• TskAuto

TskAuto calls this method before it processes each file system that is found in a volume.

You can use this to learn about each file system before it is processed and you can force TskAuto to skip this file system.

Parameters

fs_info file system details

Returns

Value to show if FS should be processed, skipped, or process should stop.

Reimplemented from TskAuto.

References TSK_FILTER_SKIP.

TskAuto calls this method before it processes each pool that is found.

You can use this to learn about each pool before it is processed and you can force TskAuto to skip this volume.

Parameters

pool_vol Pool details

Returns

Value to show if pool should be processed, skipped, or process should stop.

Reimplemented from TskAuto.

References TSK_FILTER_CONT.

TskAuto calls this method before it processes each pool volume that is found in a pool.

You can use this to learn about each volume before it is processed and you can force TskAuto to skip this volume.

Parameters

pool_vol Pool volume details

Returns

Value to show if pool volume should be processed, skipped, or process should stop.

Reimplemented from TskAuto.

References TSK_FILTER_CONT.

TskAuto calls this method before it processes each volume that is found in a volume system.

You can use this to learn about each volume before it is processed and you can force TskAuto to skip this volume. The setvolFilterFlags() method can be used to configure if TskAuto should process unallocated space.

Parameters

vs_part Parition details

Returns

Value to show if volume should be processed, skipped, or process should stop.

Reimplemented from TskAuto.

References TSK_FILTER_CONT.

Prepare the result for dataModel_SleuthkitJNI::isImageSupportedNat.

There's some complexity here because BitLocker drives appear to have a very small unencrypted volume followed by the encrypted volume. So we need to check for BitLocker errors instead of just going by whether we were able to open a file system.

Returns

Empty string if image is supported, error string if not

References getSingleLineErrorMessage(), TSK_IMG_INFO::images, TSK_IMG_INFO::num_img, TSK_IMG_INFO::sector_size, tsk_error_get_errstr(), tsk_img_close(), tsk_img_open(), and TSK_IMG_TYPE_VMDK_VMDK.

Override this method to get called for each error that is registered.

This method allows you to log the message or stop processing. Use setStopProcessing() to do that.

Returns

1 to stop the processing flow and 0 to continue.

Reimplemented from TskAuto.

TskAuto calls this method for each file and directory that it finds in an image.

The setFileFilterFlags() method can be used to set the criteria for what types of files this should be called for. There are several methods, such as isDir() that can be used by this method to help focus in on the files that you care about. When errors are encountered, send them to registerError().

Parameters

fs_file file details

path full path of parent directory

Returns

STOP or OK. All error must have been registered.

Implements TskAuto.

References TSK_OK.