19 package org.sleuthkit.datamodel;
 
   21 import java.text.MessageFormat;
 
   22 import java.util.ResourceBundle;
 
   23 import java.util.EnumSet;
 
   32         private static ResourceBundle bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
 
   53                 private short dirType;
 
   57                         this.dirType = (short) type;
 
   88                                 if (v.dirType == dir_type) {
 
   92                         throw new IllegalArgumentException(
 
   93                                         MessageFormat.format(bundle.getString(
"TskData.tskFsNameTypeEnum.exception.msg1.text"), dir_type));
 
  116                 private short metaType;
 
  117                 private String metaTypeStr;
 
  120                         this.metaType = (short) type;
 
  121                         this.metaTypeStr = metaTypeStr;
 
  140                                 if (type.getValue() == metaType) {
 
  144                         throw new IllegalArgumentException(
 
  145                                         MessageFormat.format(bundle.getString(
"TskData.tskFsMetaTypeEnum.exception.msg1.text"), metaType));
 
  156                 ALLOC(1, bundle.getString(
"TskData.tskFsNameFlagEnum.allocated")), 
 
  157                 UNALLOC(2, bundle.getString(
"TskData.tskFsNameFlagEnum.unallocated"));    
 
  159                 private short dirFlag;
 
  160                 private String dirFlagStr;
 
  163                         this.dirFlag = (short) flag;
 
  164                         this.dirFlagStr = dirFlagStr;
 
  190                                 if (flag.dirFlag == dirFlag) {
 
  194                         throw new IllegalArgumentException(
 
  195                                         MessageFormat.format(bundle.getString(
"TskData.tskFsNameFlagEnum.exception.msg1.text"), dirFlag));
 
  206                 ALLOC(1, bundle.getString(
"TskData.tskFsMetaFlagEnum.allocated")), 
 
  207                 UNALLOC(2, bundle.getString(
"TskData.tskFsMetaFlagEnum.unallocated")), 
 
  208                 USED(4, bundle.getString(
"TskData.tskFsMetaFlagEnum.used")), 
 
  209                 UNUSED(8, bundle.getString(
"TskData.tskFsMetaFlagEnum.unused")), 
 
  210                 COMP(16, bundle.getString(
"TskData.tskFsMetaFlagEnum.compressed")), 
 
  211                 ORPHAN(32, bundle.getString(
"TskData.tskFsMetaFlagEnum.orphan"));       
 
  213                 private short meta_flag;
 
  214                 private String label;
 
  217                         this.meta_flag = (short) flag;
 
  247                 public static Set<TSK_FS_META_FLAG_ENUM> 
valuesOf(
short metaFlags) {
 
  251                                 long flag = v.getValue();
 
  253                                 if ((metaFlags & flag) == flag) {
 
  261                 public static short toInt(Set<TSK_FS_META_FLAG_ENUM> metaFlags) {
 
  264                                 val |= flag.getValue();
 
  318                                 if (type.val == val) {
 
  322                         throw new IllegalArgumentException(
 
  323                                         MessageFormat.format(bundle.getString(
"TskData.tskFsAttrTypeEnum.exception.msg1.text"), val));
 
  338                 private long vs_flag;
 
  383                         this.mode = (short) mode;
 
  403                 public static Set<TSK_FS_META_MODE_ENUM> 
valuesOf(
short modes) {
 
  407                                 long flag = v.getMode();
 
  409                                 if ((modes & flag) == flag) {
 
  422                 public static short toInt(Set<TSK_FS_META_MODE_ENUM> modes) {
 
  425                                 modesInt |= mode.getMode();
 
  468                 private String displayName;
 
  472                         this.displayName = displayName;
 
  503                                 if (type.value == fsTypeValue) {
 
  507                         throw new IllegalArgumentException(
 
  508                                         MessageFormat.format(bundle.getString(
"TskData.tskFsTypeEnum.exception.msg1.text"), fsTypeValue));
 
  532                 private long imgType;
 
  542                                 if (type.getValue() == imgType) {
 
  546                         throw new IllegalArgumentException(
 
  547                                         MessageFormat.format(bundle.getString(
"TskData.tskImgTypeEnum.exception.msg1.text"), imgType));
 
  595                                 if (type.getVsType() == vsType) {
 
  599                         throw new IllegalArgumentException(
 
  600                                         MessageFormat.format(bundle.getString(
"TskData.tskVSTypeEnum.exception.msg1.text"), vsType));
 
  637                 private short objectType;
 
  640                         this.objectType = (short) objectType;
 
  661                                 if (v.objectType == objectType) {
 
  665                         throw new IllegalArgumentException(
 
  666                                         MessageFormat.format(bundle.getString(
"TskData.objectTypeEnum.exception.msg1.text"), objectType));
 
  676                 FS(0, 
"File System"), 
 
  688                 private final short fileType;
 
  689                 private final String name;
 
  692                         this.fileType = (short) fileType;
 
  705                                 if (type.fileType == fileType) {
 
  709                         throw new IllegalArgumentException(
 
  710                                         MessageFormat.format(bundle.getString(
"TskData.tskDbFilesTypeEnum.exception.msg1.text"), fileType));
 
  734                 TSK_POOL_TYPE_UNSUPP(0xffff, 
"Unsupported") 
 
  737                 private final short poolType;
 
  738                 private final String name;
 
  741                         this.poolType = (short) poolType;
 
  754                                 if (type.poolType == poolType) {
 
  758                         throw new IllegalArgumentException(
 
  759                                         MessageFormat.format(bundle.getString(
"TskData.tskDbFilesTypeEnum.exception.msg1.text"), poolType)); 
 
  782                 UNKNOWN(0, bundle.getString(
"TskData.fileKnown.unknown")), 
 
  783                 KNOWN(1, bundle.getString(
"TskData.fileKnown.known")), 
 
  784                 BAD(2, bundle.getString(
"TskData.fileKnown.knownBad")); 
 
  789                 private FileKnown(
int known, String name) {
 
  790                         this.known = (byte) known;
 
  803                                 if (v.known == known) {
 
  807                         throw new IllegalArgumentException(
 
  808                                         MessageFormat.format(bundle.getString(
"TskData.fileKnown.exception.msg1.text"), known));
 
  861                 private final int type;
 
  873                                 if (v.type == type) {
 
  877                         throw new IllegalArgumentException(
 
  878                                         MessageFormat.format(bundle.getString(
"TskData.encodingType.exception.msg1.text"), type));
 
VIRT
Special (TSK added "Virtual" files) NON-NLS. 
 
TSK_FS_ATTR_TYPE_NTFS_OBJID
 
FS
File that can be found in file system tree. 
 
static FileKnown valueOf(byte known)
 
TSK_POOL_TYPE_ENUM(int poolType, String name)
 
TSK_VS_PART_FLAG_ALL
Show all sectors in the walk. 
 
TSK_FS_ATTR_TYPE_NTFS_EAINFO
 
TSK_VS_TYPE_BSD
BSD Partition table NON-NLS. 
 
TSK_FS_META_TYPE_WHT
Whiteout NON-NLS. 
 
TSK_FS_TYPE_EXT_DETECT
ExtX auto detection. 
 
TSK_VS_TYPE_MAC
Mac partition table NON-NLS. 
 
TSK_FS_ATTR_TYPE_NTFS_VNAME
 
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
 
TSK_VS_TYPE_DBFILLER
fake partition table type for loaddb (for images that do not have a volume system) ...
 
UNUSED
Metadata structure has never been allocated. 
 
TSK_FS_TYPE_EXT3
Ext3 file system. 
 
ALLOC
Metadata structure is currently in an allocated state. 
 
TSK_FS_ATTR_TYPE_NTFS_VINFO
 
TSK_VS_PART_FLAG_ALLOC
Sectors are allocated to a volume in the volume system. 
 
TSK_FS_TYPE_NTFS_DETECT
NTFS auto detection. 
 
static TSK_FS_TYPE_ENUM valueOf(int fsTypeValue)
 
TSK_FS_TYPE_NTFS
NTFS file system. 
 
TSK_FS_META_TYPE_DIR
Directory file NON-NLS. 
 
TSK_FS_META_TYPE_SHAD
SOLARIS ONLY NON-NLS. 
 
TSK_FS_META_MODE_ISVTX
sticky bit 
 
TSK_VS_TYPE_SUN
Sun VTOC NON-NLS. 
 
UNALLOC
Metadata structure is currently in an unallocated state. 
 
TSK_FS_ATTR_TYPE_HFS_EXT_ATTR
 
TSK_FS_TYPE_FAT32
FAT32 file system. 
 
static TSK_FS_META_TYPE_ENUM valueOf(short metaType)
 
TSK_FS_META_MODE_IXOTH
X for other. 
 
LNK
Symbolic link NON-NLS. 
 
TSK_FS_META_TYPE_VIRT_DIR
"Virtual Directory" created by TSK for Orphan Files NON-NLS 
 
TSK_FS_ATTR_TYPE_NTFS_ATTRLIST
 
COMP
The file contents are compressed. 
 
TSK_FS_META_MODE_ISUID
set user id on execution 
 
TSK_VS_TYPE_APFS
APFS pool NON-NLS. 
 
TSK_FS_TYPE_HFS_DETECT
HFS auto detection. 
 
TSK_FS_META_MODE_IXGRP
X for group. 
 
TSK_FS_TYPE_FAT12
FAT12 file system. 
 
LAYOUT_FILE
Set of blocks from an image that have been designated as a file. 
 
TSK_FS_TYPE_YAFFS2_DETECT
YAFFS2 auto detection. 
 
TSK_FS_META_MODE_IWOTH
W for other. 
 
WHT
Whiteout (openbsd) NON-NLS. 
 
TSK_FS_META_MODE_IRGRP
R for group. 
 
TSK_VS_PART_FLAG_META
Sectors contain volume system metadata and could also be ALLOC or UNALLOC. 
 
TSK_FS_ATTR_TYPE_HFS_COMP_REC
 
TSK_FS_TYPE_FFS1B
UFS1b (Solaris - has no type) 
 
SLACK
Slack space for a single file. 
 
TSK_FS_ATTR_TYPE_NTFS_REPARSE
 
TSK_FS_TYPE_FFS1
UFS1 (FreeBSD, OpenBSD, BSDI ...) 
 
TSK_FS_ATTR_TYPE_NTFS_IDXROOT
 
static TSK_FS_ATTR_TYPE_ENUM valueOf(int val)
 
LOCAL
Local file that was added (not from a disk image) 
 
TSK_FS_META_MODE_IWUSR
W for owner. 
 
TSK_VS_TYPE_UNSUPP
Unsupported. 
 
TSK_FS_TYPE_SWAP_DETECT
SWAP auto detection. 
 
TSK_FS_META_TYPE_CHR
Character device NON-NLS. 
 
static TSK_POOL_TYPE_ENUM valueOf(long poolType)
 
TSK_POOL_TYPE_APFS
APFS Pooled Volumes. 
 
TSK_FS_TYPE_APFS_DETECT
APFS auto detection. 
 
CARVED
Set of blocks for a file found from carving. Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS ra...
 
static TSK_FS_NAME_FLAG_ENUM valueOf(int dirFlag)
 
TSK_FS_TYPE_ISO9660_DETECT
ISO9660 auto detection. 
 
TSK_FS_ATTR_TYPE_HFS_DATA
 
FS
File System - see tsk_fs_info for more details. 
 
TSK_FS_TYPE_SWAP
SWAP file system. 
 
TSK_FS_META_MODE_IROTH
R for other. 
 
TSK_FS_TYPE_UNSUPP
Unsupported file system. 
 
TSK_FS_TYPE_RAW
RAW file system. 
 
TSK_FS_TYPE_EXFAT
ExFAT file system. 
 
USED
Metadata structure has been allocated at least once. 
 
VIRT_DIR
Special (TSK added "Virtual" directories) NON-NLS. 
 
LOCAL_DIR
Local directory that was added (not from a disk image) 
 
TSK_FS_TYPE_FAT_DETECT
FAT auto detection. 
 
VOL
Volume - see tsk_vs_parts for more details. 
 
TSK_FS_ATTR_TYPE_NTFS_IDXALLOC
 
static EncodingType valueOf(int type)
 
TSK_FS_ATTR_TYPE_NTFS_BITMAP
 
TSK_FS_TYPE_RAW_DETECT
RAW auto detection. 
 
TSK_FS_META_TYPE_VIRT
"Virtual File" created by TSK for file system areas NON-NLS 
 
TSK_VS_TYPE_GPT
GPT partition table NON-NLS. 
 
TSK_FS_META_MODE_IRUSR
R for owner. 
 
TSK_FS_TYPE_DETECT
Use autodetection methods. 
 
TSK_FS_ATTR_TYPE_HFS_DEFAULT
 
static TSK_FS_NAME_TYPE_ENUM valueOf(short dir_type)
 
CHR
Character device NON-NLS. 
 
TSK_FS_TYPE_APFS
APFS file system. 
 
REPORT
Artifact - see blackboard_artifacts for more details. 
 
SHAD
Shadow inode (solaris) NON-NLS. 
 
static short toInt(Set< TSK_FS_META_MODE_ENUM > modes)
 
BAD
File marked as known and bad/notable/interesting by hash db. 
 
DERIVED
File derived from a parent file (i.e. from ZIP) 
 
TSK_FS_TYPE_EXT2
Ext2 file system. 
 
TSK_FS_ATTR_TYPE_NTFS_LOG
 
TSK_FS_ATTR_TYPE_UNIX_INDIR
 
TSK_FS_TYPE_HFS
HFS file system. 
 
static TSK_DB_FILES_TYPE_ENUM valueOf(short fileType)
 
TSK_FS_META_TYPE_BLK
Block device NON-NLS. 
 
TSK_FS_TYPE_EXT4
Ext4 file system. 
 
TSK_FS_ATTR_TYPE_NTFS_PROP
 
static short toInt(Set< TSK_FS_META_FLAG_ENUM > metaFlags)
 
TSK_FS_ATTR_TYPE_HFS_RSRC
 
static TSK_IMG_TYPE_ENUM valueOf(long imgType)
 
TSK_FS_TYPE_YAFFS2
YAFFS2 file system. 
 
UNALLOC_BLOCKS
Set of blocks not allocated by file system. Parent should be image, volume, or file system...
 
TSK_FS_META_TYPE_SOCK
UNIX domain socket NON-NLS. 
 
static ObjectType valueOf(short objectType)
 
TSK_POOL_TYPE_DETECT
Use autodetection methods. 
 
TSK_FS_META_TYPE_FIFO
Named pipe (fifo) NON-NLS. 
 
UNKNOWN
File marked as unknown by hash db. 
 
static Set< TSK_FS_META_MODE_ENUM > valuesOf(short modes)
 
TSK_FS_META_TYPE_LNK
Symbolic link NON-NLS. 
 
TSK_VS_TYPE_DETECT
Use autodetection methods. 
 
TSK_FS_ATTR_TYPE_NTFS_SEC
 
TSK_FS_TYPE_FAT16
FAT16 file system. 
 
TSK_FS_TYPE_FFS_DETECT
UFS auto detection. 
 
KNOWN
File marked as a known by hash db. 
 
TSK_FS_ATTR_TYPE_NTFS_DATA
 
TSK_FS_META_MODE_IWGRP
W for group. 
 
ALLOC
Name is in an allocated state. 
 
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
 
TSK_VS_PART_FLAG_UNALLOC
Sectors are not allocated to a volume. 
 
TSK_FS_ATTR_TYPE_NTFS_FNAME
 
static TSK_VS_TYPE_ENUM valueOf(long vsType)
 
ABSTRACTFILE
File - see tsk_files for more details. 
 
TSK_FS_ATTR_TYPE_NTFS_SYMLNK
 
TSK_FS_TYPE_ISO9660
ISO9660 file system. 
 
TSK_VS_TYPE_DOS
DOS Partition table NON-NLS. 
 
TSK_FS_META_TYPE_REG
Regular file NON-NLS. 
 
TSK_FS_ATTR_TYPE_NOT_FOUND
 
TSK_FS_META_MODE_ISGID
set group id on execution 
 
ORPHAN
Return only metadata structures that have no file name pointing to the (inode_walk flag only) ...
 
TSK_FS_TYPE_FFS2
UFS2 - FreeBSD, NetBSD. 
 
TSK_FS_META_MODE_IXUSR
X for owner. 
 
UNUSED_BLOCKS
Set of blocks that are unallocated AND not used by a carved or other file type. Parent should be UNAL...
 
VS
Volume System - see tsk_vs_info for more details. 
 
IMG
Disk Image - see tsk_image_info for more details. 
 
UNALLOC
Name is in an unallocated state. 
 
TSK_FS_ATTR_TYPE_NTFS_VVER