19 package org.sleuthkit.datamodel;
21 import java.text.MessageFormat;
22 import java.util.ResourceBundle;
23 import java.util.ArrayList;
24 import java.util.Arrays;
25 import java.util.List;
26 import java.util.logging.Level;
27 import java.util.logging.Logger;
39 private long type, ssize, size;
43 private static ResourceBundle
bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
73 if (imageHandle == 0) {
93 if (imageHandle != 0) {
112 if (paths.length > 0) {
117 Logger.getLogger(
Image.class.
getName()).log(Level.SEVERE,
"Could not find image size, image: " +
this.getId(), ex);
164 List<VolumeSystem> vs =
new ArrayList<VolumeSystem>();
165 for (
Content child : children) {
167 vs.add((VolumeSystem) child);
182 List<Volume> volumes =
new ArrayList<Volume>();
183 for (
Content child : children) {
184 if (child instanceof
Volume) {
185 volumes.add((Volume) child);
200 List<FileSystem> fs =
new ArrayList<FileSystem>();
216 return v.
visit(
this);
220 public <T> T accept(ContentVisitor<T> v) {
221 return v.visit(
this);
236 return super.toString(preserveState) +
"Image [\t" +
"\t" +
"paths " + Arrays.toString(paths) +
"\t" +
"size " + size +
"\t" +
"ssize " + ssize +
"\t" +
"timezone " + timezone +
"\t" +
"type " + type +
"]\t";
246 if (paths.length > 0) {
247 File imageFile =
new File(paths[0]);
248 return imageFile.
exists();
262 Logger logger1 = Logger.getLogger(
"verifyImageSizes");
263 String errorString =
"";
267 List<Volume> volumes = vs.getVolumes();
268 for (
Volume v : volumes) {
269 byte[] buf =
new byte[512];
270 long endOffset = (v.getStart() + v.getLength()) * 512 - 512;
272 int readBytes =
read(buf, endOffset, 512);
274 logger1.warning(
"Possible Incomplete Image: Error reading volume at offset " + endOffset);
275 errorString = MessageFormat.format(bundle.getString(
"Image.verifyImageSize.errStr1.text"), endOffset);
278 logger1.warning(
"Possible Incomplete Image: Error reading volume at offset " + endOffset +
": " + ex.getLocalizedMessage());
279 errorString = MessageFormat.format(bundle.getString(
"Image.verifyImageSize.errStr2.text"), endOffset);
286 long block_size = fs.getBlock_size();
287 long endOffset = fs.getImageOffset() + fs.getSize() - block_size;
289 byte[] buf =
new byte[(int) block_size];
290 int readBytes =
read(buf, endOffset, block_size);
292 logger1.warning(
"Possible Incomplete Image: Error reading file system at offset " + endOffset);
293 errorString = MessageFormat.format(bundle.getString(
"Image.verifyImageSize.errStr3.text"), endOffset);
296 logger1.warning(
"Possible Incomplete Image: Error reading file system at offset " + endOffset +
": " + ex.getLocalizedMessage());
297 errorString = MessageFormat.format(bundle.getString(
"Image.verifyImageSize.errStr4.text"), endOffset);
static int readImg(long imgHandle, byte[] readBuffer, long offset, long len)
List< Volume > getVolumes()
List< FileSystem > getFileSystems()
Boolean imageFileExists()
Image(SleuthkitCase db, long obj_id, long type, long ssize, String name, String[] paths, String timezone, String md5)
TskData.TSK_IMG_TYPE_ENUM getType()
List< Long > getChildrenIds()
int read(byte[] buf, long offset, long len)
volatile long imageHandle
static long openImage(String[] imageFiles)
static long findDeviceSize(String devPath)
static ResourceBundle bundle
static void closeImg(long imgHandle)
SleuthkitCase getSleuthkitCase()
List< Content > getChildren()
List< VolumeSystem > getVolumeSystems()
static TSK_IMG_TYPE_ENUM valueOf(long imgType)
String toString(boolean preserveState)
synchronized long getImageHandle()