Inherits org.sleuthkit.datamodel.AbstractContent.

Inherited by org.sleuthkit.datamodel.DerivedFile, org.sleuthkit.datamodel.FsContent, org.sleuthkit.datamodel.LayoutFile, org.sleuthkit.datamodel.LocalFile, and org.sleuthkit.datamodel.SpecialDirectory.

Classes
enum	MimeMatchEnum

Public Member Functions
void	addAttributes (Collection< Attribute > attributes, final SleuthkitCase.CaseDbTransaction caseDbTransaction) throws TskCoreException
boolean	canRead ()
void	close ()
long	convertToImgOffset (long fileOffset) throws TskCoreException
List< TskFileRange >	convertToImgRanges (long fileOffset, long length) throws TskCoreException
int	countChildrenOfType (List< TSK_FS_NAME_TYPE_ENUM > types) throws TskCoreException
boolean	exists ()
long	getAtime ()
String	getAtimeAsDate ()
int	getAttributeId ()
List< Attribute >	getAttributes () throws TskCoreException
short	getAttrId ()
TskData.TSK_FS_ATTR_TYPE_ENUM	getAttrType ()
TskData.CollectedStatus	getCollected ()
long	getCrtime ()
String	getCrtimeAsDate ()
long	getCtime ()
String	getCtimeAsDate ()
Content	getDataSource () throws TskCoreException
long	getDataSourceObjectId ()
String	getDirFlagAsString ()
TSK_FS_NAME_TYPE_ENUM	getDirType ()
String	getDirTypeAsString ()
FileSystem	getFileSystem () throws TskCoreException
Optional< Long >	getFileSystemObjectId ()
int	getGid ()
TskData.FileKnown	getKnown ()
String	getLocalAbsPath ()
String	getLocalPath ()
String	getMd5Hash ()
long	getMetaAddr ()
String	getMetaFlagsAsString ()
long	getMetaSeq ()
TSK_FS_META_TYPE_ENUM	getMetaType ()
String	getMetaTypeAsString ()
String	getMIMEType ()
String	getModesAsString ()
long	getMtime ()
String	getMtimeAsDate ()
String	getNameExtension ()
Optional< Long >	getOsAccountObjectId ()
Optional< String >	getOwnerUid ()
String	getParentPath ()
List< TskFileRange >	getRanges () throws TskCoreException
String	getSha1Hash ()
String	getSha256Hash ()
long	getSize ()
TskData.TSK_DB_FILES_TYPE_ENUM	getType ()
int	getUid ()
String	getUniquePath () throws TskCoreException
boolean	hasFileSystem ()
boolean	isDir ()
boolean	isDirNameFlagSet (TSK_FS_NAME_FLAG_ENUM flag)
boolean	isFile ()
boolean	isMetaFlagSet (TSK_FS_META_FLAG_ENUM metaFlag)
MimeMatchEnum	isMimeType (SortedSet< String > mimeTypes)
boolean	isModeSet (TskData.TSK_FS_META_MODE_ENUM mode)
abstract boolean	isRoot ()
boolean	isVirtual ()
List< AbstractFile >	listFiles () throws TskCoreException
BlackboardArtifact	newArtifact (int artifactTypeID) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException
final int	read (byte[] buf, long offset, long len) throws TskCoreException
void	save () throws TskCoreException
void	save (CaseDbTransaction transaction) throws TskCoreException
void	setCollected (TskData.CollectedStatus collected)
void	setKnown (TskData.FileKnown knownState)
void	setMd5Hash (String md5Hash)
void	setMIMEType (String mimeType)
void	setSha1Hash (String sha1Hash)
void	setSha256Hash (String sha256Hash)
String	toString (boolean preserveState)
Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean	equals (Object obj)
Score	getAggregateScore () throws TskCoreException
List< AnalysisResult >	getAllAnalysisResults () throws TskCoreException
ArrayList< BlackboardArtifact >	getAllArtifacts () throws TskCoreException
long	getAllArtifactsCount () throws TskCoreException
List< DataArtifact >	getAllDataArtifacts () throws TskCoreException
List< AnalysisResult >	getAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (int artifactTypeID) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (String artifactTypeName) throws TskCoreException
long	getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException
long	getArtifactsCount (int artifactTypeID) throws TskCoreException
long	getArtifactsCount (String artifactTypeName) throws TskCoreException
List< Content >	getChildren () throws TskCoreException
int	getChildrenCount () throws TskCoreException
List< Long >	getChildrenIds () throws TskCoreException
BlackboardArtifact	getGenInfoArtifact () throws TskCoreException
BlackboardArtifact	getGenInfoArtifact (boolean create) throws TskCoreException
ArrayList< BlackboardAttribute >	getGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException
Set< String >	getHashSetNames () throws TskCoreException
long	getId ()
String	getName ()
Content	getParent () throws TskCoreException
Optional< Long >	getParentId () throws TskCoreException
SleuthkitCase	getSleuthkitCase ()
boolean	hasChildren () throws TskCoreException
int	hashCode ()
AnalysisResultAdded	newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException
AnalysisResultAdded	newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException
BlackboardArtifact	newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException
String	toString ()
Public Member Functions inherited from org.sleuthkit.datamodel.Content
public< T > T	accept (ContentVisitor< T > v)
long	getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
ArrayList< BlackboardAttribute >	getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException
Public Member Functions inherited from org.sleuthkit.datamodel.SleuthkitVisitableItem
public< T > T	accept (SleuthkitItemVisitor< T > v)

Static Public Member Functions
static String	createNonUniquePath (String uniquePath)
static String	epochToTime (long epoch)
static String	epochToTime (long epoch, TimeZone tzone)
static long	timeToEpoch (String time)

Protected Member Functions
void	finalize () throws Throwable
int	readInt (byte[] buf, long offset, long len) throws TskCoreException
final int	readLocal (byte[] buf, long offset, long len) throws TskCoreException
void	setLocalPath (String localPath, boolean isAbsolute)
Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
	AbstractContent (SleuthkitCase db, long obj_id, String name)

Protected Attributes
final long	atime
final int	attrId
final TskData.TSK_FS_ATTR_TYPE_ENUM	attrType
final long	crtime
final long	ctime
TSK_FS_NAME_FLAG_ENUM	dirFlag
final TSK_FS_NAME_TYPE_ENUM	dirType
final Long	fileSystemObjectId
final TskData.TSK_DB_FILES_TYPE_ENUM	fileType
final int	gid
TskData.FileKnown	knownState
String	md5Hash
final long	metaAddr
Set< TSK_FS_META_FLAG_ENUM >	metaFlags
final int	metaSeq
final TSK_FS_META_TYPE_ENUM	metaType
final Set< TskData.TSK_FS_META_MODE_ENUM >	modes
final long	mtime
final String	parentPath
String	sha1Hash
String	sha256Hash
long	size
final int	uid
Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long	parentId

Additional Inherited Members
Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long	UNKNOWN_ID = -1

Detailed Description

An abstract base class for classes that represent files that have been added to the case.

Definition at line 53 of file AbstractFile.java.

Member Function Documentation

◆ addAttributes()

void org.sleuthkit.datamodel.AbstractFile.addAttributes	(	Collection< Attribute >	attributes,
		final SleuthkitCase.CaseDbTransaction	caseDbTransaction ) throws TskCoreException

Adds a collection of attributes to this file in a single operation within a transaction supplied by the caller.

Parameters

attributes	The collection of attributes.
caseDbTransaction	The transaction in the scope of which the operation is to be performed, managed by the caller. if Null is passed in a local transaction will be created and used.

Exceptions

TskCoreException If an error occurs and the attributes were not added to the artifact.

Definition at line 623 of file AbstractFile.java.

References org.sleuthkit.datamodel.SleuthkitCase.beginTransaction(), org.sleuthkit.datamodel.AbstractContent.getId(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ canRead()

boolean org.sleuthkit.datamodel.AbstractFile.canRead ( )

Check if the file exists and is readable. If non-local (e.g. within an image) or file is marked with YES_REPO and there is a content provider, always true, if local, checks if actual local path exists and is readable

Returns: true if the file is readable

Definition at line 1330 of file AbstractFile.java.

◆ close()

void org.sleuthkit.datamodel.AbstractFile.close ( )

Free native resources after read is done on the Content object. After closing, read can be called again on the same Content object, which should result in re-opening of new native resources.

Implements org.sleuthkit.datamodel.Content.

Reimplemented in org.sleuthkit.datamodel.FsContent, org.sleuthkit.datamodel.LayoutFile, and org.sleuthkit.datamodel.SpecialDirectory.

Definition at line 1369 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractContent.getName(), and getParentPath().

Referenced by finalize(), and org.sleuthkit.datamodel.DerivedFile.finalize().

◆ convertToImgOffset()

long org.sleuthkit.datamodel.AbstractFile.convertToImgOffset ( long fileOffset ) throws TskCoreException

Convert an internal offset to an image offset

Parameters

fileOffset the byte offset in this layout file to map

Returns: the corresponding byte offset in the image where the file offset is located, or -1 if the file has no range layout information or if the fileOffset is larger than file size

Exceptions

TskCoreException exception thrown if critical error occurred within tsk core and offset could not be converted

Definition at line 796 of file AbstractFile.java.

References getRanges().

◆ convertToImgRanges()

List< TskFileRange > org.sleuthkit.datamodel.AbstractFile.convertToImgRanges	(	long	fileOffset,
		long	length ) throws TskCoreException

Converts a file offset and length into a series of TskFileRange objects whose offsets are relative to the image. This method will only work on files with layout ranges.

Parameters

fileOffset	The byte offset in this file to map.
length	The length of bytes starting at fileOffset requested.

Returns: The TskFileRange objects whose offsets are relative to the image. The sum total of lengths in these ranges will equal the length requested or will run until the end of this file.

Exceptions

TskCoreException

Definition at line 829 of file AbstractFile.java.

References org.sleuthkit.datamodel.TskFileRange.getByteLen(), org.sleuthkit.datamodel.TskFileRange.getByteStart(), and getRanges().

◆ countChildrenOfType()

int org.sleuthkit.datamodel.AbstractFile.countChildrenOfType ( List< TSK_FS_NAME_TYPE_ENUM > types ) throws TskCoreException

Count of Abstract File's children of specified types. The types are instances of TskData.TSK_FS_NAME_TYPE_ENUM types and the matching is performed against the tsk_files.dir_type column. Some usage examples are to get a count of all subdirectories, which requires searching for all children of types TskData.TSK_FS_NAME_TYPE_ENUM.DIR "OR" TskData.TSK_FS_NAME_TYPE_ENUM.VIRT_DIR.

Parameters

types List of TskData.TSK_FS_NAME_TYPE_ENUM types.

Returns: Total count of children of the specified types.

Exceptions

org.sleuthkit.datamodel.TskCoreException exception thrown if a critical error occurs within tsk core

Definition at line 930 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ createNonUniquePath()

String org.sleuthkit.datamodel.AbstractFile.createNonUniquePath ( String uniquePath )

static

Parameters

uniquePath the unique path to an AbstractFile (or subclass) usually obtained by a call to AbstractFile.getUniquePath.

Returns: the path to to an AbstractFile (or subclass) with the image and volume path segments removed.

Definition at line 949 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.SleuthkitCase.openFiles().

◆ epochToTime() [1/2]

String org.sleuthkit.datamodel.AbstractFile.epochToTime ( long epoch )

static

Return the epoch into string in ISO 8601 dateTime format

Parameters

epoch time in seconds

Returns: formatted date time string as "yyyy-MM-dd HH:mm:ss"

Deprecated

Definition at line 1745 of file AbstractFile.java.

References org.sleuthkit.datamodel.TimeUtilities.epochToTime().

Referenced by getAtimeAsDate(), getCrtimeAsDate(), getCtimeAsDate(), and getMtimeAsDate().

◆ epochToTime() [2/2]

String org.sleuthkit.datamodel.AbstractFile.epochToTime	(	long	epoch,
		TimeZone	tzone )

static

Return the epoch into string in ISO 8601 dateTime format, in the given timezone

Parameters

epoch	time in seconds
tzone	time zone

Returns: formatted date time string as "yyyy-MM-dd HH:mm:ss"

Deprecated

Definition at line 1761 of file AbstractFile.java.

References org.sleuthkit.datamodel.TimeUtilities.epochToTime().

◆ exists()

boolean org.sleuthkit.datamodel.AbstractFile.exists ( )

Check if the file exists. If non-local or file is marked with YES_REPO and there is a content provider always true, if local, checks if actual local path exists

Returns: true if the file exists, false otherwise

Definition at line 1309 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Image.imageFileExists().

◆ finalize()

void org.sleuthkit.datamodel.AbstractFile.finalize ( ) throws Throwable

protected

Reimplemented in org.sleuthkit.datamodel.DerivedFile, and org.sleuthkit.datamodel.FsContent.

Definition at line 1389 of file AbstractFile.java.

References close().

◆ getAtime()

long org.sleuthkit.datamodel.AbstractFile.getAtime ( )

Get the access time

Returns: access time

Definition at line 314 of file AbstractFile.java.

References atime.

◆ getAtimeAsDate()

String org.sleuthkit.datamodel.AbstractFile.getAtimeAsDate ( )

Get the access time as Date (in local timezone)

Returns: access time as Date

Definition at line 323 of file AbstractFile.java.

References atime, and epochToTime().

◆ getAttributeId()

int org.sleuthkit.datamodel.AbstractFile.getAttributeId ( )

Get the attribute id

Returns: attribute id

Definition at line 269 of file AbstractFile.java.

References attrId.

◆ getAttributes()

List< Attribute > org.sleuthkit.datamodel.AbstractFile.getAttributes ( ) throws TskCoreException

Gets the attributes of this File

Returns

Exceptions

TskCoreException

Definition at line 598 of file AbstractFile.java.

References org.sleuthkit.datamodel.SleuthkitCase.getBlackboard(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

◆ getAttrId()

short org.sleuthkit.datamodel.AbstractFile.getAttrId ( )

Get the attribute id

Returns: attribute id

Deprecated: Use getAttributeId() method instead as it returns integer instead of short.

Definition at line 1701 of file AbstractFile.java.

References attrId, and getAttrId().

Referenced by getAttrId().

◆ getAttrType()

TskData.TSK_FS_ATTR_TYPE_ENUM org.sleuthkit.datamodel.AbstractFile.getAttrType ( )

Get the attribute type

Returns: attribute type

Definition at line 260 of file AbstractFile.java.

References attrType.

◆ getCollected()

TskData.CollectedStatus org.sleuthkit.datamodel.AbstractFile.getCollected ( )

Gets the collected status of the file data.

Returns: The collected.

Definition at line 752 of file AbstractFile.java.

Referenced by save().

◆ getCrtime()

long org.sleuthkit.datamodel.AbstractFile.getCrtime ( )

Get the creation time

Returns: creation time

Definition at line 296 of file AbstractFile.java.

References crtime.

◆ getCrtimeAsDate()

String org.sleuthkit.datamodel.AbstractFile.getCrtimeAsDate ( )

Get the creation time as Date (in local timezone)

Returns: creation time as Date

Definition at line 305 of file AbstractFile.java.

References crtime, and epochToTime().

◆ getCtime()

long org.sleuthkit.datamodel.AbstractFile.getCtime ( )

Get the change time

Returns: change time

Definition at line 278 of file AbstractFile.java.

References ctime.

◆ getCtimeAsDate()

String org.sleuthkit.datamodel.AbstractFile.getCtimeAsDate ( )

Get the change time as Date (in local timezone)

Returns: change time as Date

Definition at line 287 of file AbstractFile.java.

References ctime, and epochToTime().

◆ getDataSource()

Content org.sleuthkit.datamodel.AbstractFile.getDataSource ( ) throws TskCoreException

Gets the data source for this file.

Returns: The data source.

Exceptions

TskCoreException if there was an error querying the case database.

To obtain the data source as a DataSource object, use: getSleuthkitCase().getDataSource(getDataSourceObjectId());

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Reimplemented in org.sleuthkit.datamodel.FsContent, and org.sleuthkit.datamodel.VirtualDirectory.

Definition at line 734 of file AbstractFile.java.

References org.sleuthkit.datamodel.SleuthkitCase.getContentById(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by getUniquePath(), and org.sleuthkit.datamodel.LayoutFile.readInt().

◆ getDataSourceObjectId()

long org.sleuthkit.datamodel.AbstractFile.getDataSourceObjectId ( )

Gets the object id of the data source for this file.

Returns: The object id of the data source.

Definition at line 743 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.SleuthkitCase.addCarvedFiles(), org.sleuthkit.datamodel.SleuthkitCase.addLocalFile(), org.sleuthkit.datamodel.VirtualDirectory.getDataSource(), and org.sleuthkit.datamodel.SpecialDirectory.isDataSource().

◆ getDirFlagAsString()

String org.sleuthkit.datamodel.AbstractFile.getDirFlagAsString ( )

Returns: a string representation of the directory name flag (type TSK_FS_NAME_FLAG_ENUM)

Definition at line 1035 of file AbstractFile.java.

References dirFlag.

◆ getDirType()

TSK_FS_NAME_TYPE_ENUM org.sleuthkit.datamodel.AbstractFile.getDirType ( )

Get the directory type id

Returns: directory type id

Definition at line 1014 of file AbstractFile.java.

References dirType.

◆ getDirTypeAsString()

String org.sleuthkit.datamodel.AbstractFile.getDirTypeAsString ( )

Definition at line 1018 of file AbstractFile.java.

References dirType.

◆ getFileSystem()

FileSystem org.sleuthkit.datamodel.AbstractFile.getFileSystem ( ) throws TskCoreException

Gets the parent file system of this file or directory. If the AbstractFile object is not FsContent, hasFileSystem() should be called before this method to ensure the file belongs to a file system.

Returns: The file system object of the parent.

Exceptions

org.sleuthkit.datamodel.TskCoreException If the file does not belong to a file system or another error occurs.

Definition at line 1591 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractContent.AbstractContent(), fileSystemObjectId, org.sleuthkit.datamodel.AbstractContent.getId(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.FsContent.getDataSource(), getUniquePath(), and org.sleuthkit.datamodel.FsContent.isRoot().

◆ getFileSystemObjectId()

Optional< Long > org.sleuthkit.datamodel.AbstractFile.getFileSystemObjectId ( )

Get the object id of the parent file system of this file or directory if it exists.

Returns: The parent file system id.

Definition at line 1567 of file AbstractFile.java.

References fileSystemObjectId.

Referenced by org.sleuthkit.datamodel.FsContent.getFileSystemId(), and getUniquePath().

◆ getGid()

int org.sleuthkit.datamodel.AbstractFile.getGid ( )

Get the group id

Returns: group id

Definition at line 359 of file AbstractFile.java.

References gid.

◆ getKnown()

TskData.FileKnown org.sleuthkit.datamodel.AbstractFile.getKnown ( )

Get "knownState" file status - after running a HashDB ingest on it As marked by a knownState file database, such as NSRL

Returns: file knownState status enum value

Definition at line 688 of file AbstractFile.java.

References knownState.

Referenced by save().

◆ getLocalAbsPath()

String org.sleuthkit.datamodel.AbstractFile.getLocalAbsPath ( )

Get local absolute path of the file, if localPath has been set

Returns: local absolute file path if local path has been set, or null

Definition at line 1289 of file AbstractFile.java.

◆ getLocalPath()

String org.sleuthkit.datamodel.AbstractFile.getLocalPath ( )

Get local relative to case db path of the file

Returns: local file path if set

Definition at line 1280 of file AbstractFile.java.

◆ getMd5Hash()

String org.sleuthkit.datamodel.AbstractFile.getMd5Hash ( )

Get the md5 hash value as calculated, if present

Returns: md5 hash string, if it is present or null if it is not

Definition at line 543 of file AbstractFile.java.

Referenced by save().

◆ getMetaAddr()

long org.sleuthkit.datamodel.AbstractFile.getMetaAddr ( )

Get the file meta address

Returns: Address of the meta data structure

Definition at line 368 of file AbstractFile.java.

References metaAddr.

Referenced by org.sleuthkit.datamodel.FsContent.isRoot().

◆ getMetaFlagsAsString()

String org.sleuthkit.datamodel.AbstractFile.getMetaFlagsAsString ( )

Returns: a string representation of the meta flags

Definition at line 1051 of file AbstractFile.java.

References org.sleuthkit.datamodel.TskData.TSK_FS_META_FLAG_ENUM.ALLOC, metaFlags, and org.sleuthkit.datamodel.TskData.TSK_FS_META_FLAG_ENUM.UNALLOC.

◆ getMetaSeq()

long org.sleuthkit.datamodel.AbstractFile.getMetaSeq ( )

Get the file meta address sequence. Only useful with NTFS. Incremented each time a structure is re-allocated.

Returns: Address of the meta data structure sequence.

Definition at line 378 of file AbstractFile.java.

References metaSeq.

◆ getMetaType()

TSK_FS_META_TYPE_ENUM org.sleuthkit.datamodel.AbstractFile.getMetaType ( )

Get the meta data type

Returns: meta data type

Definition at line 1001 of file AbstractFile.java.

References metaType.

◆ getMetaTypeAsString()

String org.sleuthkit.datamodel.AbstractFile.getMetaTypeAsString ( )

Definition at line 1005 of file AbstractFile.java.

References metaType.

◆ getMIMEType()

String org.sleuthkit.datamodel.AbstractFile.getMIMEType ( )

Gets the MIME type of this file.

Returns: The MIME type name or null if the MIME type has not been set.

Definition at line 504 of file AbstractFile.java.

Referenced by save().

◆ getModesAsString()

String org.sleuthkit.datamodel.AbstractFile.getModesAsString ( )

Get the file's mode as a user-displayable string

Returns: formatted user-displayable string for mode

Definition at line 387 of file AbstractFile.java.

◆ getMtime()

long org.sleuthkit.datamodel.AbstractFile.getMtime ( )

Get the modified time

Returns: modified time

Definition at line 332 of file AbstractFile.java.

References mtime.

◆ getMtimeAsDate()

String org.sleuthkit.datamodel.AbstractFile.getMtimeAsDate ( )

Get the modified time as Date (in local timezone)

Returns: modified time as Date

Definition at line 341 of file AbstractFile.java.

References epochToTime(), and mtime.

◆ getNameExtension()

String org.sleuthkit.datamodel.AbstractFile.getNameExtension ( )

Get the extension part of the filename, if there is one. We assume that extensions only have ASCII alphanumeric chars

Returns: The filename extension in lowercase (not including the period) or empty string if there is no extension

Definition at line 699 of file AbstractFile.java.

◆ getOsAccountObjectId()

Optional< Long > org.sleuthkit.datamodel.AbstractFile.getOsAccountObjectId ( )

Get the Object Id of the owner account.

Returns: Optional with Object Id of the OsAccount, or Optional.empty.

Definition at line 1549 of file AbstractFile.java.

Referenced by newDataArtifact().

◆ getOwnerUid()

Optional< String > org.sleuthkit.datamodel.AbstractFile.getOwnerUid ( )

Get the owner uid.

Note this is a string uid, typically a Windows SID. This is different from the numeric uid commonly found on Unix based file systems.

Returns: Optional with owner uid.

Definition at line 1540 of file AbstractFile.java.

◆ getParentPath()

String org.sleuthkit.datamodel.AbstractFile.getParentPath ( )

Get path of the parent of this file

Returns: path string of the parent

Definition at line 718 of file AbstractFile.java.

References parentPath.

Referenced by org.sleuthkit.datamodel.blackboardutils.attributes.MessageAttachments.FileAttachment.FileAttachment(), org.sleuthkit.datamodel.SleuthkitCase.addFileSystemFile(), org.sleuthkit.datamodel.SleuthkitCase.addLocalDirectory(), org.sleuthkit.datamodel.SleuthkitCase.addLocalFile(), and close().

◆ getRanges()

List< TskFileRange > org.sleuthkit.datamodel.AbstractFile.getRanges ( ) throws TskCoreException

Gets file ranges associated with the file. File ranges are objects in tsk_file_layout table Any file type (especially unallocated) may have 1 or more block ranges associated with it

Returns: list of file layout ranges

Exceptions

TskCoreException exception thrown if critical error occurred within tsk core

Reimplemented in org.sleuthkit.datamodel.LocalFile, and org.sleuthkit.datamodel.SpecialDirectory.

Definition at line 776 of file AbstractFile.java.

References org.sleuthkit.datamodel.SleuthkitCase.getFileRanges(), org.sleuthkit.datamodel.AbstractContent.getId(), and org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by convertToImgOffset(), convertToImgRanges(), org.sleuthkit.datamodel.LayoutFile.getNumParts(), and org.sleuthkit.datamodel.LayoutFile.readInt().

◆ getSha1Hash()

String org.sleuthkit.datamodel.AbstractFile.getSha1Hash ( )

Get the SHA-1 hash value as calculated, if present

Returns: SHA-1 hash string, if it is present or null if it is not

Definition at line 587 of file AbstractFile.java.

Referenced by save().

◆ getSha256Hash()

String org.sleuthkit.datamodel.AbstractFile.getSha256Hash ( )

Get the SHA-256 hash value as calculated, if present

Returns: SHA-256 hash string, if it is present or null if it is not

Definition at line 565 of file AbstractFile.java.

Referenced by save().

◆ getSize()

long org.sleuthkit.datamodel.AbstractFile.getSize ( )

Get size of the file

Returns: file size in bytes

Implements org.sleuthkit.datamodel.Content.

Definition at line 709 of file AbstractFile.java.

References size.

Referenced by readLocal().

◆ getType()

TskData.TSK_DB_FILES_TYPE_ENUM org.sleuthkit.datamodel.AbstractFile.getType ( )

Gets type of the abstract file as defined in TSK_DB_FILES_TYPE_ENUM

Returns: the type of the abstract file

Definition at line 251 of file AbstractFile.java.

References fileType.

Referenced by org.sleuthkit.datamodel.SleuthkitCase.findFilesWhere().

◆ getUid()

int org.sleuthkit.datamodel.AbstractFile.getUid ( )

Get the user id

Returns: user id

Definition at line 350 of file AbstractFile.java.

References uid.

◆ getUniquePath()

String org.sleuthkit.datamodel.AbstractFile.getUniquePath ( ) throws TskCoreException

Get the full path to this file or directory, starting with a "/" and the data source name and then all the other segments in the path.

Returns: A unique path for this object.

Exceptions

TskCoreException if there is an error querying the case database.

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Reimplemented in org.sleuthkit.datamodel.LocalFilesDataSource.

Definition at line 1614 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractContent.equals(), getDataSource(), getFileSystem(), getFileSystemObjectId(), org.sleuthkit.datamodel.AbstractContent.getName(), getUniquePath(), org.sleuthkit.datamodel.Content.getUniquePath(), org.sleuthkit.datamodel.VirtualDirectory.NAME_CARVED, org.sleuthkit.datamodel.VirtualDirectory.NAME_UNALLOC, and parentPath.

Referenced by getUniquePath(), and org.sleuthkit.datamodel.FsContent.toString().

◆ hasFileSystem()

boolean org.sleuthkit.datamodel.AbstractFile.hasFileSystem ( )

Check if this AbstractFile belongs to a file system.

Returns: True if the file belongs to a file system, false otherwise.

Definition at line 1576 of file AbstractFile.java.

References fileSystemObjectId.

◆ isDir()

boolean org.sleuthkit.datamodel.AbstractFile.isDir ( )

Is this object a directory. Should return true for file system folders and virtual folders.

Returns: true if directory, false otherwise

Definition at line 908 of file AbstractFile.java.

References metaType, org.sleuthkit.datamodel.TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR, and org.sleuthkit.datamodel.TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.

Referenced by readLocal().

◆ isDirNameFlagSet()

boolean org.sleuthkit.datamodel.AbstractFile.isDirNameFlagSet ( TSK_FS_NAME_FLAG_ENUM flag )

Parameters

flag	the TSK_FS_NAME_FLAG_ENUM to check

Returns: true if the given flag is set in this FsContent object.

Definition at line 1027 of file AbstractFile.java.

References dirFlag.

◆ isFile()

boolean org.sleuthkit.datamodel.AbstractFile.isFile ( )

Is this object a file. Should return true for all types of files, including file system, logical, derived, layout, and slack space for files.

Returns: true if a file, false otherwise

Definition at line 895 of file AbstractFile.java.

References dirType, metaType, org.sleuthkit.datamodel.TskData.TSK_FS_NAME_TYPE_ENUM.REG, org.sleuthkit.datamodel.TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG, and org.sleuthkit.datamodel.TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_UNDEF.

◆ isMetaFlagSet()

boolean org.sleuthkit.datamodel.AbstractFile.isMetaFlagSet ( TSK_FS_META_FLAG_ENUM metaFlag )

Parameters

metaFlag the TSK_FS_META_FLAG_ENUM to check

Returns: true if the given meta flag is set in this FsContent object.

Definition at line 1066 of file AbstractFile.java.

References metaFlags.

◆ isMimeType()

MimeMatchEnum org.sleuthkit.datamodel.AbstractFile.isMimeType ( SortedSet< String > mimeTypes )

Determines if this file's type is one of the ones passed in. Uses the blackboard attribute for file type.

Parameters

mimeTypes Set of file types to compare against

Returns

Definition at line 1436 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractFile.MimeMatchEnum.FALSE, org.sleuthkit.datamodel.AbstractFile.MimeMatchEnum.TRUE, and org.sleuthkit.datamodel.AbstractFile.MimeMatchEnum.UNDEFINED.

◆ isModeSet()

boolean org.sleuthkit.datamodel.AbstractFile.isModeSet ( TskData.TSK_FS_META_MODE_ENUM mode )

Definition at line 521 of file AbstractFile.java.

References modes.

◆ isRoot()

abstract boolean org.sleuthkit.datamodel.AbstractFile.isRoot ( )

abstract

Is this a root of a file system

Returns: true if root of a file system, false otherwise

Reimplemented in org.sleuthkit.datamodel.DerivedFile, org.sleuthkit.datamodel.FsContent, org.sleuthkit.datamodel.LayoutFile, org.sleuthkit.datamodel.LocalDirectory, org.sleuthkit.datamodel.LocalFile, and org.sleuthkit.datamodel.SpecialDirectory.

◆ isVirtual()

boolean org.sleuthkit.datamodel.AbstractFile.isVirtual ( )

is this a virtual file or directory that was created by The Sleuth Kit or Autopsy for general structure and organization.

Returns: true if it's virtual, false otherwise

Definition at line 882 of file AbstractFile.java.

References dirType, fileType, metaType, org.sleuthkit.datamodel.TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT, org.sleuthkit.datamodel.TskData.TSK_FS_NAME_TYPE_ENUM.VIRT, and org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.

◆ listFiles()

List< AbstractFile > org.sleuthkit.datamodel.AbstractFile.listFiles ( ) throws TskCoreException

Returns: a list of AbstractFiles that are the children of this Directory. Only returns children of type TskData.TSK_DB_FILES_TYPE_ENUM.FS.

Exceptions

org.sleuthkit.datamodel.TskCoreException

Definition at line 981 of file AbstractFile.java.

References org.sleuthkit.datamodel.AbstractContent.getChildren().

◆ newArtifact()

BlackboardArtifact org.sleuthkit.datamodel.AbstractFile.newArtifact ( int artifactTypeID ) throws TskCoreException

Create and add an artifact associated with this content to the blackboard

Parameters

artifactTypeID id of the artifact type (if the id doesn't already exist an exception will be thrown)

Returns: the blackboard artifact created (the artifact type id can be looked up from this)

Exceptions

TskCoreException if critical error occurred within tsk core

Deprecated: Please use newDataArtifact or newAnalysisResult.

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Definition at line 1669 of file AbstractFile.java.

◆ newDataArtifact()

DataArtifact org.sleuthkit.datamodel.AbstractFile.newDataArtifact	(	BlackboardArtifact.Type	artifactType,
		Collection< BlackboardAttribute >	attributesList ) throws TskCoreException

Create and add a data artifact associated with this abstract file. This method creates the data artifact with the os account id associated with this abstract file if one exists.

Parameters

artifactType	Type of data artifact to create.
attributesList	Additional attributes to attach to this data artifact.

Returns: DataArtifact New data artifact.

Exceptions

TskCoreException If a critical error occurred within tsk core.

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Definition at line 1687 of file AbstractFile.java.

References getOsAccountObjectId().

◆ read()

final int org.sleuthkit.datamodel.AbstractFile.read	(	byte[]	buf,
		long	offset,
		long	len ) throws TskCoreException

Reads data that this content object is associated with (file contents, volume contents, etc.).

Parameters

buf	a character array of data (in bytes) to copy read data to
offset	byte offset in the content to start reading from
len	number of bytes to read into buf.

Returns: num of bytes read, or -1 on error

Exceptions

TskCoreException if critical error occurred during read in the tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 1131 of file AbstractFile.java.

References org.sleuthkit.datamodel.ContentProviderStream.read(), readInt(), and readLocal().

◆ readInt()

int org.sleuthkit.datamodel.AbstractFile.readInt	(	byte[]	buf,
		long	offset,
		long	len ) throws TskCoreException

protected

Internal custom read (non-local) method that child classes can implement

Parameters

buf	buffer to read into
offset	start reading position in the file
len	number of bytes to read

Returns: number of bytes read

Exceptions

TskCoreException exception thrown when file could not be read

Reimplemented in org.sleuthkit.datamodel.FsContent, org.sleuthkit.datamodel.LayoutFile, and org.sleuthkit.datamodel.SlackFile.

Definition at line 1156 of file AbstractFile.java.

Referenced by read().

◆ readLocal()

final int org.sleuthkit.datamodel.AbstractFile.readLocal	(	byte[]	buf,
		long	offset,
		long	len ) throws TskCoreException

protected

Local file path read support

Parameters

buf	buffer to read into
offset	start reading position in the file
len	number of bytes to read

Returns: number of bytes read

Exceptions

TskCoreException exception thrown when file could not be read

Definition at line 1171 of file AbstractFile.java.

References getSize(), isDir(), and org.sleuthkit.datamodel.TskData.EncodingType.NONE.

Referenced by read().

◆ save() [1/2]

void org.sleuthkit.datamodel.AbstractFile.save ( ) throws TskCoreException

Saves the editable properties of this file to the case database, e.g., the MIME type, MD5 hash, and known state.

Exceptions

TskCoreException if there is an error saving the editable file properties to the case database.

Definition at line 1453 of file AbstractFile.java.

References org.sleuthkit.datamodel.SleuthkitCase.beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback(), and save().

Referenced by save().

◆ save() [2/2]

void org.sleuthkit.datamodel.AbstractFile.save ( CaseDbTransaction transaction ) throws TskCoreException

Saves the editable properties of this file to the case database, e.g., the MIME type, MD5 hash, and known state, in the context of a given case database transaction.

Parameters

transaction The transaction.

Exceptions

TskCoreException if there is an error saving the editable file properties to the case database.

Definition at line 1477 of file AbstractFile.java.

References getCollected(), org.sleuthkit.datamodel.AbstractContent.getId(), getKnown(), getMd5Hash(), getMIMEType(), org.sleuthkit.datamodel.AbstractContent.getName(), getSha1Hash(), and getSha256Hash().

◆ setCollected()

void org.sleuthkit.datamodel.AbstractFile.setCollected ( TskData.CollectedStatus collected )

Sets the collected status of the file data.

Parameters

collected The file data's collected status

Definition at line 761 of file AbstractFile.java.

◆ setKnown()

void org.sleuthkit.datamodel.AbstractFile.setKnown ( TskData.FileKnown knownState )

Sets the known state for this file. Passed in value will be ignored if it is "less" than the current state. A NOTABLE file cannot be downgraded to KNOWN.

IMPORTANT: The known state is set for this AbstractFile object, but it is not saved to the case database until AbstractFile.save is called.

Parameters

knownState The known state of the file.

Definition at line 671 of file AbstractFile.java.

References knownState.

◆ setLocalPath()

void org.sleuthkit.datamodel.AbstractFile.setLocalPath	(	String	localPath,
		boolean	isAbsolute )

protected

Set local path for the file, as stored in db tsk_files_path, relative to the case db path or an absolute path. When set, subsequent invocations of read() will read the file in the local path.

Parameters

localPath	local path to be set
isAbsolute	true if the path is absolute, false if relative to the case db

Deprecated: Do not make subclasses outside of this package.

Definition at line 1726 of file AbstractFile.java.

◆ setMd5Hash()

void org.sleuthkit.datamodel.AbstractFile.setMd5Hash ( String md5Hash )

Sets the MD5 hash for this file.

IMPORTANT: The MD5 hash is set for this AbstractFile object, but it is not saved to the case database until AbstractFile.save is called.

Parameters

md5Hash The MD5 hash of the file.

Definition at line 533 of file AbstractFile.java.

References md5Hash.

◆ setMIMEType()

void org.sleuthkit.datamodel.AbstractFile.setMIMEType ( String mimeType )

Sets the MIME type for this file.

IMPORTANT: The MIME type is set for this AbstractFile object, but it is not saved to the case database until AbstractFile.save is called.

Parameters

mimeType The MIME type of this file.

Definition at line 516 of file AbstractFile.java.

◆ setSha1Hash()

void org.sleuthkit.datamodel.AbstractFile.setSha1Hash ( String sha1Hash )

Sets the SHA-1 hash for this file.

IMPORTANT: The SHA-1 hash is set for this AbstractFile object, but it is not saved to the case database until AbstractFile.save is called.

Parameters

sha1Hash The SHA-1 hash of the file.

Definition at line 577 of file AbstractFile.java.

References sha1Hash.

◆ setSha256Hash()

void org.sleuthkit.datamodel.AbstractFile.setSha256Hash ( String sha256Hash )

Sets the SHA-256 hash for this file.

IMPORTANT: The SHA-256 hash is set for this AbstractFile object, but it is not saved to the case database until AbstractFile.save is called.

Parameters

sha256Hash The SHA-256 hash of the file.

Definition at line 555 of file AbstractFile.java.

References sha256Hash.

◆ timeToEpoch()

long org.sleuthkit.datamodel.AbstractFile.timeToEpoch ( String time )

static

Convert from ISO 8601 formatted date time string to epoch time in seconds

Parameters

time	formatted date time string as "yyyy-MM-dd HH:mm:ss"

Returns: epoch time in seconds

Definition at line 1773 of file AbstractFile.java.

References org.sleuthkit.datamodel.TimeUtilities.timeToEpoch().

◆ toString()

String org.sleuthkit.datamodel.AbstractFile.toString ( boolean preserveState )

Reimplemented from org.sleuthkit.datamodel.AbstractContent.

Reimplemented in org.sleuthkit.datamodel.DerivedFile, org.sleuthkit.datamodel.Directory, org.sleuthkit.datamodel.File, org.sleuthkit.datamodel.FsContent, org.sleuthkit.datamodel.LayoutFile, org.sleuthkit.datamodel.LocalDirectory, org.sleuthkit.datamodel.LocalFile, org.sleuthkit.datamodel.SlackFile, and org.sleuthkit.datamodel.VirtualDirectory.

Definition at line 1398 of file AbstractFile.java.

References atime, attrId, attrType, crtime, ctime, dirFlag, dirType, fileType, gid, knownState, md5Hash, metaAddr, metaFlags, metaSeq, metaType, modes, mtime, parentPath, sha1Hash, sha256Hash, size, and uid.

Member Data Documentation

◆ atime

final long org.sleuthkit.datamodel.AbstractFile.atime

protected

Definition at line 62 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), getAtime(), getAtimeAsDate(), and toString().

◆ attrId

final int org.sleuthkit.datamodel.AbstractFile.attrId

protected

Definition at line 65 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), getAttributeId(), getAttrId(), and toString().

◆ attrType

final TskData.TSK_FS_ATTR_TYPE_ENUM org.sleuthkit.datamodel.AbstractFile.attrType

protected

Definition at line 66 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), getAttrType(), and toString().

◆ crtime

final long org.sleuthkit.datamodel.AbstractFile.crtime

protected

Definition at line 62 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), getCrtime(), getCrtimeAsDate(), and toString().

◆ ctime

final long org.sleuthkit.datamodel.AbstractFile.ctime

protected

Definition at line 62 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), getCtime(), getCtimeAsDate(), and toString().

◆ dirFlag

TSK_FS_NAME_FLAG_ENUM org.sleuthkit.datamodel.AbstractFile.dirFlag

protected

Definition at line 58 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), getDirFlagAsString(), isDirNameFlagSet(), and toString().

◆ dirType

final TSK_FS_NAME_TYPE_ENUM org.sleuthkit.datamodel.AbstractFile.dirType

protected

Definition at line 56 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), getDirType(), getDirTypeAsString(), isFile(), isVirtual(), and toString().

◆ fileSystemObjectId

final Long org.sleuthkit.datamodel.AbstractFile.fileSystemObjectId

protected

Definition at line 60 of file AbstractFile.java.

Referenced by getFileSystem(), getFileSystemObjectId(), and hasFileSystem().

◆ fileType

final TskData.TSK_DB_FILES_TYPE_ENUM org.sleuthkit.datamodel.AbstractFile.fileType

protected

Definition at line 55 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), getType(), isVirtual(), and toString().

◆ gid

final int org.sleuthkit.datamodel.AbstractFile.gid

protected

Definition at line 64 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), getGid(), and toString().

◆ knownState

TskData.FileKnown org.sleuthkit.datamodel.AbstractFile.knownState

protected

knownState status in database

Definition at line 84 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), getKnown(), setKnown(), and toString().

◆ md5Hash

String org.sleuthkit.datamodel.AbstractFile.md5Hash

protected

Definition at line 89 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), setMd5Hash(), and toString().

◆ metaAddr

final long org.sleuthkit.datamodel.AbstractFile.metaAddr

protected

Definition at line 62 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), getMetaAddr(), org.sleuthkit.datamodel.FsContent.getMetaDataText(), and toString().

◆ metaFlags

Set<TSK_FS_META_FLAG_ENUM> org.sleuthkit.datamodel.AbstractFile.metaFlags

protected

Definition at line 59 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), getMetaFlagsAsString(), isMetaFlagSet(), and toString().

◆ metaSeq

final int org.sleuthkit.datamodel.AbstractFile.metaSeq

protected

Definition at line 63 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), getMetaSeq(), and toString().

◆ metaType

final TSK_FS_META_TYPE_ENUM org.sleuthkit.datamodel.AbstractFile.metaType

protected

Definition at line 57 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), getMetaType(), getMetaTypeAsString(), getModesAsString(), isDir(), isFile(), isVirtual(), and toString().

◆ modes

final Set<TskData.TSK_FS_META_MODE_ENUM> org.sleuthkit.datamodel.AbstractFile.modes

protected

Definition at line 67 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), getModesAsString(), isModeSet(), and toString().

◆ mtime

final long org.sleuthkit.datamodel.AbstractFile.mtime

protected

Definition at line 62 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), getMtime(), getMtimeAsDate(), and toString().

◆ parentPath

final String org.sleuthkit.datamodel.AbstractFile.parentPath

protected

Definition at line 80 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), getParentPath(), getUniquePath(), and toString().

◆ sha1Hash

String org.sleuthkit.datamodel.AbstractFile.sha1Hash

protected

Definition at line 100 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), setSha1Hash(), and toString().

◆ sha256Hash

String org.sleuthkit.datamodel.AbstractFile.sha256Hash

protected

Definition at line 94 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.LocalFilesDataSource.LocalFilesDataSource(), setSha256Hash(), and toString().

◆ size

long org.sleuthkit.datamodel.AbstractFile.size

protected

Definition at line 61 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), org.sleuthkit.datamodel.LocalFile.LocalFile(), getSize(), org.sleuthkit.datamodel.FsContent.readInt(), org.sleuthkit.datamodel.LayoutFile.readInt(), org.sleuthkit.datamodel.SlackFile.readInt(), and toString().

◆ uid

final int org.sleuthkit.datamodel.AbstractFile.uid

protected

Definition at line 64 of file AbstractFile.java.

Referenced by org.sleuthkit.datamodel.Directory.Directory(), org.sleuthkit.datamodel.File.File(), getUid(), and toString().

The documentation for this class was generated from the following file:

/home/carriersleuth/repos/sleuthkit/bindings/java/src/org/sleuthkit/datamodel/AbstractFile.java

Classes

Public Member Functions

Static Public Member Functions

Protected Member Functions

Protected Attributes

Additional Inherited Members

Detailed Description

Member Function Documentation

◆ addAttributes()

◆ canRead()

◆ close()

◆ convertToImgOffset()

◆ convertToImgRanges()

◆ countChildrenOfType()

◆ createNonUniquePath()

◆ epochToTime() [1/2]

◆ epochToTime() [2/2]

◆ exists()

◆ finalize()

◆ getAtime()

◆ getAtimeAsDate()

◆ getAttributeId()

◆ getAttributes()

◆ getAttrId()

◆ getAttrType()

◆ getCollected()

◆ getCrtime()

◆ getCrtimeAsDate()

◆ getCtime()

◆ getCtimeAsDate()

◆ getDataSource()

◆ getDataSourceObjectId()

◆ getDirFlagAsString()

◆ getDirType()

◆ getDirTypeAsString()

◆ getFileSystem()

◆ getFileSystemObjectId()

◆ getGid()

◆ getKnown()

◆ getLocalAbsPath()

◆ getLocalPath()

◆ getMd5Hash()

◆ getMetaAddr()

◆ getMetaFlagsAsString()

◆ getMetaSeq()

◆ getMetaType()

◆ getMetaTypeAsString()

◆ getMIMEType()

◆ getModesAsString()

◆ getMtime()

◆ getMtimeAsDate()

◆ getNameExtension()

◆ getOsAccountObjectId()

◆ getOwnerUid()

◆ getParentPath()

◆ getRanges()

◆ getSha1Hash()

◆ getSha256Hash()

◆ getSize()

◆ getType()

◆ getUid()

◆ getUniquePath()

◆ hasFileSystem()

◆ isDir()

◆ isDirNameFlagSet()

◆ isFile()

◆ isMetaFlagSet()

◆ isMimeType()

◆ isModeSet()

◆ isRoot()

◆ isVirtual()

◆ listFiles()

◆ newArtifact()

◆ newDataArtifact()

◆ read()

◆ readInt()

◆ readLocal()

◆ save() [1/2]

◆ save() [2/2]

◆ setCollected()