19 package org.sleuthkit.datamodel;
21 import java.text.MessageFormat;
22 import java.util.ResourceBundle;
23 import java.util.ArrayList;
24 import java.util.Arrays;
25 import java.util.List;
26 import java.util.logging.Level;
27 import java.util.logging.Logger;
39 private long type, ssize, size;
43 private static ResourceBundle
bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
99 if (imageHandle == 0) {
119 if (imageHandle != 0) {
138 if (paths.length > 0) {
143 Logger.getLogger(
Image.class.
getName()).log(Level.SEVERE,
"Could not find image size, image: " +
this.getId(), ex);
190 List<VolumeSystem> vs =
new ArrayList<VolumeSystem>();
191 for (
Content child : children) {
193 vs.add((VolumeSystem) child);
208 List<Volume> volumes =
new ArrayList<Volume>();
209 for (
Content child : children) {
210 if (child instanceof
Volume) {
211 volumes.add((Volume) child);
226 List<FileSystem> fs =
new ArrayList<FileSystem>();
242 return v.
visit(
this);
246 public <T> T accept(ContentVisitor<T> v) {
247 return v.visit(
this);
262 return super.toString(preserveState) +
"Image [\t" +
"\t" +
"paths " + Arrays.toString(paths) +
"\t" +
"size " + size +
"\t" +
"ssize " + ssize +
"\t" +
"timezone " + timezone +
"\t" +
"type " + type +
"]\t";
272 if (paths.length > 0) {
273 File imageFile =
new File(paths[0]);
274 return imageFile.
exists();
288 Logger logger1 = Logger.getLogger(
"verifyImageSizes");
289 String errorString =
"";
293 List<Volume> volumes = vs.getVolumes();
294 for (
Volume v : volumes) {
295 byte[] buf =
new byte[512];
296 long endOffset = (v.getStart() + v.getLength()) * 512 - 512;
298 int readBytes =
read(buf, endOffset, 512);
300 logger1.warning(
"Possible Incomplete Image: Error reading volume at offset " + endOffset);
301 errorString = MessageFormat.format(bundle.getString(
"Image.verifyImageSize.errStr1.text"), endOffset);
304 logger1.warning(
"Possible Incomplete Image: Error reading volume at offset " + endOffset +
": " + ex.getLocalizedMessage());
305 errorString = MessageFormat.format(bundle.getString(
"Image.verifyImageSize.errStr2.text"), endOffset);
312 long block_size = fs.getBlock_size();
313 long endOffset = fs.getImageOffset() + fs.getSize() - block_size;
315 byte[] buf =
new byte[(int) block_size];
316 int readBytes =
read(buf, endOffset, block_size);
318 logger1.warning(
"Possible Incomplete Image: Error reading file system at offset " + endOffset);
319 errorString = MessageFormat.format(bundle.getString(
"Image.verifyImageSize.errStr3.text"), endOffset);
322 logger1.warning(
"Possible Incomplete Image: Error reading file system at offset " + endOffset +
": " + ex.getLocalizedMessage());
323 errorString = MessageFormat.format(bundle.getString(
"Image.verifyImageSize.errStr4.text"), endOffset);
static int readImg(long imgHandle, byte[] readBuffer, long offset, long len)
List< Volume > getVolumes()
List< FileSystem > getFileSystems()
Boolean imageFileExists()
Image(SleuthkitCase db, long obj_id, long type, long ssize, String name, String[] paths, String timezone, String md5)
TskData.TSK_IMG_TYPE_ENUM getType()
List< Long > getChildrenIds()
int read(byte[] buf, long offset, long len)
volatile long imageHandle
static long openImage(String[] imageFiles)
static long findDeviceSize(String devPath)
static ResourceBundle bundle
static void closeImg(long imgHandle)
SleuthkitCase getSleuthkitCase()
List< Content > getChildren()
List< VolumeSystem > getVolumeSystems()
static TSK_IMG_TYPE_ENUM valueOf(long imgType)
String toString(boolean preserveState)
synchronized long getImageHandle()