Autopsy  4.14.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule Class Reference

Inherits Serializable.

Classes

class  AbstractTextCondition
 
class  CaseInsensitiveMultiValueStringComparisionMatcher
 
class  CaseInsensitivePartialStringComparisionMatcher
 
class  CaseInsensitiveStringComparisionMatcher
 
class  DateCondition
 
class  ExtensionCondition
 
interface  FileAttributeCondition
 
interface  FileNameCondition
 
class  FileSizeCondition
 
class  FullNameCondition
 
class  MetaTypeCondition
 
class  MimeTypeCondition
 
class  ParentPathCondition
 
class  RegexMatcher
 
interface  TextCondition
 
interface  TextMatcher
 

Public Member Functions

 Rule (String ruleName, FileNameCondition fileNameCondition, MetaTypeCondition metaTypeCondition, ParentPathCondition pathCondition, MimeTypeCondition mimeTypeCondition, FileSizeCondition fileSizeCondition, DateCondition dateCondition)
 
DateCondition getDateCondition ()
 
FileNameCondition getFileNameCondition ()
 
FileSizeCondition getFileSizeCondition ()
 
MetaTypeCondition getMetaTypeCondition ()
 
MimeTypeCondition getMimeTypeCondition ()
 
String getName ()
 
ParentPathCondition getPathCondition ()
 
String getUuid ()
 
boolean isSatisfied (AbstractFile file)
 
String toString ()
 

Private Attributes

final List< FileAttributeCondition > conditions = new ArrayList<>()
 
final DateCondition dateCondition
 
final FileNameCondition fileNameCondition
 
final FileSizeCondition fileSizeCondition
 
final MetaTypeCondition metaTypeCondition
 
final MimeTypeCondition mimeTypeCondition
 
final ParentPathCondition pathCondition
 
final String ruleName
 
final String uuid
 

Static Private Attributes

static final long serialVersionUID = 1L
 

Detailed Description

A set membership rule for an interesting files set. The immutability of a rule object allows it to be safely published to multiple threads.

Definition at line 163 of file FilesSet.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.Rule ( String  ruleName,
FileNameCondition  fileNameCondition,
MetaTypeCondition  metaTypeCondition,
ParentPathCondition  pathCondition,
MimeTypeCondition  mimeTypeCondition,
FileSizeCondition  fileSizeCondition,
DateCondition  dateCondition 
)

Construct an interesting files set membership rule.

Parameters
ruleNameThe name of the rule. Can be empty string.
fileNameConditionA file name condition, may be null.
metaTypeConditionA file meta-type condition.
pathConditionA file path condition, may be null.
mimeTypeConditionA file mime type condition, may be null.
fileSizeConditionA file size condition, may be null.
dateConditionA file date created or modified condition, may be null

Definition at line 188 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.dateCondition, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.fileNameCondition, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.fileSizeCondition, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.metaTypeCondition, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.mimeTypeCondition, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.pathCondition, and org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.ruleName.

Member Function Documentation

DateCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getDateCondition ( )
FileNameCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getFileNameCondition ( )

Get the file name condition for the rule.

Returns
A file name condition. Can be null.

Definition at line 243 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.fileNameCondition.

FileSizeCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getFileSizeCondition ( )
Returns
the file size condition. Can be null.

Definition at line 327 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.fileSizeCondition.

MetaTypeCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getMetaTypeCondition ( )

Get the meta-type condition for the rule.

Returns
A meta-type condition. Can be null.

Definition at line 252 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.metaTypeCondition.

MimeTypeCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getMimeTypeCondition ( )
Returns
the mime type condition. Can be null.

Definition at line 320 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.mimeTypeCondition.

String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getName ( )

Get the name of the rule.

Returns
A name string.

Definition at line 234 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.ruleName.

ParentPathCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getPathCondition ( )

Get the path condition for the rule.

Returns
A path condition, may be null.

Definition at line 261 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.pathCondition.

String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.getUuid ( )
Returns
the ruleUUID

Definition at line 313 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.uuid.

boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.isSatisfied ( AbstractFile  file)

Determines whether or not a file satisfies the rule.

Parameters
fileThe file to test.
Returns
True if the rule is satisfied, false otherwise.

Definition at line 276 of file FilesSet.java.

String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.toString ( )

Member Data Documentation

final List<FileAttributeCondition> org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.conditions = new ArrayList<>()
private

Definition at line 174 of file FilesSet.java.

final DateCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.dateCondition
private
final FileNameCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.fileNameCondition
private
final FileSizeCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.fileSizeCondition
private
final MetaTypeCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.metaTypeCondition
private
final MimeTypeCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.mimeTypeCondition
private
final ParentPathCondition org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.pathCondition
private
final String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.ruleName
private
final long org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.serialVersionUID = 1L
staticprivate

Definition at line 165 of file FilesSet.java.

final String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.Rule.uuid
private

The documentation for this class was generated from the following file:

Copyright © 2012-2020 Basis Technology. Generated on: Wed Apr 8 2020
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.