = getSleuthkitCase().getFileRanges(this.getId());
557  }
558  return ranges;
559  }
560 
574  public long convertToImgOffset(long fileOffset) throws TskCoreException {
575  long imgOffset = -1;
576  for (TskFileRange byteRange : getRanges()) {
577 
578  // if fileOffset is within the current byteRange, calculate the image
579  // offset and break
580  long rangeLength = byteRange.getByteLen();
581  if (fileOffset < rangeLength) {
582  imgOffset = byteRange.getByteStart() + fileOffset;
583  break;
584  }
585 
586  // otherwise, decrement fileOffset by the length of the current
587  // byte range and continue
588  fileOffset -= rangeLength;
589  }
590  return imgOffset;
591  }
592 
599  public boolean isVirtual() {
601  || dirType.equals(TskData.TSK_FS_NAME_TYPE_ENUM.VIRT)
603  }
604 
612  public boolean isFile() {
613  return metaType.equals(TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG)
614  ||(metaType.equals(TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_UNDEF)
615  && dirType.equals(TSK_FS_NAME_TYPE_ENUM.REG));
616 
617  }
618 
625  public boolean isDir() {
626  return metaType.equals(TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR);
627  }
628 
634  public abstract boolean isRoot();
635 
644  public static String createNonUniquePath(String uniquePath) {
645 
646  // split the path into parts
647  String[] pathSegments = uniquePath.split("/");
648 
649  // see if uniquePath had an image and/or volume name
650  int index = 0;
651  if (pathSegments[0].startsWith("img_")) { //NON-NLS
652  ++index;
653  }
654  if (pathSegments[1].startsWith("vol_")) { //NON-NLS
655  ++index;
656  }
657 
658  // Assemble the non-unique path (skipping over the image and volume
659  // name, if they exist).
660  StringBuilder strbuf = new StringBuilder();
661  for (; index < pathSegments.length; ++index) {
662  if (!pathSegments[index].isEmpty()) {
663  strbuf.append("/").append(pathSegments[index]);
664  }
665  }
666 
667  return strbuf.toString();
668  }
669 
676  public List<AbstractFile> listFiles() throws TskCoreException {
677  // first, get all children
678  List<Content> children = getChildren();
679 
680  // only keep those that are of type AbstractFile
681  List<AbstractFile> files = new ArrayList<AbstractFile>();
682  for (Content child : children) {
683  if (child instanceof AbstractFile) {
684  AbstractFile afChild = (AbstractFile) child;
685  files.add(afChild);
686  }
687  }
688  return files;
689  }
690 
697  return metaType;
698  }
699 
700  public String getMetaTypeAsString() {
701  return metaType.toString();
702  }
703 
710  return dirType;
711  }
712 
713  public String getDirTypeAsString() {
714  return dirType.toString();
715  }
716 
723  return dirFlag == flag;
724  }
725 
730  public String getDirFlagAsString() {
731  return dirFlag.toString();
732  }
733 
737  public String getMetaFlagsAsString() {
738  String str = "";
739  if (metaFlags.contains(TSK_FS_META_FLAG_ENUM.ALLOC)) {
740  str = TSK_FS_META_FLAG_ENUM.ALLOC.toString();
741  } else if (metaFlags.contains(TSK_FS_META_FLAG_ENUM.UNALLOC)) {
742  str = TSK_FS_META_FLAG_ENUM.UNALLOC.toString();
743  }
744  return str;
745  }
746 
752  public boolean isMetaFlagSet(TSK_FS_META_FLAG_ENUM metaFlag) {
753  return metaFlags.contains(metaFlag);
754  }
755 
756  @Override
757  public final int read(byte[] buf, long offset, long len) throws TskCoreException {
758  //template method
759  //if localPath is set, use local, otherwise, use readCustom() supplied by derived class
760  if (localPathSet) {
761  return readLocal(buf, offset, len);
762  } else {
763  return readInt(buf, offset, len);
764  }
765 
766  }
767 
779  protected int readInt(byte[] buf, long offset, long len) throws TskCoreException {
780  return 0;
781  }
782 
794  protected final int readLocal(byte[] buf, long offset, long len) throws TskCoreException {
795  if (!localPathSet) {
796  throw new TskCoreException(
797  bundle.getString("AbstractFile.readLocal.exception.msg1.text"));
798  }
799 
800  if (isDir()) {
801  return 0;
802  }
803 
804  loadLocalFile();
805  if (!localFile.exists()) {
806  throw new TskCoreException(
807  MessageFormat.format(bundle.getString("AbstractFile.readLocal.exception.msg2.text"), localAbsPath));
808  }
809  if (!localFile.canRead()) {
810  throw new TskCoreException(
811  MessageFormat.format(bundle.getString("AbstractFile.readLocal.exception.msg3.text"), localAbsPath));
812  }
813 
814  int bytesRead = 0;
815 
816  if (localFileHandle == null) {
817  synchronized (this) {
818  if (localFileHandle == null) {
819  try {
820  localFileHandle = new RandomAccessFile(localFile, "r");
821  } catch (FileNotFoundException ex) {
822  final String msg = MessageFormat.format(bundle.getString(
823  "AbstractFile.readLocal.exception.msg4.text"),
824  localAbsPath);
825  logger.log(Level.SEVERE, msg, ex);
826  //file could have been deleted or moved
827  throw new TskCoreException(msg, ex);
828  }
829  }
830  }
831  }
832 
833  try {
834  if( ! encodingType.equals(TskData.EncodingType.NONE)){
835  // The file is encoded, so we need to alter the offset to read (since there's
836  // a header on the encoded file) and then decode each byte
837  long encodedOffset = offset + EncodedFileUtil.getHeaderLength();
838 
839  //move to the user request offset in the stream
840  long curOffset = localFileHandle.getFilePointer();
841  if (curOffset != encodedOffset) {
842  localFileHandle.seek(encodedOffset);
843  }
844  bytesRead = localFileHandle.read(buf, 0, (int) len);
845  for(int i = 0;i < bytesRead;i++){
846  buf[i] = EncodedFileUtil.decodeByte(buf[i], encodingType);
847  }
848  return bytesRead;
849  } else {
850  //move to the user request offset in the stream
851  long curOffset = localFileHandle.getFilePointer();
852  if (curOffset != offset) {
853  localFileHandle.seek(offset);
854  }
855  //note, we are always writing at 0 offset of user buffer
856  return localFileHandle.read(buf, 0, (int) len);
857  }
858  } catch (IOException ex) {
859  final String msg = MessageFormat.format(bundle.getString("AbstractFile.readLocal.exception.msg5.text"), localAbsPath);
860  logger.log(Level.SEVERE, msg, ex);
861  //local file could have been deleted / moved
862  throw new TskCoreException(msg, ex);
863  }
864  }
865 
866 
876  void setLocalFilePath(String localPath, boolean isAbsolute) {
877 
878  if (localPath == null || localPath.equals("")) {
879  this.localPath = "";
880  localAbsPath = null;
881  localPathSet = false;
882  } else {
883  this.localPath = localPath;
884  if (isAbsolute) {
885  this.localAbsPath = localPath;
886  } else {
887  this.localAbsPath = getSleuthkitCase().getDbDirPath() + java.io.File.separator + this.localPath;
888  }
889  this.localPathSet = true;
890  }
891  }
892 
898  public String getLocalPath() {
899  return localPath;
900  }
901 
907  public String getLocalAbsPath() {
908  return localAbsPath;
909  }
910 
915  final void setEncodingType(TskData.EncodingType encodingType){
916  this.encodingType = encodingType;
917  }
918 
925  public boolean exists() {
926  if (!localPathSet) {
927  return true;
928  } else {
929  try {
930  loadLocalFile();
931  return localFile.exists();
932  } catch (TskCoreException ex) {
933  logger.log(Level.SEVERE, ex.getMessage());
934  return false;
935  }
936  }
937  }
938 
946  public boolean canRead() {
947  if (!localPathSet) {
948  return true;
949  } else {
950  try {
951  loadLocalFile();
952  return localFile.canRead();
953  } catch (TskCoreException ex) {
954  logger.log(Level.SEVERE, ex.getMessage());
955  return false;
956  }
957  }
958  }
959 
964  private void loadLocalFile() throws TskCoreException {
965  if (!localPathSet) {
966  throw new TskCoreException(
967  bundle.getString("AbstractFile.readLocal.exception.msg1.text"));
968  }
969 
970  // already been set
971  if (localFile != null) {
972  return;
973  }
974 
975  synchronized (this) {
976  if (localFile == null) {
977  localFile = new java.io.File(localAbsPath);
978  }
979  }
980  }
981 
982  @Override
983  public void close() {
984 
985  //close local file handle if set
986  if (localFileHandle != null) {
987  synchronized (this) {
988  if (localFileHandle != null) {
989  try {
990  localFileHandle.close();
991  } catch (IOException ex) {
992  logger.log(Level.SEVERE, "Could not close file handle for file: " + getParentPath() + "/" + getName(), ex); //NON-NLS
993  }
994  localFileHandle = null;
995  }
996  }
997  }
998 
999  }
1000 
1001  @Override
1002  protected void finalize() throws Throwable {
1003  try {
1004  close();
1005  } finally {
1006  super.finalize();
1007  }
1008  }
1009 
1010  @Override
1011  public String toString(boolean preserveState) {
1012  return super.toString(preserveState) + "AbstractFile [\t" //NON-NLS
1013  + "\t" + "fileType " + fileType //NON-NLS
1014  + "\tctime " + ctime //NON-NLS
1015  + "\tcrtime " + crtime //NON-NLS
1016  + "\t" + "mtime " + mtime + "\t" + "atime " + atime //NON-NLS
1017  + "\t" + "attrId " + attrId //NON-NLS
1018  + "\t" + "attrType " + attrType //NON-NLS
1019  + "\t" + "dirFlag " + dirFlag + "\t" + "dirType " + dirType //NON-NLS
1020  + "\t" + "uid " + uid //NON-NLS
1021  + "\t" + "gid " + gid //NON-NLS
1022  + "\t" + "metaAddr " + metaAddr + "\t" + "metaSeq " + metaSeq + "\t" + "metaFlags " + metaFlags //NON-NLS
1023  + "\t" + "metaType " + metaType + "\t" + "modes " + modes //NON-NLS
1024  + "\t" + "parentPath " + parentPath + "\t" + "size " + size //NON-NLS
1025  + "\t" + "knownState " + knownState + "\t" + "md5Hash " + md5Hash //NON-NLS
1026  + "\t" + "localPathSet " + localPathSet + "\t" + "localPath " + localPath //NON-NLS
1027  + "\t" + "localAbsPath " + localAbsPath + "\t" + "localFile " + localFile //NON-NLS
1028  + "]\t";
1029  }
1030 
1031  /*
1032  * -------------------------------------------------------------------------
1033  * Util methods to convert / map the data
1034  * -------------------------------------------------------------------------
1035  */
1043  public static String epochToTime(long epoch) {
1044  String time = "0000-00-00 00:00:00";
1045  if (epoch != 0) {
1046  time = new java.text.SimpleDateFormat("yyyy-MM-dd HH:mm:ss z").format(new java.util.Date(epoch * 1000));
1047  }
1048  return time;
1049  }
1050 
1058  public static long timeToEpoch(String time) {
1059  long epoch = 0;
1060  try {
1061  epoch = new java.text.SimpleDateFormat("yyyy-MM-dd HH:mm:ss").parse(time).getTime() / 1000;
1062  } catch (Exception e) {
1063  }
1064 
1065  return epoch;
1066  }
1067 
1071  public enum MimeMatchEnum {
1072 
1075  FALSE
1076  }
1077 
1086  public MimeMatchEnum isMimeType(SortedSet<String> mimeTypes) {
1087  if (this.mimeType == null) {
1088  return MimeMatchEnum.UNDEFINED;
1089  }
1090  if (mimeTypes.contains(this.mimeType)) {
1091  return MimeMatchEnum.TRUE;
1092  }
1093  return MimeMatchEnum.FALSE;
1094  }
1095 
1127  @Deprecated
1128  @SuppressWarnings("deprecation")
1130  String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq,
1131  TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags,
1132  long size, long ctime, long crtime, long atime, long mtime, short modes, int uid, int gid, String md5Hash, FileKnown knownState,
1133  String parentPath) {
1134  this(db, objId, db.getDataSourceObjectId(objId), attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null);
1135  }
1136 
1137 
1174  @Deprecated
1175  @SuppressWarnings("deprecation")
1176  AbstractFile(SleuthkitCase db, long objId, long dataSourceObjectId, TskData.TSK_FS_ATTR_TYPE_ENUM attrType, short attrId,
1177  String name, TskData.TSK_DB_FILES_TYPE_ENUM fileType, long metaAddr, int metaSeq, TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType,
1178  TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, short modes,
1179  int uid, int gid, String md5Hash, FileKnown knownState, String parentPath, String mimeType) {
1180  this(db, objId, dataSourceObjectId, attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null);
1181  }
1182 
1190  @Deprecated
1191  @SuppressWarnings("deprecation")
1192  public short getAttrId() {
1193  /*
1194  * NOTE: previously attrId used to be stored in AbstractFile as (signed)
1195  * short even though it is stored as uint16 in TSK. In extremely rare
1196  * occurrences attrId can be larger than what a signed short can hold
1197  * (2^15). Changes were made to AbstractFile to store attrId as integer.
1198  * Therefore this method has been deprecated. For backwards
1199  * compatibility, attribute ids that are larger than 32K are converted
1200  * to a negative number.
1201  */
1202  return (short) attrId; // casting to signed short converts values over 32K to negative values
1203  }
1204 
1216  @Deprecated
1217  protected void setLocalPath(String localPath, boolean isAbsolute) {
1218  setLocalFilePath(localPath, isAbsolute);
1219  }
1220 }
VIRT
Special (TSK added "Virtual" files) NON-NLS.
Definition: TskData.java:50
boolean isModeSet(TskData.TSK_FS_META_MODE_ENUM mode)
final TSK_FS_NAME_TYPE_ENUM dirType
static String epochToTime(long epoch)
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
Definition: TskData.java:245
final int readLocal(byte[] buf, long offset, long len)
boolean isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM flag)
ALLOC
Metadata structure is currently in an allocated state.
Definition: TskData.java:204
final TSK_FS_NAME_FLAG_ENUM dirFlag
final TskData.TSK_DB_FILES_TYPE_ENUM fileType
UNALLOC
Metadata structure is currently in an unallocated state.
Definition: TskData.java:205
TskData.TSK_DB_FILES_TYPE_ENUM getType()
boolean localPathSet
if set by setLocalPath(), reads are done on local file
final TskData.TSK_FS_ATTR_TYPE_ENUM attrType
long convertToImgOffset(long fileOffset)
TSK_FS_NAME_TYPE_ENUM getDirType()
MimeMatchEnum isMimeType(SortedSet< String > mimeTypes)
final Set< TSK_FS_META_FLAG_ENUM > metaFlags
String toString(boolean preserveState)
static final ResourceBundle bundle
List< Content > getChildren()
FALSE
file has a defined mime type and it is one of the given ones
final Set< TskData.TSK_FS_META_MODE_ENUM > modes
TSK_FS_META_TYPE_VIRT
"Virtual File" created by TSK for file system areas NON-NLS
Definition: TskData.java:112
TSK_FS_META_TYPE_ENUM getMetaType()
String localPath
local path as stored in db tsk_files_path, is relative to the db,
boolean isMetaFlagSet(TSK_FS_META_FLAG_ENUM metaFlag)
TRUE
file does not have a defined mime time in blackboard
static short toInt(Set< TSK_FS_META_MODE_ENUM > modes)
Definition: TskData.java:420
static long timeToEpoch(String time)
int readInt(byte[] buf, long offset, long len)
volatile RandomAccessFile localFileHandle
UNKNOWN
File marked as unknown by hash db.
Definition: TskData.java:711
static Set< TSK_FS_META_MODE_ENUM > valuesOf(short modes)
Definition: TskData.java:401
void setLocalPath(String localPath, boolean isAbsolute)
static String createNonUniquePath(String uniquePath)
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
Definition: TskData.java:662
final int read(byte[] buf, long offset, long len)
final TSK_FS_META_TYPE_ENUM metaType
List< TskFileRange > getFileRanges(long id)
String localAbsPath
absolute path representation of the local path
TskData.TSK_FS_ATTR_TYPE_ENUM getAttrType()

Copyright © 2011-2015 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.