• TskAuto

Parameters

a_db Database to add an image to

a_NSRLDb Database of "known" files (can be NULL)

a_knownBadDb Database of "known bad" files (can be NULL)

Analyzes the open image and adds image info to a database.

Does not deal with transactions and such. Refer to startAddImage() for more control.

Returns

1 if a critical error occurred (DB doesn't exist, no file system, etc.), 2 if errors occurred at some point adding files to the DB (corrupt file, etc.), and 0 otherwise. Errors will have been registered.

References TskAuto::findFilesInImg(), TskAuto::registerError(), TskAuto::setVolFilterFlags(), TSK_ERR, tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), TSK_OK, TSK_VS_PART_FLAG_ALLOC, and TSK_VS_PART_FLAG_UNALLOC.

Referenced by startAddImage().

Closes the handles to the open disk image.

Should be called after you have completed analysis of the image.

Reimplemented from TskAuto.

References TskAuto::closeImage().

Finish the transaction after the startAddImage is finished.

Returns

Id of the image that was added or -1 on error (error was NOT registered in list)

References tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_fprintf(), and tsk_verbose.

Referenced by TskCaseDb::addImage().

TskAuto calls this method before it processes each file system that is found in a volume.

You can use this to learn about each file system before it is processed and you can force TskAuto to skip this file system.

Parameters

fs_info file system details

Returns

Value to show if FS should be processed, skipped, or process should stop.

Reimplemented from TskAuto.

References TSK_FS_INFO::block_count, TSK_FS_INFO::block_size, TSK_FS_INFO::first_inum, TSK_FS_INFO::ftype, TSK_FS_INFO::last_inum, _TSK_DB_FS_INFO::objId, TSK_FS_INFO::offset, processFile(), TskAuto::registerError(), TSK_FS_INFO::root_inum, TskAuto::setFileFilterFlags(), TSK_FILTER_CONT, TSK_FILTER_STOP, TSK_FS_DIR_WALK_FLAG_ALLOC, TSK_FS_DIR_WALK_FLAG_NOORPHAN, TSK_FS_DIR_WALK_FLAG_UNALLOC, tsk_fs_file_close(), tsk_fs_file_open(), and TSK_FS_TYPE_ISFAT.

TskAuto calls this method before it processes each pool that is found.

You can use this to learn about each pool before it is processed and you can force TskAuto to skip this volume.

Parameters

pool_vol Pool details

Returns

Value to show if pool should be processed, skipped, or process should stop.

Reimplemented from TskAuto.

References _TSK_DB_VS_INFO::objId, TskAuto::registerError(), TSK_FILTER_CONT, TSK_FILTER_STOP, TSK_VS_TYPE_APFS, and TSK_VS_TYPE_LVM.

TskAuto calls this method before it processes each pool volume that is found in a pool.

You can use this to learn about each volume before it is processed and you can force TskAuto to skip this volume.

Parameters

pool_vol Pool volume details

Returns

Value to show if pool volume should be processed, skipped, or process should stop.

< Starting Block number

Reimplemented from TskAuto.

References _TSK_DB_VS_PART_INFO::objId, TskAuto::registerError(), TSK_FILTER_CONT, TSK_FILTER_STOP, and TSK_MAX_DB_VS_PART_INFO_DESC_LEN.

TskAuto calls this method before it processes each volume that is found in a volume system.

You can use this to learn about each volume before it is processed and you can force TskAuto to skip this volume. The setvolFilterFlags() method can be used to configure if TskAuto should process unallocated space.

Parameters

vs_part Parition details

Returns

Value to show if volume should be processed, skipped, or process should stop.

Reimplemented from TskAuto.

References TSK_VS_PART_INFO::addr, TSK_VS_PART_INFO::desc, TSK_VS_PART_INFO::flags, TSK_VS_PART_INFO::len, _TSK_DB_VS_PART_INFO::objId, TskAuto::registerError(), TSK_VS_PART_INFO::start, TSK_FILTER_CONT, TSK_FILTER_STOP, and TSK_MAX_DB_VS_PART_INFO_DESC_LEN.

TskAuto calls this method before it processes the volume system that is found in an image.

You can use this to learn about the volume system before it is processed and you can force TskAuto to skip this volume system.

Parameters

vs_info volume system details

Returns

Value to show if Vs should be processed, skipped, or process should stop.

Reimplemented from TskAuto.

References TSK_VS_INFO::block_size, _TSK_DB_VS_INFO::objId, TSK_VS_INFO::offset, TskAuto::registerError(), TSK_FILTER_CONT, TSK_FILTER_STOP, and TSK_VS_INFO::vstype.

Returns the directory currently being analyzed by processFile().

Safe to use from another thread than processFile().

Returns

curDirPath string representing currently analyzed directory

Calculate hash values of files and add them to database.

Default is false. Will be set to true if a Hash DB is configured.

Parameters

flag True to calculate hash values and look them up.

Check if we can talk to the database.

Returns true if the database is reachable with current credentials, false otherwise.

Opens the disk image to be analyzed.

This must be called before any of the findFilesInXXX() methods.

Parameters

a_numImg The number of images to open (will be > 1 for split images).

a_images The path to the image files (the number of files must be equal to num_img and they must be in a sorted order)

a_imgType The disk image type (can be autodetection)

a_sSize Size of device sector in bytes (or 0 for default)

Returns

1 on error (messages were NOT registered), 0 on success

Reimplemented from TskAuto.

Referenced by startAddImage().

Adds an image to the database.

Parameters

a_num Number of image parts

a_images Array of paths to the image parts

a_type Image type

a_ssize Size of device sector in bytes (or 0 for default)

a_deviceId An ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID).

Returns

0 for success, 1 for failure

References TskAuto::openImage(), and openImageUtf8().

Adds an image to the database.

Requires that m_img_info is already initialized

Parameters

a_deviceId An ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID).

Returns

0 for success, 1 for failure

Opens the disk image to be analyzed.

This must be called before any of the findFilesInXXX() methods. Always uses the utf8 tsk_img_open even in windows.

Parameters

a_numImg The number of images to open (will be > 1 for split images).

a_images The path to the image files (the number of files must be equal to num_img and they must be in a sorted order)

a_imgType The disk image type (can be autodetection)

a_sSize Size of device sector in bytes (or 0 for default)

Returns

1 on error (messages were NOT registered), 0 on success

Reimplemented from TskAuto.

Referenced by openImage().

Adds an image to the database.

Parameters

a_num Number of image parts

a_images Array of paths to the image parts

a_type Image type

a_ssize Size of device sector in bytes (or 0 for default)

a_deviceId An ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID).

Returns

0 for success, 1 for failure

References TskAuto::openImageUtf8().

TskAuto calls this method for each file and directory that it finds in an image.

The setFileFilterFlags() method can be used to set the criteria for what types of files this should be called for. There are several methods, such as isDir() that can be used by this method to help focus in on the files that you care about. When errors are encountered, send them to registerError().

Parameters

fs_file file details

path full path of parent directory

Returns

STOP or OK. All error must have been registered.

Implements TskAuto.

References TskAuto::isDir(), TSK_FS_NAME::meta_addr, TSK_FS_NAME::name, TSK_FS_FILE::name, TSK_FS_NAME::par_addr, TskAuto::processAttributes(), TSK_DB_FILES_KNOWN_UNKNOWN, tsk_fprintf(), tsk_fs_file_attr_getsize(), TSK_OK, TSK_STOP, and tsk_verbose.

Referenced by filterFs().

Revert all changes after the startAddImage() process has run successfully.

Returns

1 on error (error was NOT registered in list), 0 on success

References tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_fprintf(), and tsk_verbose.

Referenced by TskCaseDb::addImage(), and startAddImage().

Sets whether or not the file systems for an image should be added when the image is added to the case database.

The default value is true.

When enabled, records for unallocated file system space will be added to the database.

Default value is false.

Parameters

addUnallocSpace If true, create records for contiguous unallocated file system sectors.

When enabled, records for unallocated file system space will be added to the database.

Default value is false.

Parameters

addUnallocSpace If true, create records for contiguous unallocated file system sectors.

minChunkSize the number of bytes to group unallocated data into. A value of 0 will create one large chunk and group only on volume boundaries. A value of -1 will group each consecutive chunk.

When enabled, records for unallocated file system space will be added to the database with the given parameters.

Automatically sets the flag to create records for contiguous unallocated file system sectors.

Parameters

minChunkSize the number of bytes to group unallocated data into. A value of 0 will create one large chunk and group only on volume boundaries. A value of -1 will group each consecutive chunk.

maxChunkSize the maximum number of bytes in one record of unallocated data. A value of -1 will not split the records based on size

Skip processing of orphans on FAT filesystems.

This will make the loading of the database much faster but you will not have all deleted files. Default value is false.

Parameters

noFatFsOrphans flag set to true if to skip processing orphans on FAT fs

Start the process to add image/file metadata to database inside of a transaction.

User must call either commitAddImage() to commit the changes, or revertAddImage() to revert them.

Parameters

numImg Number of image parts

imagePaths Array of paths to the image parts

imgType Image type

sSize Size of device sector in bytes (or 0 for default)

deviceId An ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID)

Returns

0 for success, 1 for failure

References addFilesInImgToDb(), openImage(), TskAuto::registerError(), revertAddImage(), tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_error_set_errstr2(), tsk_fprintf(), and tsk_verbose.

Referenced by TskCaseDb::addImage().

Start the process to add image/file metadata to database inside of a transaction.

User must call either commitAddImage() to commit the changes, or revertAddImage() to revert them.

Parameters

img_info Previously initialized TSK_IMG_INFO object

deviceId An ASCII-printable identifier for the device associated with the data source that is intended to be unique across multiple cases (e.g., a UUID)

Returns

0 for success, 1 for failure

References addFilesInImgToDb(), openImage(), TskAuto::openImageHandle(), TskAuto::registerError(), revertAddImage(), tsk_error_reset(), tsk_error_set_errno(), tsk_error_set_errstr(), tsk_error_set_errstr2(), tsk_fprintf(), and tsk_verbose.

Cancel the running process.

Will not be handled immediately.

References TskAuto::setStopProcessing(), tsk_fprintf(), and tsk_verbose.