Sleuth Kit Java Bindings (JNI): org.sleuthkit.datamodel.SleuthkitCase Class Reference

Deprecated: User TaggingManager.addArtifactTag instead.

Definition at line 12591 of file SleuthkitCase.java.

◆ addBlackboardArtifactType()

BlackboardArtifact.Type org.sleuthkit.datamodel.SleuthkitCase.addBlackboardArtifactType	(	String	artifactTypeName,
		String	displayName ) throws TskCoreException, TskDataException

Add an artifact type with the given name. Will return an artifact Type.

This assumes that the artifact type being added has the category DATA_ARTIFACT.

Parameters

artifactTypeName	System (unique) name of artifact
displayName	Display (non-unique) name of artifact

Returns: Type of the artifact added

Exceptions

TskCoreException	exception thrown if a critical error occurs
TskDataException	exception thrown if given data is already in db within tsk core

Deprecated: Use Blackboard.getOrAddArtifactType() instead.

Definition at line 5245 of file SleuthkitCase.java.

References addBlackboardArtifactType(), and org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT.

Referenced by addArtifactType(), and addBlackboardArtifactType().

◆ addBlackboardAttribute()

void org.sleuthkit.datamodel.SleuthkitCase.addBlackboardAttribute	(	BlackboardAttribute	attr,
		int	artifactTypeId ) throws TskCoreException

Add a blackboard attribute.

Parameters

attr	A blackboard attribute.
artifactTypeId	The type of artifact associated with the attribute.

Exceptions

TskCoreException thrown if a critical error occurs.

Definition at line 4917 of file SleuthkitCase.java.

References acquireSingleUserCaseWriteLock(), and releaseSingleUserCaseWriteLock().

Referenced by org.sleuthkit.datamodel.BlackboardArtifact.addAttribute().

◆ addBlackboardAttributes()

void org.sleuthkit.datamodel.SleuthkitCase.addBlackboardAttributes	(	Collection< BlackboardAttribute >	attributes,
		int	artifactTypeId ) throws TskCoreException

Add a set blackboard attributes.

Parameters

attributes	A set of blackboard attribute.
artifactTypeId	The type of artifact associated with the attributes.

Exceptions

TskCoreException thrown if a critical error occurs.

Definition at line 4937 of file SleuthkitCase.java.

References acquireSingleUserCaseWriteLock(), and releaseSingleUserCaseWriteLock().

Referenced by org.sleuthkit.datamodel.BlackboardArtifact.addAttributes().

◆ addCarvedFile()

LayoutFile org.sleuthkit.datamodel.SleuthkitCase.addCarvedFile	(	String	carvedFileName,
		long	carvedFileSize,
		long	containerId,
		List< TskFileRange >	data ) throws TskCoreException

Adds a carved file to the VirtualDirectory '$CarvedFiles' in the volume or image given by systemId. Creates $CarvedFiles virtual directory if it does not exist already.

Parameters

carvedFileName	the name of the carved file to add
carvedFileSize	the size of the carved file to add
containerId	the ID of the parent volume, file system, or image
data	the layout information - a list of offsets that make up this carved file.

Returns: A LayoutFile object representing the carved file.

Exceptions

Deprecated: Use addCarvedFile(CarvingResult) instead

Definition at line 15269 of file SleuthkitCase.java.

References addCarvedFiles(), and getContentById().

◆ addCarvedFiles() [1/2]

final List< LayoutFile > org.sleuthkit.datamodel.SleuthkitCase.addCarvedFiles ( CarvingResult carvingResult ) throws TskCoreException

Adds a carving result to the case database.

Parameters

carvingResult The carving result (a set of carved files and their parent) to be added.

Returns: A list of LayoutFile representations of the carved files.

Exceptions

TskCoreException If there is a problem completing a case database operation.

Definition at line 8106 of file SleuthkitCase.java.

Referenced by addCarvedFile(), and addCarvedFiles().

◆ addCarvedFiles() [2/2]

List< LayoutFile > org.sleuthkit.datamodel.SleuthkitCase.addCarvedFiles ( List< CarvedFileContainer > filesToAdd ) throws TskCoreException

Adds a collection of carved files to the VirtualDirectory '$CarvedFiles' in the volume or image given by systemId. Creates $CarvedFiles virtual directory if it does not exist already.

Parameters

filesToAdd A list of CarvedFileContainer files to add as carved files.

Returns: A list of the files added to the database.

Exceptions

Deprecated: Use addCarvedFile(CarvingResult) instead

Definition at line 15299 of file SleuthkitCase.java.

References addCarvedFiles(), getContentById(), and org.sleuthkit.datamodel.Content.getId().

◆ addContentTag()

ContentTag org.sleuthkit.datamodel.SleuthkitCase.addContentTag	(	Content	content,
		TagName	tagName,
		String	comment,
		long	beginByteOffset,
		long	endByteOffset ) throws TskCoreException

Inserts a row into the content_tags table in the case database.

Parameters

content	The content to tag.
tagName	The name to use for the tag.
comment	A comment to store with the tag.
beginByteOffset	Designates the beginning of a tagged section.
endByteOffset	Designates the end of a tagged section.

Returns: A ContentTag data transfer object (DTO) for the new row.

Exceptions

Deprecated: Use TaggingManager.addContentTag

Definition at line 12202 of file SleuthkitCase.java.

◆ addDerivedFile() [1/3]

DerivedFile org.sleuthkit.datamodel.SleuthkitCase.addDerivedFile	(	String	fileName,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		boolean	isFile,
		AbstractFile	parentFile,
		String	rederiveDetails,
		String	toolName,
		String	toolVersion,
		String	otherDetails ) throws TskCoreException

Creates a new derived file object, adds it to database and returns it.

TODO add support for adding derived method

Parameters

fileName	file name the derived file
localPath	local path of the derived file, including the file name. The path is relative to the database path.
size	size of the derived file in bytes
ctime	The changed time of the file.
crtime	The creation time of the file.
atime	The accessed time of the file
mtime	The modified time of the file.
isFile	whether a file or directory, true if a file
parentFile	parent file object (derived or local file)
rederiveDetails	details needed to re-derive file (will be specific to the derivation method), currently unused
toolName	name of derivation method/tool, currently unused
toolVersion	version of derivation method/tool, currently unused
otherDetails	details of derivation method/tool, currently unused

Returns: newly created derived file object

Exceptions

TskCoreException exception thrown if the object creation failed due to a critical system error

Deprecated: Use the newer version with explicit encoding type parameter

Definition at line 15347 of file SleuthkitCase.java.

References addDerivedFile(), and org.sleuthkit.datamodel.TskData.EncodingType.NONE.

◆ addDerivedFile() [2/3]

DerivedFile org.sleuthkit.datamodel.SleuthkitCase.addDerivedFile	(	String	fileName,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		boolean	isFile,
		Content	parentObj,
		String	rederiveDetails,
		String	toolName,
		String	toolVersion,
		String	otherDetails,
		TskData.EncodingType	encodingType ) throws TskCoreException

Creates a new derived file object, adds it to database and returns it.

TODO add support for adding derived method

Parameters

fileName	file name the derived file
localPath	local path of the derived file, including the file name. The path is relative to the database path.
size	size of the derived file in bytes
ctime	The changed time of the file.
crtime	The creation time of the file.
atime	The accessed time of the file
mtime	The modified time of the file.
isFile	whether a file or directory, true if a file
parentObj	parent content object
rederiveDetails	details needed to re-derive file (will be specific to the derivation method), currently unused
toolName	name of derivation method/tool, currently unused
toolVersion	version of derivation method/tool, currently unused
otherDetails	details of derivation method/tool, currently unused
encodingType	Type of encoding used on the file (or NONE if no encoding)

Returns: newly created derived file object

Exceptions

TskCoreException exception thrown if the object creation failed due to a critical system error

Definition at line 8386 of file SleuthkitCase.java.

References addDerivedFile(), beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

Referenced by addDerivedFile(), and addDerivedFile().

◆ addDerivedFile() [3/3]

DerivedFile org.sleuthkit.datamodel.SleuthkitCase.addDerivedFile	(	String	fileName,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		boolean	isFile,
		Content	parentObj,
		String	rederiveDetails,
		String	toolName,
		String	toolVersion,
		String	otherDetails,
		TskData.EncodingType	encodingType,
		CaseDbTransaction	transaction ) throws TskCoreException

Definition at line 8406 of file SleuthkitCase.java.

◆ addErrorObserver()

void org.sleuthkit.datamodel.SleuthkitCase.addErrorObserver ( ErrorObserver observer )

Add an observer for SleuthkitCase errors.

Parameters

observer The observer to add.

Deprecated: Catch exceptions instead.

Definition at line 14805 of file SleuthkitCase.java.

◆ addFileSystem()

FileSystem org.sleuthkit.datamodel.SleuthkitCase.addFileSystem	(	long	parentObjId,
		long	imgOffset,
		TskData.TSK_FS_TYPE_ENUM	type,
		long	blockSize,
		long	blockCount,
		long	rootInum,
		long	firstInum,
		long	lastInum,
		String	displayName,
		CaseDbTransaction	transaction ) throws TskCoreException

Add a FileSystem to the database.

Parameters

parentObjId	Object ID of the file system's parent
imgOffset	Offset in the image
type	Type of file system
blockSize	Block size
blockCount	Block count
rootInum	root inum
firstInum	first inum
lastInum	last inum
displayName	display name
transaction	Case DB transaction

Returns: the newly created FileSystem

Exceptions

Definition at line 7429 of file SleuthkitCase.java.

References org.sleuthkit.datamodel.TskData.ObjectType.FS, and org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.INSERT_FS_INFO.

◆ addFileSystemFile() [1/4]

FsContent org.sleuthkit.datamodel.SleuthkitCase.addFileSystemFile	(	long	dataSourceObjId,
		long	fsObjId,
		String	fileName,
		long	metaAddr,
		int	metaSeq,
		TSK_FS_ATTR_TYPE_ENUM	attrType,
		int	attrId,
		TSK_FS_NAME_FLAG_ENUM	dirFlag,
		short	metaFlags,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		boolean	isFile,
		Content	parent ) throws TskCoreException

Add a file system file.

Parameters

dataSourceObjId	The object id of the root data source of this file.
fsObjId	The file system object id.
fileName	The name of the file.
metaAddr	The meta address of the file.
metaSeq	The meta address sequence of the file.
attrType	The attributed type of the file.
attrId	The attribute id
dirFlag	The allocated status from the name structure
metaFlags
size	The size of the file in bytes.
ctime	The changed time of the file.
crtime	The creation time of the file.
atime	The accessed time of the file
mtime	The modified time of the file.
isFile	True, unless the file is a directory.
parent	The parent of the file (e.g., a virtual directory)

Returns: Newly created file

Exceptions

Definition at line 7490 of file SleuthkitCase.java.

References addFileSystemFile(), beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

Referenced by addFileSystemFile(), addFileSystemFile(), and addFileSystemFile().

◆ addFileSystemFile() [2/4]

FsContent org.sleuthkit.datamodel.SleuthkitCase.addFileSystemFile	(	long	dataSourceObjId,
		long	fsObjId,
		String	fileName,
		long	metaAddr,
		int	metaSeq,
		TSK_FS_ATTR_TYPE_ENUM	attrType,
		int	attrId,
		TSK_FS_NAME_FLAG_ENUM	dirFlag,
		short	metaFlags,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		String	md5Hash,
		String	sha256Hash,
		String	mimeType,
		boolean	isFile,
		Content	parent,
		String	ownerUid,
		OsAccount	osAccount,
		List< Attribute >	fileAttributes,
		CaseDbTransaction	transaction ) throws TskCoreException

Add a file system file.

Parameters

dataSourceObjId	The object id of the root data source of this file.
fsObjId	The file system object id.
fileName	The name of the file.
metaAddr	The meta address of the file.
metaSeq	The meta address sequence of the file.
attrType	The attributed type of the file.
attrId	The attribute id.
dirFlag	The allocated status from the name structure
metaFlags	The allocated status of the file, usually as reported in the metadata structure of the file system.
size	The size of the file in bytes.
ctime	The changed time of the file.
crtime	The creation time of the file.
atime	The accessed time of the file
mtime	The modified time of the file.
md5Hash	The MD5 hash of the file
sha256Hash	The SHA256 hash of the file
mimeType	The MIME type of the file
isFile	True, unless the file is a directory.
parent	The parent of the file (e.g., a virtual directory).
ownerUid	UID of the file owner as found in the file system, can be null.
osAccount	OS account of owner, may be null.
fileAttributes	A list of file attributes. May be empty.
transaction	A caller-managed transaction within which the add file operations are performed.

Returns: Newly created file

Exceptions

Definition at line 7558 of file SleuthkitCase.java.

References addFileSystemFile().

◆ addFileSystemFile() [3/4]

FsContent org.sleuthkit.datamodel.SleuthkitCase.addFileSystemFile	(	long	dataSourceObjId,
		long	fsObjId,
		String	fileName,
		long	metaAddr,
		int	metaSeq,
		TSK_FS_ATTR_TYPE_ENUM	attrType,
		int	attrId,
		TSK_FS_NAME_FLAG_ENUM	dirFlag,
		short	metaFlags,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		String	md5Hash,
		String	sha256Hash,
		String	sha1Hash,
		String	mimeType,
		boolean	isFile,
		Content	parent,
		String	ownerUid,
		OsAccount	osAccount,
		List< Attribute >	fileAttributes,
		CaseDbTransaction	transaction ) throws TskCoreException

Add a file system file.

Parameters

dataSourceObjId	The object id of the root data source of this file.
fsObjId	The file system object id.
fileName	The name of the file.
metaAddr	The meta address of the file.
metaSeq	The meta address sequence of the file.
attrType	The attributed type of the file.
attrId	The attribute id.
dirFlag	The allocated status from the name structure
metaFlags	The allocated status of the file, usually as reported in the metadata structure of the file system.
size	The size of the file in bytes.
ctime	The changed time of the file.
crtime	The creation time of the file.
atime	The accessed time of the file
mtime	The modified time of the file.
md5Hash	The MD5 hash of the file
sha256Hash	The SHA256 hash of the file
sha1Hash	SHA1 Hash of the file. May be null.
mimeType	The MIME type of the file
isFile	True, unless the file is a directory.
parent	The parent of the file (e.g., a virtual directory).
ownerUid	UID of the file owner as found in the file system, can be null.
osAccount	OS account of owner, may be null.
fileAttributes	A list of file attributes. May be empty.
transaction	A caller-managed transaction within which the add file operations are performed.

Returns: Newly created file

Exceptions

Definition at line 7621 of file SleuthkitCase.java.

References addFileSystemFile(), and org.sleuthkit.datamodel.TskData.CollectedStatus.UNKNOWN.

◆ addFileSystemFile() [4/4]

FsContent org.sleuthkit.datamodel.SleuthkitCase.addFileSystemFile	(	long	dataSourceObjId,
		long	fsObjId,
		String	fileName,
		long	metaAddr,
		int	metaSeq,
		TSK_FS_ATTR_TYPE_ENUM	attrType,
		int	attrId,
		TSK_FS_NAME_FLAG_ENUM	dirFlag,
		short	metaFlags,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		String	md5Hash,
		String	sha256Hash,
		String	sha1Hash,
		String	mimeType,
		boolean	isFile,
		Content	parent,
		String	ownerUid,
		OsAccount	osAccount,
		TskData.CollectedStatus	collected,
		List< Attribute >	fileAttributes,
		CaseDbTransaction	transaction ) throws TskCoreException

Add a file system file.

Parameters

dataSourceObjId	The object id of the root data source of this file.
fsObjId	The file system object id.
fileName	The name of the file.
metaAddr	The meta address of the file.
metaSeq	The meta address sequence of the file.
attrType	The attributed type of the file.
attrId	The attribute id.
dirFlag	The allocated status from the name structure
metaFlags	The allocated status of the file, usually as reported in the metadata structure of the file system.
size	The size of the file in bytes.
ctime	The changed time of the file.
crtime	The creation time of the file.
atime	The accessed time of the file
mtime	The modified time of the file.
md5Hash	The MD5 hash of the file
sha256Hash	The SHA256 hash of the file
sha1Hash	SHA1 Hash of the file. May be null.
mimeType	The MIME type of the file
isFile	True, unless the file is a directory.
parent	The parent of the file (e.g., a virtual directory).
ownerUid	UID of the file owner as found in the file system, can be null.
osAccount	OS account of owner, may be null.
collected	Collected status for file content, may be null
fileAttributes	A list of file attributes. May be empty.
transaction	A caller-managed transaction within which the add file operations are performed.

Returns: Newly created file

Exceptions

Definition at line 7685 of file SleuthkitCase.java.

◆ addImage() [1/3]

Image org.sleuthkit.datamodel.SleuthkitCase.addImage	(	TskData.TSK_IMG_TYPE_ENUM	type,
		long	sectorSize,
		long	size,
		String	displayName,
		List< String >	imagePaths,
		String	timezone,
		String	md5,
		String	sha1,
		String	sha256,
		String	deviceId,
		CaseDbTransaction	transaction ) throws TskCoreException

Add an image to the database.

Parameters

type	Type of image
sectorSize	Sector size
size	Image size
displayName	Display name for the image
imagePaths	Image path(s)
timezone	Time zone
md5	MD5 hash
sha1	SHA1 hash
sha256	SHA256 hash
deviceId	Device ID
transaction	Case DB transaction

Returns: the newly added Image

Exceptions

Definition at line 7150 of file SleuthkitCase.java.

References addImage().

Referenced by addImage(), addImage(), and org.sleuthkit.datamodel.SleuthkitJNI.addImageToDatabase().

◆ addImage() [2/3]

Image org.sleuthkit.datamodel.SleuthkitCase.addImage	(	TskData.TSK_IMG_TYPE_ENUM	type,
		long	sectorSize,
		long	size,
		String	displayName,
		List< String >	imagePaths,
		String	timezone,
		String	md5,
		String	sha1,
		String	sha256,
		String	deviceId,
		Host	host,
		CaseDbTransaction	transaction ) throws TskCoreException

Add an image to the database.

Parameters

type	Type of image
sectorSize	Sector size
size	Image size
displayName	Display name for the image
imagePaths	Image path(s)
timezone	Time zone
md5	MD5 hash
sha1	SHA1 hash
sha256	SHA256 hash
deviceId	Device ID
host	Host
transaction	Case DB transaction

Returns: the newly added Image

Exceptions

Definition at line 7177 of file SleuthkitCase.java.

References addImage().

◆ addImage() [3/3]

Image org.sleuthkit.datamodel.SleuthkitCase.addImage	(	TskData.TSK_IMG_TYPE_ENUM	type,
		long	sectorSize,
		long	size,
		String	displayName,
		List< String >	imagePaths,
		String	timezone,
		String	md5,
		String	sha1,
		String	sha256,
		String	deviceId,
		Host	host,
		String	password,
		CaseDbTransaction	transaction ) throws TskCoreException

Add an image to the database.

Parameters

type	Type of image
sectorSize	Sector size
size	Image size
displayName	Display name for the image
imagePaths	Image path(s)
timezone	Time zone
md5	MD5 hash
sha1	SHA1 hash
sha256	SHA256 hash
deviceId	Device ID
host	Host
password	The password to decrypt the image.
transaction	Case DB transaction

Returns: the newly added Image

Exceptions

References getHostManager(), org.sleuthkit.datamodel.TskData.ObjectType.IMG, org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.INSERT_DATA_SOURCE_INFO, org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.INSERT_IMAGE_INFO, org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.INSERT_IMAGE_NAME, and org.sleuthkit.datamodel.HostManager.newHost().

Definition at line 7207 of file SleuthkitCase.java.

◆ addImageInfo() [1/3]

Image org.sleuthkit.datamodel.SleuthkitCase.addImageInfo	(	long	deviceObjId,
		List< String >	imageFilePaths,
		String	timeZone ) throws TskCoreException

Adds an image to the case database.

Parameters

deviceObjId	The object id of the device associated with the image.
imageFilePaths	The image file paths.
timeZone	The time zone for the image.

Returns: An Image object.

Exceptions

TskCoreException if there is an error adding the image to case database.

Definition at line 10328 of file SleuthkitCase.java.

References addImageInfo().

Referenced by addImageInfo(), and addImageInfo().

◆ addImageInfo() [2/3]

Image org.sleuthkit.datamodel.SleuthkitCase.addImageInfo	(	long	deviceObjId,
		List< String >	imageFilePaths,
		String	timeZone,
		Host	host ) throws TskCoreException

Adds an image to the case database.

Parameters

deviceObjId	The object id of the device associated with the image.
imageFilePaths	The image file paths.
timeZone	The time zone for the image.
host	The host for this image.

Returns: An Image object.

Exceptions

TskCoreException if there is an error adding the image to case database.

Definition at line 10346 of file SleuthkitCase.java.

References addImageInfo().

◆ addImageInfo() [3/3]

Image org.sleuthkit.datamodel.SleuthkitCase.addImageInfo	(	long	deviceObjId,
		List< String >	imageFilePaths,
		String	timeZone,
		Host	host,
		String	password ) throws TskCoreException

Adds an image to the case database.

Parameters

deviceObjId	The object id of the device associated with the image.
imageFilePaths	The image file paths.
timeZone	The time zone for the image.
host	The host for this image.
password	The password to decrypt the image or null.

Returns: An Image object.

Exceptions

TskCoreException if there is an error adding the image to case database.

Definition at line 10367 of file SleuthkitCase.java.

References getImageById().

◆ addIngestJob()

final IngestJobInfo org.sleuthkit.datamodel.SleuthkitCase.addIngestJob	(	Content	dataSource,
		String	hostName,
		List< IngestModuleInfo >	ingestModules,
		Date	jobStart,
		Date	jobEnd,
		IngestJobStatusType	status,
		String	settingsDir ) throws TskCoreException

Parameters

dataSource	The datasource the ingest job is being run on
hostName	The name of the host
ingestModules	The ingest modules being run during the ingest job. Should be in pipeline order.
jobStart	The time the job started
jobEnd	The time the job ended
status	The ingest job status
settingsDir	The directory of the job's settings

Returns: An information object representing the ingest job added to the database.

Exceptions

TskCoreException If adding the job to the database fails.

Definition at line 13310 of file SleuthkitCase.java.

References acquireSingleUserCaseWriteLock(), org.sleuthkit.datamodel.IngestModuleInfo.getIngestModuleId(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.INSERT_INGEST_JOB, and releaseSingleUserCaseWriteLock().

◆ addIngestModule()

final IngestModuleInfo org.sleuthkit.datamodel.SleuthkitCase.addIngestModule	(	String	displayName,
		String	factoryClassName,
		IngestModuleType	type,
		String	version ) throws TskCoreException

Adds the given ingest module to the database.

Parameters

displayName	The display name of the module
factoryClassName	The factory class name of the module.
type	The type of the module.
version	The version of the module.

Returns: An ingest module info object representing the module added to the db.

Exceptions

TskCoreException When the ingest module cannot be added.

Definition at line 13362 of file SleuthkitCase.java.

References acquireSingleUserCaseWriteLock(), org.sleuthkit.datamodel.IngestModuleInfo.IngestModuleType.fromID(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.INSERT_INGEST_MODULE, and releaseSingleUserCaseWriteLock().

◆ addLayoutFile()

LayoutFile org.sleuthkit.datamodel.SleuthkitCase.addLayoutFile	(	String	fileName,
		long	size,
		TSK_FS_NAME_FLAG_ENUM	dirFlag,
		TSK_FS_META_FLAG_ENUM	metaFlag,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		List< TskFileRange >	fileRanges,
		Content	parent ) throws TskCoreException

Add a new layout file to the database.

Parameters

fileName	The name of the file.
size	The size of the file in bytes.
dirFlag	The allocated status from the name structure
metaFlag	The allocated status from the metadata structure
ctime	The changed time of the file.
crtime	The creation time of the file.
atime	The accessed time of the file
mtime	The modified time of the file.
fileRanges	The byte ranges that belong to this file (relative to start of image)
parent	The parent of the file

Returns: The new LayoutFile

Exceptions

Definition at line 9102 of file SleuthkitCase.java.

◆ addLayoutFiles()

final List< LayoutFile > org.sleuthkit.datamodel.SleuthkitCase.addLayoutFiles	(	Content	parent,
		List< TskFileRange >	fileRanges ) throws TskCoreException

Adds one or more layout files for a parent Content object to the case database.

Parameters

parent	The parent Content.
fileRanges	File range objects for the file(s).

Returns: A list of LayoutFile objects.

Exceptions

TskCoreException If there is a problem completing a case database operation.

Definition at line 7838 of file SleuthkitCase.java.

◆ addLocalDirectory() [1/2]

LocalDirectory org.sleuthkit.datamodel.SleuthkitCase.addLocalDirectory	(	long	parentId,
		String	directoryName ) throws TskCoreException

Adds a local directory to the database and returns a LocalDirectory object representing it.

Parameters

parentId	the ID of the parent, or 0 if NULL
directoryName	the name of the local directory to create

Returns: a LocalDirectory object representing the one added to the database.

Exceptions

Definition at line 6888 of file SleuthkitCase.java.

References addLocalDirectory(), beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

Referenced by addLocalDirectory().

◆ addLocalDirectory() [2/2]

LocalDirectory org.sleuthkit.datamodel.SleuthkitCase.addLocalDirectory	(	long	parentId,
		String	directoryName,
		CaseDbTransaction	transaction ) throws TskCoreException

Adds a local directory to the database and returns a LocalDirectory object representing it.

Make sure the connection in transaction is used for all database interactions called by this method

Parameters

parentId	the ID of the parent, or 0 if NULL
directoryName	the name of the local directory to create
transaction	the transaction in the scope of which the operation is to be performed, managed by the caller

Returns: a LocalDirectory object representing the one added to the database.

Exceptions

Definition at line 6921 of file SleuthkitCase.java.

◆ addLocalFile() [1/8]

LocalFile org.sleuthkit.datamodel.SleuthkitCase.addLocalFile	(	String	fileName,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		boolean	isFile,
		AbstractFile	parent ) throws TskCoreException

Wraps the version of addLocalFile that takes a Transaction in a transaction local to this method.

Parameters

fileName
localPath
size
ctime
crtime
atime
mtime
isFile
parent

Returns

Exceptions

Deprecated: Use the newer version with explicit encoding type parameter

Definition at line 15450 of file SleuthkitCase.java.

References addLocalFile(), and org.sleuthkit.datamodel.TskData.EncodingType.NONE.

◆ addLocalFile() [2/8]

LocalFile org.sleuthkit.datamodel.SleuthkitCase.addLocalFile	(	String	fileName,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		boolean	isFile,
		AbstractFile	parent,
		CaseDbTransaction	transaction ) throws TskCoreException

Adds a local/logical file to the case database. The database operations are done within a caller-managed transaction; the caller is responsible for committing or rolling back the transaction.

Parameters

fileName	The name of the file.
localPath	The absolute path (including the file name) of the local/logical in secondary storage.
size	The size of the file in bytes.
ctime	The changed time of the file.
crtime	The creation time of the file.
atime	The accessed time of the file
mtime	The modified time of the file.
isFile	True, unless the file is a directory.
parent	The parent of the file (e.g., a virtual directory)
transaction	A caller-managed transaction within which the add file operations are performed.

Returns: An object representing the local/logical file.

Exceptions

TskCoreException if there is an error completing a case database operation.

Deprecated: Use the newer version with explicit encoding type parameter

Definition at line 15422 of file SleuthkitCase.java.

References addLocalFile(), and org.sleuthkit.datamodel.TskData.EncodingType.NONE.

◆ addLocalFile() [3/8]

LocalFile org.sleuthkit.datamodel.SleuthkitCase.addLocalFile	(	String	fileName,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		boolean	isFile,
		TskData.EncodingType	encodingType,
		AbstractFile	parent ) throws TskCoreException

Wraps the version of addLocalFile that takes a Transaction in a transaction local to this method.

Parameters

fileName
localPath
size
ctime
crtime
atime
mtime
isFile
encodingType
parent

Returns

Exceptions

Definition at line 8664 of file SleuthkitCase.java.

References addLocalFile(), beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

Referenced by addLocalFile(), addLocalFile(), addLocalFile(), addLocalFile(), addLocalFile(), addLocalFile(), and addLocalFile().

◆ addLocalFile() [4/8]

LocalFile org.sleuthkit.datamodel.SleuthkitCase.addLocalFile	(	String	fileName,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		boolean	isFile,
		TskData.EncodingType	encodingType,
		Content	parent,
		CaseDbTransaction	transaction ) throws TskCoreException

Adds a local/logical file to the case database. The database operations are done within a caller-managed transaction; the caller is responsible for committing or rolling back the transaction.

Parameters

fileName	The name of the file.
localPath	The absolute path (including the file name) of the local/logical in secondary storage.
size	The size of the file in bytes.
ctime	The changed time of the file.
crtime	The creation time of the file.
atime	The accessed time of the file
mtime	The modified time of the file.
isFile	True, unless the file is a directory.
encodingType	Type of encoding used on the file
parent	The parent of the file (e.g., a virtual directory)
transaction	A caller-managed transaction within which the add file operations are performed.

Returns: An object representing the local/logical file.

Exceptions

TskCoreException if there is an error completing a case database operation.

Definition at line 8710 of file SleuthkitCase.java.

References addLocalFile().

◆ addLocalFile() [5/8]

LocalFile org.sleuthkit.datamodel.SleuthkitCase.addLocalFile	(	String	fileName,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		String	md5,
		FileKnown	known,
		String	mimeType,
		boolean	isFile,
		TskData.EncodingType	encodingType,
		Content	parent,
		CaseDbTransaction	transaction ) throws TskCoreException

Adds a local/logical file to the case database. The database operations are done within a caller-managed transaction; the caller is responsible for committing or rolling back the transaction.

Parameters

fileName	The name of the file.
localPath	The absolute path (including the file name) of the local/logical in secondary storage.
size	The size of the file in bytes.
ctime	The changed time of the file.
crtime	The creation time of the file.
atime	The accessed time of the file
mtime	The modified time of the file.
md5	The MD5 hash of the file
known	The known status of the file (can be null)
mimeType	The MIME type of the file
isFile	True, unless the file is a directory.
encodingType	Type of encoding used on the file
parent	The parent of the file (e.g., a virtual directory)
transaction	A caller-managed transaction within which the add file operations are performed.

Returns: An object representing the local/logical file.

Exceptions

TskCoreException if there is an error completing a case database operation.

Deprecated: Use the newer version with explicit sha256 parameter

Definition at line 15386 of file SleuthkitCase.java.

References addLocalFile().

◆ addLocalFile() [6/8]

LocalFile org.sleuthkit.datamodel.SleuthkitCase.addLocalFile	(	String	fileName,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		String	md5,
		String	sha256,
		FileKnown	known,
		String	mimeType,
		boolean	isFile,
		TskData.EncodingType	encodingType,
		Content	parent,
		CaseDbTransaction	transaction ) throws TskCoreException

Adds a local/logical file to the case database. The database operations are done within a caller-managed transaction; the caller is responsible for committing or rolling back the transaction.

Parameters

fileName	The name of the file.
localPath	The absolute path (including the file name) of the local/logical in secondary storage.
size	The size of the file in bytes.
ctime	The changed time of the file.
crtime	The creation time of the file.
atime	The accessed time of the file
mtime	The modified time of the file.
md5	The MD5 hash of the file
sha256	the SHA-256 hash of the file.
known	The known status of the file (can be null)
mimeType	The MIME type of the file
isFile	True, unless the file is a directory.
encodingType	Type of encoding used on the file
parent	The parent of the file (e.g., a virtual directory)
transaction	A caller-managed transaction within which the add file operations are performed.

Returns: An object representing the local/logical file.

Exceptions

TskCoreException if there is an error completing a case database operation.

Definition at line 8750 of file SleuthkitCase.java.

References addLocalFile().

◆ addLocalFile() [7/8]

LocalFile org.sleuthkit.datamodel.SleuthkitCase.addLocalFile	(	String	fileName,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		String	md5,
		String	sha256,
		FileKnown	known,
		String	mimeType,
		boolean	isFile,
		TskData.EncodingType	encodingType,
		Long	osAccountId,
		String	ownerAccount,
		Content	parent,
		CaseDbTransaction	transaction ) throws TskCoreException

Adds a local/logical file to the case database. The database operations are done within a caller-managed transaction; the caller is responsible for committing or rolling back the transaction.

Parameters

fileName	The name of the file.
localPath	The absolute path (including the file name) of the local/logical in secondary storage.
size	The size of the file in bytes.
ctime	The changed time of the file.
crtime	The creation time of the file.
atime	The accessed time of the file
mtime	The modified time of the file.
md5	The MD5 hash of the file
sha256	the SHA-256 hash of the file.
known	The known status of the file (can be null)
mimeType	The MIME type of the file
isFile	True, unless the file is a directory.
encodingType	Type of encoding used on the file
osAccountId	OS account id (can be null)
ownerAccount	Owner account (can be null)
parent	The parent of the file (e.g., a virtual directory)
transaction	A caller-managed transaction within which the add file operations are performed.

Returns: An object representing the local/logical file.

Exceptions

TskCoreException if there is an error completing a case database operation.

Definition at line 8792 of file SleuthkitCase.java.

References addLocalFile().

◆ addLocalFile() [8/8]

LocalFile org.sleuthkit.datamodel.SleuthkitCase.addLocalFile	(	String	fileName,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		String	md5,
		String	sha256,
		String	sha1Hash,
		FileKnown	known,
		String	mimeType,
		boolean	isFile,
		TskData.EncodingType	encodingType,
		Long	osAccountId,
		String	ownerAccount,
		Content	parent,
		CaseDbTransaction	transaction ) throws TskCoreException

Adds a local/logical file to the case database. The database operations are done within a caller-managed transaction; the caller is responsible for committing or rolling back the transaction.

Parameters

fileName	The name of the file.
localPath	The absolute path (including the file name) of the local/logical in secondary storage.
size	The size of the file in bytes.
ctime	The changed time of the file.
crtime	The creation time of the file.
atime	The accessed time of the file
mtime	The modified time of the file.
md5	The MD5 hash of the file
sha256	the SHA-256 hash of the file.
sha1Hash	SHA-1 Hash of the file, may be null.
known	The known status of the file (can be null)
mimeType	The MIME type of the file
isFile	True, unless the file is a directory.
encodingType	Type of encoding used on the file
osAccountId	OS account id (can be null)
ownerAccount	Owner account (can be null)
parent	The parent of the file (e.g., a virtual directory)
transaction	A caller-managed transaction within which the add file operations are performed.

Returns: An object representing the local/logical file.

Exceptions

TskCoreException if there is an error completing a case database operation.

Definition at line 8838 of file SleuthkitCase.java.

◆ addLocalFilesDataSource() [1/2]

LocalFilesDataSource org.sleuthkit.datamodel.SleuthkitCase.addLocalFilesDataSource	(	String	deviceId,
		String	rootDirectoryName,
		String	timeZone,
		CaseDbTransaction	transaction ) throws TskCoreException

Adds a local/logical files and/or directories data source.

Parameters

deviceId	An ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID).
rootDirectoryName	The name for the root virtual directory for the data source.
timeZone	The time zone used to process the data source, may be the empty string.
transaction	A transaction in the scope of which the operation is to be performed, managed by the caller.

Returns: The new local files data source.

Exceptions

TskCoreException if there is an error adding the data source.

Definition at line 7033 of file SleuthkitCase.java.

References addLocalFilesDataSource().

Referenced by addLocalFilesDataSource().

◆ addLocalFilesDataSource() [2/2]

LocalFilesDataSource org.sleuthkit.datamodel.SleuthkitCase.addLocalFilesDataSource	(	String	deviceId,
		String	rootDirectoryName,
		String	timeZone,
		Host	host,
		CaseDbTransaction	transaction ) throws TskCoreException

Adds a local/logical files and/or directories data source.

Parameters

deviceId	An ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID).
rootDirectoryName	The name for the root virtual directory for the data source.
timeZone	The time zone used to process the data source, may be the empty string.
host	The host for the data source (may be null)
transaction	A transaction in the scope of which the operation is to be performed, managed by the caller.

Returns: The new local files data source.

Exceptions

TskCoreException if there is an error adding the data source.

Definition at line 7057 of file SleuthkitCase.java.

◆ addOrUpdateTagName()

TagName org.sleuthkit.datamodel.SleuthkitCase.addOrUpdateTagName	(	String	displayName,
		String	description,
		TagName.HTML_COLOR	color,
		TskData.FileKnown	knownStatus ) throws TskCoreException

Inserts row into the tags_names table, or updates the existing row if the displayName already exists in the tag_names table in the case database.

Parameters

displayName	The display name for the new tag name.
description	The description for the new tag name.
color	The HTML color to associate with the new tag name.
knownStatus	The TskData.FileKnown value to associate with the new tag name.

Returns: A TagName data transfer object (DTO) for the new row.

Exceptions

Deprecated: This method has been replaced by TaggingManager.addOrUpdateTagName.

Definition at line 12183 of file SleuthkitCase.java.

References org.sleuthkit.datamodel.TaggingManager.addOrUpdateTagName(), and getTaggingManager().

Referenced by addTagName().

◆ addPool()

Pool org.sleuthkit.datamodel.SleuthkitCase.addPool	(	long	parentObjId,
		TskData.TSK_POOL_TYPE_ENUM	type,
		CaseDbTransaction	transaction ) throws TskCoreException

Add a pool to the database.

Parameters

parentObjId	Object ID of the pool's parent
type	Type of pool
transaction	Case DB transaction

Returns: the newly created Pool

Exceptions

Definition at line 7390 of file SleuthkitCase.java.

References org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.INSERT_POOL_INFO, and org.sleuthkit.datamodel.TskData.ObjectType.POOL.

◆ addReport() [1/2]

Report org.sleuthkit.datamodel.SleuthkitCase.addReport	(	String	localPath,
		String	sourceModuleName,
		String	reportName ) throws TskCoreException

Inserts a row into the reports table in the case database.

Parameters

localPath	The path of the report file, must be in the database directory (case directory in Autopsy) or one of its subdirectories.
sourceModuleName	The name of the module that created the report.
reportName	The report name.

Returns: A Report object for the new row.

Exceptions

Definition at line 12997 of file SleuthkitCase.java.

References addReport().

Referenced by addReport().

◆ addReport() [2/2]

Report org.sleuthkit.datamodel.SleuthkitCase.addReport	(	String	localPath,
		String	sourceModuleName,
		String	reportName,
		Content	parent ) throws TskCoreException

Inserts a row into the reports table in the case database.

Parameters

localPath	The path of the report file, must be in the database directory (case directory in Autopsy) or one of its subdirectories.
sourceModuleName	The name of the module that created the report.
reportName	The report name.
parent	The Content from which the report was created, if available.

Returns: A Report object for the new row.

Exceptions

Definition at line 13016 of file SleuthkitCase.java.

References acquireSingleUserCaseWriteLock(), getDbDirPath(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.INSERT_REPORT, releaseSingleUserCaseWriteLock(), and org.sleuthkit.datamodel.TskData.ObjectType.REPORT.

◆ addTagName()

TagName org.sleuthkit.datamodel.SleuthkitCase.addTagName	(	String	displayName,
		String	description,
		TagName.HTML_COLOR	color ) throws TskCoreException

Inserts row into the tags_names table in the case database.

Parameters

displayName	The display name for the new tag name.
description	The description for the new tag name.
color	The HTML color to associate with the new tag name.

Returns: A TagName data transfer object (DTO) for the new row.

Exceptions

Deprecated: TaggingManager.addOrUpdateTagName should be used instead with the default knowStatus of TskData.TagType.UNKNOWN

Definition at line 12162 of file SleuthkitCase.java.

References addOrUpdateTagName(), addTagName(), and org.sleuthkit.datamodel.TskData.FileKnown.UNKNOWN.

Referenced by addTagName().

◆ addVirtualDirectory() [1/2]

VirtualDirectory org.sleuthkit.datamodel.SleuthkitCase.addVirtualDirectory	(	long	parentId,
		String	directoryName ) throws TskCoreException

Adds a virtual directory to the database and returns a VirtualDirectory object representing it.

Parameters

parentId	the ID of the parent, or 0 if NULL
directoryName	the name of the virtual directory to create

Returns

Exceptions

Definition at line 6680 of file SleuthkitCase.java.

References addVirtualDirectory(), beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

Referenced by addCarvedFiles(), and addVirtualDirectory().

◆ addVirtualDirectory() [2/2]

VirtualDirectory org.sleuthkit.datamodel.SleuthkitCase.addVirtualDirectory	(	long	parentId,
		String	directoryName,
		CaseDbTransaction	transaction ) throws TskCoreException

Adds a virtual directory to the database and returns a VirtualDirectory object representing it.

Make sure the connection in transaction is used for all database interactions called by this method

Parameters

parentId	the ID of the parent, or 0 if NULL
directoryName	the name of the virtual directory to create
transaction	the transaction in the scope of which the operation is to be performed, managed by the caller

Returns: a VirtualDirectory object representing the one added to the database.

Exceptions

Definition at line 6757 of file SleuthkitCase.java.

◆ addVolume()

Volume org.sleuthkit.datamodel.SleuthkitCase.addVolume	(	long	parentObjId,
		long	addr,
		long	start,
		long	length,
		String	desc,
		long	flags,
		CaseDbTransaction	transaction ) throws TskCoreException

Add a volume to the database

Parameters

parentObjId	Object ID of the volume's parent
addr	Address of the volume
start	Start of the volume
length	Length of the volume
desc	Description of the volume
flags	Flags
transaction	Case DB transaction

Returns: the newly created Volume

Exceptions

References org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.INSERT_VS_PART_POSTGRESQL, org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.INSERT_VS_PART_SQLITE, org.sleuthkit.datamodel.TskData.DbType.POSTGRESQL, and org.sleuthkit.datamodel.TskData.ObjectType.VOL.

Definition at line 7348 of file SleuthkitCase.java.

◆ addVolumeSystem()

VolumeSystem org.sleuthkit.datamodel.SleuthkitCase.addVolumeSystem	(	long	parentObjId,
		TskData.TSK_VS_TYPE_ENUM	type,
		long	imgOffset,
		long	blockSize,
		CaseDbTransaction	transaction ) throws TskCoreException

Add a volume system to the database.

Parameters

parentObjId	Object ID of the volume system's parent
type	Type of volume system
imgOffset	Image offset
blockSize	Block size
transaction	Case DB transaction

Returns: the newly added VolumeSystem

Exceptions

Definition at line 7308 of file SleuthkitCase.java.

References org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.INSERT_VS_INFO, and org.sleuthkit.datamodel.TskData.ObjectType.VS.

◆ allFilesMd5Hashed()

boolean org.sleuthkit.datamodel.SleuthkitCase.allFilesMd5Hashed ( )

Query all the files to verify if they have an MD5 hash associated with them.

Returns: true if all files have an MD5 hash

Definition at line 11971 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.TskData.TSK_FS_NAME_TYPE_ENUM.REG, and releaseSingleUserCaseReadLock().

◆ beginReadOnlyTransaction()

CaseDbTransaction org.sleuthkit.datamodel.SleuthkitCase.beginReadOnlyTransaction ( ) throws TskCoreException

Create a new transaction on the case database. The transaction object that is returned can be passed to methods that take a CaseDbTransaction. The caller is responsible for calling either commit() or rollback() on the transaction object.

Note that this beginning the transaction also acquires the single user case read lock, which will be automatically released when the transaction is closed.

WARNING: This API should only be used if the transaction is guaranteed to only ever perform reads and no updates to the database. Undefined behavior can occur if this API is used with database updates.

Returns: A CaseDbTransaction object.

Exceptions

Definition at line 3105 of file SleuthkitCase.java.

◆ beginTransaction()

CaseDbTransaction org.sleuthkit.datamodel.SleuthkitCase.beginTransaction ( ) throws TskCoreException

Create a new transaction on the case database. The transaction object that is returned can be passed to methods that take a CaseDbTransaction. The caller is responsible for calling either commit() or rollback() on the transaction object.

Note that this beginning the transaction also acquires the single user case write lock, which will be automatically released when the transaction is closed.

Returns: A CaseDbTransaction object.

Exceptions

Definition at line 3082 of file SleuthkitCase.java.

◆ close()

void org.sleuthkit.datamodel.SleuthkitCase.close ( )

Call to free resources when done with instance.

Definition at line 11197 of file SleuthkitCase.java.

References acquireSingleUserCaseWriteLock(), and releaseSingleUserCaseWriteLock().

Referenced by finalize().

◆ closeRunQuery()

void org.sleuthkit.datamodel.SleuthkitCase.closeRunQuery ( ResultSet resultSet ) throws SQLException

Closes ResultSet and its Statement previously retrieved from runQuery()

Parameters

resultSet with its Statement to close

Exceptions

SQLException of closing the query files failed

Deprecated: Do not use runQuery() and closeRunQuery(), use executeQuery() instead. Query the Database

Definition at line 15244 of file SleuthkitCase.java.

◆ copyCaseDB()

void org.sleuthkit.datamodel.SleuthkitCase.copyCaseDB ( String newDBPath ) throws IOException

Make a duplicate / backup copy of the current case database. Makes a new copy only, and continues to use the current connection.

Parameters

newDBPath Path to the copy to be created. File will be overwritten if it exists.

Exceptions

IOException if copying fails.

Definition at line 1183 of file SleuthkitCase.java.

References acquireSingleUserCaseWriteLock(), and releaseSingleUserCaseWriteLock().

◆ countFilesMd5Hashed()

int org.sleuthkit.datamodel.SleuthkitCase.countFilesMd5Hashed ( )

Query all the files and counts how many have an MD5 hash.

Returns: the number of files with an MD5 hash

Definition at line 12004 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

◆ countFilesWhere()

long org.sleuthkit.datamodel.SleuthkitCase.countFilesWhere ( String sqlWhereClause ) throws TskCoreException

Count files matching the specific Where clause

Parameters

sqlWhereClause a SQL where clause appropriate for the desired files (do not begin the WHERE clause with the word WHERE!)

Returns: count of files each of which satisfy the given WHERE clause

Exceptions

References beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.DELETE_ARTIFACT_TAG, getScoringManager(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

Definition at line 9412 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

◆ countFsContentType()

int org.sleuthkit.datamodel.SleuthkitCase.countFsContentType ( TskData.TSK_FS_META_TYPE_ENUM contentType ) throws TskCoreException

Return the number of objects in the database of a given file type.

Parameters

contentType Type of file to count

Returns: Number of objects with that type.

Exceptions

TskCoreException thrown if a critical error occurred within tsk core

Definition at line 11890 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

◆ deleteBlackboardArtifactTag()

void org.sleuthkit.datamodel.SleuthkitCase.deleteBlackboardArtifactTag ( BlackboardArtifactTag tag ) throws TskCoreException

Definition at line 12600 of file SleuthkitCase.java.

◆ deleteContentTag()

void org.sleuthkit.datamodel.SleuthkitCase.deleteContentTag ( ContentTag tag ) throws TskCoreException

Definition at line 12211 of file SleuthkitCase.java.

References beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.DELETE_CONTENT_TAG, getScoringManager(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

◆ deleteReport()

void org.sleuthkit.datamodel.SleuthkitCase.deleteReport ( Report report ) throws TskCoreException

Deletes a row from the reports table in the case database.

Parameters

report A Report data transfer object (DTO) for the row to delete.

Exceptions

References acquireSingleUserCaseWriteLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.DELETE_REPORT, org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.DELETE_REPORT_TSK_OBJECT, releaseSingleUserCaseWriteLock(), and org.sleuthkit.datamodel.TskData.ObjectType.REPORT.

Definition at line 13210 of file SleuthkitCase.java.

◆ disableTimelineEventCreation()

void org.sleuthkit.datamodel.SleuthkitCase.disableTimelineEventCreation ( )

Disable the creation of timeline events for new files.

This setting is not saved to the case database.

Definition at line 3523 of file SleuthkitCase.java.

◆ escapeSingleQuotes()

String org.sleuthkit.datamodel.SleuthkitCase.escapeSingleQuotes ( String text )

static

Escape the single quotes in the given string so they can be added to the SQL caseDbConnection

Parameters

text

Returns: text the escaped version

Definition at line 11923 of file SleuthkitCase.java.

◆ executeInsertOrUpdate()

CaseDbQuery org.sleuthkit.datamodel.SleuthkitCase.executeInsertOrUpdate ( String query ) throws TskCoreException

This method allows developers to run arbitrary SQL queries, including INSERT and UPDATE. The CaseDbQuery object will take care of acquiring the necessary database lock and when used in a try-with-resources block will automatically take care of releasing the lock. If you do not use a try-with-resources block you must call CaseDbQuery.close() once you are done processing the files of the query.

Also note that if you use it within a transaction to insert something into the database, and then within that same transaction query the inserted item from the database, you will likely not see your inserted item, as the method uses new connections for each execution. With this method, you must close your transaction before successfully querying for newly-inserted items.

Parameters

query The query string to execute.

Returns: A CaseDbQuery instance.

Exceptions

Definition at line 11158 of file SleuthkitCase.java.

◆ executeQuery()

CaseDbQuery org.sleuthkit.datamodel.SleuthkitCase.executeQuery ( String query ) throws TskCoreException

This method allows developers to run arbitrary SQL "SELECT" queries. The CaseDbQuery object will take care of acquiring the necessary database lock and when used in a try-with-resources block will automatically take care of releasing the lock. If you do not use a try-with-resources block you must call CaseDbQuery.close() once you are done processing the files of the query.

Also note that if you use it within a transaction to insert something into the database, and then within that same transaction query the inserted item from the database, you will likely not see your inserted item, as the method uses new connections for each execution. With this method, you must close your transaction before successfully querying for newly-inserted items.

Parameters

query The query string to execute.

Returns: A CaseDbQuery instance.

Exceptions

Definition at line 11133 of file SleuthkitCase.java.

◆ finalize()

void org.sleuthkit.datamodel.SleuthkitCase.finalize ( ) throws Throwable

protected

Definition at line 11186 of file SleuthkitCase.java.

References close().

◆ findAllFileIdsWhere()

List< Long > org.sleuthkit.datamodel.SleuthkitCase.findAllFileIdsWhere ( String sqlWhereClause ) throws TskCoreException

Find and return list of all (abstract) ids of files matching the specific Where clause

Parameters

sqlWhereClause a SQL where clause appropriate for the desired files (do not begin the WHERE clause with the word WHERE!)

Returns: a list of file ids each of which satisfy the given WHERE clause

Exceptions

Definition at line 9515 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

◆ findAllFilesInFolderWhere()

List< AbstractFile > org.sleuthkit.datamodel.SleuthkitCase.findAllFilesInFolderWhere	(	long	parentId,
		String	sqlWhereClause ) throws TskCoreException

Find and return list of all (abstract) files matching the specific Where clause with the give parentId. You need to know the database schema to use this, which is outlined on the wiki. You should use enums from org.sleuthkit.datamodel.TskData to make the queries easier to maintain and understand.

Parameters

parentId	The parentId
sqlWhereClause	a SQL where clause appropriate for the desired files (do not begin the WHERE clause with the word WHERE!)

Returns: a list of AbstractFile each of which satisfy the given WHERE clause

Exceptions

Definition at line 9488 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

◆ findAllFilesWhere()

List< AbstractFile > org.sleuthkit.datamodel.SleuthkitCase.findAllFilesWhere ( String sqlWhereClause ) throws TskCoreException

Find and return list of all (abstract) files matching the specific Where clause. You need to know the database schema to use this, which is outlined on the wiki. You should use enums from org.sleuthkit.datamodel.TskData to make the queries easier to maintain and understand.

Parameters

sqlWhereClause a SQL where clause appropriate for the desired files (do not begin the WHERE clause with the word WHERE!)

Returns: a list of AbstractFile each of which satisfy the given WHERE clause

Exceptions

References acquireSingleUserCaseReadLock(), releaseSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_NAME, and org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_FILES_BY_EXTENSION_AND_DATA_SOURCE_AND_NAME.

Definition at line 9450 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

Referenced by org.sleuthkit.datamodel.Examples.Sample.run().

◆ findFiles() [1/3]

List< AbstractFile > org.sleuthkit.datamodel.SleuthkitCase.findFiles	(	Content	dataSource,
		String	fileName ) throws TskCoreException

Parameters

dataSource	the dataSource (Image, parent-less VirtualDirectory) to search for the given file name
fileName	Pattern of the name of the file or directory to match (case insensitive, used in LIKE SQL statement).

Returns: a list of AbstractFile for files/directories whose name matches the given fileName

Exceptions

TskCoreException thrown if check failed

Definition at line 6577 of file SleuthkitCase.java.

Referenced by openFiles().

◆ findFiles() [2/3]

List< AbstractFile > org.sleuthkit.datamodel.SleuthkitCase.findFiles	(	Content	dataSource,
		String	fileName,
		AbstractFile	parentFile ) throws TskCoreException

Find all files in the data source, by name and parent

Parameters

dataSource	the dataSource (Image, parent-less VirtualDirectory) to search for the given file name
fileName	Pattern of the name of the file or directory to match (case insensitive, used in LIKE SQL statement).
parentFile	Object for parent file/directory to find children in

Returns: a list of AbstractFile for files/directories whose name matches fileName and that were inside a directory described by parentFile.

Exceptions

Deprecated: Use findFilesInFolder()

Definition at line 15517 of file SleuthkitCase.java.

References findFilesInFolder().

◆ findFiles() [3/3]

List< AbstractFile > org.sleuthkit.datamodel.SleuthkitCase.findFiles	(	Content	dataSource,
		String	fileName,
		String	dirSubString ) throws TskCoreException

Parameters

dataSource	the dataSource (Image, parent-less VirtualDirectory) to search for the given file name
fileName	Pattern of the name of the file or directory to match (case insensitive, used in LIKE SQL statement).
dirSubString	Substring that must exist in parent path. Will be surrounded by % in LIKE query

Returns: a list of AbstractFile for files/directories whose name matches fileName and whose parent directory contains dirName.

Exceptions

References acquireSingleUserCaseReadLock(), releaseSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME, and org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_FILES_BY_EXTENSION_AND_DATA_SOURCE_AND_PARENT_PATH_AND_NAME.

Definition at line 6629 of file SleuthkitCase.java.

◆ findFilesByMd5()

List< AbstractFile > org.sleuthkit.datamodel.SleuthkitCase.findFilesByMd5 ( String md5Hash )

Find all the files with the given MD5 hash.

Parameters

md5Hash hash value to match files with

Returns: List of AbstractFile with the given hash

Definition at line 11938 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

◆ findFilesInFolder()

List< AbstractFile > org.sleuthkit.datamodel.SleuthkitCase.findFilesInFolder	(	String	fileName,
		AbstractFile	parentFile ) throws TskCoreException

Find all files by name and parent

Parameters

fileName	Pattern of the name of the file or directory to match (case insensitive, used in LIKE SQL statement).
parentFile	Object for parent file/directory to find children in

Returns: a list of AbstractFile for files/directories whose name matches fileName and that were inside a directory described by parentFile.

Exceptions

References acquireSingleUserCaseReadLock(), releaseSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_FILES_BY_EXTENSION_AND_PARENT_AND_NAME, and org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_FILES_BY_PARENT_AND_NAME.

Definition at line 9362 of file SleuthkitCase.java.

Referenced by findFiles().

◆ findFilesWhere()

List< FsContent > org.sleuthkit.datamodel.SleuthkitCase.findFilesWhere ( String sqlWhereClause ) throws TskCoreException

Find and return list of files matching the specific Where clause. Use findAllFilesWhere instead. It returns a more generic data type

Parameters

sqlWhereClause a SQL where clause appropriate for the desired files (do not begin the WHERE clause with the word WHERE!)

Returns: a list of FsContent each of which satisfy the given WHERE clause

Exceptions

Deprecated: use SleuthkitCase.findAllFilesWhere() instead

Definition at line 14958 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM.FS, org.sleuthkit.datamodel.AbstractFile.getType(), and releaseSingleUserCaseReadLock().

◆ getAbstractFileById()

AbstractFile org.sleuthkit.datamodel.SleuthkitCase.getAbstractFileById ( long id ) throws TskCoreException

Get abstract file object from tsk_files table by its id

Parameters

id	id of the file object in tsk_files table

Returns: AbstractFile object populated, or null if not found.

Exceptions

TskCoreException thrown if critical error occurred within tsk core and file could not be queried

Definition at line 6349 of file SleuthkitCase.java.

References getAbstractFileById().

Referenced by org.sleuthkit.datamodel.blackboardutils.CommunicationArtifactsHelper.addAttachments(), addLocalDirectory(), addVirtualDirectory(), getAbstractFileById(), getContentById(), and getRootObjects().

◆ getAllBlackboardArtifactTags()

List< BlackboardArtifactTag > org.sleuthkit.datamodel.SleuthkitCase.getAllBlackboardArtifactTags ( ) throws TskCoreException

Selects all of the rows from the blackboard_artifacts_tags table in the case database.

Returns: A list, possibly empty, of BlackboardArtifactTag data transfer objects (DTOs) for the rows.

Exceptions

References acquireSingleUserCaseReadLock(), getBlackboardArtifact(), org.sleuthkit.datamodel.TagName.HTML_COLOR.getColorByName(), getContentById(), org.sleuthkit.datamodel.BlackboardArtifact.getObjectID(), releaseSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS, and org.sleuthkit.datamodel.TskData.TagType.valueOf().

Definition at line 12637 of file SleuthkitCase.java.

◆ getAllContentTags()

List< ContentTag > org.sleuthkit.datamodel.SleuthkitCase.getAllContentTags ( ) throws TskCoreException

Selects all of the rows from the content_tags table in the case database.

Returns: A list, possibly empty, of ContentTag data transfer objects (DTOs) for the rows.

Exceptions

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.TagName.HTML_COLOR.getColorByName(), getContentById(), releaseSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_CONTENT_TAGS, and org.sleuthkit.datamodel.TskData.TagType.valueOf().

Definition at line 12247 of file SleuthkitCase.java.

◆ getAllReports()

List< Report > org.sleuthkit.datamodel.SleuthkitCase.getAllReports ( ) throws TskCoreException

Selects all of the rows from the reports table in the case database.

Returns: A list, possibly empty, of Report data transfer objects (DTOs) for the rows.

Exceptions

Definition at line 13088 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.Content.close(), getContentById(), getDbDirPath(), releaseSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_REPORTS.

◆ getAllTagNames()

List< TagName > org.sleuthkit.datamodel.SleuthkitCase.getAllTagNames ( ) throws TskCoreException

Selects all of the rows from the tag_names table in the case database.

Returns: A list, possibly empty, of TagName data transfer objects (DTOs) for the rows.

Exceptions

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.TagName.HTML_COLOR.getColorByName(), releaseSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_TAG_NAMES, and org.sleuthkit.datamodel.TskData.TagType.valueOf().

Definition at line 12040 of file SleuthkitCase.java.

◆ getArtifactByArtifactId()

BlackboardArtifact org.sleuthkit.datamodel.SleuthkitCase.getArtifactByArtifactId ( long id ) throws TskCoreException

Get artifact from blackboard_artifacts table by its artifact_id

Parameters

id	Artifact ID of the artifact in blackboard_artifacts table

Returns: Artifact object populated, or null if not found.

Exceptions

TskCoreException thrown if critical error occurred within tsk core and file could not be queried

Deprecated: Use the type specific methods in Blackboard getAnalysisResultsById and getDataArtifactById

Definition at line 6455 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

◆ getArtifactById()

BlackboardArtifact org.sleuthkit.datamodel.SleuthkitCase.getArtifactById ( long id ) throws TskCoreException

Get artifact from blackboard_artifacts table by its artifact_obj_id

Parameters

id	id of the artifact in blackboard_artifacts table (artifact_obj_id column)

Returns: Artifact object populated, or null if not found.

Exceptions

TskCoreException thrown if critical error occurred within tsk core and file could not be queried

Definition at line 6403 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), releaseSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_ARTIFACT_TYPE_BY_ARTIFACT_OBJ_ID.

Referenced by getContentById().

◆ getArtifactType()

BlackboardArtifact.Type org.sleuthkit.datamodel.SleuthkitCase.getArtifactType ( String artTypeName ) throws TskCoreException

Get the artifact type associated with an artifact type name.

Parameters

artTypeName An artifact type name.

Returns: An artifact type or null if the artifact type does not exist.

Exceptions

TskCoreException If an error occurs accessing the case database.

Deprecated: Use Blackboard.getArtifactType instead

Definition at line 5224 of file SleuthkitCase.java.

Referenced by getBlackboardArtifacts(), getBlackboardArtifacts(), and getBlackboardArtifactsCount().

◆ getArtifactTypeID()

int org.sleuthkit.datamodel.SleuthkitCase.getArtifactTypeID ( String artifactTypeName ) throws TskCoreException

Get the artifact type id associated with an artifact type name.

Parameters

artifactTypeName An artifact type name.

Returns: An artifact id or -1 if the attribute type does not exist.

Exceptions

TskCoreException If an error occurs accessing the case database.

Deprecated: Use getArtifactType instead

Definition at line 14998 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

◆ getArtifactTypes()

Iterable< BlackboardArtifact.Type > org.sleuthkit.datamodel.SleuthkitCase.getArtifactTypes ( ) throws TskCoreException

Gets a list of all the artifact types for this case

Returns: a list of artifact types

Exceptions

TskCoreException when there is an error getting the types

Definition at line 4451 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.fromID(), and releaseSingleUserCaseReadLock().

◆ getArtifactTypesInUse()

List< BlackboardArtifact.Type > org.sleuthkit.datamodel.SleuthkitCase.getArtifactTypesInUse ( ) throws TskCoreException

Gets the list of all unique artifact IDs in use.

Gets both static and dynamic IDs.

Returns: The list of unique IDs

Exceptions

TskCoreException exception thrown if a critical error occurred within tsk core

Definition at line 4528 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.fromID(), and releaseSingleUserCaseReadLock().

◆ getAttributeType()

BlackboardAttribute.Type org.sleuthkit.datamodel.SleuthkitCase.getAttributeType ( String attrTypeName ) throws TskCoreException

Get the attribute type associated with an attribute type name.

Parameters

attrTypeName An attribute type name.

Returns: An attribute type or null if the attribute type does not exist.

Exceptions

TskCoreException If an error occurs accessing the case database.

Deprecated: Use Blackboard.getAttributeType instead

Definition at line 5208 of file SleuthkitCase.java.

◆ getAttributeTypes()

List< BlackboardAttribute.Type > org.sleuthkit.datamodel.SleuthkitCase.getAttributeTypes ( ) throws TskCoreException

Gets a list of all the attribute types for this case

Returns: a list of attribute types

Exceptions

TskCoreException when there is an error getting the types

Definition at line 4568 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromType(), and releaseSingleUserCaseReadLock().

◆ getAttrTypeDisplayName()

String org.sleuthkit.datamodel.SleuthkitCase.getAttrTypeDisplayName ( int attrTypeID ) throws TskCoreException

Get the display name for the attribute with the given id. Will throw an error if that id does not exist

Parameters

attrTypeID attribute id

Returns: string associated with the given id

Exceptions

TskCoreException exception thrown if a critical error occurs within tsk core

Deprecated: Use getAttributeType instead

Definition at line 15164 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

◆ getAttrTypeID()

int org.sleuthkit.datamodel.SleuthkitCase.getAttrTypeID ( String attrTypeName ) throws TskCoreException

Gets the attribute type id associated with an attribute type name.

Parameters

attrTypeName An attribute type name.

Returns: An attribute id or -1 if the attribute type does not exist.

Exceptions

TskCoreException If an error occurs accessing the case database.

Deprecated: Use SleuthkitCase.getAttributeType() instead.

Definition at line 15090 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

◆ getAttrTypeString()

String org.sleuthkit.datamodel.SleuthkitCase.getAttrTypeString ( int attrTypeID ) throws TskCoreException

Get the string associated with the given id. Will throw an error if that id does not exist

Parameters

attrTypeID attribute id

Returns: string associated with the given id

Exceptions

TskCoreException exception thrown if a critical error occurs within tsk core

Deprecated: Use getAttributeType instead

Definition at line 15127 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

◆ getBackupDatabasePath()

String org.sleuthkit.datamodel.SleuthkitCase.getBackupDatabasePath ( )

Returns the path of a backup copy of the database made when a schema version upgrade has occurred.

Returns: The path of the backup file or null if no backup was made.

Definition at line 3064 of file SleuthkitCase.java.

◆ getBlackboard()

Blackboard org.sleuthkit.datamodel.SleuthkitCase.getBlackboard ( )

Gets the artifacts blackboard for this case.

Returns: The per case Blackboard object.

Definition at line 586 of file SleuthkitCase.java.

Referenced by org.sleuthkit.datamodel.AbstractFile.getAttributes(), org.sleuthkit.datamodel.BlackboardArtifact.getAttributes(), and org.sleuthkit.datamodel.BlackboardArtifact.getType().

◆ getBlackboardArtifact()

BlackboardArtifact org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifact ( long artifactID ) throws TskCoreException

Get the blackboard artifact with the given artifact id (artifact_id in blackboard_artifacts)

Parameters

artifactID artifact ID (artifact_id column)

Returns: blackboard artifact

Exceptions

TskCoreException exception thrown if a critical error occurs within TSK core

Definition at line 4895 of file SleuthkitCase.java.

Referenced by getAllBlackboardArtifactTags(), getBlackboardArtifactTagByID(), getBlackboardArtifactTagsByTagName(), and getBlackboardArtifactTagsByTagName().

◆ getBlackboardArtifacts() [1/13]

ArrayList< BlackboardArtifact > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts ( ARTIFACT_TYPE artifactType ) throws TskCoreException

Get all blackboard artifacts of a given type. Does not included rejected artifacts.

Parameters

artifactType artifact type enum

Returns: list of blackboard artifacts

Exceptions

TskCoreException exception thrown if a critical error occurs within TSK core

Definition at line 4799 of file SleuthkitCase.java.

◆ getBlackboardArtifacts() [2/13]

List< BlackboardArtifact > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts	(	ARTIFACT_TYPE	artifactType,
		BlackboardAttribute.ATTRIBUTE_TYPE	attrType,
		String	value ) throws TskCoreException

Get all blackboard artifacts of a given type with an attribute of a given type and String value. Does not included rejected artifacts.

Parameters

artifactType	artifact type enum
attrType	attribute type enum
value	String value of attribute

Returns: list of blackboard artifacts

Exceptions

TskCoreException exception thrown if a critical error occurs within TSK core

Deprecated: Do not use.

Definition at line 4821 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, org.sleuthkit.datamodel.Score.Priority.fromID(), org.sleuthkit.datamodel.Score.Significance.fromID(), org.sleuthkit.datamodel.BlackboardArtifact.ReviewStatus.REJECTED, releaseSingleUserCaseReadLock(), and org.sleuthkit.datamodel.BlackboardArtifact.ReviewStatus.withID().

◆ getBlackboardArtifacts() [3/13]

ArrayList< BlackboardArtifact > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts	(	ARTIFACT_TYPE	artifactType,
		long	obj_id ) throws TskCoreException

Get all blackboard artifacts of a given type for the given object id. Does not included rejected artifacts.

Parameters

artifactType	artifact type enum
obj_id	object id

Returns: list of blackboard artifacts

Exceptions

TskCoreException exception thrown if a critical error occurs within TSK core

Definition at line 4715 of file SleuthkitCase.java.

References getBlackboardArtifacts().

◆ getBlackboardArtifacts() [4/13]

List< BlackboardArtifact > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts	(	BlackboardAttribute.ATTRIBUTE_TYPE	attrType,
		byte	value ) throws TskCoreException

Get all blackboard artifacts that have an attribute of the given type and byte value. Does not include rejected artifacts.

Parameters

attrType	attribute of this attribute type to look for in the artifacts
value	value of the attribute of the attrType type to look for

Returns: a list of blackboard artifacts with such an attribute

Exceptions

TskCoreException exception thrown if a critical error occurred within tsk core and artifacts could not be queried

Deprecated: Do not use.

Definition at line 4403 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, org.sleuthkit.datamodel.BlackboardArtifact.ReviewStatus.REJECTED, and releaseSingleUserCaseReadLock().

◆ getBlackboardArtifacts() [5/13]

List< BlackboardArtifact > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts	(	BlackboardAttribute.ATTRIBUTE_TYPE	attrType,
		double	value ) throws TskCoreException

Get all blackboard artifacts that have an attribute of the given type and double value. Does not included rejected artifacts.

Parameters

attrType	attribute of this attribute type to look for in the artifacts
value	value of the attribute of the attrType type to look for

Returns: a list of blackboard artifacts with such an attribute

Exceptions

TskCoreException exception thrown if a critical error occurred within tsk core and artifacts could not be queried

Deprecated: Do not use.

Definition at line 4346 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, org.sleuthkit.datamodel.BlackboardArtifact.ReviewStatus.REJECTED, and releaseSingleUserCaseReadLock().

◆ getBlackboardArtifacts() [6/13]

List< BlackboardArtifact > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts	(	BlackboardAttribute.ATTRIBUTE_TYPE	attrType,
		int	value ) throws TskCoreException

Get all blackboard artifacts that have an attribute of the given type and integer value. Does not included rejected artifacts.

Parameters

attrType	attribute of this attribute type to look for in the artifacts
value	value of the attribute of the attrType type to look for

Returns: a list of blackboard artifacts with such an attribute

Exceptions

TskCoreException exception thrown if a critical error occurred within tsk core and artifacts could not be queried

Deprecated: Do not use.

Definition at line 4232 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, org.sleuthkit.datamodel.BlackboardArtifact.ReviewStatus.REJECTED, and releaseSingleUserCaseReadLock().

◆ getBlackboardArtifacts() [7/13]

List< BlackboardArtifact > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts	(	BlackboardAttribute.ATTRIBUTE_TYPE	attrType,
		long	value ) throws TskCoreException

Get all blackboard artifacts that have an attribute of the given type and long value. Does not included rejected artifacts.

Parameters

attrType	attribute of this attribute type to look for in the artifacts
value	value of the attribute of the attrType type to look for

Returns: a list of blackboard artifacts with such an attribute

Exceptions

TskCoreException exception thrown if a critical error occurred within tsk core and artifacts could not be queried

Deprecated: Do not use.

Definition at line 4289 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, org.sleuthkit.datamodel.BlackboardArtifact.ReviewStatus.REJECTED, and releaseSingleUserCaseReadLock().

◆ getBlackboardArtifacts() [8/13]

List< BlackboardArtifact > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts	(	BlackboardAttribute.ATTRIBUTE_TYPE	attrType,
		String	subString,
		boolean	startsWith ) throws TskCoreException

Get all blackboard artifacts that have an attribute of the given type and String value. Does not included rejected artifacts.

Parameters

attrType	attribute of this attribute type to look for in the artifacts
subString	value substring of the string attribute of the attrType type to look for
startsWith	if true, the artifact attribute string should start with the substring, if false, it should just contain it

Returns: a list of blackboard artifacts with such an attribute

Exceptions

TskCoreException exception thrown if a critical error occurred within tsk core and artifacts could not be queried

Deprecated: Do not use.

Definition at line 4171 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, org.sleuthkit.datamodel.BlackboardArtifact.ReviewStatus.REJECTED, and releaseSingleUserCaseReadLock().

◆ getBlackboardArtifacts() [9/13]

List< BlackboardArtifact > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts	(	BlackboardAttribute.ATTRIBUTE_TYPE	attrType,
		String	value ) throws TskCoreException

Get all blackboard artifacts that have an attribute of the given type and String value. Does not included rejected artifacts.

Parameters

attrType	attribute of this attribute type to look for in the artifacts
value	value of the attribute of the attrType type to look for

Returns: a list of blackboard artifacts with such an attribute

Exceptions

TskCoreException exception thrown if a critical error occurred within tsk core and artifacts could not be queried

Deprecated: Do not use.

Definition at line 4111 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, org.sleuthkit.datamodel.BlackboardArtifact.ReviewStatus.REJECTED, and releaseSingleUserCaseReadLock().

◆ getBlackboardArtifacts() [10/13]

ArrayList< BlackboardArtifact > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts ( int artifactTypeID ) throws TskCoreException

Get all blackboard artifacts of a given type. Does not included rejected artifacts.

Parameters

artifactTypeID artifact type id (must exist in database)

Returns: list of blackboard artifacts.

Exceptions

Deprecated: Use Blackboard.getArtifacts with the desired type(s) and data source(s) as arguments instead.

Definition at line 3978 of file SleuthkitCase.java.

Referenced by getBlackboardArtifacts().

◆ getBlackboardArtifacts() [11/13]

ArrayList< BlackboardArtifact > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts	(	int	artifactTypeID,
		long	obj_id ) throws TskCoreException

Get all blackboard artifacts of a given type for the given object id. Does not included rejected artifacts.

Parameters

artifactTypeID	artifact type id (must exist in database)
obj_id	object id

Returns: list of blackboard artifacts

Exceptions

TskCoreException exception thrown if a critical error occurs within TSK core

Definition at line 4697 of file SleuthkitCase.java.

◆ getBlackboardArtifacts() [12/13]

ArrayList< BlackboardArtifact > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts ( String artifactTypeName ) throws TskCoreException

Get all blackboard artifacts of a given type. Does not included rejected artifacts.

Parameters

artifactTypeName artifact type name

Returns: list of blackboard artifacts

Exceptions

TskCoreException exception thrown if a critical error occurs within TSK core

Definition at line 4782 of file SleuthkitCase.java.

References getArtifactType().

◆ getBlackboardArtifacts() [13/13]

ArrayList< BlackboardArtifact > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts	(	String	artifactTypeName,
		long	obj_id ) throws TskCoreException

Get all blackboard artifacts of a given type for the given source (object id). Does not included rejected artifacts.

Parameters

artifactTypeName	artifact type name
obj_id	object id

Returns: list of blackboard artifacts

Exceptions

TskCoreException exception thrown if a critical error occurs within TSK core

Definition at line 4679 of file SleuthkitCase.java.

References getArtifactType().

◆ getBlackboardArtifactsCount() [1/4]

long org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactsCount	(	ARTIFACT_TYPE	artifactType,
		long	obj_id ) throws TskCoreException

Get count of all blackboard artifacts of a given type for the given object id. Does not include rejected artifacts.

Parameters

artifactType	artifact type enum
obj_id	object id

Returns: count of blackboard artifacts

Exceptions

TskCoreException exception thrown if a critical error occurs within TSK core

Definition at line 4767 of file SleuthkitCase.java.

◆ getBlackboardArtifactsCount() [2/4]

long org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactsCount	(	int	artifactTypeID,
		long	obj_id ) throws TskCoreException

Get count of all blackboard artifacts of a given type for the given object id. Does not include rejected artifacts.

Parameters

artifactTypeID	artifact type id (must exist in database)
obj_id	object id

Returns: count of blackboard artifacts

Exceptions

TskCoreException exception thrown if a critical error occurs within TSK core

Definition at line 4751 of file SleuthkitCase.java.

◆ getBlackboardArtifactsCount() [3/4]

long org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactsCount ( long objId ) throws TskCoreException

Get a count of blackboard artifacts for a given content. Does not include rejected artifacts.

Parameters

objId Id of the content.

Returns: The artifacts count for the content.

Exceptions

Definition at line 3994 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.COUNT_ARTIFACTS_FROM_SOURCE, and releaseSingleUserCaseReadLock().

◆ getBlackboardArtifactsCount() [4/4]

long org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactsCount	(	String	artifactTypeName,
		long	obj_id ) throws TskCoreException

Get count of all blackboard artifacts of a given type for the given object id. Does not include rejected artifacts.

Parameters

artifactTypeName	artifact type name
obj_id	object id

Returns: count of blackboard artifacts

Exceptions

TskCoreException exception thrown if a critical error occurs within TSK core

Definition at line 4731 of file SleuthkitCase.java.

References getArtifactType().

◆ getBlackboardArtifactsTypeCount() [1/2]

long org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactsTypeCount ( int artifactTypeID ) throws TskCoreException

Get a count of artifacts of a given type. Does not include rejected artifacts.

Parameters

artifactTypeID Id of the artifact type.

Returns: The artifacts count for the type.

Exceptions

Definition at line 4030 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.COUNT_ARTIFACTS_OF_TYPE, and releaseSingleUserCaseReadLock().

◆ getBlackboardArtifactsTypeCount() [2/2]

long org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactsTypeCount	(	int	artifactTypeID,
		long	dataSourceID ) throws TskCoreException

Get a count of artifacts of a given type for the given data source. Does not include rejected artifacts.

Parameters

artifactTypeID	Id of the artifact type.
dataSourceID

Returns: The artifacts count for the type.

Exceptions

Definition at line 4067 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.COUNT_ARTIFACTS_OF_TYPE_BY_DATA_SOURCE, and releaseSingleUserCaseReadLock().

◆ getBlackboardArtifactTagByID()

BlackboardArtifactTag org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactTagByID ( long artifactTagID ) throws TskCoreException

Selects the row in the blackboard artifact tags table in the case database with a specified tag id.

Parameters

artifactTagID the tag id of the BlackboardArtifactTag to retrieve.

Returns: the BlackBoardArtifact Tag with the given tag id, or null if no such tag could be found

Exceptions

References acquireSingleUserCaseReadLock(), getBlackboardArtifact(), org.sleuthkit.datamodel.TagName.HTML_COLOR.getColorByName(), getContentById(), org.sleuthkit.datamodel.BlackboardArtifact.getObjectID(), releaseSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_ARTIFACT_TAG_BY_ID, and org.sleuthkit.datamodel.TskData.TagType.valueOf().

Definition at line 12872 of file SleuthkitCase.java.

◆ getBlackboardArtifactTagsByArtifact()

List< BlackboardArtifactTag > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactTagsByArtifact ( BlackboardArtifact artifact ) throws TskCoreException

Selects the rows in the blackboard_artifacts_tags table in the case database with a specified foreign key into the blackboard_artifacts table.

Parameters

artifact A data transfer object (DTO) for the artifact to match.

Returns: A list, possibly empty, of BlackboardArtifactTag data transfer objects (DTOs) for the rows.

Exceptions

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.TagName.HTML_COLOR.getColorByName(), getContentById(), releaseSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_ARTIFACT, and org.sleuthkit.datamodel.TskData.TagType.valueOf().

Definition at line 12924 of file SleuthkitCase.java.

◆ getBlackboardArtifactTagsByTagName() [1/2]

List< BlackboardArtifactTag > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactTagsByTagName ( TagName tagName ) throws TskCoreException

Selects the rows in the blackboard_artifacts_tags table in the case database with a specified foreign key into the tag_names table.

Parameters

tagName A data transfer object (DTO) for the tag name to match.

Returns: A list, possibly empty, of BlackboardArtifactTag data transfer objects (DTOs) for the rows.

Exceptions

References acquireSingleUserCaseReadLock(), getBlackboardArtifact(), getContentById(), org.sleuthkit.datamodel.BlackboardArtifact.getObjectID(), releaseSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME.

Definition at line 12769 of file SleuthkitCase.java.

◆ getBlackboardArtifactTagsByTagName() [2/2]

List< BlackboardArtifactTag > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactTagsByTagName	(	TagName	tagName,
		long	dsObjId ) throws TskCoreException

Gets artifact tags by tag name, for specified data source.

Parameters

tagName	The representation of the desired tag type in the case database, which can be obtained by calling getTagNames and/or addTagName.
dsObjId	data source object id

Returns: A list, possibly empty, of the artifact tags with the specified tag name, for the specified data source.

Exceptions

TskCoreException If there is an error getting the tags from the case database.

Definition at line 12819 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), getBlackboardArtifact(), getContentById(), org.sleuthkit.datamodel.BlackboardArtifact.getObjectID(), releaseSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME_BY_DATASOURCE.

◆ getBlackboardArtifactTagsCountByTagName() [1/2]

long org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactTagsCountByTagName ( TagName tagName ) throws TskCoreException

Gets a count of the rows in the blackboard_artifact_tags table in the case database with a specified foreign key into the tag_names table.

Parameters

tagName A data transfer object (DTO) for the tag name to match.

Returns: The count, possibly zero.

Exceptions

Definition at line 12681 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME, and releaseSingleUserCaseReadLock().

◆ getBlackboardArtifactTagsCountByTagName() [2/2]

long org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactTagsCountByTagName	(	TagName	tagName,
		long	dsObjId ) throws TskCoreException

Gets an artifact tags count by tag name, for the given data source.

Parameters

tagName	The representation of the desired tag type in the case database, which can be obtained by calling getTagNames and/or addTagName.
dsObjId	data source object id

Returns: A count of the artifact tags with the specified tag name, for the given data source.

Exceptions

TskCoreException If there is an error getting the tags count from the case database.

Definition at line 12724 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME_BY_DATASOURCE, and releaseSingleUserCaseReadLock().

◆ getBlackboardArtifactTypes()

ArrayList< BlackboardArtifact.ARTIFACT_TYPE > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactTypes ( ) throws TskCoreException

Gets a list of the standard blackboard artifact type enum objects.

Returns: The members of the BlackboardArtifact.ARTIFACT_TYPE enum.

Exceptions

TskCoreException Specified, but not thrown.

Deprecated: For a list of standard blackboard artifacts type enum objects, use BlackboardArtifact.ARTIFACT_TYPE.values.

Definition at line 15031 of file SleuthkitCase.java.

◆ getBlackboardArtifactTypesInUse()

ArrayList< BlackboardArtifact.ARTIFACT_TYPE > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactTypesInUse ( ) throws TskCoreException

Get all of the standard blackboard artifact types that are in use in the blackboard.

Returns: List of standard blackboard artifact types

Exceptions

Definition at line 4485 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.fromID(), org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.getTypeID(), and releaseSingleUserCaseReadLock().

◆ getBlackboardAttributes()

ArrayList< BlackboardAttribute > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardAttributes ( final BlackboardArtifact artifact ) throws TskCoreException

Get the list of attributes for the given artifact.

Parameters

artifact The artifact to load attributes for.

Returns: The list of attributes.

Exceptions

Deprecated: Use Blackboard.getBlackboardAttributes instead

Definition at line 5285 of file SleuthkitCase.java.

Referenced by org.sleuthkit.datamodel.BlackboardArtifact.getAttributes().

◆ getBlackboardAttributeTypes()

ArrayList< BlackboardAttribute.ATTRIBUTE_TYPE > org.sleuthkit.datamodel.SleuthkitCase.getBlackboardAttributeTypes ( ) throws TskCoreException

Gets a list of the standard blackboard attribute type enum objects.

Returns: The members of the BlackboardAttribute.ATTRIBUTE_TYPE enum.

Exceptions

TskCoreException Specified, but not thrown.

Deprecated: For a list of standard blackboard attribute types enum objects, use BlackboardAttribute.ATTRIBUTE_TYP.values.

Definition at line 15198 of file SleuthkitCase.java.

◆ getBlackboardAttributeTypesCount()

int org.sleuthkit.datamodel.SleuthkitCase.getBlackboardAttributeTypesCount ( ) throws TskCoreException

Get count of blackboard attribute types

Counts both static (in enum) and dynamic attributes types (created by modules at runtime)

Returns: count of attribute types

Exceptions

TskCoreException exception thrown if a critical error occurs within TSK core

Definition at line 4604 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

◆ getCaseDbAccessManager()

CaseDbAccessManager org.sleuthkit.datamodel.SleuthkitCase.getCaseDbAccessManager ( ) throws TskCoreException

Definition at line 617 of file SleuthkitCase.java.

◆ getCommunicationsManager()

CommunicationsManager org.sleuthkit.datamodel.SleuthkitCase.getCommunicationsManager ( ) throws TskCoreException

Gets the communications manager for this case.

Returns: The per case CommunicationsManager object.

Exceptions

Referenced by addCarvedFile(), addCarvedFiles(), getAllBlackboardArtifactTags(), getAllContentTags(), getAllReports(), getBlackboardArtifactTagByID(), getBlackboardArtifactTagsByArtifact(), getBlackboardArtifactTagsByTagName(), getBlackboardArtifactTagsByTagName(), getContentTagByID(), getContentTagsByTagName(), getContentTagsByTagName(), org.sleuthkit.datamodel.AbstractFile.getDataSource(), org.sleuthkit.datamodel.BlackboardArtifact.getDataSource(), org.sleuthkit.datamodel.BlackboardArtifact.getParent(), getReportById(), and newBlackboardArtifact().

Definition at line 577 of file SleuthkitCase.java.

◆ getContentById()

Content org.sleuthkit.datamodel.SleuthkitCase.getContentById ( long id ) throws TskCoreException

Get content object by content id

Parameters

id	to get content object for

Returns: instance of a Content object (one of its subclasses), or null if not found.

Exceptions

TskCoreException thrown if critical error occurred within tsk core

Definition at line 6084 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), getAbstractFileById(), getArtifactById(), getImageById(), org.sleuthkit.datamodel.OsAccountManager.getOsAccountByObjectId(), getReportById(), releaseSingleUserCaseReadLock(), and org.sleuthkit.datamodel.TskData.ObjectType.valueOf().

◆ getContentTagByID()

ContentTag org.sleuthkit.datamodel.SleuthkitCase.getContentTagByID ( long contentTagID ) throws TskCoreException

Selects the rows in the content_tags table in the case database with a specified tag id.

Parameters

contentTagID the tag id of the ContentTag to retrieve.

Returns: The content tag.

Exceptions

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.TagName.HTML_COLOR.getColorByName(), getContentById(), releaseSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_CONTENT_TAG_BY_ID, and org.sleuthkit.datamodel.TskData.TagType.valueOf().

Definition at line 12378 of file SleuthkitCase.java.

◆ getContentTagsByContent()

List< ContentTag > org.sleuthkit.datamodel.SleuthkitCase.getContentTagsByContent ( Content content ) throws TskCoreException

Selects the rows in the content_tags table in the case database with a specified foreign key into the tsk_objects table.

Parameters

content A data transfer object (DTO) for the content to match.

Returns: A list, possibly empty, of ContentTag data transfer objects (DTOs) for the rows.

Exceptions

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.TagName.HTML_COLOR.getColorByName(), releaseSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_CONTENT, and org.sleuthkit.datamodel.TskData.TagType.valueOf().

Definition at line 12541 of file SleuthkitCase.java.

◆ getContentTagsByTagName() [1/2]

List< ContentTag > org.sleuthkit.datamodel.SleuthkitCase.getContentTagsByTagName ( TagName tagName ) throws TskCoreException

Selects the rows in the content_tags table in the case database with a specified foreign key into the tag_names table.

Parameters

tagName A data transfer object (DTO) for the tag name to match.

Returns: A list, possibly empty, of ContentTag data transfer objects (DTOs) for the rows.

Exceptions

Definition at line 12427 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), getContentById(), releaseSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME.

◆ getContentTagsByTagName() [2/2]

List< ContentTag > org.sleuthkit.datamodel.SleuthkitCase.getContentTagsByTagName	(	TagName	tagName,
		long	dsObjId ) throws TskCoreException

Gets content tags by tag name, for the given data source. This includes looking up all Content objects that have entries in tsk_files, as well as all OsAccounts (which do not have entries in tsk_files).

Parameters

tagName	The tag name of interest.
dsObjId	data source object id

Returns: A list, possibly empty, of the content tags with the specified tag name, and for the given data source.

Exceptions

TskCoreException If there is an error getting the tags from the case database.

Definition at line 12476 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), getContentById(), releaseSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE.

◆ getContentTagsCountByTagName() [1/2]

long org.sleuthkit.datamodel.SleuthkitCase.getContentTagsCountByTagName ( TagName tagName ) throws TskCoreException

Gets a count of the rows in the content_tags table in the case database with a specified foreign key into the tag_names table.

Parameters

tagName A data transfer object (DTO) for the tag name to match.

Returns: The count, possibly zero.

Exceptions

Definition at line 12289 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME, and releaseSingleUserCaseReadLock().

◆ getContentTagsCountByTagName() [2/2]

long org.sleuthkit.datamodel.SleuthkitCase.getContentTagsCountByTagName	(	TagName	tagName,
		long	dsObjId ) throws TskCoreException

Gets content tags count by tag name, for the given data source

Parameters

tagName	The representation of the desired tag type in the case database, which can be obtained by calling getTagNames and/or addTagName.
dsObjId	data source object id

Returns: A count of the content tags with the specified tag name, and for the given data source

Exceptions

TskCoreException If there is an error getting the tags count from the case database.

Definition at line 12333 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE, and releaseSingleUserCaseReadLock().

◆ getCurrentExaminer()

Examiner org.sleuthkit.datamodel.SleuthkitCase.getCurrentExaminer ( ) throws TskCoreException

Returns the Examiner object for currently logged in user

Returns: A Examiner object.

Exceptions

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.TskData.TSK_FS_META_FLAG_ENUM.ALLOC, org.sleuthkit.datamodel.TskData.TSK_FS_NAME_FLAG_ENUM.ALLOC, org.sleuthkit.datamodel.TskData.TSK_FS_NAME_TYPE_ENUM.DIR, releaseSingleUserCaseReadLock(), org.sleuthkit.datamodel.TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR, org.sleuthkit.datamodel.TskData.FileKnown.UNKNOWN, and org.sleuthkit.datamodel.TskData.TSK_FS_META_FLAG_ENUM.USED.

Definition at line 3534 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), releaseSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_EXAMINER_BY_LOGIN_NAME.

◆ getDatabaseName()

String org.sleuthkit.datamodel.SleuthkitCase.getDatabaseName ( )

Gets the case database name.

Returns: The case database name.

Definition at line 3115 of file SleuthkitCase.java.

◆ getDatabaseType()

DbType org.sleuthkit.datamodel.SleuthkitCase.getDatabaseType ( )

Returns the type of database in use.

Returns: database type

Definition at line 3054 of file SleuthkitCase.java.

Referenced by org.sleuthkit.datamodel.CaseDbAccessManager.select().

◆ getDataSource()

DataSource org.sleuthkit.datamodel.SleuthkitCase.getDataSource ( long objectId ) throws TskDataException, TskCoreException

Gets a specific data source for the case. If it is an image, an Image will be instantiated. Otherwise, a LocalFilesDataSource will be instantiated.

NOTE: The DataSource class is an emerging feature and at present is only useful for obtaining the object id and the data source identifier, an ASCII-printable identifier for the data source that is intended to be unique across multiple cases (e.g., a UUID). In the future, this method will be a replacement for the getRootObjects method.

Parameters

objectId The object id of the data source.

Returns: The data source.

Exceptions

TskDataException	If there is no data source for the given object id.
TskCoreException	If there is a problem getting the data source.

Definition at line 3885 of file SleuthkitCase.java.

◆ getDataSources()

List< DataSource > org.sleuthkit.datamodel.SleuthkitCase.getDataSources ( ) throws TskCoreException

Gets the data sources for the case. For each data source, if it is an image, an Image will be instantiated. Otherwise, a LocalFilesDataSource will be instantiated.

NOTE: The DataSource interface is an emerging feature and at present is only useful for obtaining the object id and the device id, an ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID). In the future, this method will be a replacement for the getRootObjects method.

Returns: A list of the data sources for the case.

Exceptions

TskCoreException if there is a problem getting the data sources.

Definition at line 3780 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.TskData.TSK_FS_META_FLAG_ENUM.ALLOC, org.sleuthkit.datamodel.TskData.TSK_FS_NAME_FLAG_ENUM.ALLOC, org.sleuthkit.datamodel.TskData.TSK_FS_NAME_TYPE_ENUM.DIR, getImagePaths(), releaseSingleUserCaseReadLock(), org.sleuthkit.datamodel.TskData.TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR, org.sleuthkit.datamodel.TskData.FileKnown.UNKNOWN, and org.sleuthkit.datamodel.TskData.TSK_FS_META_FLAG_ENUM.USED.

◆ getDbDirPath()

String org.sleuthkit.datamodel.SleuthkitCase.getDbDirPath ( )

Get the full path to the case directory. For a SQLite case database, this is the same as the database directory path.

Returns: Case directory path.

Definition at line 3125 of file SleuthkitCase.java.

Referenced by addReport(), getAllReports(), and getReportById().

◆ getDBSchemaCreationVersion()

CaseDbSchemaVersionNumber org.sleuthkit.datamodel.SleuthkitCase.getDBSchemaCreationVersion ( )

Gets the creation version of the database schema.

Returns: the creation version for the database schema, the creation version will be 0.0 for databases created prior to 8.2

Definition at line 3045 of file SleuthkitCase.java.

◆ getDBSchemaVersion()

VersionNumber org.sleuthkit.datamodel.SleuthkitCase.getDBSchemaVersion ( )

Gets the database schema version in use.

Returns: the database schema version in use.

Definition at line 3035 of file SleuthkitCase.java.

Referenced by getSchemaVersion().

◆ getFileManager()

FileManager org.sleuthkit.datamodel.SleuthkitCase.getFileManager ( )

Gets the file manager for this case.

Returns: The per case FileManager object.

Definition at line 595 of file SleuthkitCase.java.

◆ getFileRanges()

List< TskFileRange > org.sleuthkit.datamodel.SleuthkitCase.getFileRanges ( long id ) throws TskCoreException

Get file layout ranges from tsk_file_layout, for a file with specified id

Parameters

id	of the file to get file layout ranges for

Returns: list of populated file ranges

Exceptions

TskCoreException thrown if a critical error occurred within tsk core

Definition at line 9581 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

Referenced by org.sleuthkit.datamodel.AbstractFile.getRanges().

◆ getFileSystems()

Collection< FileSystem > org.sleuthkit.datamodel.SleuthkitCase.getFileSystems ( Image image )

Helper to return FileSystems in an Image

Parameters

image Image to lookup FileSystem for

Returns: Collection of FileSystems in the image

Deprecated: Use getImageFileSystems which throws an exception if an error occurs.

Definition at line 15490 of file SleuthkitCase.java.

References org.sleuthkit.datamodel.AbstractContent.getId(), and getImageFileSystems().

◆ getHostAddressManager()

HostAddressManager org.sleuthkit.datamodel.SleuthkitCase.getHostAddressManager ( ) throws TskCoreException

Gets the HostAddress manager for this case.

Returns: The per case HostAddressManager object.

Exceptions

Definition at line 692 of file SleuthkitCase.java.

◆ getHostManager()

HostManager org.sleuthkit.datamodel.SleuthkitCase.getHostManager ( ) throws TskCoreException

Gets the Hosts manager for this case.

Returns: The per case HostManager object.

Exceptions

Definition at line 670 of file SleuthkitCase.java.

Referenced by addImage(), addLocalFilesDataSource(), org.sleuthkit.datamodel.Image.getHost(), and org.sleuthkit.datamodel.LocalFilesDataSource.getHost().

◆ getImageById()

Image org.sleuthkit.datamodel.SleuthkitCase.getImageById ( long id ) throws TskCoreException

Get am image by the image object id

Parameters

id	of the image object

Returns: Image object populated

Exceptions

TskCoreException thrown if a critical error occurred within tsk core

Definition at line 9617 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

Referenced by addImageInfo(), getContentById(), getImages(), and getRootObjects().

◆ getImageFileSystems()

Collection< FileSystem > org.sleuthkit.datamodel.SleuthkitCase.getImageFileSystems ( Image image ) throws TskCoreException

Helper to return FileSystems in an Image

Parameters

image Image to lookup FileSystem for

Returns: Collection of FileSystems in the image

Exceptions

Definition at line 10018 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), releaseSingleUserCaseReadLock(), and org.sleuthkit.datamodel.TskData.TSK_FS_TYPE_ENUM.valueOf().

Referenced by getFileSystems().

◆ getImagePaths()

Map< Long, List< String > > org.sleuthkit.datamodel.SleuthkitCase.getImagePaths ( ) throws TskCoreException

Returns a map of image object IDs to a list of fully qualified file paths for that image

Returns: map of image object IDs to file paths

Exceptions

TskCoreException thrown if a critical error occurred within tsk core

Definition at line 10381 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

Referenced by getDataSources().

◆ getImages()

List< Image > org.sleuthkit.datamodel.SleuthkitCase.getImages ( ) throws TskCoreException

Returns: a collection of Images associated with this instance of SleuthkitCase

Exceptions

Definition at line 10458 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), getImageById(), and releaseSingleUserCaseReadLock().

Referenced by org.sleuthkit.datamodel.Examples.Sample.run().

◆ getIngestJobs()

final List< IngestJobInfo > org.sleuthkit.datamodel.SleuthkitCase.getIngestJobs ( ) throws TskCoreException

Gets all of the ingest jobs that have been run.

Returns: The information about the ingest jobs that have been run

Exceptions

TskCoreException If there is a problem getting the ingest jobs

Definition at line 13421 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.IngestJobInfo.IngestJobStatusType.fromID(), and releaseSingleUserCaseReadLock().

◆ getLastObjectId()

long org.sleuthkit.datamodel.SleuthkitCase.getLastObjectId ( ) throws TskCoreException

Get last (max) object id of content object in tsk_objects.

Returns: currently max id

Exceptions

TskCoreException exception thrown when database error occurs and last object id could not be queried

Deprecated: Do not use, assumes a single-threaded, single-user case.

Definition at line 14920 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), releaseSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_MAX_OBJECT_ID.

◆ getMatchingArtifacts()

ArrayList< BlackboardArtifact > org.sleuthkit.datamodel.SleuthkitCase.getMatchingArtifacts ( String whereClause ) throws TskCoreException

Get all artifacts that match a where clause. The clause should begin with "WHERE" or "JOIN". To use this method you must know the database tables

Parameters

whereClause a sqlite where clause

Returns: a list of matching artifacts

Exceptions

TskCoreException exception thrown if a critical error occurs within tsk core Query the Database

Definition at line 5357 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, and releaseSingleUserCaseReadLock().

◆ getMatchingAttributes()

ArrayList< BlackboardAttribute > org.sleuthkit.datamodel.SleuthkitCase.getMatchingAttributes ( String whereClause ) throws TskCoreException

Get all attributes that match a where clause. The clause should begin with "WHERE" or "JOIN". To use this method you must know the database tables

Parameters

whereClause a sqlite where clause

Returns: a list of matching attributes

Exceptions

TskCoreException exception thrown if a critical error occurs within tsk core Query the Database

Definition at line 5302 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

◆ getOsAccountManager()

OsAccountManager org.sleuthkit.datamodel.SleuthkitCase.getOsAccountManager ( ) throws TskCoreException

Gets the OS account manager for this case.

Returns: The per case OsAccountManager object.

Exceptions

Definition at line 659 of file SleuthkitCase.java.

◆ getOsAccountRealmManager()

OsAccountRealmManager org.sleuthkit.datamodel.SleuthkitCase.getOsAccountRealmManager ( ) throws TskCoreException

Gets the OS account realm manager for this case.

Returns: The per case OsAccountRealmManager object.

Exceptions

Definition at line 648 of file SleuthkitCase.java.

◆ getPersonManager()

PersonManager org.sleuthkit.datamodel.SleuthkitCase.getPersonManager ( ) throws TskCoreException

Gets the Person manager for this case.

Returns: The per case PersonManager object.

Exceptions

Definition at line 681 of file SleuthkitCase.java.

◆ getReportById()

Report org.sleuthkit.datamodel.SleuthkitCase.getReportById ( long id ) throws TskCoreException

Get a Report object for the given id.

Parameters

id

Returns: A new Report object for the given id.

Exceptions

Definition at line 13152 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), getContentById(), getDbDirPath(), releaseSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_REPORT_BY_ID.

Referenced by getContentById().

◆ getRootObjects()

List< Content > org.sleuthkit.datamodel.SleuthkitCase.getRootObjects ( ) throws TskCoreException

Get the list of root objects (data sources) from the case database, e.g., image files, logical (local) files, virtual directories.

Returns: List of content objects representing root objects.

Exceptions

Definition at line 3658 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), getAbstractFileById(), getImageById(), releaseSingleUserCaseReadLock(), and org.sleuthkit.datamodel.TskData.ObjectType.valueOf().

◆ getSchemaVersion()

int org.sleuthkit.datamodel.SleuthkitCase.getSchemaVersion ( )

Returns case database schema version number. As of TSK 4.5.0 db schema versions are two part Major.minor. This method only returns the major part. Use getDBSchemaVersion() for the complete version.

Returns: The schema version number as an integer.

Deprecated: since 4.5.0 Use getDBSchemaVersion() instead for more complete version info.

Definition at line 3026 of file SleuthkitCase.java.

References getDBSchemaVersion(), and org.sleuthkit.datamodel.VersionNumber.getMajor().

◆ getScoringManager()

ScoringManager org.sleuthkit.datamodel.SleuthkitCase.getScoringManager ( ) throws TskCoreException

Gets the scoring manager for this case.

Returns: The per case ScoringManager object.

Exceptions

Definition at line 637 of file SleuthkitCase.java.

Referenced by deleteBlackboardArtifactTag(), and deleteContentTag().

◆ getTaggingManager()

TaggingManager org.sleuthkit.datamodel.SleuthkitCase.getTaggingManager ( )

Get the case database TaggingManager object.

Returns: The per case TaggingManager object.

Definition at line 626 of file SleuthkitCase.java.

Referenced by addOrUpdateTagName().

◆ getTagNamesInUse() [1/2]

List< TagName > org.sleuthkit.datamodel.SleuthkitCase.getTagNamesInUse ( ) throws TskCoreException

Selects all of the rows from the tag_names table in the case database for which there is at least one matching row in the content_tags or blackboard_artifact_tags tables.

Returns: A list, possibly empty, of TagName data transfer objects (DTOs) for the rows.

Exceptions

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.TagName.HTML_COLOR.getColorByName(), releaseSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE, and org.sleuthkit.datamodel.TskData.TagType.valueOf().

Definition at line 12076 of file SleuthkitCase.java.

◆ getTagNamesInUse() [2/2]

List< TagName > org.sleuthkit.datamodel.SleuthkitCase.getTagNamesInUse ( long dsObjId ) throws TskCoreException

Selects all of the rows from the tag_names table in the case database for which there is at least one matching row in the content_tags or blackboard_artifact_tags tables, for the given data source object id.

Parameters

dsObjId data source object id

Returns: A list, possibly empty, of TagName data transfer objects (DTOs) for the rows.

Exceptions

References acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.TagName.HTML_COLOR.getColorByName(), releaseSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE_BY_DATASOURCE, and org.sleuthkit.datamodel.TskData.TagType.valueOf().

Definition at line 12114 of file SleuthkitCase.java.

◆ getTimelineManager()

TimelineManager org.sleuthkit.datamodel.SleuthkitCase.getTimelineManager ( ) throws TskCoreException

Gets the communications manager for this case.

Returns: The per case TimelineManager object.

Exceptions

Definition at line 606 of file SleuthkitCase.java.

Referenced by addDerivedFile(), addFileSystemFile(), and addLocalFile().

◆ getVirtualDirectoryRoots()

List< VirtualDirectory > org.sleuthkit.datamodel.SleuthkitCase.getVirtualDirectoryRoots ( ) throws TskCoreException

Get IDs of the virtual folder roots (at the same level as image), used for containers such as for local files.

Returns: IDs of virtual directory root objects.

Exceptions

References org.sleuthkit.datamodel.AnalysisResultAdded.getAnalysisResult(), getContentById(), org.sleuthkit.datamodel.BlackboardArtifact.Category.getName(), org.sleuthkit.datamodel.Content.newAnalysisResult(), org.sleuthkit.datamodel.Content.newDataArtifact(), and org.sleuthkit.datamodel.Score.SCORE_UNKNOWN.

Definition at line 7799 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), releaseSingleUserCaseReadLock(), and org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.

◆ isFileFromSource()

boolean org.sleuthkit.datamodel.SleuthkitCase.isFileFromSource	(	Content	dataSource,
		long	fileId ) throws TskCoreException

Checks if the file is a (sub)child of the data source (parentless Content object such as Image or VirtualDirectory representing filesets)

Parameters

dataSource	dataSource to check
fileId	id of file to check

Returns: true if the file is in the dataSource hierarchy

Exceptions

TskCoreException thrown if check failed

Definition at line 6527 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

◆ makeAddImageProcess() [1/3]

AddImageProcess org.sleuthkit.datamodel.SleuthkitCase.makeAddImageProcess	(	String	timezone,
		boolean	addUnallocSpace,
		boolean	noFatFsOrphans )

Start process of adding a image to the case. Adding an image is a multi-step process and this returns an object that allows it to happen.

Parameters

timezone	TZ time zone string to use for ingest of image.
addUnallocSpace	Set to true to create virtual files for unallocated space in the image.
noFatFsOrphans	Set to true to skip processing orphan files of FAT file systems.

Returns: Object that encapsulates control of adding an image via the SleuthKit native code layer

Deprecated: Use the newer version with explicit image writer path parameter

Definition at line 15475 of file SleuthkitCase.java.

◆ makeAddImageProcess() [2/3]

AddImageProcess org.sleuthkit.datamodel.SleuthkitCase.makeAddImageProcess	(	String	timeZone,
		boolean	addUnallocSpace,
		boolean	noFatFsOrphans,
		String	imageCopyPath )

Starts the multi-step process of adding an image data source to the case by creating an object that can be used to control the process and get progress messages from it.

Parameters

timeZone	The time zone of the image.
addUnallocSpace	Set to true to create virtual files for unallocated space in the image.
noFatFsOrphans	Set to true to skip processing orphan files of FAT file systems.
imageCopyPath	Path to which a copy of the image should be written. Use the empty string to disable image writing.

Returns: An object that encapsulates control of adding an image via the SleuthKit native code layer.

Definition at line 3622 of file SleuthkitCase.java.

References makeAddImageProcess().

Referenced by makeAddImageProcess(), and org.sleuthkit.datamodel.Examples.Sample.run().

◆ makeAddImageProcess() [3/3]

AddImageProcess org.sleuthkit.datamodel.SleuthkitCase.makeAddImageProcess	(	String	timeZone,
		boolean	addUnallocSpace,
		boolean	noFatFsOrphans,
		String	imageCopyPath,
		String	password )

Starts the multi-step process of adding an image data source to the case by creating an object that can be used to control the process and get progress messages from it.

Parameters

timeZone	The time zone of the image.
addUnallocSpace	Set to true to create virtual files for unallocated space in the image.
noFatFsOrphans	Set to true to skip processing orphan files of FAT file systems.
imageCopyPath	Path to which a copy of the image should be written. Use the empty string to disable image writing.
password	The password for decrypting the image or null if not needed.

Returns: An object that encapsulates control of adding an image via the SleuthKit native code layer.

Definition at line 3646 of file SleuthkitCase.java.

◆ newBlackboardArtifact() [1/2]

BlackboardArtifact org.sleuthkit.datamodel.SleuthkitCase.newBlackboardArtifact	(	ARTIFACT_TYPE	artifactType,
		long	obj_id ) throws TskCoreException

Add a new blackboard artifact with the given type.

Parameters

artifactType	the type the given artifact should have
obj_id	the content object id associated with this artifact

Returns: a new blackboard artifact

Exceptions

TskCoreException exception thrown if a critical error occurs within tsk core

Deprecated: Please use newDataArtifact or newAnalysisResult.

Definition at line 5451 of file SleuthkitCase.java.

References newBlackboardArtifact().

◆ newBlackboardArtifact() [2/2]

BlackboardArtifact org.sleuthkit.datamodel.SleuthkitCase.newBlackboardArtifact	(	int	artifactTypeID,
		long	obj_id ) throws TskCoreException

Add a new blackboard artifact with the given type. If that artifact type does not exist an error will be thrown. The artifact type name can be looked up in the returned blackboard artifact.

Parameters

artifactTypeID	the type the given artifact should have
obj_id	the content object id associated with this artifact

Returns: a new blackboard artifact

Exceptions

TskCoreException exception thrown if a critical error occurs within tsk core

Deprecated: Please use newDataArtifact or newAnalysisResult.

Definition at line 5408 of file SleuthkitCase.java.

Referenced by newBlackboardArtifact().

◆ newCase() [1/6]

SleuthkitCase org.sleuthkit.datamodel.SleuthkitCase.newCase	(	String	caseName,
		CaseDbConnectionInfo	info,
		String	caseDirPath ) throws TskCoreException

static

Creates a new PostgreSQL case database.

Parameters

caseName	The name of the case. It will be used to create a case database name that can be safely used in SQL commands and will not be subject to name collisions on the case database server. Use getDatabaseName to get the created name.
info	The information to connect to the database.
caseDirPath	The case directory path.

Returns: A case database object.

Exceptions

Definition at line 3402 of file SleuthkitCase.java.

References newCase().

◆ newCase() [2/6]

SleuthkitCase org.sleuthkit.datamodel.SleuthkitCase.newCase	(	String	caseName,
		CaseDbConnectionInfo	info,
		String	caseDirPath,
		ContentStreamProvider	contentProvider ) throws TskCoreException

static

Creates a new PostgreSQL case database.

Parameters

caseName	The name of the case. It will be used to create a case database name that can be safely used in SQL commands and will not be subject to name collisions on the case database server. Use getDatabaseName to get the created name.
info	The information to connect to the database.
caseDirPath	The case directory path.
contentProvider	Custom provider for file bytes (can be null).

Returns: A case database object.

Exceptions

The flow of this method involves trying to create a new case and if successful, return that case. If unsuccessful, an exception is thrown. We catch any exceptions, and use tryConnect() to attempt to obtain further information about the error. If tryConnect() is unable to successfully connect, tryConnect() will throw a TskCoreException with a message containing user-level error reporting. If tryConnect() is able to connect, flow continues and we rethrow the original exception obtained from trying to create the case. In this way, we obtain more detailed information if we are able, but do not lose any information if unable.

Definition at line 3424 of file SleuthkitCase.java.

References tryConnect().

◆ newCase() [3/6]

SleuthkitCase org.sleuthkit.datamodel.SleuthkitCase.newCase ( String dbPath ) throws TskCoreException

static

Creates a new SQLite case database.

Parameters

dbPath Path to where SQlite case database should be created.

Returns: A case database object.

Exceptions

Definition at line 3315 of file SleuthkitCase.java.

References newCase().

Referenced by newCase(), newCase(), newCase(), newCase(), and org.sleuthkit.datamodel.Examples.Sample.run().

◆ newCase() [4/6]

SleuthkitCase org.sleuthkit.datamodel.SleuthkitCase.newCase	(	String	dbPath,
		ContentStreamProvider	contentProvider ) throws TskCoreException

static

Creates a new SQLite case database.

Parameters

dbPath	Path to where SQlite case database should be created.
contentProvider	Custom provider for file bytes (can be null).

Returns: A case database object.

Exceptions

Definition at line 3330 of file SleuthkitCase.java.

References newCase().

◆ newCase() [5/6]

SleuthkitCase org.sleuthkit.datamodel.SleuthkitCase.newCase	(	String	dbPath,
		ContentStreamProvider	contentProvider,
		String	lockingApplicationName ) throws TskCoreException

static

Creates a new SQLite case database.

Parameters

dbPath	Path to where SQlite case database should be created.
contentProvider	Custom provider for file bytes (can be null).
lockingApplicationName	The name of the application locking the case database (null value prevents locking; 500 character maximum).

Returns: A case database object.

Exceptions

Definition at line 3350 of file SleuthkitCase.java.

References newCase().

◆ newCase() [6/6]

SleuthkitCase org.sleuthkit.datamodel.SleuthkitCase.newCase	(	String	dbPath,
		ContentStreamProvider	contentProvider,
		String	lockingApplicationName,
		boolean	useWAL ) throws TskCoreException

static

Creates a new SQLite case database.

Parameters

dbPath	Path to where SQlite case database should be created.
contentProvider	Custom provider for file bytes (can be null).
lockingApplicationName	The name of the application locking the case database (null value prevents locking; 500 character maximum).
useWAL	Flag to set journal_mode=WAL. WAL does not work over a network file system. For more details

See also: https://www.sqlite.org/wal.html

Returns: A case database object.

Exceptions

Definition at line 3374 of file SleuthkitCase.java.

References org.sleuthkit.datamodel.TskData.DbType.SQLITE.

◆ openCase() [1/6]

SleuthkitCase org.sleuthkit.datamodel.SleuthkitCase.openCase	(	String	databaseName,
		CaseDbConnectionInfo	info,
		String	caseDir ) throws TskCoreException

static

Open an existing multi-user case database.

Parameters

databaseName	The name of the database.
info	Connection information for the the database.
caseDir	The folder where the case metadata fils is stored.

Returns: A case database object.

Exceptions

TskCoreException If there is a problem opening the database.

Definition at line 3261 of file SleuthkitCase.java.

References openCase().

◆ openCase() [2/6]

SleuthkitCase org.sleuthkit.datamodel.SleuthkitCase.openCase	(	String	databaseName,
		CaseDbConnectionInfo	info,
		String	caseDir,
		ContentStreamProvider	contentProvider ) throws TskCoreException

static

Open an existing multi-user case database.

Parameters

databaseName	The name of the database.
info	Connection information for the the database.
caseDir	The folder where the case metadata fils is stored.
contentProvider	Custom provider for file content bytes (can be null).

Returns: A case database object.

Exceptions

TskCoreException If there is a problem opening the database.

Definition at line 3278 of file SleuthkitCase.java.

References tryConnect().

◆ openCase() [3/6]

SleuthkitCase org.sleuthkit.datamodel.SleuthkitCase.openCase ( String dbPath ) throws TskCoreException

static

Open an existing case database.

Parameters

dbPath Path to SQLite case database.

Returns: Case database object.

Exceptions

Definition at line 3182 of file SleuthkitCase.java.

References openCase().

Referenced by openCase(), openCase(), openCase(), and openCase().

◆ openCase() [4/6]

SleuthkitCase org.sleuthkit.datamodel.SleuthkitCase.openCase	(	String	dbPath,
		ContentStreamProvider	contentProvider ) throws TskCoreException

static

Open an existing case database.

Parameters

dbPath	Path to SQLite case database.
contentProvider	Custom provider for file content bytes (can be null).

Returns: Case database object.

Exceptions

Definition at line 3197 of file SleuthkitCase.java.

References openCase().

◆ openCase() [5/6]

SleuthkitCase org.sleuthkit.datamodel.SleuthkitCase.openCase	(	String	dbPath,
		ContentStreamProvider	contentProvider,
		String	lockingApplicationName ) throws TskCoreException

static

Open an existing case database.

Parameters

dbPath	Path to SQLite case database.
contentProvider	Custom provider for file content bytes (can be null).
lockingApplicationName	The name of the application locking the case database (null value prevents locking; 500 character maximum).

Returns: Case database object.

Exceptions

Definition at line 3214 of file SleuthkitCase.java.

References openCase().

◆ openCase() [6/6]

SleuthkitCase org.sleuthkit.datamodel.SleuthkitCase.openCase	(	String	dbPath,
		ContentStreamProvider	contentProvider,
		String	lockingApplicationName,
		boolean	useWAL ) throws TskCoreException

static

Open an existing case database.

Parameters

dbPath	Path to SQLite case database.
contentProvider	Custom provider for file content bytes (can be null).
lockingApplicationName	The name of the application locking the case database (null value prevents locking; 500 character maximum).
useWAL	Flag to set journal_mode=WAL. WAL does not work over a network file system. For more details

See also: https://www.sqlite.org/wal.html

Returns: Case database object.

Exceptions

Definition at line 3235 of file SleuthkitCase.java.

References org.sleuthkit.datamodel.TskData.DbType.SQLITE.

◆ openFiles()

List< AbstractFile > org.sleuthkit.datamodel.SleuthkitCase.openFiles	(	Content	dataSource,
		String	filePath ) throws TskCoreException

Parameters

dataSource	the data source (Image, VirtualDirectory for file-sets, etc) to search for the given file name
filePath	The full path to the file(s) of interest. This can optionally include the image and volume names. Treated in a case- insensitive manner.

Returns: a list of AbstractFile that have the given file path.

Exceptions

References acquireSingleUserCaseWriteLock(), org.sleuthkit.datamodel.TskData.TSK_FS_META_FLAG_ENUM.ALLOC, releaseSingleUserCaseWriteLock(), org.sleuthkit.datamodel.TskData.TSK_FS_META_FLAG_ENUM.toInt(), org.sleuthkit.datamodel.TskData.TSK_FS_META_FLAG_ENUM.UNALLOC, org.sleuthkit.datamodel.TskData.TSK_FS_NAME_FLAG_ENUM.UNALLOC, and org.sleuthkit.datamodel.TskData.TSK_FS_META_FLAG_ENUM.valuesOf().

Definition at line 9550 of file SleuthkitCase.java.

References org.sleuthkit.datamodel.AbstractFile.createNonUniquePath(), and findFiles().

◆ registerForEvents()

void org.sleuthkit.datamodel.SleuthkitCase.registerForEvents ( Object listener )

Definition at line 260 of file SleuthkitCase.java.

◆ releaseExclusiveLock()

void org.sleuthkit.datamodel.SleuthkitCase.releaseExclusiveLock ( )

Releases a write lock, but only if this is a single-user case. This method should always be called in the finally block of a try block in which the lock was acquired.

Deprecated: Use releaseSingleUserCaseWriteLock.

Definition at line 15541 of file SleuthkitCase.java.

References releaseSingleUserCaseWriteLock().

◆ releaseSharedLock()

void org.sleuthkit.datamodel.SleuthkitCase.releaseSharedLock ( )

Releases a read lock, but only if this is a single-user case. This method should always be called in the finally block of a try block in which the lock was acquired.

Deprecated: Use releaseSingleUserCaseReadLock.

Definition at line 15565 of file SleuthkitCase.java.

References releaseSingleUserCaseReadLock().

◆ releaseSingleUserCaseReadLock()

void org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock ( )

Releases a read lock, but only if this is a single-user case. This method should always be called in the finally block of a try block in which the lock was acquired.

Definition at line 3167 of file SleuthkitCase.java.

References org.sleuthkit.datamodel.TskData.DbType.SQLITE.

◆ releaseSingleUserCaseWriteLock()

void org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseWriteLock ( )

Releases a write lock, but only if this is a single-user case. This method should always be called in the finally block of a try block in which the lock was acquired.

Definition at line 3145 of file SleuthkitCase.java.

References org.sleuthkit.datamodel.TskData.DbType.SQLITE.

Referenced by addBlackboardAttribute(), addBlackboardAttributes(), addIngestJob(), addIngestModule(), addReport(), close(), copyCaseDB(), deleteReport(), releaseExclusiveLock(), setFileMIMEType(), setFileUnalloc(), setKnown(), setReviewStatus(), updateFile(), and updateImagePath().

◆ removeErrorObserver()

void org.sleuthkit.datamodel.SleuthkitCase.removeErrorObserver ( ErrorObserver observer )

Remove an observer for SleuthkitCase errors.

Parameters

observer The observer to remove.

Deprecated: Catch exceptions instead.

Definition at line 14817 of file SleuthkitCase.java.

◆ runQuery()

ResultSet org.sleuthkit.datamodel.SleuthkitCase.runQuery ( String query ) throws SQLException

Process a read-only query on the tsk database, any table Can be used to e.g. to find files of a given criteria. resultSetToFsContents() will convert the files to useful objects. MUST CALL closeRunQuery() when done

Parameters

query the given string query to run

Returns: the resultSet from running the query. Caller MUST CALL closeRunQuery(resultSet) as soon as possible, when done with retrieving data from the resultSet

Exceptions

SQLException if error occurred during the query

Deprecated: Do not use runQuery(), use executeQuery() instead. Query the Database

Definition at line 15218 of file SleuthkitCase.java.

References acquireSingleUserCaseReadLock(), and releaseSingleUserCaseReadLock().

◆ setFileMIMEType()

void org.sleuthkit.datamodel.SleuthkitCase.setFileMIMEType	(	AbstractFile	file,
		String	mimeType ) throws TskCoreException

Stores the MIME type of a file in the case database and updates the MIME type of the given file object.

Parameters

file	A file.
mimeType	The MIME type.

Exceptions

TskCoreException If there is an error updating the case database.

Definition at line 11397 of file SleuthkitCase.java.

References acquireSingleUserCaseWriteLock(), and releaseSingleUserCaseWriteLock().

◆ setFileUnalloc()

void org.sleuthkit.datamodel.SleuthkitCase.setFileUnalloc ( AbstractFile file ) throws TskCoreException

Sets the unalloc meta flags for the file in the case database, and updates the meta flags in given file object. Also updates the dir flag to unalloc.

Parameters

file A file.

Exceptions

TskCoreException If there is an error updating the case database.

Definition at line 11420 of file SleuthkitCase.java.

◆ setImagePaths() [1/2]

void org.sleuthkit.datamodel.SleuthkitCase.setImagePaths	(	long	obj_id,
		List< String >	paths ) throws TskCoreException

Set the file paths for the image given by obj_id

Parameters

obj_id	the ID of the image to update
paths	the fully qualified path to the files that make up the image

Exceptions

TskCoreException exception thrown when critical error occurs within tsk core and the update fails

Definition at line 10496 of file SleuthkitCase.java.

References beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback(), and setImagePaths().

Referenced by setImagePaths().

◆ setImagePaths() [2/2]

void org.sleuthkit.datamodel.SleuthkitCase.setImagePaths	(	long	objId,
		List< String >	paths,
		CaseDbTransaction	trans ) throws TskCoreException

Set the file paths for the image given by obj_id

Parameters

obj_id	the ID of the image to update
paths	the fully qualified path to the files that make up the image
trans	The case database transaction.

Exceptions

TskCoreException exception thrown when critical error occurs within tsk core and the update fails

Definition at line 10521 of file SleuthkitCase.java.

References org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.DELETE_IMAGE_NAME, and org.sleuthkit.datamodel.SleuthkitCase.PREPARED_STATEMENT.INSERT_IMAGE_NAME.

◆ setKnown()

boolean org.sleuthkit.datamodel.SleuthkitCase.setKnown	(	AbstractFile	file,
		FileKnown	fileKnown ) throws TskCoreException

Store the known status for the FsContent in the database Note: will not update status if content is already 'Known Bad'

Parameters

file	The AbstractFile object
fileKnown	The object's known status

Returns: true if the known status was updated, false otherwise

Exceptions

TskCoreException thrown if a critical error occurred within tsk core

Definition at line 11240 of file SleuthkitCase.java.

References acquireSingleUserCaseWriteLock(), and releaseSingleUserCaseWriteLock().

◆ setReviewStatus()

void org.sleuthkit.datamodel.SleuthkitCase.setReviewStatus	(	BlackboardArtifact	artifact,
		BlackboardArtifact.ReviewStatus	newStatus ) throws TskCoreException

Set the review status of the given artifact to newStatus

Parameters

artifact	The artifact whose review status is being set.
newStatus	The new review status for the given artifact. Must not be null.

Exceptions

TskCoreException thrown if a critical error occurred within tsk core

Definition at line 11863 of file SleuthkitCase.java.

References acquireSingleUserCaseWriteLock(), and releaseSingleUserCaseWriteLock().

Referenced by org.sleuthkit.datamodel.BlackboardArtifact.setReviewStatus().

◆ submitError()

void org.sleuthkit.datamodel.SleuthkitCase.submitError	(	String	context,
		String	errorMessage )

Submit an error to all clients that are listening.

Parameters

context	The context in which the error occurred.
errorMessage	A description of the error that occurred.

Deprecated: Catch exceptions instead.

Definition at line 14833 of file SleuthkitCase.java.

◆ tryConnect()

void org.sleuthkit.datamodel.SleuthkitCase.tryConnect ( CaseDbConnectionInfo info ) throws TskCoreException

static

Attempts to connect to the database with the passed in settings, throws if the settings are not sufficient to connect to the database type indicated. Only attempts to connect to remote databases.

When issues occur, it attempts to diagnose them by looking at the exception messages, returning the appropriate user-facing text for the exception received. This method expects the Exceptions messages to be in English and compares against English text.

Parameters

info	The connection information

Exceptions

Definition at line 298 of file SleuthkitCase.java.

Referenced by newCase(), and openCase().

◆ unregisterForEvents()

void org.sleuthkit.datamodel.SleuthkitCase.unregisterForEvents ( Object listener )

Definition at line 264 of file SleuthkitCase.java.

◆ updateDerivedFile() [1/2]

DerivedFile org.sleuthkit.datamodel.SleuthkitCase.updateDerivedFile	(	DerivedFile	derivedFile,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		boolean	isFile,
		String	mimeType,
		String	rederiveDetails,
		String	toolName,
		String	toolVersion,
		String	otherDetails,
		TskData.EncodingType	encodingType ) throws TskCoreException

Updates an existing derived file in the database and returns a new derived file object with the updated contents

Parameters

derivedFile	The derived file you wish to update
localPath	local path of the derived file, including the file name. The path is relative to the database path.
size	size of the derived file in bytes
ctime	The changed time of the file.
crtime	The creation time of the file.
atime	The accessed time of the file
mtime	The modified time of the file.
isFile	whether a file or directory, true if a file
mimeType	The MIME type the updated file should have, null to unset it
rederiveDetails	details needed to re-derive file (will be specific to the derivation method), currently unused
toolName	name of derivation method/tool, currently unused
toolVersion	version of derivation method/tool, currently unused
otherDetails	details of derivation method/tool, currently unused
encodingType	Type of encoding used on the file (or NONE if no encoding)

Returns: newly created derived file object which contains the updated data

Exceptions

TskCoreException exception thrown if the object creation failed due to a critical system error

Definition at line 8548 of file SleuthkitCase.java.

References beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), org.sleuthkit.datamodel.Content.getParent(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback(), and updateDerivedFile().

Referenced by updateDerivedFile().

◆ updateDerivedFile() [2/2]

DerivedFile org.sleuthkit.datamodel.SleuthkitCase.updateDerivedFile	(	DerivedFile	derivedFile,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		boolean	isFile,
		String	mimeType,
		String	rederiveDetails,
		String	toolName,
		String	toolVersion,
		String	otherDetails,
		TskData.EncodingType	encodingType,
		Content	parentObj,
		CaseDbTransaction	trans ) throws TskCoreException

Definition at line 8574 of file SleuthkitCase.java.

◆ updateFile()

void org.sleuthkit.datamodel.SleuthkitCase.updateFile	(	long	fileObjId,
		long	size,
		long	mtime,
		long	atime,
		long	ctime,
		long	crtime,
		String	userSid,
		Long	osAcctObjId ) throws TskCoreException

Updates the given fields of a file entry in the database.

Parameters

fileObjId
size
mtime
atime
ctime
crtime
userSid
osAcctObjId	(may be null)

Exceptions

Definition at line 11354 of file SleuthkitCase.java.

References acquireSingleUserCaseWriteLock(), and releaseSingleUserCaseWriteLock().

◆ updateImagePath()

void org.sleuthkit.datamodel.SleuthkitCase.updateImagePath	(	String	newPath,
		long	objectId ) throws TskCoreException

Change the path for an image in the database.

Parameters

newPath	New path to the image
objectId	Data source ID of the image

Exceptions