19 package org.sleuthkit.datamodel;
 
   21 import java.io.FileNotFoundException;
 
   22 import java.io.IOException;
 
   23 import java.io.RandomAccessFile;
 
   24 import java.sql.SQLException;
 
   25 import java.sql.Statement;
 
   26 import java.text.MessageFormat;
 
   27 import java.util.ArrayList;
 
   28 import java.util.List;
 
   29 import java.util.ResourceBundle;
 
   31 import java.util.SortedSet;
 
   32 import java.util.TimeZone;
 
   33 import java.util.logging.Level;
 
   34 import java.util.logging.Logger;
 
   52         protected final Set<TSK_FS_META_FLAG_ENUM> 
metaFlags;
 
   54         protected final long metaAddr, ctime, crtime, atime, mtime;
 
   56         protected final int uid, gid;
 
   61         private boolean localPathSet = 
false; 
 
   62         private String localPath; 
 
   63         private String localAbsPath; 
 
   64         private volatile RandomAccessFile localFileHandle;
 
   65         private volatile java.io.File localFile;
 
   68         private List<TskFileRange> ranges;
 
   77         private boolean knownStateDirty = 
false;
 
   82         private boolean md5HashDirty = 
false;
 
   83         private String mimeType;
 
   84         private boolean mimeTypeDirty = 
false;
 
   86         private static final ResourceBundle BUNDLE = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
 
   87         private long dataSourceObjectId;
 
   88         private final String extension;
 
  127                         long dataSourceObjectId,
 
  131                         long metaAddr, 
int metaSeq,
 
  135                         long ctime, 
long crtime, 
long atime, 
long mtime,
 
  142                 super(db, objId, name);
 
  143                 this.dataSourceObjectId = dataSourceObjectId;
 
  155                 this.crtime = crtime;
 
  163                 if (knownState == null) {
 
  169                 this.mimeType = mimeType;
 
  170                 this.extension = extension == null ? 
"" : extension;
 
  339                 if ((mode & irusr) == irusr) {
 
  344                 if ((mode & iwusr) == iwusr) {
 
  351                 if ((mode & isuid) == isuid) {
 
  352                         if ((mode & ixusr) == ixusr) {
 
  358                         if ((mode & ixusr) == ixusr) {
 
  366                 if ((mode & irgrp) == irgrp) {
 
  371                 if ((mode & iwgrp) == iwgrp) {
 
  378                 if ((mode & isgid) == isgid) {
 
  379                         if ((mode & ixgrp) == ixgrp) {
 
  385                         if ((mode & ixgrp) == ixgrp) {
 
  393                 if ((mode & iroth) == iroth) {
 
  398                 if ((mode & iwoth) == iwoth) {
 
  405                 if ((mode & isvtx) == isvtx) {
 
  406                         if ((mode & ixoth) == ixoth) {
 
  412                         if ((mode & ixoth) == ixoth) {
 
  420                 if (result.length() != 10) {
 
  445                 this.mimeType = mimeType;
 
  446                 this.mimeTypeDirty = 
true;
 
  450                 return modes.contains(mode);
 
  463                 this.md5HashDirty = 
true;
 
  493                 this.knownStateDirty = 
true;
 
  558                 return dataSourceObjectId;
 
  572                 if (ranges == null) {
 
  597                         long rangeLength = byteRange.getByteLen();
 
  598                         if (fileOffset < rangeLength) {
 
  599                                 imgOffset = byteRange.getByteStart() + fileOffset;
 
  605                         fileOffset -= rangeLength;
 
  652         public abstract boolean isRoot();
 
  665                 String[] pathSegments = uniquePath.split(
"/");
 
  669                 if (pathSegments[0].startsWith(
"img_")) { 
 
  672                 if (pathSegments[1].startsWith(
"vol_")) { 
 
  678                 StringBuilder strbuf = 
new StringBuilder();
 
  679                 for (; index < pathSegments.length; ++index) {
 
  680                         if (!pathSegments[index].isEmpty()) {
 
  681                                 strbuf.append(
"/").append(pathSegments[index]);
 
  685                 return strbuf.toString();
 
  699                 List<AbstractFile> files = 
new ArrayList<AbstractFile>();
 
  700                 for (
Content child : children) {
 
  702                                 AbstractFile afChild = (AbstractFile) child;
 
  732                 return dirType.toString();
 
  741                 return dirFlag == flag;
 
  771                 return metaFlags.contains(metaFlag);
 
  781                         return readInt(buf, offset, len);
 
  815                                         BUNDLE.getString(
"AbstractFile.readLocal.exception.msg1.text"));
 
  828                 if (!localFile.
exists()) {
 
  830                                         MessageFormat.format(BUNDLE.getString(
"AbstractFile.readLocal.exception.msg2.text"), localAbsPath));
 
  834                                         MessageFormat.format(BUNDLE.getString(
"AbstractFile.readLocal.exception.msg3.text"), localAbsPath));
 
  839                 if (localFileHandle == null) {
 
  840                         synchronized (
this) {
 
  841                                 if (localFileHandle == null) {
 
  843                                                 localFileHandle = 
new RandomAccessFile(localFile, 
"r");
 
  844                                         } 
catch (FileNotFoundException ex) {
 
  845                                                 final String msg = MessageFormat.format(BUNDLE.getString(
 
  846                                                                 "AbstractFile.readLocal.exception.msg4.text"),
 
  848                                                 LOGGER.log(Level.SEVERE, msg, ex);
 
  860                                 long encodedOffset = offset + EncodedFileUtil.getHeaderLength();
 
  863                                 long curOffset = localFileHandle.getFilePointer();
 
  864                                 if (curOffset != encodedOffset) {
 
  865                                         localFileHandle.seek(encodedOffset);
 
  867                                 bytesRead = localFileHandle.read(buf, 0, (
int) len);
 
  868                                 for (
int i = 0; i < bytesRead; i++) {
 
  869                                         buf[i] = EncodedFileUtil.decodeByte(buf[i], encodingType);
 
  874                                 long curOffset = localFileHandle.getFilePointer();
 
  875                                 if (curOffset != offset) {
 
  876                                         localFileHandle.seek(offset);
 
  879                                 return localFileHandle.read(buf, 0, (
int) len);
 
  881                 } 
catch (IOException ex) {
 
  882                         final String msg = MessageFormat.format(BUNDLE.getString(
"AbstractFile.readLocal.exception.msg5.text"), localAbsPath);
 
  883                         LOGGER.log(Level.SEVERE, msg, ex);
 
  896         void setLocalFilePath(String localPath) {
 
  898                 if (localPath == null || localPath.equals(
"")) {
 
  901                         localPathSet = 
false;
 
  906                         this.localPath = localPath;
 
  907                         if (
this instanceof DerivedFile) {
 
  913                                 if (localPath.startsWith(
"/") || localPath.startsWith(
"\\")
 
  914                                                 || localPath.matches(
"[A-Za-z]:[/\\\\].*")) {
 
  915                                         this.localAbsPath = localPath;
 
  920                         this.localPathSet = 
true;
 
  948                 this.encodingType = encodingType;
 
  963                                 return localFile.
exists();
 
  965                                 LOGGER.log(Level.SEVERE, ex.getMessage());
 
  986                                 LOGGER.log(Level.SEVERE, ex.getMessage());
 
 1000                         throw new TskCoreException(
 
 1001                                         BUNDLE.getString(
"AbstractFile.readLocal.exception.msg1.text"));
 
 1005                 if (localFile != null) {
 
 1009                 synchronized (
this) {
 
 1010                         if (localFile == null) {
 
 1011                                 localFile = 
new java.io.File(localAbsPath);
 
 1020                 if (localFileHandle != null) {
 
 1021                         synchronized (
this) {
 
 1022                                 if (localFileHandle != null) {
 
 1024                                                 localFileHandle.close();
 
 1025                                         } 
catch (IOException ex) {
 
 1026                                                 LOGGER.log(Level.SEVERE, 
"Could not close file handle for file: " + 
getParentPath() + 
getName(), ex); 
 
 1028                                         localFileHandle = null;
 
 1046                 return super.toString(preserveState) + 
"AbstractFile [\t"  
 1048                                 + 
"\tctime " + ctime 
 
 1049                                 + 
"\tcrtime " + crtime 
 
 1050                                 + 
"\t" + 
"mtime " + mtime + 
"\t" + 
"atime " + atime 
 
 1051                                 + 
"\t" + 
"attrId " + attrId 
 
 1053                                 + 
"\t" + 
"dirFlag " + dirFlag + 
"\t" + 
"dirType " + dirType 
 
 1054                                 + 
"\t" + 
"uid " + uid 
 
 1055                                 + 
"\t" + 
"gid " + gid 
 
 1056                                 + 
"\t" + 
"metaAddr " + metaAddr + 
"\t" + 
"metaSeq " + metaSeq + 
"\t" + 
"metaFlags " + metaFlags 
 
 1057                                 + 
"\t" + 
"metaType " + metaType + 
"\t" + 
"modes " + 
modes  
 1058                                 + 
"\t" + 
"parentPath " + parentPath + 
"\t" + 
"size " + size 
 
 1059                                 + 
"\t" + 
"knownState " + 
knownState + 
"\t" + 
"md5Hash " + md5Hash 
 
 1060                                 + 
"\t" + 
"localPathSet " + localPathSet + 
"\t" + 
"localPath " + localPath 
 
 1061                                 + 
"\t" + 
"localAbsPath " + localAbsPath + 
"\t" + 
"localFile " + localFile 
 
 1084                 if (this.mimeType == null) {
 
 1087                 if (mimeTypes.contains(
this.mimeType)) {
 
 1100         public void save() throws TskCoreException {
 
 1103                 if (!(md5HashDirty || mimeTypeDirty || knownStateDirty)) {
 
 1107                 String queryStr = 
"";
 
 1108                 if (mimeTypeDirty) {
 
 1109                         queryStr = 
"mime_type = '" + this.
getMIMEType() + 
"'";
 
 1112                         if (!queryStr.isEmpty()) {
 
 1115                         queryStr += 
"md5 = '" + this.
getMd5Hash() + 
"'";
 
 1117                 if (knownStateDirty) {
 
 1118                         if (!queryStr.isEmpty()) {
 
 1121                         queryStr += 
"known = '" + this.
getKnown().getFileKnownValue() + 
"'";
 
 1124                 queryStr = 
"UPDATE tsk_files SET " + queryStr + 
" WHERE obj_id = " + this.
getId();
 
 1128                                 Statement statement = connection.createStatement();) {
 
 1130                         connection.executeUpdate(statement, queryStr);
 
 1131                         md5HashDirty = 
false;
 
 1132                         mimeTypeDirty = 
false;
 
 1133                         knownStateDirty = 
false;
 
 1134                 } 
catch (SQLException ex) {
 
 1135                         throw new TskCoreException(String.format(
"Error saving properties for file (obj_id = %s)", 
this.getId()), ex);
 
 1173         @SuppressWarnings(
"deprecation")
 
 1177                         long size, 
long ctime, 
long crtime, 
long atime, 
long mtime, 
short modes, 
int uid, 
int gid, String md5Hash, 
FileKnown knownState,
 
 1178                         String parentPath) {
 
 1179                 this(db, objId, db.getDataSourceObjectId(objId), 
attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
 
 1219         @SuppressWarnings(
"deprecation")
 
 1223                         int uid, 
int gid, String md5Hash, 
FileKnown knownState, String parentPath, String mimeType) {
 
 1224                 this(db, objId, dataSourceObjectId, 
attrType, (int) attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, knownState, parentPath, null, null);
 
 1236         @SuppressWarnings(
"deprecation")
 
 1263                 setLocalFilePath(localPath);
 
VIRT
Special (TSK added "Virtual" files) NON-NLS. 
 
boolean isModeSet(TskData.TSK_FS_META_MODE_ENUM mode)
 
final TSK_FS_NAME_TYPE_ENUM dirType
 
static long timeToEpoch(String time)
 
static String epochToTime(long epoch)
 
static String epochToTime(long epoch)
 
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
 
String getMetaFlagsAsString()
 
final int readLocal(byte[] buf, long offset, long len)
 
boolean isDirNameFlagSet(TSK_FS_NAME_FLAG_ENUM flag)
 
List< Content > getChildren()
 
ALLOC
Metadata structure is currently in an allocated state. 
 
final TSK_FS_NAME_FLAG_ENUM dirFlag
 
TSK_FS_META_TYPE_DIR
Directory file NON-NLS. 
 
void setMIMEType(String mimeType)
 
TSK_FS_META_MODE_ISVTX
sticky bit 
 
final TskData.TSK_DB_FILES_TYPE_ENUM fileType
 
UNALLOC
Metadata structure is currently in an unallocated state. 
 
TskData.TSK_DB_FILES_TYPE_ENUM getType()
 
final TskData.TSK_FS_ATTR_TYPE_ENUM attrType
 
TSK_FS_META_MODE_IXOTH
X for other. 
 
TSK_FS_META_TYPE_VIRT_DIR
"Virtual Directory" created by TSK for Orphan Files NON-NLS 
 
long convertToImgOffset(long fileOffset)
 
TSK_FS_META_MODE_ISUID
set user id on execution 
 
TSK_FS_NAME_TYPE_ENUM getDirType()
 
Content getContentById(long id)
 
String getDirFlagAsString()
 
TSK_FS_META_MODE_IXGRP
X for group. 
 
String getNameExtension()
 
TSK_FS_META_MODE_IWOTH
W for other. 
 
TSK_FS_META_MODE_IRGRP
R for group. 
 
long getDataSourceObjectId()
 
TSK_FS_META_MODE_IWUSR
W for owner. 
 
MimeMatchEnum isMimeType(SortedSet< String > mimeTypes)
 
String getDirTypeAsString()
 
final Set< TSK_FS_META_FLAG_ENUM > metaFlags
 
TSK_FS_META_MODE_IROTH
R for other. 
 
String toString(boolean preserveState)
 
TskData.FileKnown getKnown()
 
void setKnown(TskData.FileKnown knownState)
 
FALSE
file has a defined mime type and it is one of the given ones 
 
final Set< TskData.TSK_FS_META_MODE_ENUM > modes
 
List< AbstractFile > listFiles()
 
TskData.FileKnown knownState
 
TSK_FS_META_TYPE_VIRT
"Virtual File" created by TSK for file system areas NON-NLS 
 
TSK_FS_META_TYPE_ENUM getMetaType()
 
TSK_FS_META_MODE_IRUSR
R for owner. 
 
SleuthkitCase getSleuthkitCase()
 
boolean isMetaFlagSet(TSK_FS_META_FLAG_ENUM metaFlag)
 
TRUE
file does not have a defined mime time in blackboard 
 
void acquireSingleUserCaseWriteLock()
 
static short toInt(Set< TSK_FS_META_MODE_ENUM > modes)
 
void releaseSingleUserCaseWriteLock()
 
static String epochToTime(long epoch, TimeZone tzone)
 
static long timeToEpoch(String time)
 
String getModesAsString()
 
int readInt(byte[] buf, long offset, long len)
 
UNKNOWN
File marked as unknown by hash db. 
 
static Set< TSK_FS_META_MODE_ENUM > valuesOf(short modes)
 
void setLocalPath(String localPath, boolean isAbsolute)
 
void setMd5Hash(String md5Hash)
 
static String createNonUniquePath(String uniquePath)
 
TSK_FS_META_MODE_IWGRP
W for group. 
 
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
 
List< TskFileRange > getRanges()
 
final int read(byte[] buf, long offset, long len)
 
String getMetaTypeAsString()
 
final TSK_FS_META_TYPE_ENUM metaType
 
TSK_FS_META_TYPE_REG
Regular file NON-NLS. 
 
TSK_FS_META_MODE_ISGID
set group id on execution 
 
List< TskFileRange > getFileRanges(long id)
 
TSK_FS_META_MODE_IXUSR
X for owner. 
 
TskData.TSK_FS_ATTR_TYPE_ENUM getAttrType()
 
abstract boolean isRoot()