The Sleuth Kit Framework  4.1
Class List
Here are the classes, structs, unions and interfaces with brief descriptions:
[detail level 12]
|\CTskExtractAbstract base interface class for container extractor classes
oCCarveExtractInterface for class that will carve an unallocated sectors image file
oCCarvePrepInterface for class that prepares for later carving
oCLogLogging class to enable the framework, apps that use it, and modules to log error and warning messages
oCSchedulerInterface for class that will handle scheduling of tasks
|\Ctask_structDescribes a single task to be scheduled or perform
oCSectorRunsStores a list of runs (which have a starting sector and length)
oCTskAllocUnallocMapRecordContains data about the mapping of data in the unallocated chunks back to their original location in the disk image
oCTskArtifactNamesClass used to store the pair of type and display names of artifacts
oCTskAttributeNamesClass used to store the pair of type and display names of attributes
oCTSKAutoImplImplements TskAuto and is used to analyze the data in a disk image and populate TskImgDB with the results
oCTskBlackboardAn interface for setting and retrieving name/value pairs to the blackboard
oCTskBlackboardArtifactClass that represents a blackboard artifact object
oCTskBlackboardAttributeClass that represents a blackboard attribute object
oCTskBlackboardRecordContains data for a blackboard entry for a given file and artifact ID
oCTskCarvedFileInfoContains data derived from joining carved file records from multiple tables in the image database
oCTskCarveExtractScalpelImplements the CarveExtract interface to carve unallocated sectors image files using Scalpel
oCTskCarvePrepSectorConcatImplements the CarvePrep abstract interface
oCTskDBBlackboardAn implementation of TskBlackboard that stores the name / value pairs in the TskImgDB
oCTskExceptionFramework exception class
oCTskExecutableModuleSupports launching a process via an executable file to perform some analysis on a TskFile object in a TskPipeline
oCTskFileAn interface that is used to represent a file
oCTskFileAnalysisPipelineControls the processing of a file analysis pipeline
oCTskFileAnalysisPluginModuleSupports the loading of custom dynamic libraries to perform analysis on a single TskFile
oCTskFileManagerResponsible for managing TskFile objects in the system
|\CAutoFilePtrListThis nested class should be used to hold a FilePtrList object returned by methods such as findFilesByName() so that the file objects will be automatically freed
oCTskFileManagerImplAn implementation of the TskFileManager interface that stores files in a directory named 'files' based on their file ids
oCTskFileRecordContains data from a file record in the database
oCTskFileTskTskFileTsk is a Sleuthkit and Poco based implementation of the TskFile interface
oCTskFsInfoRecordContains data from a file system record in the database
oCTskImageFileAn interface to a class that allows file system and low-level access to a disk image
oCTskImageFileTskA Sleuth Kit implementation of the TskImageFile interface
oCTskImgDBInterface for class that implments database storage for an image
oCTskImgDBPostgreSQLFramework data access layer the uses PostgreSQL as the back end
oCTskImgDBSqliteImplementation of TskImgDB that uses SQLite to store the data
oCTskModuleInterface for classes that represent different types of modules in the pipeline
oCTskModuleInfoContains data about a module
oCTskModuleStatusContains data about the module return status for a given file (as recorded in the database)
oCTskPipelineThe Pipeline class controls the processing of data through an ordered list of dynamic library or executable modules
oCTskPipelineManagerResponsible for creation and destruction of of TskPipeline objects
oCTskPluginModuleSupports the loading of a custom dynamic library to perform analysis in either a TskPipeline or TskReportPipeline
oCTskReportPipelineControls a series of reporting modules that are run after all of the file-specific analysis modules are run
oCTskReportPluginModuleSupports the use of custom dynamic libraries to perform reporting and post-processing in a TskReportPipeline
oCTskSchedulerQueueImplementation of the Scheduler interface that keeps a local queue of tasks to run
oCTskServicesProvides singleton access to many framework services
oCTskSystemPropertiesA base class for setting and retrieving system-wide name/value pairs
oCTskSystemPropertiesImplAn implementation of TskSystemProperties that uses Poco AbstractConfiguration class to set and retrieve name/value pairs from an XML file
oCTskUnallocImgStatusRecordContains data about the current status for an unallocated chunk of data
oCTskUnusedSectorsRecordData about the 'unused sectors', which did not have carvable data
oCTskUtilitiesContains commonly needed utility methods
oCTskVolumeInfoRecordContains data from a volume/partition record in the database
\CUnallocRunStores information that can map a region in the original disk image to a region in one of the chunks of unallocated space (as created by the CarvePrep implementation

Copyright © 2011-2013 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.