Autopsy  4.16.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.modules.interestingitems.FilesSet Class Reference

Inherits Serializable.

Classes

class  Rule
 

Public Member Functions

 FilesSet (String name, String description, boolean ignoreKnownFiles, boolean ignoreUnallocatedSpace, Map< String, Rule > rules)
 
 FilesSet (String name, String description, boolean ignoreKnownFiles, boolean ignoreUnallocatedSpace, Map< String, Rule > rules, boolean standardSet, int versionNumber)
 
String fileIsMemberOf (AbstractFile file)
 
String getDescription ()
 
String getName ()
 
Map< String, RulegetRules ()
 
boolean ignoresKnownFiles ()
 
boolean ingoresUnallocatedSpace ()
 
String toString ()
 

Private Attributes

final String description
 
final boolean ignoreKnownFiles
 
final boolean ignoreUnallocatedSpace
 
final String name
 
final Map< String, Rulerules = new HashMap<>()
 
final boolean standardSet
 
final int versionNumber
 

Static Private Attributes

static final long serialVersionUID = 1L
 

Detailed Description

A collection of set membership rules that define an interesting files set. The rules are independent, i.e., if any rule is satisfied by a file, the file belongs to the set.

Interesting files set definition objects are immutable, so they may be safely published to multiple threads.

Definition at line 40 of file FilesSet.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.modules.interestingitems.FilesSet.FilesSet ( String  name,
String  description,
boolean  ignoreKnownFiles,
boolean  ignoreUnallocatedSpace,
Map< String, Rule rules 
)

Constructs an interesting files set.

Parameters
nameThe name of the set.
descriptionA description of the set, may be null.
ignoreKnownFilesWhether or not to exclude known files from the set.
ignoreUnallocatedSpaceWhether or not to exclude unallocated space from the set.
rulesThe rules that define the set. May be null, but a set with no rules is the empty set.

Definition at line 65 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.description, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreKnownFiles, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreUnallocatedSpace, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.name, and org.sleuthkit.autopsy.modules.interestingitems.FilesSet.rules.

org.sleuthkit.autopsy.modules.interestingitems.FilesSet.FilesSet ( String  name,
String  description,
boolean  ignoreKnownFiles,
boolean  ignoreUnallocatedSpace,
Map< String, Rule rules,
boolean  standardSet,
int  versionNumber 
)

Constructs an interesting files set.

Parameters
nameThe name of the set.
descriptionA description of the set, may be null.
ignoreKnownFilesWhether or not to exclude known files from the set.
ignoreUnallocatedSpaceWhether or not to exclude unallocated space from the set.
standardSetWhether or not the FilesSet is considered a standard interesting set file.
versionNumberThe versionNumber for the FilesSet so that older versions can be replaced with newer versions.
rulesThe rules that define the set. May be null, but a set with no rules is the empty set.

Definition at line 86 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreKnownFiles, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreUnallocatedSpace, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.name, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.standardSet, and org.sleuthkit.autopsy.modules.interestingitems.FilesSet.versionNumber.

Member Function Documentation

String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.fileIsMemberOf ( AbstractFile  file)

Determines whether a file is a member of this interesting files set.

Parameters
fileA file to test for set membership.
Returns
The name of the first set membership rule satisfied by the file, will be null if the file does not belong to the set.

Definition at line 182 of file FilesSet.java.

String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getDescription ( )
String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getName ( )
Map<String, Rule> org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getRules ( )
boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoresKnownFiles ( )

Returns whether or not this interesting files set ignores known files, i.e., files marked as known by a look up in a known files hash set such as the National Software Reference Library (NSRL). Note that the interesting files set does not do hash set look ups; it simply queries the known status of the files when testing them for set membership.

Returns
True if known files are ignored, false otherwise.

Definition at line 151 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreKnownFiles.

Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.replaceFilesSet(), and org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.SetsListSelectionListener.valueChanged().

boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ingoresUnallocatedSpace ( )
String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.toString ( )

Member Data Documentation

final String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.description
private
final boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreKnownFiles
private
final boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreUnallocatedSpace
private
final String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.name
private
final Map<String, Rule> org.sleuthkit.autopsy.modules.interestingitems.FilesSet.rules = new HashMap<>()
private
final long org.sleuthkit.autopsy.modules.interestingitems.FilesSet.serialVersionUID = 1L
staticprivate

Definition at line 42 of file FilesSet.java.

final boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.standardSet
private
final int org.sleuthkit.autopsy.modules.interestingitems.FilesSet.versionNumber
private

The documentation for this class was generated from the following file:

Copyright © 2012-2020 Basis Technology. Generated on: Tue Sep 22 2020
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.