org.sleuthkit.autopsy.modules.interestingitems.FilesSet Class Reference

Inherits Serializable.

Classes
class	Rule

Public Member Functions
	FilesSet (String name, String description, boolean ignoreKnownFiles, boolean ignoreUnallocatedSpace, Map< String, Rule > rules)
String	fileIsMemberOf (AbstractFile file)
String	getDescription ()
String	getName ()
boolean	ingoresUnallocatedSpace ()
String	toString ()

Private Attributes
final String	description
final boolean	ignoreKnownFiles
final boolean	ignoreUnallocatedSpace
final String	name
final Map< String, Rule >	rules = new HashMap<>()

Static Private Attributes
static final long	serialVersionUID = 1L

Detailed Description

A collection of set membership rules that define an interesting files set. The rules are independent, i.e., if any rule is satisfied by a file, the file belongs to the set.

Interesting files set definition objects are immutable, so they may be safely published to multiple threads.

Definition at line 39 of file FilesSet.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.modules.interestingitems.FilesSet.FilesSet	(	String	name,
		String	description,
		boolean	ignoreKnownFiles,
		boolean	ignoreUnallocatedSpace,
		Map< String, Rule >	rules
	)

Constructs an interesting files set.

Parameters

name	The name of the set.
description	A description of the set, may be null.
ignoreKnownFiles	Whether or not to exclude known files from the set.
ignoreUnallocatedSpace	Whether or not to exclude unallocated space from the set.
rules	The rules that define the set. May be null, but a set with no rules is the empty set.

Definition at line 60 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreKnownFiles, org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreUnallocatedSpace, and org.sleuthkit.autopsy.modules.interestingitems.FilesSet.name.

Member Function Documentation

String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.fileIsMemberOf

(

AbstractFile

file

)

Determines whether a file is a member of this interesting files set.

Parameters

file	A file to test for set membership.

Returns

The name of the first set membership rule satisfied by the file, will be null if the file does not belong to the set.

Definition at line 131 of file FilesSet.java.

References org::sleuthkit::datamodel::AbstractFile.getKnown(), org::sleuthkit::datamodel::AbstractFile.getType(), org::sleuthkit::datamodel::TskData::FileKnown.KNOWN, org::sleuthkit::datamodel::TskData::TSK_DB_FILES_TYPE_ENUM.SLACK, org::sleuthkit::datamodel::TskData::TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS, and org::sleuthkit::datamodel::TskData::TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS.

String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getDescription

(

)

Gets the description of this interesting files set.

Returns

A description string, possibly the empty string.

Definition at line 87 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.description.

Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.deleteRuleButtonActionPerformed(), org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.doFilesSetRuleDialog(), and org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.SetsListSelectionListener.valueChanged().

String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getName

(

)

Gets the name of this interesting files set.

Returns

A name string.

Definition at line 78 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.name.

Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.deleteRuleButtonActionPerformed(), org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.deleteSetButtonActionPerformed(), org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.doFilesSetRuleDialog(), org.sleuthkit.autopsy.ingest.IngestJobSettingsPanel.fileIngestFilterComboBoxActionPerformed(), org.sleuthkit.autopsy.ingest.IngestJobSettingsPanel.IngestJobSettingsPanel(), org.sleuthkit.autopsy.ingest.IngestJobSettings.load(), and org.sleuthkit.autopsy.ingest.IngestJobSettings.store().

boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ingoresUnallocatedSpace

(

)

Returns whether or not this set of rules will process unallocated space.

Returns

True if unallocated space should be processed, false if it should not be.

Definition at line 110 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreUnallocatedSpace.

Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.deleteRuleButtonActionPerformed(), org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.doFilesSetRuleDialog(), and org.sleuthkit.autopsy.modules.interestingitems.FilesSetDefsPanel.SetsListSelectionListener.valueChanged().

String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.toString

(

)

Definition at line 152 of file FilesSet.java.

References org.sleuthkit.autopsy.modules.interestingitems.FilesSet.name.

Member Data Documentation

final String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.description

private

Definition at line 43 of file FilesSet.java.

Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getDescription().

final boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreKnownFiles

private

Definition at line 44 of file FilesSet.java.

Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSet.FilesSet().

final boolean org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ignoreUnallocatedSpace

private

Definition at line 45 of file FilesSet.java.

Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSet.FilesSet(), and org.sleuthkit.autopsy.modules.interestingitems.FilesSet.ingoresUnallocatedSpace().

final String org.sleuthkit.autopsy.modules.interestingitems.FilesSet.name

private

Definition at line 42 of file FilesSet.java.

Referenced by org.sleuthkit.autopsy.modules.interestingitems.FilesSet.FilesSet(), org.sleuthkit.autopsy.modules.interestingitems.FilesSet.getName(), and org.sleuthkit.autopsy.modules.interestingitems.FilesSet.toString().

final Map<String, Rule> org.sleuthkit.autopsy.modules.interestingitems.FilesSet.rules = new HashMap<>()

private

Definition at line 46 of file FilesSet.java.

final long org.sleuthkit.autopsy.modules.interestingitems.FilesSet.serialVersionUID = 1L

staticprivate

Definition at line 41 of file FilesSet.java.

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java