The Sleuth Kit  4.10.2
Public Member Functions | Protected Member Functions | List of all members
TskDb Class Referenceabstract
Inheritance diagram for TskDb:
TskDbSqlite

Public Member Functions

virtual TSK_RETVAL_ENUM addCarvedFile (const int64_t parentObjId, const int64_t fsObjId, const uint64_t size, vector< TSK_DB_FILE_LAYOUT_RANGE > &ranges, int64_t &objId, int64_t dataSourceObjId)=0
 
virtual int addFileLayoutRange (const TSK_DB_FILE_LAYOUT_RANGE &fileLayoutRange)=0
 
virtual int addFileLayoutRange (int64_t a_fileObjId, uint64_t a_byteStart, uint64_t a_byteLen, int a_sequence)=0
 
virtual int addFsFile (TSK_FS_FILE *fs_file, const TSK_FS_ATTR *fs_attr, const char *path, const unsigned char *const md5, const TSK_DB_FILES_KNOWN_ENUM known, int64_t fsObjId, int64_t &objId, int64_t dataSourceObjId)=0
 
virtual int addFsInfo (const TSK_FS_INFO *fs_info, int64_t parObjId, int64_t &objId)=0
 
virtual int addImageInfo (int type, int size, int64_t &objId, const string &timezone)=0
 
virtual int addImageInfo (int type, int size, int64_t &objId, const string &timezone, TSK_OFF_T, const string &md5, const string &sha1, const string &sha256)=0
 
virtual int addImageInfo (int type, TSK_OFF_T size, int64_t &objId, const string &timezone, TSK_OFF_T, const string &md5, const string &sha1, const string &sha256, const string &deviceId, const string &collectionDetails)=0
 
virtual int addImageName (int64_t objId, char const *imgName, int sequence)=0
 
virtual int addPoolInfoAndVS (const TSK_POOL_INFO *pool_info, int64_t parObjId, int64_t &vsObjId)=0
 
virtual int addPoolVolumeInfo (const TSK_POOL_VOLUME_INFO *pool_vol, int64_t parObjId, int64_t &objId)=0
 
virtual int addUnallocatedPoolVolume (int vol_index, int64_t parObjId, int64_t &objId)=0
 
virtual TSK_RETVAL_ENUM addUnallocBlockFile (const int64_t parentObjId, const int64_t fsObjId, const uint64_t size, vector< TSK_DB_FILE_LAYOUT_RANGE > &ranges, int64_t &objId, int64_t dataSourceObjId)=0
 
virtual TSK_RETVAL_ENUM addUnallocFsBlockFilesParent (const int64_t fsObjId, int64_t &objId, int64_t dataSourceObjId)=0
 
virtual TSK_RETVAL_ENUM addUnusedBlockFile (const int64_t parentObjId, const int64_t fsObjId, const uint64_t size, vector< TSK_DB_FILE_LAYOUT_RANGE > &ranges, int64_t &objId, int64_t dataSourceObjId)=0
 
virtual TSK_RETVAL_ENUM addVirtualDir (const int64_t fsObjId, const int64_t parentDirId, const char *const name, int64_t &objId, int64_t dataSourceObjId)=0
 
virtual int addVolumeInfo (const TSK_VS_PART_INFO *vs_part, int64_t parObjId, int64_t &objId)=0
 
virtual int addVsInfo (const TSK_VS_INFO *vs_info, int64_t parObjId, int64_t &objId)=0
 
virtual int close ()=0
 
virtual int createSavepoint (const char *name)=0
 
virtual bool dbExists ()=0
 
virtual TSK_RETVAL_ENUM getFileLayouts (vector< TSK_DB_FILE_LAYOUT_RANGE > &fileLayouts)=0
 
virtual TSK_RETVAL_ENUM getFsInfos (int64_t imgId, vector< TSK_DB_FS_INFO > &fsInfos)=0
 
virtual TSK_RETVAL_ENUM getFsRootDirObjectInfo (const int64_t fsObjId, TSK_DB_OBJECT &rootDirObjInfo)=0
 
virtual TSK_RETVAL_ENUM getObjectInfo (int64_t objId, TSK_DB_OBJECT &objectInfo)=0
 
virtual TSK_RETVAL_ENUM getParentImageId (const int64_t objId, int64_t &imageId)=0
 
virtual bool getParentPathAndName (const char *path, const char **ret_parent_path, const char **ret_name)
 
virtual TSK_RETVAL_ENUM getVsInfo (int64_t objId, TSK_DB_VS_INFO &vsInfo)=0
 
virtual TSK_RETVAL_ENUM getVsInfos (int64_t imgId, vector< TSK_DB_VS_INFO > &vsInfos)=0
 
virtual TSK_RETVAL_ENUM getVsPartInfos (int64_t imgId, vector< TSK_DB_VS_PART_INFO > &vsPartInfos)=0
 
virtual bool inTransaction ()=0
 
virtual bool isDbOpen ()=0
 
virtual int open (bool)=0
 
virtual int releaseSavepoint (const char *name)=0
 
virtual int revertSavepoint (const char *name)=0
 
 TskDb (const char *a_dbFilePathUtf8, bool a_blkMapFlag)
 Set the locations and logging object. More...
 

Protected Member Functions

void extractExtension (char *name, char *extension)
 Extract the extension from the given file name and store it in the supplied string. More...
 

Constructor & Destructor Documentation

TskDb::TskDb ( const char *  a_dbFilePathUtf8,
bool  a_blkMapFlag 
)

Set the locations and logging object.

Must call open() before the object can be used.

Member Function Documentation

void TskDb::extractExtension ( char *  name,
char *  extension 
)
inlineprotected

Extract the extension from the given file name and store it in the supplied string.

Parameters
nameA file name
extensionThe file name extension will be extracted to extension.

The documentation for this class was generated from the following files:

Copyright © 2007-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.