org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder Class Reference

Static Public Member Functions
static List< String >	identifyVirtualMachines (Path imageFolderPath)
static final boolean	isVirtualMachine (String fileName)

Private Member Functions
	VirtualMachineFinder ()

Static Private Member Functions
static List< String >	getAllFilesInFolder (String path)
static boolean	isAcceptedByFiler (File file, List< FileFilter > filters)
static List< String >	readExtentFilesFromVmdkDescriptorFile (File file)

Static Private Attributes
static final int	FILE_NAME_FIELD_INDX = 3
static final Logger	logger = Logger.getLogger(VirtualMachineFinder.class.getName())
static final int	MAX_VMDK_DESCRIPTOR_FILE_SIZE_BYTES = 10000
static final int	MIN_VMDK_EXTENT_DESCRIPTOR_FIELDS = 4
static final GeneralFilter	virtualMachineFilter = new GeneralFilter(GeneralFilter.VIRTUAL_MACHINE_EXTS, GeneralFilter.VIRTUAL_MACHINE_DESC)
static final List< String >	VMDK_EXTS = Arrays.asList(new String[]{".vmdk"})
static final GeneralFilter	vmdkFilter = new GeneralFilter(VMDK_EXTS, "")
static final List< FileFilter >	vmdkFiltersList = new ArrayList<>()
static final List< FileFilter >	vmFiltersList = new ArrayList<>()

Detailed Description

Virtual machine file finder

Definition at line 38 of file VirtualMachineFinder.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.VirtualMachineFinder ( )

private

Prevent instantiation of this utility class.

Definition at line 182 of file VirtualMachineFinder.java.

Member Function Documentation

static List<String> org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.getAllFilesInFolder ( String  path )

staticprivate

Returns a list of all file names in the folder of interest. Sub-folders are excluded.

Parameters

path	Absolute path of the folder of interest

Returns

List of all file names in the folder of interest

Definition at line 168 of file VirtualMachineFinder.java.

Referenced by org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.identifyVirtualMachines().

static List<String> org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.identifyVirtualMachines ( Path  imageFolderPath )

static

Identifies virtual machine files for ingest.

Parameters

imageFolderPath

Absolute path to the folder to be analyzed

Returns

List of VM files to be ingested

Definition at line 72 of file VirtualMachineFinder.java.

References org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.getAllFilesInFolder(), org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.isAcceptedByFiler(), org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.isVirtualMachine(), org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.MAX_VMDK_DESCRIPTOR_FILE_SIZE_BYTES, and org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.readExtentFilesFromVmdkDescriptorFile().

static boolean org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.isAcceptedByFiler ( File  file, List< FileFilter >  filters  )

staticprivate

Definition at line 150 of file VirtualMachineFinder.java.

Referenced by org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.identifyVirtualMachines(), and org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.isVirtualMachine().

static final boolean org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.isVirtualMachine ( String  fileName )

static

Definition at line 61 of file VirtualMachineFinder.java.

References org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.isAcceptedByFiler().

Referenced by org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.identifyVirtualMachines().

static List<String> org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.readExtentFilesFromVmdkDescriptorFile ( File  file )

staticprivate

Opens VMDK descriptor file, finds and returns a list of all VMDK extent files listed in the descriptor file.

Parameters

file	VMDK descriptor file to read

Returns

List of VMDK extent file names listed in the descriptor file

Definition at line 112 of file VirtualMachineFinder.java.

References org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.FILE_NAME_FIELD_INDX.

Referenced by org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.identifyVirtualMachines().

Member Data Documentation

final int org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.FILE_NAME_FIELD_INDX = 3

staticprivate

Definition at line 44 of file VirtualMachineFinder.java.

Referenced by org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.readExtentFilesFromVmdkDescriptorFile().

final Logger org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.logger = Logger.getLogger(VirtualMachineFinder.class.getName())

staticprivate

Definition at line 40 of file VirtualMachineFinder.java.

final int org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.MAX_VMDK_DESCRIPTOR_FILE_SIZE_BYTES = 10000

staticprivate

Definition at line 42 of file VirtualMachineFinder.java.

Referenced by org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.identifyVirtualMachines().

final int org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.MIN_VMDK_EXTENT_DESCRIPTOR_FIELDS = 4

staticprivate

Definition at line 43 of file VirtualMachineFinder.java.

final GeneralFilter org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.virtualMachineFilter = new GeneralFilter(GeneralFilter.VIRTUAL_MACHINE_EXTS, GeneralFilter.VIRTUAL_MACHINE_DESC)

staticprivate

Definition at line 46 of file VirtualMachineFinder.java.

final List<String> org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.VMDK_EXTS = Arrays.asList(new String[]{".vmdk"})

staticprivate

Definition at line 53 of file VirtualMachineFinder.java.

final GeneralFilter org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.vmdkFilter = new GeneralFilter(VMDK_EXTS, "")

staticprivate

Definition at line 54 of file VirtualMachineFinder.java.

final List<FileFilter> org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.vmdkFiltersList = new ArrayList<>()

staticprivate

Definition at line 55 of file VirtualMachineFinder.java.

final List<FileFilter> org.sleuthkit.autopsy.modules.vmextractor.VirtualMachineFinder.vmFiltersList = new ArrayList<>()

staticprivate

Definition at line 47 of file VirtualMachineFinder.java.

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/modules/vmextractor/VirtualMachineFinder.java