The Sleuth Kit Framework  4.1
Class Hierarchy
This inheritance list is sorted roughly, but not completely, alphabetically:
[detail level 123]
oCTskFileManager::AutoFilePtrListThis nested class should be used to hold a FilePtrList object returned by methods such as findFilesByName() so that the file objects will be automatically freed
oCCarveExtractInterface for class that will carve an unallocated sectors image file
|\CTskCarveExtractScalpelImplements the CarveExtract interface to carve unallocated sectors image files using Scalpel
oCCarvePrepInterface for class that prepares for later carving
|\CTskCarvePrepSectorConcatImplements the CarvePrep abstract interface
oCexception
|\CTskExceptionFramework exception class
oCewf::IMG_EWF_INFO
oCLogLogging class to enable the framework, apps that use it, and modules to log error and warning messages
oCSchedulerInterface for class that will handle scheduling of tasks
|\CTskSchedulerQueueImplementation of the Scheduler interface that keeps a local queue of tasks to run
oCSectorRunsStores a list of runs (which have a starting sector and length)
oCScheduler::task_structDescribes a single task to be scheduled or perform
oCTskAllocUnallocMapRecordContains data about the mapping of data in the unallocated chunks back to their original location in the disk image
oCTskArtifactNamesClass used to store the pair of type and display names of artifacts
oCTskAttributeNamesClass used to store the pair of type and display names of attributes
oCTskAuto [external]
|\CTSKAutoImplImplements TskAuto and is used to analyze the data in a disk image and populate TskImgDB with the results
oCTskBlackboardAn interface for setting and retrieving name/value pairs to the blackboard
|\CTskDBBlackboardAn implementation of TskBlackboard that stores the name / value pairs in the TskImgDB
oCTskBlackboardArtifactClass that represents a blackboard artifact object
oCTskBlackboardAttributeClass that represents a blackboard attribute object
oCTskBlackboardRecordContains data for a blackboard entry for a given file and artifact ID
oCTskCarvedFileInfoContains data derived from joining carved file records from multiple tables in the image database
oCTskArchiveExtraction::TskExtractAbstract base interface class for container extractor classes
|\CTskL01Extract
oCTskFileAn interface that is used to represent a file
|\CTskFileTskTskFileTsk is a Sleuthkit and Poco based implementation of the TskFile interface
oCTskFileManagerResponsible for managing TskFile objects in the system
|\CTskFileManagerImplAn implementation of the TskFileManager interface that stores files in a directory named 'files' based on their file ids
oCTskFileRecordContains data from a file record in the database
oCTskFileTypeRecord
oCTskFsInfoRecordContains data from a file system record in the database
oCTskImageFileAn interface to a class that allows file system and low-level access to a disk image
|\CTskImageFileTskA Sleuth Kit implementation of the TskImageFile interface
oCTskImgDBInterface for class that implments database storage for an image
|oCTskImgDBPostgreSQLFramework data access layer the uses PostgreSQL as the back end
|\CTskImgDBSqliteImplementation of TskImgDB that uses SQLite to store the data
oCTskModuleInterface for classes that represent different types of modules in the pipeline
|oCTskExecutableModuleSupports launching a process via an executable file to perform some analysis on a TskFile object in a TskPipeline
|\CTskPluginModuleSupports the loading of a custom dynamic library to perform analysis in either a TskPipeline or TskReportPipeline
| oCTskFileAnalysisPluginModuleSupports the loading of custom dynamic libraries to perform analysis on a single TskFile
| \CTskReportPluginModuleSupports the use of custom dynamic libraries to perform reporting and post-processing in a TskReportPipeline
oCTskModuleInfoContains data about a module
oCTskModuleStatusContains data about the module return status for a given file (as recorded in the database)
oCTskPipelineThe Pipeline class controls the processing of data through an ordered list of dynamic library or executable modules
|oCTskFileAnalysisPipelineControls the processing of a file analysis pipeline
|\CTskReportPipelineControls a series of reporting modules that are run after all of the file-specific analysis modules are run
oCTskPipelineManagerResponsible for creation and destruction of of TskPipeline objects
oCTskServicesProvides singleton access to many framework services
oCTskSystemPropertiesA base class for setting and retrieving system-wide name/value pairs
|\CTskSystemPropertiesImplAn implementation of TskSystemProperties that uses Poco AbstractConfiguration class to set and retrieve name/value pairs from an XML file
oCTskUnallocImgStatusRecordContains data about the current status for an unallocated chunk of data
oCTskUnusedSectorsRecordData about the 'unused sectors', which did not have carvable data
oCTskUtilitiesContains commonly needed utility methods
oCTskVolumeInfoRecordContains data from a volume/partition record in the database
\CUnallocRunStores information that can map a region in the original disk image to a region in one of the chunks of unallocated space (as created by the CarvePrep implementation

Copyright © 2011-2013 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.