Autopsy  4.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Static Public Member Functions | Static Private Member Functions | Static Private Attributes | List of all members
org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder Class Reference

Static Public Member Functions

static List< String > identifyVirtualMachines (Path imageFolderPath)
 

Static Private Member Functions

static List< String > getAllFilesInFolder (String path)
 
static boolean isAcceptedByFiler (File file, List< FileFilter > filters)
 
static boolean isPartOfSplitVMDKImage (String fileName)
 
static boolean isVirtualMachine (String fileName)
 
static List< String > readExtentFilesFromVmdkDescriptorFile (File file)
 

Static Private Attributes

static final int FILE_NAME_FIELD_INDX_IN_EXTENT_DESCRIPTOR = 3
 
static final Logger logger = Logger.getLogger(VirtualMachineFinder.class.getName())
 
static final int MAX_VMDK_DESCRIPTOR_FILE_SIZE_BYTES = 10000
 
static final int MIN_VMDK_EXTENT_DESCRIPTOR_FIELDS_NUM = 4
 
static final GeneralFilter virtualMachineFilter = new GeneralFilter(GeneralFilter.VIRTUAL_MACHINE_EXTS, GeneralFilter.VIRTUAL_MACHINE_DESC)
 
static final List< String > VMDK_EXTS = Arrays.asList(new String[]{".vmdk"})
 
static final GeneralFilter vmdkFilter = new GeneralFilter(VMDK_EXTS, "")
 
static final List< FileFilter > vmdkFiltersList = new ArrayList<>()
 
static final List< FileFilter > vmFiltersList = new ArrayList<>()
 

Detailed Description

Virtual machine file finder

Definition at line 38 of file VirtualMachineFinder.java.

Member Function Documentation

static List<String> org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.getAllFilesInFolder ( String  path)
staticprivate

Returns a list of all file names in the folder of interest. Sub-folders are excluded.

Parameters
pathAbsolute path of the folder of interest
Returns
List of all file names in the folder of interest

Definition at line 200 of file VirtualMachineFinder.java.

Referenced by org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.identifyVirtualMachines().

static List<String> org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.identifyVirtualMachines ( Path  imageFolderPath)
static
static boolean org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.isAcceptedByFiler ( File  file,
List< FileFilter >  filters 
)
staticprivate
static boolean org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.isPartOfSplitVMDKImage ( String  fileName)
staticprivate

Identifies whether a vmdk file is part of split vmdk image

Parameters
fileNameName of the vmdk file
Returns
True if the file is part of split vmdk image, false if not

Definition at line 160 of file VirtualMachineFinder.java.

References org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.isAcceptedByFiler().

static boolean org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.isVirtualMachine ( String  fileName)
staticprivate
static List<String> org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.readExtentFilesFromVmdkDescriptorFile ( File  file)
staticprivate

Opens VMDK descriptor file, finds and returns a list of all VMDK extent files listed in the descriptor file.

Parameters
fileVMDK descriptor file to read
Returns
List of VMDK extent file names listed in the descriptor file

Definition at line 116 of file VirtualMachineFinder.java.

References org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.FILE_NAME_FIELD_INDX_IN_EXTENT_DESCRIPTOR.

Referenced by org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.identifyVirtualMachines().

Member Data Documentation

final int org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.FILE_NAME_FIELD_INDX_IN_EXTENT_DESCRIPTOR = 3
staticprivate
final Logger org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.logger = Logger.getLogger(VirtualMachineFinder.class.getName())
staticprivate

Definition at line 40 of file VirtualMachineFinder.java.

final int org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.MAX_VMDK_DESCRIPTOR_FILE_SIZE_BYTES = 10000
staticprivate
final int org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.MIN_VMDK_EXTENT_DESCRIPTOR_FIELDS_NUM = 4
staticprivate

Definition at line 43 of file VirtualMachineFinder.java.

final GeneralFilter org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.virtualMachineFilter = new GeneralFilter(GeneralFilter.VIRTUAL_MACHINE_EXTS, GeneralFilter.VIRTUAL_MACHINE_DESC)
staticprivate

Definition at line 46 of file VirtualMachineFinder.java.

final List<String> org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.VMDK_EXTS = Arrays.asList(new String[]{".vmdk"})
staticprivate

Definition at line 53 of file VirtualMachineFinder.java.

final GeneralFilter org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.vmdkFilter = new GeneralFilter(VMDK_EXTS, "")
staticprivate

Definition at line 54 of file VirtualMachineFinder.java.

final List<FileFilter> org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.vmdkFiltersList = new ArrayList<>()
staticprivate

Definition at line 55 of file VirtualMachineFinder.java.

final List<FileFilter> org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.vmFiltersList = new ArrayList<>()
staticprivate

Definition at line 47 of file VirtualMachineFinder.java.


The documentation for this class was generated from the following file:

Copyright © 2012-2015 Basis Technology. Generated on: Wed Apr 6 2016
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.