Sleuth Kit Java Bindings (JNI): /home/carriersleuth/repos/sleuthkit/bindings/java/src/org/sleuthkit/datamodel/Image.java Source File

Sleuth Kit Java Bindings (JNI)  4.3
Java bindings for using The Sleuth Kit
Image.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2013 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.text.MessageFormat;
22 import java.util.ResourceBundle;
23 import java.util.ArrayList;
24 import java.util.Arrays;
25 import java.util.List;
26 import java.util.logging.Level;
27 import java.util.logging.Logger;
28 import java.io.File;
29 
36  public class Image extends AbstractContent {
37  //data about image
38 
39   private long type, ssize, size;
40   private String[] paths;
41   private volatile long imageHandle = 0;
42   private String timezone, md5;
43   private static ResourceBundle bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle");
44 
57   protected Image(SleuthkitCase db, long obj_id, long type, long ssize, String name, String[] paths, String timezone, String md5) throws TskCoreException {
58  super(db, obj_id, name);
59  this.type = type;
60  this.ssize = ssize;
61  this.paths = paths;
62  this.timezone = timezone;
63  this.size = 0;
64  this.md5 = md5;
65  }
66 
72   public synchronized long getImageHandle() throws TskCoreException {
73  if (imageHandle == 0) {
74  imageHandle = SleuthkitJNI.openImage(paths);
75  }
76 
77  return imageHandle;
78  }
79 
80  @Override
81   public Content getDataSource() {
82  return this;
83  }
84 
85  @Override
86   public void close() {
87  //frees nothing, as we are caching image handles
88  }
89 
90  @Override
91   public void finalize() throws Throwable {
92  try {
93  if (imageHandle != 0) {
94  SleuthkitJNI.closeImg(imageHandle);
95  imageHandle = 0;
96  }
97  } finally {
98  super.finalize();
99  }
100  }
101 
102  @Override
103   public int read(byte[] buf, long offset, long len) throws TskCoreException {
104  // read from the image
105  return SleuthkitJNI.readImg(getImageHandle(), buf, offset, len);
106  }
107 
108  @Override
109   public long getSize() {
110  if (size == 0) {
111  try {
112  if (paths.length > 0) {
113  //should always had at least one path
114  size = SleuthkitJNI.findDeviceSize(paths[0]);
115  }
116  } catch (TskCoreException ex) {
117  Logger.getLogger(Image.class.getName()).log(Level.SEVERE, "Could not find image size, image: " + this.getId(), ex); //NON-NLS
118  }
119  }
120  return size;
121  }
122 
123  //Methods for retrieval of meta-data attributes
129   public TskData.TSK_IMG_TYPE_ENUM getType() {
130  return TskData.TSK_IMG_TYPE_ENUM.valueOf(type);
131  }
132 
138   public long getSsize() {
139  return ssize;
140  }
141 
142  @Override
143   public String getUniquePath() throws TskCoreException {
144  return "/img_" + getName(); //NON-NLS
145  }
146 
152   public String[] getPaths() {
153  return paths;
154  }
155 
161   public List<VolumeSystem> getVolumeSystems() throws TskCoreException {
162 
163  List<Content> children = getChildren();
164  List<VolumeSystem> vs = new ArrayList<VolumeSystem>();
165  for (Content child : children) {
166  if (child instanceof VolumeSystem) {
167  vs.add((VolumeSystem) child);
168  }
169  }
170 
171  return vs;
172  }
173 
179   public List<Volume> getVolumes() throws TskCoreException {
180 
181  List<Content> children = getChildren();
182  List<Volume> volumes = new ArrayList<Volume>();
183  for (Content child : children) {
184  if (child instanceof Volume) {
185  volumes.add((Volume) child);
186  }
187  }
188 
189  return volumes;
190  }
191 
199   public List<FileSystem> getFileSystems() throws TskCoreException {
200  List<FileSystem> fs = new ArrayList<FileSystem>();
201  fs.addAll(getSleuthkitCase().getFileSystems(this));
202  return fs;
203  }
204 
210   public String getTimeZone() {
211  return timezone;
212  }
213 
214  @Override
215  public <T> T accept(SleuthkitItemVisitor<T> v) {
216  return v.visit(this);
217  }
218 
219  @Override
220  public <T> T accept(ContentVisitor<T> v) {
221  return v.visit(this);
222  }
223 
224  @Override
225   public List<Content> getChildren() throws TskCoreException {
226  return getSleuthkitCase().getImageChildren(this);
227  }
228 
229  @Override
230   public List<Long> getChildrenIds() throws TskCoreException {
231  return getSleuthkitCase().getImageChildrenIds(this);
232  }
233 
234  @Override
235   public String toString(boolean preserveState) {
236  return super.toString(preserveState) + "Image [\t" + "\t" + "paths " + Arrays.toString(paths) + "\t" + "size " + size + "\t" + "ssize " + ssize + "\t" + "timezone " + timezone + "\t" + "type " + type + "]\t"; //NON-NLS
237  }
238 
245   public Boolean imageFileExists() {
246  if (paths.length > 0) {
247  File imageFile = new File(paths[0]);
248  return imageFile.exists();
249  }
250 
251  return false;
252  }
253 
261   public String verifyImageSize() {
262  Logger logger1 = Logger.getLogger("verifyImageSizes"); //NON-NLS
263  String errorString = "";
264  try {
265  List<VolumeSystem> volumeSystems = getVolumeSystems();
266  for (VolumeSystem vs : volumeSystems) {
267  List<Volume> volumes = vs.getVolumes();
268  for (Volume v : volumes) {
269  byte[] buf = new byte[512];
270  long endOffset = (v.getStart() + v.getLength()) * 512 - 512;
271  try {
272  int readBytes = read(buf, endOffset, 512);
273  if (readBytes < 0) {
274  logger1.warning("Possible Incomplete Image: Error reading volume at offset " + endOffset); //NON-NLS
275  errorString = MessageFormat.format(bundle.getString("Image.verifyImageSize.errStr1.text"), endOffset);
276  }
277  } catch (TskCoreException ex) {
278  logger1.warning("Possible Incomplete Image: Error reading volume at offset " + endOffset + ": " + ex.getLocalizedMessage()); //NON-NLS
279  errorString = MessageFormat.format(bundle.getString("Image.verifyImageSize.errStr2.text"), endOffset);
280  }
281  }
282  }
283 
284  List<FileSystem> fileSystems = getFileSystems();
285  for (FileSystem fs : fileSystems) {
286  long block_size = fs.getBlock_size();
287  long endOffset = fs.getImageOffset() + fs.getSize() - block_size;
288  try {
289  byte[] buf = new byte[(int) block_size];
290  int readBytes = read(buf, endOffset, block_size);
291  if (readBytes < 0) {
292  logger1.warning("Possible Incomplete Image: Error reading file system at offset " + endOffset); //NON-NLS
293  errorString = MessageFormat.format(bundle.getString("Image.verifyImageSize.errStr3.text"), endOffset);
294  }
295  } catch (TskCoreException ex) {
296  logger1.warning("Possible Incomplete Image: Error reading file system at offset " + endOffset + ": " + ex.getLocalizedMessage()); //NON-NLS
297  errorString = MessageFormat.format(bundle.getString("Image.verifyImageSize.errStr4.text"), endOffset);
298  }
299  }
300  } catch (TskException ex) {
301  // do nothing if we got an exception from trying to get file systems and volume systems
302  }
303  return errorString;
304  }
305 
311   public String getMd5() {
312  return md5;
313  }
314 }
static int readImg(long imgHandle, byte[] readBuffer, long offset, long len)
List< Volume > getVolumes()
Definition: Image.java:179
List< FileSystem > getFileSystems()
Definition: Image.java:199
String getName()
Image(SleuthkitCase db, long obj_id, long type, long ssize, String name, String[] paths, String timezone, String md5)
Definition: Image.java:57
TskData.TSK_IMG_TYPE_ENUM getType()
Definition: Image.java:129
List< Long > getChildrenIds()
Definition: Image.java:230
int read(byte[] buf, long offset, long len)
Definition: Image.java:103
final SleuthkitCase db
volatile long imageHandle
Definition: Image.java:41
final String name
static long openImage(String[] imageFiles)
static long findDeviceSize(String devPath)
static ResourceBundle bundle
Definition: Image.java:43
static void closeImg(long imgHandle)
SleuthkitCase getSleuthkitCase()
Definition: Content.java:32
List< Content > getChildren()
Definition: Image.java:225
List< VolumeSystem > getVolumeSystems()
Definition: Image.java:161
static TSK_IMG_TYPE_ENUM valueOf(long imgType)
Definition: TskData.java:524
String toString(boolean preserveState)
Definition: Image.java:235
Definition: TskData.java:502
synchronized long getImageHandle()
Definition: Image.java:72

Copyright © 2011-2015 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.

AltStyle によって変換されたページ (->オリジナル) /