The Sleuth Kit Framework  4.1
Public Member Functions | Protected Member Functions | Friends | List of all members
TskBlackboardAttribute Class Reference

Class that represents a blackboard attribute object. More...

#include <TskBlackboardAttribute.h>

Public Member Functions

uint64_t getArtifactID () const
 Get artifact id for the parent of this attribute. More...
 
int getAttributeTypeID () const
 Get attribute type id for this attribute. More...
 
string getContext () const
 Get context for this attribute. More...
 
string getModuleName () const
 Get nameof the module that created this attribute. More...
 
uint64_t getObjectID () const
 Get object id this attribute is associated with. More...
 
TskBlackboardArtifact getParentArtifact () const
 Get parent artifact for this attribute. More...
 
vector< unsigned char > getValueBytes () const
 Get value bytes (if this attribute stores bytes) More...
 
double getValueDouble () const
 Get value double (if the attribute stores a double) More...
 
int getValueInt () const
 Get value int (if the attribute stores an int) More...
 
uint64_t getValueLong () const
 Get value long (if the attribute stores a long0. More...
 
string getValueString () const
 Get value string (if this attribute stores a string) More...
 
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType () const
 Get typeof value this attribute stores. More...
 
 TskBlackboardAttribute (const int attributeTypeID, const string &moduleName, const string &context, const int valueInt)
 Constructor for an attribute storing an int. More...
 
 TskBlackboardAttribute (const int attributeTypeID, const string &moduleName, const string &context, const uint64_t valueLong)
 Constructor for an attribute storing a 64 bit integer. More...
 
 TskBlackboardAttribute (const int attributeTypeID, const string &moduleName, const string &context, const double valueDouble)
 Constructor for an attribute storing a double. More...
 
 TskBlackboardAttribute (const int attributeTypeID, const string &moduleName, const string &context, const string &valueString)
 Constructor for an attribute storing a string. More...
 
 TskBlackboardAttribute (const int attributeTypeID, const string &moduleName, const string &context, const vector< unsigned char > &valueBytes)
 Constructor for an attribute storing a byte array. More...
 
 ~TskBlackboardAttribute ()
 Default destructor.
 

Protected Member Functions

void setArtifactID (uint64_t artifactID)
 Set artifact id. More...
 
void setObjectID (uint64_t objectID)
 Set object id. More...
 
 TskBlackboardAttribute (const uint64_t artifactID, const int attributeTypeID, const uint64_t objectID, const string &moduleName, const string &context, const TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, const int valueInt, const uint64_t valueLong, const double valueDouble, const string &valueString, const vector< unsigned char > &valueBytes)
 Constructor. More...
 

Friends

class TskBlackboardArtifact
 
class TskDBBlackboard
 
class TskFile
 
class TskImgDB
 

Detailed Description

Class that represents a blackboard attribute object.

Constructor & Destructor Documentation

TskBlackboardAttribute::TskBlackboardAttribute ( const int  attributeTypeID,
const string &  moduleName,
const string &  context,
const int  valueInt 
)

Constructor for an attribute storing an int.

Constructor.

Parameters
attributeTypeIDattribute type id
moduleNamemodule that created this attribute
contextadditional context
valueIntinteger value
TskBlackboardAttribute::TskBlackboardAttribute ( const int  attributeTypeID,
const string &  moduleName,
const string &  context,
const uint64_t  valueLong 
)

Constructor for an attribute storing a 64 bit integer.

Constructor.

Parameters
attributeTypeIDattribute type id
moduleNamemodule that created this attribute
contextadditional context
valueLong64 bit integer value
TskBlackboardAttribute::TskBlackboardAttribute ( const int  attributeTypeID,
const string &  moduleName,
const string &  context,
const double  valueDouble 
)

Constructor for an attribute storing a double.

Constructor.

Parameters
attributeTypeIDattribute type id
moduleNamemodule that created this attribute
contextadditional context
valueDoubledouble value
TskBlackboardAttribute::TskBlackboardAttribute ( const int  attributeTypeID,
const string &  moduleName,
const string &  context,
const string &  valueString 
)

Constructor for an attribute storing a string.

Constructor.

Parameters
attributeTypeIDattribute type id
moduleNamemodule that created this attribute
contextadditional context
valueStringstring value
TskBlackboardAttribute::TskBlackboardAttribute ( const int  attributeTypeID,
const string &  moduleName,
const string &  context,
const vector< unsigned char > &  valueBytes 
)

Constructor for an attribute storing a byte array.

Constructor.

Parameters
attributeTypeIDattribute type id
moduleNamemodule that created this attribute
contextadditional context
valueBytesbyte array value
TskBlackboardAttribute::TskBlackboardAttribute ( const uint64_t  artifactID,
const int  attributeTypeID,
const uint64_t  objectID,
const string &  moduleName,
const string &  context,
const TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE  valueType,
const int  valueInt,
const uint64_t  valueLong,
const double  valueDouble,
const string &  valueString,
const vector< unsigned char > &  valueBytes 
)
protected

Constructor.

Parameters
artifactIDif of the artifact this is associated with
attributeTypeIDattribute type id
moduleNamemodule that created this attribute
contextadditional context
valueTypeType of value being set (only the corresponding value from the next parameters will be used)
valueIntinteger value
valueLong64 bit integer value
valueDoubledouble value
valueStringstring value
valueBytesbyte array value
objectIDobject the attribute is associated with

Member Function Documentation

uint64_t TskBlackboardAttribute::getArtifactID ( ) const

Get artifact id for the parent of this attribute.

Get artifact id.

Returns
artifact id

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

int TskBlackboardAttribute::getAttributeTypeID ( ) const

Get attribute type id for this attribute.

Get attribute type id.

Returns
attribute type id

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

string TskBlackboardAttribute::getContext ( ) const

Get context for this attribute.

Get context.

Returns
context

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

string TskBlackboardAttribute::getModuleName ( ) const

Get nameof the module that created this attribute.

Get module name.

Returns
module name

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

uint64_t TskBlackboardAttribute::getObjectID ( ) const

Get object id this attribute is associated with.

Get object id.

Returns
object id

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

TskBlackboardArtifact TskBlackboardAttribute::getParentArtifact ( ) const

Get parent artifact for this attribute.

Get parent artifact.

Returns
parent artifact

References TskServices::getBlackboard(), TskBlackboard::getBlackboardArtifact(), and TskServices::Instance().

vector< unsigned char > TskBlackboardAttribute::getValueBytes ( ) const

Get value bytes (if this attribute stores bytes)

Get value bytes.

Returns
value bytes

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

double TskBlackboardAttribute::getValueDouble ( ) const

Get value double (if the attribute stores a double)

Get value double.

Returns
value double

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

int TskBlackboardAttribute::getValueInt ( ) const

Get value int (if the attribute stores an int)

Get value int.

Returns
value int

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

uint64_t TskBlackboardAttribute::getValueLong ( ) const

Get value long (if the attribute stores a long0.

Get value long.

Returns
value long

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

string TskBlackboardAttribute::getValueString ( ) const

Get value string (if this attribute stores a string)

Get value string.

Returns
value string

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE TskBlackboardAttribute::getValueType ( ) const

Get typeof value this attribute stores.

Get value type.

Returns
value type

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

void TskBlackboardAttribute::setArtifactID ( uint64_t  artifactID)
protected

Set artifact id.

Parameters
artifactIDartifact id

Referenced by TskBlackboardArtifact::addAttribute().

void TskBlackboardAttribute::setObjectID ( uint64_t  objectID)
protected

Set object id.

Parameters
objectIDobject id

Referenced by TskBlackboardArtifact::addAttribute().


The documentation for this class was generated from the following files:

Copyright © 2011-2013 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.