Inherits Closeable.

Classes
interface	FileAddProgressUpdater

Public Member Functions
	FileManager (SleuthkitCase tskCase)

synchronized LayoutFile	addCarvedFile (String carvedFileName, long carvedFileSize, long systemId, List< TskFileRange > sectors) throws TskCoreException

List< LayoutFile >	addCarvedFiles (List< CarvedFileContainer > filesToAdd) throws TskCoreException

synchronized DerivedFile	addDerivedFile (String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails) throws TskCoreException

synchronized LocalFilesDataSource	addLocalFilesDataSource (String deviceId, String rootVirtualDirectoryName, String timeZone, List< String > localFilePaths, FileAddProgressUpdater progressUpdater) throws TskCoreException, TskDataException

synchronized VirtualDirectory	addLocalFilesDirs (List< String > localAbsPaths, FileAddProgressUpdater addProgressUpdater) throws TskCoreException

synchronized void	close () throws IOException

synchronized List< AbstractFile >	findFiles (String fileName) throws TskCoreException

synchronized List< AbstractFile >	findFiles (String fileName, String dirName) throws TskCoreException

synchronized List< AbstractFile >	findFiles (String fileName, AbstractFile parentFile) throws TskCoreException

synchronized List< AbstractFile >	findFiles (Content dataSource, String fileName) throws TskCoreException

synchronized List< AbstractFile >	findFiles (Content dataSource, String fileName, String dirName) throws TskCoreException

synchronized List< AbstractFile >	findFiles (Content dataSource, String fileName, AbstractFile parentFile) throws TskCoreException

synchronized List< AbstractFile >	openFiles (Content dataSource, String filePath) throws TskCoreException

Private Member Functions
AbstractFile	addLocalDirInt (CaseDbTransaction trans, VirtualDirectory parentVd, java.io.File localFile, FileAddProgressUpdater addProgressUpdater) throws TskCoreException

synchronized LocalFile	addLocalFileInt (AbstractFile parentFile, java.io.File localFile, CaseDbTransaction trans) throws TskCoreException

VirtualDirectory	addLocalFileSetRootDir (CaseDbTransaction trans) throws TskCoreException

List< java.io.File >	getFilesAndDirectories (List< String > localFilePaths) throws TskDataException

synchronized void	init ()

Private Attributes
volatile int	curNumFileSets

SleuthkitCase	tskCase

Static Private Attributes
static final Logger	logger = Logger.getLogger(FileManager.class.getName())

Detailed Description

Abstraction to facilitate access to localFiles and directories.

Definition at line 52 of file FileManager.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.casemodule.services.FileManager.FileManager ( SleuthkitCase tskCase )

Definition at line 58 of file FileManager.java.

References org.sleuthkit.autopsy.casemodule.services.FileManager.init(), and org.sleuthkit.autopsy.casemodule.services.FileManager.tskCase.

Member Function Documentation

synchronized LayoutFile org.sleuthkit.autopsy.casemodule.services.FileManager.addCarvedFile	(	String	carvedFileName,
		long	carvedFileSize,
		long	systemId,
		List< TskFileRange >	sectors
	)		throws TskCoreException

Adds a carved file to the VirtualDirectory '$CarvedFiles' in the volume or image given by systemId.

Parameters

carvedFileName	the name of the carved file (containing appropriate extension)
carvedFileSize	size of the carved file to add
systemId	the ID of the parent volume or file system
sectors	a list of SectorGroups giving this sectors that make up this carved file.

Exceptions

TskCoreException exception thrown when critical tsk error occurred and carved file could not be added

Definition at line 289 of file FileManager.java.

List<LayoutFile> org.sleuthkit.autopsy.casemodule.services.FileManager.addCarvedFiles ( List< CarvedFileContainer > filesToAdd ) throws TskCoreException

Adds a collection of carved localFiles to the VirtualDirectory '$CarvedFiles' in the volume or image given by systemId. Creates $CarvedFiles if it does not exist already.

Parameters

filesToAdd a list of CarvedFileContainer localFiles to add as carved localFiles

Returns: List<LayoutFile> This is a list of the localFiles added to the database

Exceptions

org.sleuthkit.datamodel.TskCoreException

Definition at line 312 of file FileManager.java.

synchronized DerivedFile org.sleuthkit.autopsy.casemodule.services.FileManager.addDerivedFile	(	String	fileName,
		String	localPath,
		long	size,
		long	ctime,
		long	crtime,
		long	atime,
		long	mtime,
		boolean	isFile,
		AbstractFile	parentFile,
		String	rederiveDetails,
		String	toolName,
		String	toolVersion,
		String	otherDetails
	)		throws TskCoreException

Creates a derived file, adds it to the database and returns it.

Parameters

fileName	file name the derived file
localPath	local path of the derived file, including the file name. The path is relative to the case folder.
size	size of the derived file in bytes
ctime
crtime
atime
mtime
isFile	whether a file or directory, true if a file
parentFile	the parent file object this the new file was derived from, either a fs file or parent derived file/dikr\r
rederiveDetails	details needed to re-derive file (will be specific to the derivation method), currently unused
toolName	name of derivation method/tool, currently unused
toolVersion	version of derivation method/tool, currently unused
otherDetails	details of derivation method/tool, currently unused

Returns: newly created derived file object added to the database

Exceptions

TskCoreException exception thrown if the object creation failed due to a critical system error or of the file manager has already been closed

Definition at line 261 of file FileManager.java.

Referenced by org.sleuthkit.autopsy.modules.embeddedfileextractor.SevenZipExtractor.UnpackedTree.addDerivedFilesToCaseRec(), org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule.handleAttachments(), and org.sleuthkit.autopsy.externalresults.ExternalResultsImporter.importDerivedFiles().

AbstractFile org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalDirInt	(	CaseDbTransaction	trans,
		VirtualDirectory	parentVd,
		java.io.File	localFile,
		FileAddProgressUpdater	addProgressUpdater
	)		throws TskCoreException

private

Helper (internal) method to recursively add contents of a folder. Node passed in can be a file or directory. Children of directories are added.

Parameters

trans	A case database transaction.
parentVd	Dir that is the parent of localFile
localFile	File/Dir that we are adding
addProgressUpdater	notifier to receive progress notifications on folders added, or null if not used

Returns: File object of file added or new virtualdirectory for the directory.

Exceptions

TskCoreException

Definition at line 525 of file FileManager.java.

References org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFileInt().

Referenced by org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFilesDataSource(), and org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFilesDirs().

synchronized LocalFile org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFileInt	(	AbstractFile	parentFile,
		java.io.File	localFile,
		CaseDbTransaction	trans
	)		throws TskCoreException

private

Adds a single local/logical file to the case. Adds it to the database. Does not refresh the views of data. Assumes that the local file exists and can be read. This checking is done by addLocalDirInt().

Parameters

parentFile	parent file object container (such as virtual directory, another local file, or fscontent File),
localFile	File that we are adding
trans	A case database transaction.

Returns: newly created local file object added to the database

Exceptions

TskCoreException exception thrown if the object creation failed due to a critical system error or of the file manager has already been closed

Definition at line 581 of file FileManager.java.

Referenced by org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalDirInt().

synchronized LocalFilesDataSource org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFilesDataSource	(	String	deviceId,
		String	rootVirtualDirectoryName,
		String	timeZone,
		List< String >	localFilePaths,
		FileAddProgressUpdater	progressUpdater
	)		throws TskCoreException, TskDataException

Adds a set of local/logical files and/or directories to the case database as data source.

Parameters

deviceId	An ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID).
rootVirtualDirectoryName	The name to give to the virtual directory that will serve as the root for the local/logical files and/or directories that compose the data source. Pass the empty string to get a default name of the form: LogicalFileSet[N]
timeZone	The time zone used to process the data source, may be the empty string.
localFilePaths	A list of local/logical file and/or directory localFilePaths.
progressUpdater	Called after each file/directory is added to the case database.

Returns: A local files data source object.

Exceptions

TskCoreException	If there is a problem completing a database operation.
TskDataException	if any of the local file paths is for a file or directory that does not exist or cannot be read.

Definition at line 421 of file FileManager.java.

References org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalDirInt(), org.sleuthkit.autopsy.ingest.IngestServices.fireModuleContentEvent(), org.sleuthkit.autopsy.casemodule.services.FileManager.getFilesAndDirectories(), org.sleuthkit.autopsy.ingest.IngestServices.getInstance(), and org.sleuthkit.autopsy.datamodel.VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX.

synchronized VirtualDirectory org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFilesDirs	(	List< String >	localAbsPaths,
		FileAddProgressUpdater	addProgressUpdater
	)		throws TskCoreException

Add a set of local/logical localFiles and dirs.

Parameters

localAbsPaths	list of absolute paths to local localFiles and dirs
addProgressUpdater	notifier to receive progress notifications on folders added, or null if not used

Returns: file set root VirtualDirectory contained containing all AbstractFile objects added

Exceptions

TskCoreException exception thrown if the object creation failed due to a critical system error or of the file manager has already been closed. There is no "revert" logic if one of the additions fails. The addition stops with the first error encountered.

Definition at line 353 of file FileManager.java.

References org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalDirInt(), org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFileSetRootDir(), org.sleuthkit.autopsy.ingest.IngestServices.fireModuleContentEvent(), org.sleuthkit.autopsy.casemodule.services.FileManager.getFilesAndDirectories(), and org.sleuthkit.autopsy.ingest.IngestServices.getInstance().

VirtualDirectory org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFileSetRootDir ( CaseDbTransaction trans ) throws TskCoreException

private

Adds a new virtual directory root object with FileSet X name and consecutive sequence number characteristic to every add operation

Returns: the virtual dir root container created

Exceptions

TskCoreException

Definition at line 490 of file FileManager.java.

References org.sleuthkit.autopsy.datamodel.VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX.

Referenced by org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFilesDirs().

synchronized void org.sleuthkit.autopsy.casemodule.services.FileManager.close ( ) throws IOException

Definition at line 606 of file FileManager.java.

synchronized List<AbstractFile> org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles ( String fileName ) throws TskCoreException

Finds a set of localFiles that meets the name criteria in all data sources in the current case.

Parameters

fileName Pattern of the name of the file or directory to match (case insensitive, used in LIKE SQL statement).

Returns: a list of AbstractFile for localFiles/directories whose name matches the given fileName

Definition at line 93 of file FileManager.java.

Referenced by org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles().

synchronized List<AbstractFile> org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles	(	String	fileName,
		String	dirName
	)		throws TskCoreException

Finds a set of localFiles that meets the name criteria in all data sources in the current case.

Parameters

fileName	Pattern of the name of the file or directory to match (case insensitive, used in LIKE SQL statement).
dirName	Pattern of the name of the parent directory to use as the root of the search (case insensitive, used in LIKE SQL statement).

Returns: a list of AbstractFile for localFiles/directories whose name matches fileName and whose parent directory contains dirName.

Definition at line 119 of file FileManager.java.

References org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles().

synchronized List<AbstractFile> org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles	(	String	fileName,
		AbstractFile	parentFile
	)		throws TskCoreException

Finds a set of localFiles that meets the name criteria in all data sources in the current case.

Parameters

fileName	Pattern of the name of the file or directory to match (case insensitive, used in LIKE SQL statement).
parentFile	Object of root/parent directory to restrict search to.

Returns: a list of AbstractFile for localFiles/directories whose name matches fileName and that were inside a directory described by parentFsContent.

Definition at line 144 of file FileManager.java.

References org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles().

synchronized List<AbstractFile> org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles	(	Content	dataSource,
		String	fileName
	)		throws TskCoreException

Finds a set of localFiles that meets the name criteria.

Parameters

dataSource	Root data source to limit search results to (Image, VirtualDirectory, etc.).
fileName	Pattern of the name of the file or directory to match (case insensitive, used in LIKE SQL statement).

Returns: a list of AbstractFile for localFiles/directories whose name matches the given fileName

Definition at line 168 of file FileManager.java.

synchronized List<AbstractFile> org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles	(	Content	dataSource,
		String	fileName,
		String	dirName
	)		throws TskCoreException

Finds a set of localFiles that meets the name criteria.

Parameters

dataSource	Root data source to limit search results to (Image, VirtualDirectory, etc.).
fileName	Pattern of the name of the file or directory to match (case insensitive, used in LIKE SQL statement).
dirName	Pattern of the name of the parent directory to use as the root of the search (case insensitive, used in LIKE SQL statement).

Returns: a list of AbstractFile for localFiles/directories whose name matches fileName and whose parent directory contains dirName.

Definition at line 189 of file FileManager.java.

synchronized List<AbstractFile> org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles	(	Content	dataSource,
		String	fileName,
		AbstractFile	parentFile
	)		throws TskCoreException

Finds a set of localFiles that meets the name criteria.

Parameters

dataSource	Root data source to limit search results to (Image, VirtualDirectory, etc.).
fileName	Pattern of the name of the file or directory to match (case insensitive, used in LIKE SQL statement).
parentFile	Object of root/parent directory to restrict search to.

Returns: a list of AbstractFile for localFiles/directories whose name matches fileName and that were inside a directory described by parentFsContent.

Definition at line 209 of file FileManager.java.

References org.sleuthkit.autopsy.casemodule.services.FileManager.findFiles().

List<java.io.File> org.sleuthkit.autopsy.casemodule.services.FileManager.getFilesAndDirectories ( List< String > localFilePaths ) throws TskDataException

private

Converts a list of local/logical file and/or directory paths to a list of file objects.

Parameters

localFilePaths A list of local/logical file and/or directory paths.

Returns: A list of file objects.

Exceptions

TskDataException if any of the paths is for a file or directory that does not exist or cannot be read.

Definition at line 470 of file FileManager.java.

Referenced by org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFilesDataSource(), and org.sleuthkit.autopsy.casemodule.services.FileManager.addLocalFilesDirs().

synchronized void org.sleuthkit.autopsy.casemodule.services.FileManager.init ( )

private

initialize the file manager for the case

Definition at line 66 of file FileManager.java.

References org.sleuthkit.autopsy.casemodule.services.FileManager.curNumFileSets, and org.sleuthkit.autopsy.datamodel.VirtualDirectoryNode.LOGICAL_FILE_SET_PREFIX.

Referenced by org.sleuthkit.autopsy.casemodule.services.FileManager.FileManager().

synchronized List<AbstractFile> org.sleuthkit.autopsy.casemodule.services.FileManager.openFiles	(	Content	dataSource,
		String	filePath
	)		throws TskCoreException

Parameters

dataSource	data source Content (Image, parent-less VirtualDirectory) where to find localFiles
filePath	The full path to the file(s) of interest. This can optionally include the image and volume names.

Returns: a list of AbstractFile that have the given file path.

Definition at line 224 of file FileManager.java.

Member Data Documentation

volatile int org.sleuthkit.autopsy.casemodule.services.FileManager.curNumFileSets

private

Definition at line 56 of file FileManager.java.

Referenced by org.sleuthkit.autopsy.casemodule.services.FileManager.init().

final Logger org.sleuthkit.autopsy.casemodule.services.FileManager.logger = Logger.getLogger(FileManager.class.getName())

staticprivate

Definition at line 55 of file FileManager.java.

SleuthkitCase org.sleuthkit.autopsy.casemodule.services.FileManager.tskCase

private

Definition at line 54 of file FileManager.java.

Referenced by org.sleuthkit.autopsy.casemodule.services.FileManager.FileManager().

The documentation for this class was generated from the following file:

/home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/casemodule/services/FileManager.java

Classes

Public Member Functions

Private Member Functions

Private Attributes

Static Private Attributes

Detailed Description

Constructor & Destructor Documentation

Member Function Documentation

Member Data Documentation