Inheritance diagram for TskDb:
Public Member Functions
virtual
TSK_RETVAL_ENUM addCarvedFile (const int64_t parentObjId, const int64_t fsObjId, const uint64_t size, vector<
TSK_DB_FILE_LAYOUT_RANGE > &ranges, int64_t &objId, int64_t dataSourceObjId)=0
virtual int addFileLayoutRange (int64_t a_fileObjId, uint64_t a_byteStart, uint64_t a_byteLen, int a_sequence)=0
virtual int
addFsInfo (const
TSK_FS_INFO *fs_info, int64_t parObjId, int64_t &objId)=0
virtual int addImageInfo (int type, int size, int64_t &objId, const string &timezone)=0
virtual int
addImageInfo (int type, int size, int64_t &objId, const string &timezone,
TSK_OFF_T, const string &md5, const string &sha1, const string &sha256)=0
virtual int
addImageInfo (int type,
TSK_OFF_T size, int64_t &objId, const string &timezone,
TSK_OFF_T, const string &md5, const string &sha1, const string &sha256, const string &deviceId, const string &collectionDetails)=0
virtual int addImageName (int64_t objId, char const *imgName, int sequence)=0
virtual int addPoolInfoAndVS (const TSK_POOL_INFO *pool_info, int64_t parObjId, int64_t &vsObjId)=0
virtual int addPoolVolumeInfo (const TSK_POOL_VOLUME_INFO *pool_vol, int64_t parObjId, int64_t &objId)=0
virtual int addUnallocatedPoolVolume (int vol_index, int64_t parObjId, int64_t &objId)=0
virtual
TSK_RETVAL_ENUM addUnallocBlockFile (const int64_t parentObjId, const int64_t fsObjId, const uint64_t size, vector<
TSK_DB_FILE_LAYOUT_RANGE > &ranges, int64_t &objId, int64_t dataSourceObjId)=0
virtual
TSK_RETVAL_ENUM addUnallocFsBlockFilesParent (const int64_t fsObjId, int64_t &objId, int64_t dataSourceObjId)=0
virtual
TSK_RETVAL_ENUM addUnusedBlockFile (const int64_t parentObjId, const int64_t fsObjId, const uint64_t size, vector<
TSK_DB_FILE_LAYOUT_RANGE > &ranges, int64_t &objId, int64_t dataSourceObjId)=0
virtual
TSK_RETVAL_ENUM addVirtualDir (const int64_t fsObjId, const int64_t parentDirId, const char *const name, int64_t &objId, int64_t dataSourceObjId)=0
virtual int
addVolumeInfo (const
TSK_VS_PART_INFO *vs_part, int64_t parObjId, int64_t &objId)=0
virtual int
addVsInfo (const
TSK_VS_INFO *vs_info, int64_t parObjId, int64_t &objId)=0
virtual int close ()=0
virtual int createSavepoint (const char *name)=0
virtual bool dbExists ()=0
virtual
TSK_RETVAL_ENUM getParentImageId (const int64_t objId, int64_t &imageId)=0
virtual bool getParentPathAndName (const char *path, const char **ret_parent_path, const char **ret_name)
virtual bool inTransaction ()=0
virtual bool isDbOpen ()=0
virtual int open (bool)=0
virtual int releaseSavepoint (const char *name)=0
virtual int revertSavepoint (const char *name)=0
TskDb (const char *a_dbFilePathUtf8, bool a_blkMapFlag)
Set the locations and logging object.
More...
Protected Member Functions
Extract the extension from the given file name and store it in the supplied string.
More...
Constructor & Destructor Documentation
TskDb::TskDb
(
const char *
a_dbFilePathUtf8,
bool
a_blkMapFlag
)
Set the locations and logging object.
Must call open() before the object can be used.
Member Function Documentation
void TskDb::extractExtension
(
char *
name,
char *
extension
)
inlineprotected
Extract the extension from the given file name and store it in the supplied string.
- Parameters
-
name A file name
extension The file name extension will be extracted to extension.
The documentation for this class was generated from the following files: