The Sleuth Kit 4.15.0-develop
Public Member Functions | Protected Member Functions | List of all members
TskDb Class Referenceabstract
Inheritance diagram for TskDb:
TskDbSqlite

Public Member Functions

virtual TSK_RETVAL_ENUM addCarvedFile (const int64_t parentObjId, const int64_t fsObjId, const uint64_t size, vector< TSK_DB_FILE_LAYOUT_RANGE > &ranges, int64_t &objId, int64_t dataSourceObjId)=0
virtual int addFileLayoutRange (const TSK_DB_FILE_LAYOUT_RANGE &fileLayoutRange)=0
virtual int addFileLayoutRange (int64_t a_fileObjId, uint64_t a_byteStart, uint64_t a_byteLen, int a_sequence)=0
virtual int addFsFile (TSK_FS_FILE *fs_file, const TSK_FS_ATTR *fs_attr, const char *path, const unsigned char *const md5, const TSK_DB_FILES_KNOWN_ENUM known, int64_t fsObjId, int64_t &objId, int64_t dataSourceObjId)=0
virtual int addFsInfo (const TSK_FS_INFO *fs_info, int64_t parObjId, int64_t &objId)=0
virtual int addImageInfo (int type, int size, int64_t &objId, const string &timezone)=0
virtual int addImageInfo (int type, int size, int64_t &objId, const string &timezone, TSK_OFF_T, const string &md5, const string &sha1, const string &sha256)=0
virtual int addImageInfo (int type, TSK_OFF_T size, int64_t &objId, const string &timezone, TSK_OFF_T, const string &md5, const string &sha1, const string &sha256, const string &deviceId, const string &collectionDetails)=0
virtual int addImageName (int64_t objId, char const *imgName, int sequence)=0
virtual int addPoolInfoAndVS (const TSK_POOL_INFO *pool_info, int64_t parObjId, int64_t &vsObjId)=0
virtual int addPoolVolumeInfo (const TSK_POOL_VOLUME_INFO *pool_vol, int64_t parObjId, int64_t &objId)=0
virtual int addUnallocatedPoolVolume (int vol_index, int64_t parObjId, int64_t &objId)=0
virtual TSK_RETVAL_ENUM addUnallocBlockFile (const int64_t parentObjId, const int64_t fsObjId, const uint64_t size, vector< TSK_DB_FILE_LAYOUT_RANGE > &ranges, int64_t &objId, int64_t dataSourceObjId)=0
virtual TSK_RETVAL_ENUM addUnallocFsBlockFilesParent (const int64_t fsObjId, int64_t &objId, int64_t dataSourceObjId)=0
virtual TSK_RETVAL_ENUM addUnusedBlockFile (const int64_t parentObjId, const int64_t fsObjId, const uint64_t size, vector< TSK_DB_FILE_LAYOUT_RANGE > &ranges, int64_t &objId, int64_t dataSourceObjId)=0
virtual TSK_RETVAL_ENUM addVirtualDir (const int64_t fsObjId, const int64_t parentDirId, const char *const name, int64_t &objId, int64_t dataSourceObjId)=0
virtual int addVolumeInfo (const TSK_VS_PART_INFO *vs_part, int64_t parObjId, int64_t &objId)=0
virtual int addVsInfo (const TSK_VS_INFO *vs_info, int64_t parObjId, int64_t &objId)=0
virtual int close ()=0
virtual int createSavepoint (const char *name)=0
virtual bool dbExists ()=0
virtual TSK_RETVAL_ENUM getFileLayouts (vector< TSK_DB_FILE_LAYOUT_RANGE > &fileLayouts)=0
virtual TSK_RETVAL_ENUM getFsInfos (int64_t imgId, vector< TSK_DB_FS_INFO > &fsInfos)=0
virtual TSK_RETVAL_ENUM getFsRootDirObjectInfo (const int64_t fsObjId, TSK_DB_OBJECT &rootDirObjInfo)=0
virtual TSK_RETVAL_ENUM getObjectInfo (int64_t objId, TSK_DB_OBJECT &objectInfo)=0
virtual TSK_RETVAL_ENUM getParentImageId (const int64_t objId, int64_t &imageId)=0
virtual bool getParentPathAndName (const char *path, const char **ret_parent_path, const char **ret_name)
virtual TSK_RETVAL_ENUM getVsInfo (int64_t objId, TSK_DB_VS_INFO &vsInfo)=0
virtual TSK_RETVAL_ENUM getVsInfos (int64_t imgId, vector< TSK_DB_VS_INFO > &vsInfos)=0
virtual TSK_RETVAL_ENUM getVsPartInfos (int64_t imgId, vector< TSK_DB_VS_PART_INFO > &vsPartInfos)=0
virtual bool inTransaction ()=0
virtual bool isDbOpen ()=0
virtual int open (bool)=0
virtual int releaseSavepoint (const char *name)=0
virtual int revertSavepoint (const char *name)=0
 TskDb (const char *a_dbFilePathUtf8, bool a_blkMapFlag)
 Set the locations and logging object.

Protected Member Functions

void extractExtension (char *name, char *extension)
 Extract the extension from the given file name and store it in the supplied string.

Constructor & Destructor Documentation

◆ TskDb()

TskDb::TskDb ( const char * a_dbFilePathUtf8,
bool a_blkMapFlag )

Set the locations and logging object.

Must call open() before the object can be used.

Referenced by TskDbSqlite::TskDbSqlite().

Member Function Documentation

◆ addCarvedFile()

virtual TSK_RETVAL_ENUM TskDb::addCarvedFile ( const int64_t parentObjId,
const int64_t fsObjId,
const uint64_t size,
vector< TSK_DB_FILE_LAYOUT_RANGE > & ranges,
int64_t & objId,
int64_t dataSourceObjId )
pure virtual

Implemented in TskDbSqlite.

◆ addFileLayoutRange() [1/2]

virtual int TskDb::addFileLayoutRange ( const TSK_DB_FILE_LAYOUT_RANGE & fileLayoutRange)
pure virtual

Implemented in TskDbSqlite.

◆ addFileLayoutRange() [2/2]

virtual int TskDb::addFileLayoutRange ( int64_t a_fileObjId,
uint64_t a_byteStart,
uint64_t a_byteLen,
int a_sequence )
pure virtual

Implemented in TskDbSqlite.

◆ addFsFile()

virtual int TskDb::addFsFile ( TSK_FS_FILE * fs_file,
const TSK_FS_ATTR * fs_attr,
const char * path,
const unsigned char *const md5,
const TSK_DB_FILES_KNOWN_ENUM known,
int64_t fsObjId,
int64_t & objId,
int64_t dataSourceObjId )
pure virtual

Implemented in TskDbSqlite.

◆ addFsInfo()

virtual int TskDb::addFsInfo ( const TSK_FS_INFO * fs_info,
int64_t parObjId,
int64_t & objId )
pure virtual

Implemented in TskDbSqlite.

◆ addImageInfo() [1/3]

virtual int TskDb::addImageInfo ( int type,
int size,
int64_t & objId,
const string & timezone )
pure virtual

Implemented in TskDbSqlite.

◆ addImageInfo() [2/3]

virtual int TskDb::addImageInfo ( int type,
int size,
int64_t & objId,
const string & timezone,
TSK_OFF_T ,
const string & md5,
const string & sha1,
const string & sha256 )
pure virtual

Implemented in TskDbSqlite.

◆ addImageInfo() [3/3]

virtual int TskDb::addImageInfo ( int type,
TSK_OFF_T size,
int64_t & objId,
const string & timezone,
TSK_OFF_T ,
const string & md5,
const string & sha1,
const string & sha256,
const string & deviceId,
const string & collectionDetails )
pure virtual

Implemented in TskDbSqlite.

◆ addImageName()

virtual int TskDb::addImageName ( int64_t objId,
char const * imgName,
int sequence )
pure virtual

Implemented in TskDbSqlite.

◆ addPoolInfoAndVS()

virtual int TskDb::addPoolInfoAndVS ( const TSK_POOL_INFO * pool_info,
int64_t parObjId,
int64_t & vsObjId )
pure virtual

Implemented in TskDbSqlite.

◆ addPoolVolumeInfo()

virtual int TskDb::addPoolVolumeInfo ( const TSK_POOL_VOLUME_INFO * pool_vol,
int64_t parObjId,
int64_t & objId )
pure virtual

Implemented in TskDbSqlite.

◆ addUnallocatedPoolVolume()

virtual int TskDb::addUnallocatedPoolVolume ( int vol_index,
int64_t parObjId,
int64_t & objId )
pure virtual

Implemented in TskDbSqlite.

◆ addUnallocBlockFile()

virtual TSK_RETVAL_ENUM TskDb::addUnallocBlockFile ( const int64_t parentObjId,
const int64_t fsObjId,
const uint64_t size,
vector< TSK_DB_FILE_LAYOUT_RANGE > & ranges,
int64_t & objId,
int64_t dataSourceObjId )
pure virtual

Implemented in TskDbSqlite.

◆ addUnallocFsBlockFilesParent()

virtual TSK_RETVAL_ENUM TskDb::addUnallocFsBlockFilesParent ( const int64_t fsObjId,
int64_t & objId,
int64_t dataSourceObjId )
pure virtual

Implemented in TskDbSqlite.

◆ addUnusedBlockFile()

virtual TSK_RETVAL_ENUM TskDb::addUnusedBlockFile ( const int64_t parentObjId,
const int64_t fsObjId,
const uint64_t size,
vector< TSK_DB_FILE_LAYOUT_RANGE > & ranges,
int64_t & objId,
int64_t dataSourceObjId )
pure virtual

Implemented in TskDbSqlite.

◆ addVirtualDir()

virtual TSK_RETVAL_ENUM TskDb::addVirtualDir ( const int64_t fsObjId,
const int64_t parentDirId,
const char *const name,
int64_t & objId,
int64_t dataSourceObjId )
pure virtual

Implemented in TskDbSqlite.

◆ addVolumeInfo()

virtual int TskDb::addVolumeInfo ( const TSK_VS_PART_INFO * vs_part,
int64_t parObjId,
int64_t & objId )
pure virtual

Implemented in TskDbSqlite.

◆ addVsInfo()

virtual int TskDb::addVsInfo ( const TSK_VS_INFO * vs_info,
int64_t parObjId,
int64_t & objId )
pure virtual

Implemented in TskDbSqlite.

◆ createSavepoint()

virtual int TskDb::createSavepoint ( const char * name)
pure virtual

Implemented in TskDbSqlite.

◆ extractExtension()

void TskDb::extractExtension ( char * name,
char * extension )
inlineprotected

Extract the extension from the given file name and store it in the supplied string.

Parameters
nameA file name
extensionThe file name extension will be extracted to extension.

◆ getFileLayouts()

virtual TSK_RETVAL_ENUM TskDb::getFileLayouts ( vector< TSK_DB_FILE_LAYOUT_RANGE > & fileLayouts)
pure virtual

Implemented in TskDbSqlite.

◆ getFsInfos()

virtual TSK_RETVAL_ENUM TskDb::getFsInfos ( int64_t imgId,
vector< TSK_DB_FS_INFO > & fsInfos )
pure virtual

Implemented in TskDbSqlite.

◆ getFsRootDirObjectInfo()

virtual TSK_RETVAL_ENUM TskDb::getFsRootDirObjectInfo ( const int64_t fsObjId,
TSK_DB_OBJECT & rootDirObjInfo )
pure virtual

Implemented in TskDbSqlite.

◆ getObjectInfo()

virtual TSK_RETVAL_ENUM TskDb::getObjectInfo ( int64_t objId,
TSK_DB_OBJECT & objectInfo )
pure virtual

Implemented in TskDbSqlite.

◆ getParentImageId()

virtual TSK_RETVAL_ENUM TskDb::getParentImageId ( const int64_t objId,
int64_t & imageId )
pure virtual

Implemented in TskDbSqlite.

◆ getVsInfo()

virtual TSK_RETVAL_ENUM TskDb::getVsInfo ( int64_t objId,
TSK_DB_VS_INFO & vsInfo )
pure virtual

Implemented in TskDbSqlite.

◆ getVsInfos()

virtual TSK_RETVAL_ENUM TskDb::getVsInfos ( int64_t imgId,
vector< TSK_DB_VS_INFO > & vsInfos )
pure virtual

Implemented in TskDbSqlite.

◆ getVsPartInfos()

virtual TSK_RETVAL_ENUM TskDb::getVsPartInfos ( int64_t imgId,
vector< TSK_DB_VS_PART_INFO > & vsPartInfos )
pure virtual

Implemented in TskDbSqlite.

◆ isDbOpen()

virtual bool TskDb::isDbOpen ( )
pure virtual

Implemented in TskDbSqlite.

◆ releaseSavepoint()

virtual int TskDb::releaseSavepoint ( const char * name)
pure virtual

Implemented in TskDbSqlite.

◆ revertSavepoint()

virtual int TskDb::revertSavepoint ( const char * name)
pure virtual

Implemented in TskDbSqlite.

The documentation for this class was generated from the following files:

Copyright © 2007-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.