org.sleuthkit.datamodel.SleuthkitJNI Class Reference

Classes
class	CaseDbHandle
enum	TSK_FS_FILE_READ_OFFSET_TYPE_ENUM

Static Public Member Functions
static void	addToHashDatabase (String filename, String md5, String sha1, String sha256, String comment, int dbHandle) throws TskCoreException
static void	addToHashDatabase (List< HashEntry > hashes, int dbHandle) throws TskCoreException
static void	cancelFinishImage (long imgHandle)
static void	closeAllHashDatabases () throws TskCoreException
static void	closeFile (long fileHandle)
static void	closeFs (long fsHandle)
static void	closeHashDatabase (int dbHandle) throws TskCoreException
static void	closeImg (long imgHandle)
static void	closeVs (long vsHandle)
static int	createHashDatabase (String path) throws TskCoreException
static void	createLookupIndexForHashDatabase (int dbHandle) throws TskCoreException
static long	findDeviceSize (String devPath) throws TskCoreException
static int	finishImageWriter (long imgHandle) throws TskCoreException
static List< String >	getFileMetaDataText (long fileHandle) throws TskCoreException
static int	getFinishImageProgress (long imgHandle)
static String	getHashDatabaseDisplayName (int dbHandle) throws TskCoreException
static String	getHashDatabaseIndexPath (int dbHandle) throws TskCoreException
static String	getHashDatabasePath (int dbHandle) throws TskCoreException
static String	getVersion ()
static boolean	hashDatabaseCanBeReindexed (int dbHandle) throws TskCoreException
static boolean	hashDatabaseHasLookupIndex (int dbHandle) throws TskCoreException
static boolean	hashDatabaseIsIndexOnly (int dbHandle) throws TskCoreException
static boolean	isImageSupported (String imagePath)
static boolean	isUpdateableHashDatabase (int dbHandle) throws TskCoreException
static boolean	lookupInHashDatabase (String hash, int dbHandle) throws TskCoreException
static HashHitInfo	lookupInHashDatabaseVerbose (String hash, int dbHandle) throws TskCoreException
static long	openFile (long fsHandle, long fileId, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId) throws TskCoreException
static long	openFs (long imgHandle, long fsOffset) throws TskCoreException
static int	openHashDatabase (String path) throws TskCoreException
static long	openImage (String[] imageFiles) throws TskCoreException
static long	openVs (long imgHandle, long vsOffset) throws TskCoreException
static long	openVsPart (long vsHandle, long volId) throws TskCoreException
static int	readFile (long fileHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static int	readFileSlack (long fileHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static int	readFs (long fsHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static int	readImg (long imgHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static int	readVs (long vsHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static int	readVsPart (long volHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static void	startVerboseLogging (String logPath)

Private Member Functions
	SleuthkitJNI ()

Static Private Member Functions
static native void	cancelFinishImageNat (long a_img_info)
static native void	closeCaseDbNat (long db) throws TskCoreException
static native void	closeFileNat (long fileHandle)
static native void	closeFsNat (long fsHandle)
static native void	closeImgNat (long imgHandle)
static native void	closeVsNat (long vsHandle)
static native long	commitAddImgNat (long process) throws TskCoreException
static int	convertSignedToUnsigned (int val)
static native long	findDeviceSizeNat (String devicePath) throws TskCoreException
static native int	finishImageWriterNat (long a_img_info)
static native String	getCurDirNat (long process)
static native int	getFinishImageProgressNat (long a_img_info)
static native String	getVersionNat ()
static native int	hashDbAddEntryNat (String filename, String hashMd5, String hashSha1, String hashSha256, String comment, int dbHandle) throws TskCoreException
static native int	hashDbBeginTransactionNat (int dbHandle) throws TskCoreException
static native void	hashDbClose (int dbHandle) throws TskCoreException
static native void	hashDbCloseAll () throws TskCoreException
static native int	hashDbCommitTransactionNat (int dbHandle) throws TskCoreException
static native void	hashDbCreateIndexNat (int dbHandle) throws TskCoreException
static native String	hashDbGetDisplayName (int dbHandle) throws TskCoreException
static native boolean	hashDbIndexExistsNat (int dbHandle) throws TskCoreException
static native String	hashDbIndexPathNat (int dbHandle)
static native boolean	hashDbIsIdxOnlyNat (int dbHandle) throws TskCoreException
static native boolean	hashDbIsReindexableNat (int dbHandle)
static native boolean	hashDbIsUpdateableNat (int dbHandle)
static native boolean	hashDbLookup (String hash, int dbHandle) throws TskCoreException
static native HashHitInfo	hashDbLookupVerbose (String hash, int dbHandle) throws TskCoreException
static native int	hashDbNewNat (String hashDbPath) throws TskCoreException
static native int	hashDbOpenNat (String hashDbPath) throws TskCoreException
static native String	hashDbPathNat (int dbHandle)
static native int	hashDbRollbackTransactionNat (int dbHandle) throws TskCoreException
static native long	initAddImgNat (long db, String timezone, boolean addUnallocSpace, boolean skipFatFsOrphans) throws TskCoreException
static native long	initializeAddImgNat (long db, String timezone, boolean addFileSystems, boolean addUnallocSpace, boolean skipFatFsOrphans) throws TskCoreException
static native boolean	isImageSupportedNat (String imagePath)
static native long	newCaseDbMultiNat (String hostNameOrIP, String portNumber, String userName, String password, int dbTypeOrdinal, String databaseName)
static native long	newCaseDbNat (String dbPath) throws TskCoreException
static native long	openCaseDbMultiNat (String hostNameOrIP, String portNumber, String userName, String password, int dbTypeOrdinal, String databaseName)
static native long	openCaseDbNat (String path) throws TskCoreException
static native long	openFileNat (long fsHandle, long fileId, int attrType, int attrId) throws TskCoreException
static native long	openFsNat (long imgHandle, long fsId) throws TskCoreException
static long	openImage (String[] imageFiles, boolean useCache) throws TskCoreException
static native long	openImgNat (String[] imgPath, int splits) throws TskCoreException
static native long	openVolNat (long vsHandle, long volId) throws TskCoreException
static native long	openVsNat (long imgHandle, long vsOffset) throws TskCoreException
static native int	readFileNat (long fileHandle, byte[] readBuffer, long offset, int offset_type, long len) throws TskCoreException
static native int	readFsNat (long fsHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static native int	readImgNat (long imgHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static native int	readVolNat (long volHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static native int	readVsNat (long vsHandle, byte[] readBuffer, long offset, long len) throws TskCoreException
static native void	revertAddImgNat (long process) throws TskCoreException
static native void	runAddImgNat (long process, String deviceId, long a_img_info, String timeZone, String imageWriterPath) throws TskCoreException, TskDataException
static native void	runOpenAndAddImgNat (long process, String deviceId, String[] imgPath, int splits, String timezone) throws TskCoreException, TskDataException
static native int	saveFileMetaDataTextNat (long fileHandle, String fileName) throws TskCoreException
static native void	startVerboseLoggingNat (String logPath)
static native void	stopAddImgNat (long process) throws TskCoreException
static String	timezoneLongToShort (String timezoneLongForm)

Static Private Attributes
static final Object	cacheLock = new Object()

Detailed Description

A utility class that provides a interface to the SleuthKit via JNI. Supports case management, add image process, reading data off content objects Setting up Hash database parameters and updating / reading values

Caches image and filesystem handles and reuses them for the duration of the application

Definition at line 43 of file SleuthkitJNI.java.

Constructor & Destructor Documentation

org.sleuthkit.datamodel.SleuthkitJNI.SleuthkitJNI ( )

private

Constructor for the utility class that provides a interface to the SleuthKit via JNI.

Definition at line 62 of file SleuthkitJNI.java.

Member Function Documentation

static void org.sleuthkit.datamodel.SleuthkitJNI.addToHashDatabase ( String  filename, String  md5, String  sha1, String  sha256, String  comment, int  dbHandle  ) throws TskCoreException

static

Adds a hash value to a hash database.

Parameters

filename	Name of file (can be null)
md5	Text of MD5 hash (can be null)
sha1	Text of SHA1 hash (can be null)
sha256	Text of SHA256 hash (can be null)
comment	A comment (can be null)
dbHandle	Handle to DB

Exceptions

TskCoreException

Definition at line 945 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbAddEntryNat().

static void org.sleuthkit.datamodel.SleuthkitJNI.addToHashDatabase ( List< HashEntry >  hashes, int  dbHandle  ) throws TskCoreException

static

Definition at line 949 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbAddEntryNat(), org.sleuthkit.datamodel.SleuthkitJNI.hashDbBeginTransactionNat(), org.sleuthkit.datamodel.SleuthkitJNI.hashDbCommitTransactionNat(), and org.sleuthkit.datamodel.SleuthkitJNI.hashDbRollbackTransactionNat().

static void org.sleuthkit.datamodel.SleuthkitJNI.cancelFinishImage ( long  imgHandle )

static

Cancel the finish image process

Parameters

imgHandle

Definition at line 1038 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.cancelFinishImageNat().

static native void org.sleuthkit.datamodel.SleuthkitJNI.cancelFinishImageNat ( long  a_img_info )

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.cancelFinishImage().

static void org.sleuthkit.datamodel.SleuthkitJNI.closeAllHashDatabases ( ) throws TskCoreException

static

Close the currently open lookup databases. Resets the handle counting.

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 878 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbCloseAll().

static native void org.sleuthkit.datamodel.SleuthkitJNI.closeCaseDbNat ( long  db ) throws TskCoreException

staticprivate

static void org.sleuthkit.datamodel.SleuthkitJNI.closeFile ( long  fileHandle )

static

frees the fileHandle pointer

Parameters

fileHandle

pointer to file structure in sleuthkit

Definition at line 787 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.closeFileNat().

Referenced by org.sleuthkit.datamodel.FsContent.close().

static native void org.sleuthkit.datamodel.SleuthkitJNI.closeFileNat ( long  fileHandle )

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.closeFile().

static void org.sleuthkit.datamodel.SleuthkitJNI.closeFs ( long  fsHandle )

static

frees the fsHandle pointer Currently does not do anything - preserves the cached object for the duration of the application

Parameters

fsHandle

pointer to file system structure in sleuthkit

Definition at line 776 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.FileSystem.finalize().

static native void org.sleuthkit.datamodel.SleuthkitJNI.closeFsNat ( long  fsHandle )

staticprivate

static void org.sleuthkit.datamodel.SleuthkitJNI.closeHashDatabase ( int  dbHandle ) throws TskCoreException

static

Close a particular open lookup database. Existing handles are not affected.

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 889 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbClose().

static void org.sleuthkit.datamodel.SleuthkitJNI.closeImg ( long  imgHandle )

static

frees the imgHandle pointer currently does not close the image, until the application terminates (image handle is cached)

Parameters

imgHandle

to close the image

Definition at line 755 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.Image.finalize().

static native void org.sleuthkit.datamodel.SleuthkitJNI.closeImgNat ( long  imgHandle )

staticprivate

static void org.sleuthkit.datamodel.SleuthkitJNI.closeVs ( long  vsHandle )

static

frees the vsHandle pointer

Parameters

vsHandle

pointer to volume system structure in sleuthkit

Definition at line 766 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.closeVsNat().

Referenced by org.sleuthkit.datamodel.Volume.close(), and org.sleuthkit.datamodel.VolumeSystem.close().

static native void org.sleuthkit.datamodel.SleuthkitJNI.closeVsNat ( long  vsHandle )

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.closeVs().

static native long org.sleuthkit.datamodel.SleuthkitJNI.commitAddImgNat ( long  process ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.AddImageProcess.commit().

static int org.sleuthkit.datamodel.SleuthkitJNI.convertSignedToUnsigned ( int  val )

staticprivate

Converts signed integer to an unsigned integer.

Parameters

val	value to be converter

Returns

unsigned integer value

Definition at line 573 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.openFile().

static int org.sleuthkit.datamodel.SleuthkitJNI.createHashDatabase ( String  path ) throws TskCoreException

static

Creates a hash database. Will be of the default TSK hash database type.

Parameters

path	The path to the database

Returns

a handle for that database

Exceptions

TskCoreException

if a critical error occurs within TSK core

Definition at line 868 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbNewNat().

static void org.sleuthkit.datamodel.SleuthkitJNI.createLookupIndexForHashDatabase ( int  dbHandle ) throws TskCoreException

static

Create an index for a hash database.

Parameters

dbHandle

A hash database handle.

Exceptions

TskCoreException

if a critical error occurs within TSK core

Definition at line 798 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbCreateIndexNat().

static long org.sleuthkit.datamodel.SleuthkitJNI.findDeviceSize ( String  devPath ) throws TskCoreException

static

Get size of a device (physical, logical device, image) pointed to by devPath

Parameters

devPath

device path pointing to the device

Returns

size of the device in bytes

Exceptions

TskCoreException

exception thrown if the device size could not be queried

Definition at line 1053 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.findDeviceSizeNat().

Referenced by org.sleuthkit.datamodel.Image.getSize().

static native long org.sleuthkit.datamodel.SleuthkitJNI.findDeviceSizeNat ( String  devicePath ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.findDeviceSize().

static int org.sleuthkit.datamodel.SleuthkitJNI.finishImageWriter ( long  imgHandle ) throws TskCoreException

static

Fills in any gaps in the image created by image writer.

Parameters

imgHandle

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 1018 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.finishImageWriterNat().

static native int org.sleuthkit.datamodel.SleuthkitJNI.finishImageWriterNat ( long  a_img_info )

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.finishImageWriter().

static native String org.sleuthkit.datamodel.SleuthkitJNI.getCurDirNat ( long  process )

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.AddImageProcess.currentDirectory().

static List<String> org.sleuthkit.datamodel.SleuthkitJNI.getFileMetaDataText ( long  fileHandle ) throws TskCoreException

static

Get human readable (some what) details about a file. This is the same as the 'istat' TSK tool

Parameters

fileHandle

pointer to file structure in the sleuthkit

Returns

text

Exceptions

TskCoreException

if errors occurred

Definition at line 722 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.saveFileMetaDataTextNat().

Referenced by org.sleuthkit.datamodel.FsContent.getMetaDataText().

static int org.sleuthkit.datamodel.SleuthkitJNI.getFinishImageProgress ( long  imgHandle )

static

Get the current progress of the finish image process (0-100)

Parameters

imgHandle

Returns

Percentage of blocks completed (0-100)

Definition at line 1029 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.getFinishImageProgressNat().

static native int org.sleuthkit.datamodel.SleuthkitJNI.getFinishImageProgressNat ( long  a_img_info )

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.getFinishImageProgress().

static String org.sleuthkit.datamodel.SleuthkitJNI.getHashDatabaseDisplayName ( int  dbHandle ) throws TskCoreException

static

Get the name of the database

Parameters

dbHandle

previously opened hash db handle

Exceptions

TskCoreException

if a critical error occurs within TSK core

Definition at line 900 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbGetDisplayName().

static String org.sleuthkit.datamodel.SleuthkitJNI.getHashDatabaseIndexPath ( int  dbHandle ) throws TskCoreException

static

getHashDatabaseIndexPath

Parameters

dbHandle

previously opened hash db handle

Returns

Index file path

Exceptions

TskCoreException

if a critical error occurs within TSK core

Definition at line 851 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbIndexPathNat().

static String org.sleuthkit.datamodel.SleuthkitJNI.getHashDatabasePath ( int  dbHandle ) throws TskCoreException

static

getHashDatabasePath

Parameters

dbHandle

previously opened hash db handle

Returns

Hash db file path

Exceptions

TskCoreException

if a critical error occurs within TSK core

Definition at line 838 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbPathNat().

static String org.sleuthkit.datamodel.SleuthkitJNI.getVersion ( )

static

get the Sleuth Kit version string

Returns

the version string

Definition at line 406 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.getVersionNat().

static native String org.sleuthkit.datamodel.SleuthkitJNI.getVersionNat ( )

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.getVersion().

static boolean org.sleuthkit.datamodel.SleuthkitJNI.hashDatabaseCanBeReindexed ( int  dbHandle ) throws TskCoreException

static

hashDatabaseCanBeReindexed

Parameters

dbHandle

previously opened hash db handle

Returns

Does this database have a source database that is different than the index?

Exceptions

TskCoreException

if a critical error occurs within TSK core

Definition at line 825 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbIsReindexableNat().

static boolean org.sleuthkit.datamodel.SleuthkitJNI.hashDatabaseHasLookupIndex ( int  dbHandle ) throws TskCoreException

static

Check if an index exists for a hash database.

Parameters

dbHandle

A hash database handle.

Returns

true if index exists

Exceptions

TskCoreException

if a critical error occurs within TSK core

Definition at line 811 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbIndexExistsNat().

static boolean org.sleuthkit.datamodel.SleuthkitJNI.hashDatabaseIsIndexOnly ( int  dbHandle ) throws TskCoreException

static

Definition at line 971 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbIsIdxOnlyNat().

static native int org.sleuthkit.datamodel.SleuthkitJNI.hashDbAddEntryNat ( String  filename, String  hashMd5, String  hashSha1, String  hashSha256, String  comment, int  dbHandle  ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.addToHashDatabase().

static native int org.sleuthkit.datamodel.SleuthkitJNI.hashDbBeginTransactionNat ( int  dbHandle ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.addToHashDatabase().

static native void org.sleuthkit.datamodel.SleuthkitJNI.hashDbClose ( int  dbHandle ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.closeHashDatabase().

static native void org.sleuthkit.datamodel.SleuthkitJNI.hashDbCloseAll ( ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.closeAllHashDatabases().

static native int org.sleuthkit.datamodel.SleuthkitJNI.hashDbCommitTransactionNat ( int  dbHandle ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.addToHashDatabase().

static native void org.sleuthkit.datamodel.SleuthkitJNI.hashDbCreateIndexNat ( int  dbHandle ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.createLookupIndexForHashDatabase().

static native String org.sleuthkit.datamodel.SleuthkitJNI.hashDbGetDisplayName ( int  dbHandle ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.getHashDatabaseDisplayName().

static native boolean org.sleuthkit.datamodel.SleuthkitJNI.hashDbIndexExistsNat ( int  dbHandle ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.hashDatabaseHasLookupIndex().

static native String org.sleuthkit.datamodel.SleuthkitJNI.hashDbIndexPathNat ( int  dbHandle )

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.getHashDatabaseIndexPath().

static native boolean org.sleuthkit.datamodel.SleuthkitJNI.hashDbIsIdxOnlyNat ( int  dbHandle ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.hashDatabaseIsIndexOnly().

static native boolean org.sleuthkit.datamodel.SleuthkitJNI.hashDbIsReindexableNat ( int  dbHandle )

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.hashDatabaseCanBeReindexed().

static native boolean org.sleuthkit.datamodel.SleuthkitJNI.hashDbIsUpdateableNat ( int  dbHandle )

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.isUpdateableHashDatabase().

static native boolean org.sleuthkit.datamodel.SleuthkitJNI.hashDbLookup ( String  hash, int  dbHandle  ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.lookupInHashDatabase().

static native HashHitInfo org.sleuthkit.datamodel.SleuthkitJNI.hashDbLookupVerbose ( String  hash, int  dbHandle  ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.lookupInHashDatabaseVerbose().

static native int org.sleuthkit.datamodel.SleuthkitJNI.hashDbNewNat ( String  hashDbPath ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.createHashDatabase().

static native int org.sleuthkit.datamodel.SleuthkitJNI.hashDbOpenNat ( String  hashDbPath ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.openHashDatabase().

static native String org.sleuthkit.datamodel.SleuthkitJNI.hashDbPathNat ( int  dbHandle )

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.getHashDatabasePath().

static native int org.sleuthkit.datamodel.SleuthkitJNI.hashDbRollbackTransactionNat ( int  dbHandle ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.addToHashDatabase().

static native long org.sleuthkit.datamodel.SleuthkitJNI.initAddImgNat ( long  db, String  timezone, boolean  addUnallocSpace, boolean  skipFatFsOrphans  ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.AddImageProcess.run().

static native long org.sleuthkit.datamodel.SleuthkitJNI.initializeAddImgNat ( long  db, String  timezone, boolean  addFileSystems, boolean  addUnallocSpace, boolean  skipFatFsOrphans  ) throws TskCoreException

staticprivate

static boolean org.sleuthkit.datamodel.SleuthkitJNI.isImageSupported ( String  imagePath )

static

Definition at line 1057 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.isImageSupportedNat().

static native boolean org.sleuthkit.datamodel.SleuthkitJNI.isImageSupportedNat ( String  imagePath )

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.isImageSupported().

static boolean org.sleuthkit.datamodel.SleuthkitJNI.isUpdateableHashDatabase ( int  dbHandle ) throws TskCoreException

static

Definition at line 967 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbIsUpdateableNat().

static boolean org.sleuthkit.datamodel.SleuthkitJNI.lookupInHashDatabase ( String  hash, int  dbHandle  ) throws TskCoreException

static

Lookup the given hash value and get basic answer

Parameters

hash	Hash value to search for
dbHandle	Handle of database to lookup in.

Returns

True if hash was found in database.

Exceptions

TskCoreException

Definition at line 914 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbLookup().

static HashHitInfo org.sleuthkit.datamodel.SleuthkitJNI.lookupInHashDatabaseVerbose ( String  hash, int  dbHandle  ) throws TskCoreException

static

Lookup hash value in DB and return details on results (more time consuming than basic lookup)

Parameters

hash	Hash value to search for
dbHandle	Handle of database to lookup in.

Returns

Details on hash if it was in DB or null if it was not found.

Exceptions

TskCoreException

Definition at line 929 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbLookupVerbose().

static native long org.sleuthkit.datamodel.SleuthkitJNI.newCaseDbMultiNat ( String  hostNameOrIP, String  portNumber, String  userName, String  password, int  dbTypeOrdinal, String  databaseName  )

staticprivate

static native long org.sleuthkit.datamodel.SleuthkitJNI.newCaseDbNat ( String  dbPath ) throws TskCoreException

staticprivate

static native long org.sleuthkit.datamodel.SleuthkitJNI.openCaseDbMultiNat ( String  hostNameOrIP, String  portNumber, String  userName, String  password, int  dbTypeOrdinal, String  databaseName  )

staticprivate

static native long org.sleuthkit.datamodel.SleuthkitJNI.openCaseDbNat ( String  path ) throws TskCoreException

staticprivate

static long org.sleuthkit.datamodel.SleuthkitJNI.openFile ( long  fsHandle, long  fileId, TSK_FS_ATTR_TYPE_ENUM  attrType, int  attrId  ) throws TskCoreException

static

Get file Handle

Parameters

fsHandle	fsHandle pointer in the sleuthkit
fileId	id of the file
attrType	file attribute type to open
attrId	file attribute id to open

Returns

pointer to a file structure in the sleuthkit

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 551 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.convertSignedToUnsigned(), and org.sleuthkit.datamodel.SleuthkitJNI.openFileNat().

static native long org.sleuthkit.datamodel.SleuthkitJNI.openFileNat ( long  fsHandle, long  fileId, int  attrType, int  attrId  ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.openFile().

static long org.sleuthkit.datamodel.SleuthkitJNI.openFs ( long  imgHandle, long  fsOffset  ) throws TskCoreException

static

Get file system Handle Opened handle is cached (transparently) so it does not need be reopened next time for the duration of the application

Parameters

imgHandle	pointer to imgHandle in sleuthkit
fsOffset	byte offset to the file system

Returns

pointer to a fsHandle structure in the sleuthkit

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 522 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.cacheLock, org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.fsHandleCache, and org.sleuthkit.datamodel.SleuthkitJNI.openFsNat().

static native long org.sleuthkit.datamodel.SleuthkitJNI.openFsNat ( long  imgHandle, long  fsId  ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.openFs().

static int org.sleuthkit.datamodel.SleuthkitJNI.openHashDatabase ( String  path ) throws TskCoreException

static

Definition at line 855 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.hashDbOpenNat().

static long org.sleuthkit.datamodel.SleuthkitJNI.openImage ( String[]  imageFiles ) throws TskCoreException

static

open the image and return the image info pointer

Parameters

imageFiles

the paths to the images

Returns

the image info pointer

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 427 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.Image.getImageHandle(), and org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.AddImageProcess.run().

static long org.sleuthkit.datamodel.SleuthkitJNI.openImage ( String[]  imageFiles, boolean  useCache  ) throws TskCoreException

staticprivate

open the image and return the image info pointer This is a temporary measure to allow ingest of multiple local disks on the same drive letter. We need to clear the cache to make sure cached data from the first drive is not used.

Parameters

imageFiles	the paths to the images
useCache	true if the image handle cache should be used, false to always go to TSK to open a fresh copy

Returns

the image info pointer

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 446 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.cacheLock, org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.fsHandleCache, org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.imageHandleCache, and org.sleuthkit.datamodel.SleuthkitJNI.openImgNat().

static native long org.sleuthkit.datamodel.SleuthkitJNI.openImgNat ( String[]  imgPath, int  splits  ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.openImage().

static native long org.sleuthkit.datamodel.SleuthkitJNI.openVolNat ( long  vsHandle, long  volId  ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.openVsPart().

static long org.sleuthkit.datamodel.SleuthkitJNI.openVs ( long  imgHandle, long  vsOffset  ) throws TskCoreException

static

Get volume system Handle

Parameters

imgHandle	a handle to previously opened image
vsOffset	byte offset in the image to the volume system (usually 0)

Returns

pointer to a vsHandle structure in the sleuthkit

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 489 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.openVsNat().

Referenced by org.sleuthkit.datamodel.VolumeSystem.getVolumeSystemHandle().

static native long org.sleuthkit.datamodel.SleuthkitJNI.openVsNat ( long  imgHandle, long  vsOffset  ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.openVs().

static long org.sleuthkit.datamodel.SleuthkitJNI.openVsPart ( long  vsHandle, long  volId  ) throws TskCoreException

static

Get volume Handle

Parameters

vsHandle	pointer to the volume system structure in the sleuthkit
volId	id of the volume

Returns

pointer to a volHandle structure in the sleuthkit

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 505 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.openVolNat().

Referenced by org.sleuthkit.datamodel.Volume.read().

static int org.sleuthkit.datamodel.SleuthkitJNI.readFile ( long  fileHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

static

reads data from an file

Parameters

fileHandle	pointer to a file structure in the sleuthkit
readBuffer	pre-allocated buffer to read to
offset	byte offset in the image to start at
len	amount of data to read

Returns

the number of characters read, or -1 if the end of the stream has been reached

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 690 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.readFileNat(), and org.sleuthkit.datamodel.SleuthkitJNI.TSK_FS_FILE_READ_OFFSET_TYPE_ENUM.START_OF_FILE.

Referenced by org.sleuthkit.datamodel.FsContent.readInt().

static native int org.sleuthkit.datamodel.SleuthkitJNI.readFileNat ( long  fileHandle, byte[]  readBuffer, long  offset, int  offset_type, long  len  ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.readFile(), and org.sleuthkit.datamodel.SleuthkitJNI.readFileSlack().

static int org.sleuthkit.datamodel.SleuthkitJNI.readFileSlack ( long  fileHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

static

reads data from the slack space of a file

Parameters

fileHandle	pointer to a file structure in the sleuthkit
readBuffer	pre-allocated buffer to read to
offset	byte offset in the slack to start at
len	amount of data to read

Returns

the number of characters read, or -1 if the end of the stream has been reached

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 708 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.readFileNat(), and org.sleuthkit.datamodel.SleuthkitJNI.TSK_FS_FILE_READ_OFFSET_TYPE_ENUM.START_OF_SLACK.

Referenced by org.sleuthkit.datamodel.SlackFile.readInt().

static int org.sleuthkit.datamodel.SleuthkitJNI.readFs ( long  fsHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

static

reads data from an file system

Parameters

fsHandle	pointer to a file system structure in the sleuthkit
readBuffer	buffer to read to
offset	byte offset in the image to start at
len	amount of data to read

Returns

the number of characters read, or -1 if the end of the stream has been reached

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 652 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.readFsNat().

Referenced by org.sleuthkit.datamodel.FileSystem.read().

static native int org.sleuthkit.datamodel.SleuthkitJNI.readFsNat ( long  fsHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.readFs().

static int org.sleuthkit.datamodel.SleuthkitJNI.readImg ( long  imgHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

static

reads data from an image

Parameters

imgHandle
readBuffer	buffer to read to
offset	byte offset in the image to start at
len	amount of data to read

Returns

the number of characters read, or -1 if the end of the stream has been reached

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 596 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.readImgNat().

Referenced by org.sleuthkit.datamodel.Image.read(), and org.sleuthkit.datamodel.LayoutFile.readImgToOffset().

static native int org.sleuthkit.datamodel.SleuthkitJNI.readImgNat ( long  imgHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.readImg().

static native int org.sleuthkit.datamodel.SleuthkitJNI.readVolNat ( long  volHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.readVsPart().

static int org.sleuthkit.datamodel.SleuthkitJNI.readVs ( long  vsHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

static

reads data from an volume system

Parameters

vsHandle	pointer to a volume system structure in the sleuthkit
readBuffer	buffer to read to
offset	sector offset in the image to start at
len	amount of data to read

Returns

the number of characters read, or -1 if the end of the stream has been reached

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 615 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.readVsNat().

Referenced by org.sleuthkit.datamodel.VolumeSystem.read().

static native int org.sleuthkit.datamodel.SleuthkitJNI.readVsNat ( long  vsHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.readVs().

static int org.sleuthkit.datamodel.SleuthkitJNI.readVsPart ( long  volHandle, byte[]  readBuffer, long  offset, long  len  ) throws TskCoreException

static

reads data from an volume

Parameters

volHandle	pointer to a volume structure in the sleuthkit
readBuffer	buffer to read to
offset	byte offset in the image to start at
len	amount of data to read

Returns

the number of characters read, or -1 if the end of the stream has been reached

Exceptions

TskCoreException

exception thrown if critical error occurs within TSK

Definition at line 633 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.readVolNat().

Referenced by org.sleuthkit.datamodel.Volume.read().

static native void org.sleuthkit.datamodel.SleuthkitJNI.revertAddImgNat ( long  process ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.AddImageProcess.revert().

static native void org.sleuthkit.datamodel.SleuthkitJNI.runAddImgNat ( long  process, String  deviceId, long  a_img_info, String  timeZone, String  imageWriterPath  ) throws TskCoreException, TskDataException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.AddImageProcess.run().

static native void org.sleuthkit.datamodel.SleuthkitJNI.runOpenAndAddImgNat ( long  process, String  deviceId, String[]  imgPath, int  splits, String  timezone  ) throws TskCoreException, TskDataException

staticprivate

static native int org.sleuthkit.datamodel.SleuthkitJNI.saveFileMetaDataTextNat ( long  fileHandle, String  fileName  ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.getFileMetaDataText().

static void org.sleuthkit.datamodel.SleuthkitJNI.startVerboseLogging ( String  logPath )

static

Enable verbose logging and redirect stderr to the given log file.

Definition at line 413 of file SleuthkitJNI.java.

References org.sleuthkit.datamodel.SleuthkitJNI.startVerboseLoggingNat().

static native void org.sleuthkit.datamodel.SleuthkitJNI.startVerboseLoggingNat ( String  logPath )

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.startVerboseLogging().

static native void org.sleuthkit.datamodel.SleuthkitJNI.stopAddImgNat ( long  process ) throws TskCoreException

staticprivate

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.AddImageProcess.stop().

static String org.sleuthkit.datamodel.SleuthkitJNI.timezoneLongToShort ( String  timezoneLongForm )

staticprivate

Convert this timezone from long to short form Convert timezoneLongForm passed in from long to short form

Parameters

timezoneLongForm

the long form (e.g., America/New_York)

Returns

the short form (e.g., EST5EDT) string representation, or an empty string if empty long form was passed in

Definition at line 984 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.AddImageProcess.run().

Member Data Documentation

final Object org.sleuthkit.datamodel.SleuthkitJNI.cacheLock = new Object()

staticprivate

Definition at line 56 of file SleuthkitJNI.java.

Referenced by org.sleuthkit.datamodel.SleuthkitJNI.openFs(), and org.sleuthkit.datamodel.SleuthkitJNI.openImage().

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/sleuthkit/bindings/java/src/org/sleuthkit/datamodel/SleuthkitJNI.java