Sleuth Kit Java Bindings (JNI)  4.3
Java bindings for using The Sleuth Kit
org.sleuthkit.datamodel.Volume Class Reference

Inherits org.sleuthkit.datamodel.AbstractContent.

Public Member Functions

void close ()
void finalize () throws Throwable
long getAddr ()
List< ContentgetChildren () throws TskCoreException
List< Long > getChildrenIds () throws TskCoreException
String getDescription ()
List< FileSystemgetFileSystems () throws TskCoreException
long getFlags ()
String getFlagsAsString ()
long getLength ()
long getSize ()
long getStart ()
synchronized String getUniquePath () throws TskCoreException
int read (byte[] buf, long offset, long len) throws TskCoreException
String toString (boolean preserveState)
- Public Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
boolean equals (Object obj)
ArrayList< BlackboardArtifactgetAllArtifacts () throws TskCoreException
long getAllArtifactsCount () throws TskCoreException
ArrayList< BlackboardArtifactgetArtifacts (String artifactTypeName) throws TskCoreException
ArrayList< BlackboardArtifactgetArtifacts (int artifactTypeID) throws TskCoreException
ArrayList< BlackboardArtifactgetArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
long getArtifactsCount (String artifactTypeName) throws TskCoreException
long getArtifactsCount (int artifactTypeID) throws TskCoreException
long getArtifactsCount (ARTIFACT_TYPE type) throws TskCoreException
int getChildrenCount () throws TskCoreException
Content getDataSource () throws TskCoreException
BlackboardArtifact getGenInfoArtifact () throws TskCoreException
BlackboardArtifact getGenInfoArtifact (boolean create) throws TskCoreException
ArrayList< BlackboardAttributegetGenInfoAttributes (ATTRIBUTE_TYPE attr_type) throws TskCoreException
Set< String > getHashSetNames () throws TskCoreException
long getId ()
String getName ()
synchronized Content getParent () throws TskCoreException
SleuthkitCase getSleuthkitCase ()
synchronized String getUniquePath () throws TskCoreException
boolean hasChildren () throws TskCoreException
int hashCode ()
BlackboardArtifact newArtifact (int artifactTypeID) throws TskCoreException
BlackboardArtifact newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
String toString ()
String toString (boolean preserveState)
- Public Member Functions inherited from org.sleuthkit.datamodel.Content
long getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
ArrayList< BlackboardAttributegetGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException

Static Public Member Functions

static long valueToVsFlag (String vsFlag)
static String vsFlagToString (long vsFlag)
static String vsFlagToValue (long vsFlag)

Protected Member Functions

 Volume (SleuthkitCase db, long obj_id, long addr, long startSector, long lengthInSectors, long flags, String desc)
- Protected Member Functions inherited from org.sleuthkit.datamodel.AbstractContent
 AbstractContent (SleuthkitCase db, long obj_id, String name)

Private Attributes

long addr
String desc
long flags
long lengthInSectors
long startSector
volatile long volumeHandle = 0

Static Private Attributes

static ResourceBundle bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle")

Additional Inherited Members

- Static Public Attributes inherited from org.sleuthkit.datamodel.AbstractContent
static final long UNKNOWN_ID = -1
- Protected Attributes inherited from org.sleuthkit.datamodel.AbstractContent
long parentId

Detailed Description

Represents a volume in a VolumeSystem, object stored in tsk_vs_parts table. Populated based on data in database.

Definition at line 29 of file

Constructor & Destructor Documentation

org.sleuthkit.datamodel.Volume.Volume ( SleuthkitCase  db,
long  obj_id,
long  addr,
long  startSector,
long  lengthInSectors,
long  flags,
String  desc 

Constructor to create the data object mapped from tsk_vs_parts entry

dbdatabase object
startSectorstarting sector, relative to start of VS

Definition at line 50 of file

References org.sleuthkit.datamodel.Volume.addr, org.sleuthkit.datamodel.Volume.desc, org.sleuthkit.datamodel.Volume.flags, org.sleuthkit.datamodel.Volume.lengthInSectors, and org.sleuthkit.datamodel.Volume.startSector.

Member Function Documentation

void org.sleuthkit.datamodel.Volume.close ( )

Free native resources after read is done on the Content object. After closing, read can be called again on the same Content object, which should result in re-opening of new native resources.

Implements org.sleuthkit.datamodel.Content.

Definition at line 81 of file

References org.sleuthkit.datamodel.SleuthkitJNI.closeVs().

Referenced by org.sleuthkit.datamodel.Volume.finalize().

void org.sleuthkit.datamodel.Volume.finalize ( ) throws Throwable

Definition at line 93 of file

References org.sleuthkit.datamodel.Volume.close().

long org.sleuthkit.datamodel.Volume.getAddr ( )

get the unique partition address within this volume system (assigned by The Sleuth Kit)

partition address in volume system

Definition at line 129 of file

References org.sleuthkit.datamodel.Volume.addr.

List<Content> org.sleuthkit.datamodel.Volume.getChildren ( ) throws TskCoreException

Gets the child content objects of this content.

List of children
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 259 of file

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.Volume.getFileSystems().

List<Long> org.sleuthkit.datamodel.Volume.getChildrenIds ( ) throws TskCoreException

Gets the child content ids of this content.

List of children ids
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 264 of file

References org.sleuthkit.datamodel.AbstractContent.getSleuthkitCase().

String org.sleuthkit.datamodel.Volume.getDescription ( )

get the description. This is set by the volume system and doesn't exist for all volumes.


Definition at line 176 of file

References org.sleuthkit.datamodel.Volume.desc.

List<FileSystem> org.sleuthkit.datamodel.Volume.getFileSystems ( ) throws TskCoreException
a list of FileSystem that are direct descendents of this Image.

Definition at line 273 of file

References org.sleuthkit.datamodel.Volume.getChildren().

long org.sleuthkit.datamodel.Volume.getFlags ( )

get the flags


Definition at line 157 of file

References org.sleuthkit.datamodel.Volume.flags.

String org.sleuthkit.datamodel.Volume.getFlagsAsString ( )

get the flags as String

flags as String

Definition at line 166 of file

References org.sleuthkit.datamodel.Volume.vsFlagToString().

long org.sleuthkit.datamodel.Volume.getLength ( )

get the length of the volume in sectors


Definition at line 148 of file

References org.sleuthkit.datamodel.Volume.lengthInSectors.

long org.sleuthkit.datamodel.Volume.getSize ( )

Get the (reported) size of the content object and, in theory, how much you should be able to read from it. In some cases, data corruption may mean that you cannot read this much data.

size of the content in bytes

Implements org.sleuthkit.datamodel.Content.

Definition at line 102 of file

long org.sleuthkit.datamodel.Volume.getStart ( )

get the starting sector address of this volume relative to start of the volume system

starting address

Definition at line 139 of file

References org.sleuthkit.datamodel.Volume.startSector.

synchronized String org.sleuthkit.datamodel.Volume.getUniquePath ( ) throws TskCoreException
returns the full path to this Content object starting with a "/" followed by the Image name and similarly for all other segments in the hierarchy.

Implements org.sleuthkit.datamodel.Content.

Definition at line 107 of file

References org.sleuthkit.datamodel.AbstractContent.getName(), org.sleuthkit.datamodel.AbstractContent.getParent(), org.sleuthkit.datamodel.Content.getUniquePath(),, and org.sleuthkit.datamodel.AbstractContent.uniquePath.

int ( byte[]  buf,
long  offset,
long  len 
) throws TskCoreException

Reads data that this content object is associated with (file contents, volume contents, etc.).

bufa character array of data (in bytes) to copy read data to
offsetbyte offset in the content to start reading from
lennumber of bytes to read into buf.
num of bytes read, or -1 on error
TskCoreExceptionif critical error occurred during read in the tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 64 of file

References org.sleuthkit.datamodel.Volume.addr, org.sleuthkit.datamodel.AbstractContent.getParent(), org.sleuthkit.datamodel.VolumeSystem.getVolumeSystemHandle(), org.sleuthkit.datamodel.SleuthkitJNI.openVsPart(), and org.sleuthkit.datamodel.SleuthkitJNI.readVsPart().

String org.sleuthkit.datamodel.Volume.toString ( boolean  preserveState)

Definition at line 287 of file

static long org.sleuthkit.datamodel.Volume.valueToVsFlag ( String  vsFlag)

Convert volume flag string to long

vsFlagstring representation of the flag
long representation of the flag

Definition at line 207 of file

static String org.sleuthkit.datamodel.Volume.vsFlagToString ( long  vsFlag)
static String org.sleuthkit.datamodel.Volume.vsFlagToValue ( long  vsFlag)

Convert volume type flag to string

vsFlaglong flag to convert
string representation

Definition at line 188 of file

Member Data Documentation

long org.sleuthkit.datamodel.Volume.addr
ResourceBundle org.sleuthkit.datamodel.Volume.bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle")

Definition at line 37 of file

String org.sleuthkit.datamodel.Volume.desc
long org.sleuthkit.datamodel.Volume.flags
long org.sleuthkit.datamodel.Volume.lengthInSectors
long org.sleuthkit.datamodel.Volume.startSector
volatile long org.sleuthkit.datamodel.Volume.volumeHandle = 0

Definition at line 36 of file

The documentation for this class was generated from the following file:

Copyright © 2011-2015 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.