Sleuth Kit Java Bindings (JNI)  4.2
Java bindings for using The Sleuth Kit
ResultSetHelper.java
Go to the documentation of this file.
1 /*
2  * Sleuth Kit Data Model
3  *
4  * Copyright 2014 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.sql.ResultSet;
22 import java.sql.SQLException;
23 import java.util.ArrayList;
24 import java.util.List;
25 import org.sleuthkit.datamodel.TskData.FileKnown;
26 import org.sleuthkit.datamodel.TskData.TSK_FS_ATTR_TYPE_ENUM;
27 import org.sleuthkit.datamodel.TskData.TSK_FS_META_TYPE_ENUM;
28 import org.sleuthkit.datamodel.TskData.TSK_FS_NAME_FLAG_ENUM;
29 import org.sleuthkit.datamodel.TskData.TSK_FS_NAME_TYPE_ENUM;
30 
35 class ResultSetHelper {
36 
37  SleuthkitCase db;
38 
39  ResultSetHelper(SleuthkitCase db) {
40  this.db = db;
41  }
42 
54  Image image(ResultSet rs, String[] imagePaths) throws TskCoreException, SQLException {
55 
56  long obj_id, type, ssize;
57  String tzone, md5;
58 
59  obj_id = rs.getLong("obj_id"); //NON-NLS
60  type = rs.getLong("type"); //NON-NLS
61  ssize = rs.getLong("ssize"); //NON-NLS
62  tzone = rs.getString("tzone"); //NON-NLS
63  md5 = "";
64  if (db.getSchemaVersion() > 2) {
65  md5 = rs.getString("md5"); //NON-NLS
66  }
67 
68  String name = rs.getString("display_name");
69  if (name == null) {
70  if (imagePaths.length > 0) {
71  String path1 = imagePaths[0];
72  name = (new java.io.File(path1)).getName();
73  } else {
74  name = "";
75  }
76  }
77 
78  Image img = new Image(db, obj_id, type, ssize, name, imagePaths, tzone, md5);
79  return img;
80  }
81 
89  String imagePath(ResultSet rs) throws SQLException {
90  return rs.getString("name"); //NON-NLS
91  }
92 
102  VolumeSystem volumeSystem(ResultSet rs, Image parent) throws SQLException {
103 
104  long id = rs.getLong("obj_id"); //NON-NLS
105  long type = rs.getLong("vs_type"); //NON-NLS
106  long imgOffset = rs.getLong("img_offset"); //NON-NLS
107  long blockSize = rs.getLong("block_size"); //NON-NLS
108 
109  VolumeSystem vs = new VolumeSystem(db, id, "", type, imgOffset, blockSize);
110 
111  vs.setParent(parent);
112  return vs;
113  }
114 
124  Volume volume(ResultSet rs, VolumeSystem parent) throws SQLException {
125  Volume vol = new Volume(db, rs.getLong("obj_id"), rs.getLong("addr"), //NON-NLS
126  rs.getLong("start"), rs.getLong("length"), rs.getLong("flags"), //NON-NLS
127  rs.getString("desc")); //NON-NLS
128  vol.setParent(parent);
129  return vol;
130  }
131 
141  FileSystem fileSystem(ResultSet rs, Content parent) throws SQLException {
142 
143  TskData.TSK_FS_TYPE_ENUM fsType = TskData.TSK_FS_TYPE_ENUM.valueOf(rs.getInt("fs_type")); //NON-NLS
144  FileSystem fs = new FileSystem(db, rs.getLong("obj_id"), "", rs.getLong("img_offset"), //NON-NLS
145  fsType, rs.getLong("block_size"), rs.getLong("block_count"), //NON-NLS
146  rs.getLong("root_inum"), rs.getLong("first_inum"), rs.getLong("last_inum")); //NON-NLS
147  fs.setParent(parent);
148  return fs;
149  }
150 
160  File file(ResultSet rs, FileSystem fs) throws SQLException {
161  File f = new File(db, rs.getLong("obj_id"), rs.getLong("fs_obj_id"), //NON-NLS
162  TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort("attr_type")), //NON-NLS
163  rs.getShort("attr_id"), rs.getString("name"), rs.getLong("meta_addr"), rs.getInt("meta_seq"), //NON-NLS
164  TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort("dir_type")), //NON-NLS
165  TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort("meta_type")), //NON-NLS
166  TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort("dir_flags")), //NON-NLS
167  rs.getShort("meta_flags"), rs.getLong("size"), //NON-NLS
168  rs.getLong("ctime"), rs.getLong("crtime"), rs.getLong("atime"), rs.getLong("mtime"), //NON-NLS
169  rs.getShort("mode"), rs.getInt("uid"), rs.getInt("gid"), //NON-NLS
170  rs.getString("md5"), //NON-NLS
171  FileKnown.valueOf(rs.getByte("known")), rs.getString("parent_path")); //NON-NLS
172  f.setFileSystem(fs);
173  return f;
174  }
175 
186  Directory directory(ResultSet rs, FileSystem fs, String name) throws SQLException {
187  Directory dir = new Directory(db, rs.getLong("obj_id"), rs.getLong("fs_obj_id"), //NON-NLS
188  TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort("attr_type")), //NON-NLS
189  rs.getShort("attr_id"), name, rs.getLong("meta_addr"), rs.getInt("meta_seq"), //NON-NLS
190  TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort("dir_type")), //NON-NLS
191  TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort("meta_type")), //NON-NLS
192  TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort("dir_flags")), //NON-NLS
193  rs.getShort("meta_flags"), rs.getLong("size"), //NON-NLS
194  rs.getLong("ctime"), rs.getLong("crtime"), rs.getLong("atime"), rs.getLong("mtime"), //NON-NLS
195  rs.getShort("mode"), rs.getInt("uid"), rs.getInt("gid"), //NON-NLS
196  rs.getString("md5"), //NON-NLS
197  FileKnown.valueOf(rs.getByte("known")), rs.getString("parent_path")); //NON-NLS
198  dir.setFileSystem(fs);
199  return dir;
200  }
201 
209  VirtualDirectory virtualDirectory(ResultSet rs) throws SQLException {
210  String parentPath = rs.getString("parent_path"); //NON-NLS
211  if (parentPath == null) {
212  parentPath = "";
213  }
214 
215  final VirtualDirectory vd = new VirtualDirectory(db, rs.getLong("obj_id"), //NON-NLS
216  rs.getString("name"), //NON-NLS
217  TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort("dir_type")), //NON-NLS
218  TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort("meta_type")), //NON-NLS
219  TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort("dir_flags")), rs.getShort("meta_flags"), //NON-NLS
220  rs.getLong("size"), rs.getString("md5"), //NON-NLS
221  FileKnown.valueOf(rs.getByte("known")), parentPath); //NON-NLS
222  return vd;
223  }
224 
234  Directory directory(ResultSet rs, FileSystem fs) throws SQLException {
235  return directory(rs, fs, rs.getString("name")); //NON-NLS
236  }
237 
246  TskFileRange tskFileRange(ResultSet rs) throws SQLException {
247  return new TskFileRange(rs.getLong("byte_start"), //NON-NLS
248  rs.getLong("byte_len"), rs.getLong("sequence")); //NON-NLS
249  }
250 
259  DerivedFile derivedFile(ResultSet rs, long parentId) throws SQLException {
260  boolean hasLocalPath = rs.getBoolean("has_path"); //NON-NLS
261  long objId = rs.getLong("obj_id"); //NON-NLS
262  String localPath = null;
263  if (hasLocalPath) {
264  localPath = db.getFilePath(objId);
265  }
266 
267  String parentPath = rs.getString("parent_path"); //NON-NLS
268  if (parentPath == null) {
269  parentPath = "";
270  }
271 
272  final DerivedFile df
273  = new DerivedFile(db, objId, rs.getString("name"), //NON-NLS
274  TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort("dir_type")), //NON-NLS
275  TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort("meta_type")), //NON-NLS
276  TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort("dir_flags")), rs.getShort("meta_flags"), //NON-NLS
277  rs.getLong("size"), //NON-NLS
278  rs.getLong("ctime"), rs.getLong("crtime"), rs.getLong("atime"), rs.getLong("mtime"), //NON-NLS
279  rs.getString("md5"), FileKnown.valueOf(rs.getByte("known")), //NON-NLS
280  parentPath, localPath,
281  parentId);
282 
283  return df;
284  }
285 
294  LocalFile localFile(ResultSet rs, long parentId) throws SQLException {
295  boolean hasLocalPath = rs.getBoolean("has_path"); //NON-NLS
296  long objId = rs.getLong("obj_id"); //NON-NLS
297  String localPath = null;
298  if (hasLocalPath) {
299  localPath = db.getFilePath(objId);
300  }
301 
302  String parentPath = rs.getString("parent_path"); //NON-NLS
303  if (parentPath == null) {
304  parentPath = "";
305  }
306 
307  final LocalFile lf
308  = new LocalFile(db, objId, rs.getString("name"), //NON-NLS
309  TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort("dir_type")), //NON-NLS
310  TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort("meta_type")), //NON-NLS
311  TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort("dir_flags")), rs.getShort("meta_flags"), //NON-NLS
312  rs.getLong("size"), //NON-NLS
313  rs.getLong("ctime"), rs.getLong("crtime"), rs.getLong("atime"), rs.getLong("mtime"), //NON-NLS
314  rs.getString("md5"), FileKnown.valueOf(rs.getByte("known")), //NON-NLS
315  parentPath, localPath,
316  parentId);
317 
318  return lf;
319  }
320 
330  List<Content> fileChildren(ResultSet rs, long parentId) throws SQLException {
331  List<Content> children = new ArrayList<Content>();
332 
333  while (rs.next()) {
334  TskData.TSK_DB_FILES_TYPE_ENUM type = TskData.TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort("type"));
335 
336  if (type == TskData.TSK_DB_FILES_TYPE_ENUM.FS) {
337  FsContent result;
338  if (rs.getShort("meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
339  result = directory(rs, null);
340  } else {
341  result = file(rs, null);
342  }
343  children.add(result);
344  } else if (type == TskData.TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR) {
345  VirtualDirectory virtDir = virtualDirectory(rs);
346  children.add(virtDir);
347  } else if (type == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS
348  || type == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS
349  || type == TskData.TSK_DB_FILES_TYPE_ENUM.CARVED) {
350  String parentPath = rs.getString("parent_path");
351  if (parentPath == null) {
352  parentPath = "";
353  }
354  final LayoutFile lf
355  = new LayoutFile(db, rs.getLong("obj_id"), rs.getString("name"),
356  type,
357  TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort("dir_type")),
358  TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort("meta_type")),
359  TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort("dir_flags")),
360  rs.getShort("meta_flags"),
361  rs.getLong("size"),
362  rs.getString("md5"), FileKnown.valueOf(rs.getByte("known")), parentPath);
363  children.add(lf);
364  } else if (type == TskData.TSK_DB_FILES_TYPE_ENUM.DERIVED) {
365  final DerivedFile df = derivedFile(rs, parentId);
366  children.add(df);
367  } else if (type == TskData.TSK_DB_FILES_TYPE_ENUM.LOCAL) {
368  final LocalFile lf = localFile(rs, parentId);
369  children.add(lf);
370  }
371  }
372  return children;
373  }
374 }
org.sleuthkit.datamodel.TskData.TSK_FS_NAME_TYPE_ENUM
Definition: TskData.java:38
org.sleuthkit.datamodel.TskData.TSK_FS_NAME_FLAG_ENUM
Definition: TskData.java:150
org.sleuthkit.datamodel.TskData.TSK_FS_ATTR_TYPE_ENUM
Definition: TskData.java:268
org.sleuthkit.datamodel.TskData.TSK_FS_META_TYPE_ENUM
Definition: TskData.java:99

Copyright © 2011-2015 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.