19 package org.sleuthkit.datamodel;
21 import java.text.MessageFormat;
22 import java.util.ResourceBundle;
23 import java.util.EnumSet;
32 private static ResourceBundle bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
53 private short dirType;
57 this.dirType = (short) type;
88 if (v.dirType == dir_type) {
92 throw new IllegalArgumentException(
93 MessageFormat.format(bundle.getString(
"TskData.tskFsNameTypeEnum.exception.msg1.text"), dir_type));
116 private short metaType;
117 private String metaTypeStr;
120 this.metaType = (short) type;
121 this.metaTypeStr = metaTypeStr;
140 if (type.getValue() == metaType) {
144 throw new IllegalArgumentException(
145 MessageFormat.format(bundle.getString(
"TskData.tskFsMetaTypeEnum.exception.msg1.text"), metaType));
156 ALLOC(1, bundle.getString(
"TskData.tskFsNameFlagEnum.allocated")),
157 UNALLOC(2, bundle.getString(
"TskData.tskFsNameFlagEnum.unallocated"));
159 private short dirFlag;
160 private String dirFlagStr;
163 this.dirFlag = (short) flag;
164 this.dirFlagStr = dirFlagStr;
190 if (flag.dirFlag == dirFlag) {
194 throw new IllegalArgumentException(
195 MessageFormat.format(bundle.getString(
"TskData.tskFsNameFlagEnum.exception.msg1.text"), dirFlag));
206 ALLOC(1, bundle.getString(
"TskData.tskFsMetaFlagEnum.allocated")),
207 UNALLOC(2, bundle.getString(
"TskData.tskFsMetaFlagEnum.unallocated")),
208 USED(4, bundle.getString(
"TskData.tskFsMetaFlagEnum.used")),
209 UNUSED(8, bundle.getString(
"TskData.tskFsMetaFlagEnum.unused")),
210 COMP(16, bundle.getString(
"TskData.tskFsMetaFlagEnum.compressed")),
211 ORPHAN(32, bundle.getString(
"TskData.tskFsMetaFlagEnum.orphan"));
213 private short meta_flag;
214 private String label;
217 this.meta_flag = (short) flag;
247 public static Set<TSK_FS_META_FLAG_ENUM>
valuesOf(
short metaFlags) {
251 long flag = v.getValue();
253 if ((metaFlags & flag) == flag) {
261 public static short toInt(Set<TSK_FS_META_FLAG_ENUM> metaFlags) {
264 val |= flag.getValue();
318 if (type.val == val) {
322 throw new IllegalArgumentException(
323 MessageFormat.format(bundle.getString(
"TskData.tskFsAttrTypeEnum.exception.msg1.text"), val));
338 private long vs_flag;
383 this.mode = (short) mode;
403 public static Set<TSK_FS_META_MODE_ENUM>
valuesOf(
short modes) {
407 long flag = v.getMode();
409 if ((modes & flag) == flag) {
422 public static short toInt(Set<TSK_FS_META_MODE_ENUM> modes) {
425 modesInt |= mode.getMode();
468 private String displayName;
472 this.displayName = displayName;
503 if (type.value == fsTypeValue) {
507 throw new IllegalArgumentException(
508 MessageFormat.format(bundle.getString(
"TskData.tskFsTypeEnum.exception.msg1.text"), fsTypeValue));
532 private long imgType;
542 if (type.getValue() == imgType) {
546 throw new IllegalArgumentException(
547 MessageFormat.format(bundle.getString(
"TskData.tskImgTypeEnum.exception.msg1.text"), imgType));
595 if (type.getVsType() == vsType) {
599 throw new IllegalArgumentException(
600 MessageFormat.format(bundle.getString(
"TskData.tskVSTypeEnum.exception.msg1.text"), vsType));
637 private short objectType;
640 this.objectType = (short) objectType;
661 if (v.objectType == objectType) {
665 throw new IllegalArgumentException(
666 MessageFormat.format(bundle.getString(
"TskData.objectTypeEnum.exception.msg1.text"), objectType));
676 FS(0,
"File System"),
688 private final short fileType;
689 private final String name;
692 this.fileType = (short) fileType;
705 if (type.fileType == fileType) {
709 throw new IllegalArgumentException(
710 MessageFormat.format(bundle.getString(
"TskData.tskDbFilesTypeEnum.exception.msg1.text"), fileType));
734 TSK_POOL_TYPE_UNSUPP(0xffff,
"Unsupported")
737 private final short poolType;
738 private final String name;
741 this.poolType = (short) poolType;
754 if (type.poolType == poolType) {
758 throw new IllegalArgumentException(
759 MessageFormat.format(bundle.getString(
"TskData.tskDbFilesTypeEnum.exception.msg1.text"), poolType));
782 UNKNOWN(0, bundle.getString(
"TskData.fileKnown.unknown")),
783 KNOWN(1, bundle.getString(
"TskData.fileKnown.known")),
784 BAD(2, bundle.getString(
"TskData.fileKnown.knownBad"));
789 private FileKnown(
int known, String name) {
790 this.known = (byte) known;
803 if (v.known == known) {
807 throw new IllegalArgumentException(
808 MessageFormat.format(bundle.getString(
"TskData.fileKnown.exception.msg1.text"), known));
861 private final int type;
873 if (v.type == type) {
877 throw new IllegalArgumentException(
878 MessageFormat.format(bundle.getString(
"TskData.encodingType.exception.msg1.text"), type));
VIRT
Special (TSK added "Virtual" files) NON-NLS.
TSK_FS_ATTR_TYPE_NTFS_OBJID
FS
File that can be found in file system tree.
static FileKnown valueOf(byte known)
TSK_POOL_TYPE_ENUM(int poolType, String name)
TSK_VS_PART_FLAG_ALL
Show all sectors in the walk.
TSK_FS_ATTR_TYPE_NTFS_EAINFO
TSK_VS_TYPE_BSD
BSD Partition table NON-NLS.
TSK_FS_META_TYPE_WHT
Whiteout NON-NLS.
TSK_FS_TYPE_EXT_DETECT
ExtX auto detection.
TSK_VS_TYPE_MAC
Mac partition table NON-NLS.
TSK_FS_ATTR_TYPE_NTFS_VNAME
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
TSK_VS_TYPE_DBFILLER
fake partition table type for loaddb (for images that do not have a volume system) ...
UNUSED
Metadata structure has never been allocated.
TSK_FS_TYPE_EXT3
Ext3 file system.
ALLOC
Metadata structure is currently in an allocated state.
TSK_FS_ATTR_TYPE_NTFS_VINFO
TSK_VS_PART_FLAG_ALLOC
Sectors are allocated to a volume in the volume system.
TSK_FS_TYPE_NTFS_DETECT
NTFS auto detection.
static TSK_FS_TYPE_ENUM valueOf(int fsTypeValue)
TSK_FS_TYPE_NTFS
NTFS file system.
TSK_FS_META_TYPE_DIR
Directory file NON-NLS.
TSK_FS_META_TYPE_SHAD
SOLARIS ONLY NON-NLS.
TSK_FS_META_MODE_ISVTX
sticky bit
TSK_VS_TYPE_SUN
Sun VTOC NON-NLS.
UNALLOC
Metadata structure is currently in an unallocated state.
TSK_FS_ATTR_TYPE_HFS_EXT_ATTR
TSK_FS_TYPE_FAT32
FAT32 file system.
static TSK_FS_META_TYPE_ENUM valueOf(short metaType)
TSK_FS_META_MODE_IXOTH
X for other.
LNK
Symbolic link NON-NLS.
TSK_FS_META_TYPE_VIRT_DIR
"Virtual Directory" created by TSK for Orphan Files NON-NLS
TSK_FS_ATTR_TYPE_NTFS_ATTRLIST
COMP
The file contents are compressed.
TSK_FS_META_MODE_ISUID
set user id on execution
TSK_VS_TYPE_APFS
APFS pool NON-NLS.
TSK_FS_TYPE_HFS_DETECT
HFS auto detection.
TSK_FS_META_MODE_IXGRP
X for group.
TSK_FS_TYPE_FAT12
FAT12 file system.
LAYOUT_FILE
Set of blocks from an image that have been designated as a file.
TSK_FS_TYPE_YAFFS2_DETECT
YAFFS2 auto detection.
TSK_FS_META_MODE_IWOTH
W for other.
WHT
Whiteout (openbsd) NON-NLS.
TSK_FS_META_MODE_IRGRP
R for group.
TSK_VS_PART_FLAG_META
Sectors contain volume system metadata and could also be ALLOC or UNALLOC.
TSK_FS_ATTR_TYPE_HFS_COMP_REC
TSK_FS_TYPE_FFS1B
UFS1b (Solaris - has no type)
SLACK
Slack space for a single file.
TSK_FS_ATTR_TYPE_NTFS_REPARSE
TSK_FS_TYPE_FFS1
UFS1 (FreeBSD, OpenBSD, BSDI ...)
TSK_FS_ATTR_TYPE_NTFS_IDXROOT
static TSK_FS_ATTR_TYPE_ENUM valueOf(int val)
LOCAL
Local file that was added (not from a disk image)
TSK_FS_META_MODE_IWUSR
W for owner.
TSK_VS_TYPE_UNSUPP
Unsupported.
TSK_FS_TYPE_SWAP_DETECT
SWAP auto detection.
TSK_FS_META_TYPE_CHR
Character device NON-NLS.
static TSK_POOL_TYPE_ENUM valueOf(long poolType)
TSK_POOL_TYPE_APFS
APFS Pooled Volumes.
TSK_FS_TYPE_APFS_DETECT
APFS auto detection.
CARVED
Set of blocks for a file found from carving. Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS ra...
static TSK_FS_NAME_FLAG_ENUM valueOf(int dirFlag)
TSK_FS_TYPE_ISO9660_DETECT
ISO9660 auto detection.
TSK_FS_ATTR_TYPE_HFS_DATA
FS
File System - see tsk_fs_info for more details.
TSK_FS_TYPE_SWAP
SWAP file system.
TSK_FS_META_MODE_IROTH
R for other.
TSK_FS_TYPE_UNSUPP
Unsupported file system.
TSK_FS_TYPE_RAW
RAW file system.
TSK_FS_TYPE_EXFAT
ExFAT file system.
USED
Metadata structure has been allocated at least once.
VIRT_DIR
Special (TSK added "Virtual" directories) NON-NLS.
LOCAL_DIR
Local directory that was added (not from a disk image)
TSK_FS_TYPE_FAT_DETECT
FAT auto detection.
VOL
Volume - see tsk_vs_parts for more details.
TSK_FS_ATTR_TYPE_NTFS_IDXALLOC
static EncodingType valueOf(int type)
TSK_FS_ATTR_TYPE_NTFS_BITMAP
TSK_FS_TYPE_RAW_DETECT
RAW auto detection.
TSK_FS_META_TYPE_VIRT
"Virtual File" created by TSK for file system areas NON-NLS
TSK_VS_TYPE_GPT
GPT partition table NON-NLS.
TSK_FS_META_MODE_IRUSR
R for owner.
TSK_FS_TYPE_DETECT
Use autodetection methods.
TSK_FS_ATTR_TYPE_HFS_DEFAULT
static TSK_FS_NAME_TYPE_ENUM valueOf(short dir_type)
CHR
Character device NON-NLS.
TSK_FS_TYPE_APFS
APFS file system.
REPORT
Artifact - see blackboard_artifacts for more details.
SHAD
Shadow inode (solaris) NON-NLS.
static short toInt(Set< TSK_FS_META_MODE_ENUM > modes)
BAD
File marked as known and bad/notable/interesting by hash db.
DERIVED
File derived from a parent file (i.e. from ZIP)
TSK_FS_TYPE_EXT2
Ext2 file system.
TSK_FS_ATTR_TYPE_NTFS_LOG
TSK_FS_ATTR_TYPE_UNIX_INDIR
TSK_FS_TYPE_HFS
HFS file system.
static TSK_DB_FILES_TYPE_ENUM valueOf(short fileType)
TSK_FS_META_TYPE_BLK
Block device NON-NLS.
TSK_FS_TYPE_EXT4
Ext4 file system.
TSK_FS_ATTR_TYPE_NTFS_PROP
static short toInt(Set< TSK_FS_META_FLAG_ENUM > metaFlags)
TSK_FS_ATTR_TYPE_HFS_RSRC
static TSK_IMG_TYPE_ENUM valueOf(long imgType)
TSK_FS_TYPE_YAFFS2
YAFFS2 file system.
UNALLOC_BLOCKS
Set of blocks not allocated by file system. Parent should be image, volume, or file system...
TSK_FS_META_TYPE_SOCK
UNIX domain socket NON-NLS.
static ObjectType valueOf(short objectType)
TSK_POOL_TYPE_DETECT
Use autodetection methods.
TSK_FS_META_TYPE_FIFO
Named pipe (fifo) NON-NLS.
UNKNOWN
File marked as unknown by hash db.
static Set< TSK_FS_META_MODE_ENUM > valuesOf(short modes)
TSK_FS_META_TYPE_LNK
Symbolic link NON-NLS.
TSK_VS_TYPE_DETECT
Use autodetection methods.
TSK_FS_ATTR_TYPE_NTFS_SEC
TSK_FS_TYPE_FAT16
FAT16 file system.
TSK_FS_TYPE_FFS_DETECT
UFS auto detection.
KNOWN
File marked as a known by hash db.
TSK_FS_ATTR_TYPE_NTFS_DATA
TSK_FS_META_MODE_IWGRP
W for group.
ALLOC
Name is in an allocated state.
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
TSK_VS_PART_FLAG_UNALLOC
Sectors are not allocated to a volume.
TSK_FS_ATTR_TYPE_NTFS_FNAME
static TSK_VS_TYPE_ENUM valueOf(long vsType)
ABSTRACTFILE
File - see tsk_files for more details.
TSK_FS_ATTR_TYPE_NTFS_SYMLNK
TSK_FS_TYPE_ISO9660
ISO9660 file system.
TSK_VS_TYPE_DOS
DOS Partition table NON-NLS.
TSK_FS_META_TYPE_REG
Regular file NON-NLS.
TSK_FS_ATTR_TYPE_NOT_FOUND
TSK_FS_META_MODE_ISGID
set group id on execution
ORPHAN
Return only metadata structures that have no file name pointing to the (inode_walk flag only) ...
TSK_FS_TYPE_FFS2
UFS2 - FreeBSD, NetBSD.
TSK_FS_META_MODE_IXUSR
X for owner.
UNUSED_BLOCKS
Set of blocks that are unallocated AND not used by a carved or other file type. Parent should be UNAL...
VS
Volume System - see tsk_vs_info for more details.
IMG
Disk Image - see tsk_image_info for more details.
UNALLOC
Name is in an unallocated state.
TSK_FS_ATTR_TYPE_NTFS_VVER