Sleuth Kit Java Bindings (JNI): /home/carriersleuth/repos/sleuthkit/bindings/java/src/org/sleuthkit/datamodel/Volume.java Source File

Sleuth Kit Java Bindings (JNI)  4.3
Java bindings for using The Sleuth Kit
Volume.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.util.ResourceBundle;
22 import java.util.ArrayList;
23 import java.util.List;
24 
29  public class Volume extends AbstractContent {
30 
31   private long addr;
32   private long startSector; //in sectors, relative to volume system start
33   private long lengthInSectors; //in sectors
34   private long flags;
35   private String desc;
36   private volatile long volumeHandle = 0;
37   private static ResourceBundle bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle");
38 
50   protected Volume(SleuthkitCase db, long obj_id, long addr, long startSector, long lengthInSectors, long flags, String desc) {
51  super(db, obj_id, "vol" + Long.toString(addr)); //NON-NLS
52  this.addr = addr;
53  this.startSector = startSector;
54  this.lengthInSectors = lengthInSectors;
55  this.flags = flags;
56  if (!desc.equals("")) {
57  this.desc = desc;
58  } else {
59  this.desc = bundle.getString("Volume.desc.text");
60  }
61  }
62 
63  @Override
64   public int read(byte[] buf, long offset, long len) throws TskCoreException {
65  synchronized (this) {
66  Content myParent = getParent();
67  if (!(myParent instanceof VolumeSystem)) {
68  throw new TskCoreException(bundle.getString("Volume.read.exception.msg1.text"));
69  }
70  VolumeSystem parentVs = (VolumeSystem) myParent;
71  // read from the volume
72  if (volumeHandle == 0) {
73  volumeHandle = SleuthkitJNI.openVsPart(parentVs.getVolumeSystemHandle(), addr);
74  }
75 
76  }
77  return SleuthkitJNI.readVsPart(volumeHandle, buf, offset, len);
78  }
79 
80  @Override
81   public void close() {
82  if (volumeHandle != 0) {
83  synchronized (this) {
84  if (volumeHandle != 0) {
85  SleuthkitJNI.closeVs(volumeHandle);
86  volumeHandle = 0;
87  }
88  }
89  }
90  }
91 
92  @Override
93   public void finalize() throws Throwable {
94  try {
95  close();
96  } finally {
97  super.finalize();
98  }
99  }
100 
101  @Override
102   public long getSize() {
103  return lengthInSectors * 512;
104  }
105 
106  @Override
107   public synchronized String getUniquePath() throws TskCoreException {
108  String uniquePath = "";
109  String name = getName();
110  if (!name.isEmpty()) {
111  uniquePath = "/vol_" + name; //NON-NLS
112  }
113 
114  Content myParent = getParent();
115  if (myParent != null) {
116  uniquePath = myParent.getUniquePath() + uniquePath;
117  }
118  return uniquePath;
119  }
120 
121  //methods get exact data from database. could be manipulated to get more
122  //meaningful data.
129   public long getAddr() {
130  return addr;
131  }
132 
139   public long getStart() {
140  return startSector;
141  }
142 
148   public long getLength() {
149  return lengthInSectors;
150  }
151 
157   public long getFlags() {
158  return flags;
159  }
160 
166   public String getFlagsAsString() {
167  return Volume.vsFlagToString(flags);
168  }
169 
176   public String getDescription() {
177  return desc;
178  }
179 
180  // ----- Here all the methods for vs flags conversion / mapping -----
188   public static String vsFlagToValue(long vsFlag) {
189 
190  String result = "";
191 
192  for (TskData.TSK_VS_PART_FLAG_ENUM flag : TskData.TSK_VS_PART_FLAG_ENUM.values()) {
193  if (flag.getVsFlag() == vsFlag) {
194  result = flag.toString();
195  }
196  }
197  return result;
198  }
199 
207   public static long valueToVsFlag(String vsFlag) {
208 
209  long result = 0;
210 
211  for (TskData.TSK_VS_PART_FLAG_ENUM flag : TskData.TSK_VS_PART_FLAG_ENUM.values()) {
212  if (flag.toString().equals(vsFlag)) {
213  result = flag.getVsFlag();
214  }
215  }
216  return result;
217  }
218 
226   public static String vsFlagToString(long vsFlag) {
227 
228  String result = "";
229 
230  long allocFlag = TskData.TSK_VS_PART_FLAG_ENUM.TSK_VS_PART_FLAG_ALLOC.getVsFlag();
231  long unallocFlag = TskData.TSK_VS_PART_FLAG_ENUM.TSK_VS_PART_FLAG_UNALLOC.getVsFlag();
232 
233  // some variables that might be needed in the future
234  long metaFlag = TskData.TSK_VS_PART_FLAG_ENUM.TSK_VS_PART_FLAG_META.getVsFlag();
235  long allFlag = TskData.TSK_VS_PART_FLAG_ENUM.TSK_VS_PART_FLAG_ALL.getVsFlag();
236 
237  if ((vsFlag & allocFlag) == allocFlag) {
238  result = bundle.getString("Volume.vsFlagToString.allocated");
239  }
240  if ((vsFlag & unallocFlag) == unallocFlag) {
241  result = bundle.getString("Volume.vsFlagToString.unallocated");
242  }
243  // ... add more code here if needed
244 
245  return result;
246  }
247 
248  @Override
249  public <T> T accept(SleuthkitItemVisitor<T> v) {
250  return v.visit(this);
251  }
252 
253  @Override
254  public <T> T accept(ContentVisitor<T> v) {
255  return v.visit(this);
256  }
257 
258  @Override
259   public List<Content> getChildren() throws TskCoreException {
260  return getSleuthkitCase().getVolumeChildren(this);
261  }
262 
263  @Override
264   public List<Long> getChildrenIds() throws TskCoreException {
265  return getSleuthkitCase().getVolumeChildrenIds(this);
266  }
267 
273   public List<FileSystem> getFileSystems() throws TskCoreException {
274 
275  List<Content> children = getChildren();
276  List<FileSystem> fileSystems = new ArrayList<FileSystem>();
277  for (Content child : children) {
278  if (child instanceof FileSystem) {
279  fileSystems.add((FileSystem) child);
280  }
281  }
282 
283  return fileSystems;
284  }
285 
286  @Override
287   public String toString(boolean preserveState) {
288  return super.toString(preserveState) + "Volume [\t" + "addr " + addr + "\t" + "desc " + desc + "\t" + "flags " + flags + "\t" + "length " + lengthInSectors + "\t" + "start " + startSector + "]\t"; //NON-NLS
289  }
290 }
TSK_VS_PART_FLAG_ALL
Show all sectors in the walk.
Definition: TskData.java:334
synchronized Content getParent()
static long valueToVsFlag(String vsFlag)
Definition: Volume.java:207
TSK_VS_PART_FLAG_ALLOC
Sectors are allocated to a volume in the volume system.
Definition: TskData.java:331
String getName()
int read(byte[] buf, long offset, long len)
Definition: Volume.java:64
List< FileSystem > getFileSystems()
Definition: Volume.java:273
synchronized long getVolumeSystemHandle()
String toString(boolean preserveState)
Definition: Volume.java:287
TSK_VS_PART_FLAG_META
Sectors contain volume system metadata and could also be ALLOC or UNALLOC.
Definition: TskData.java:333
static ResourceBundle bundle
Definition: Volume.java:37
Volume(SleuthkitCase db, long obj_id, long addr, long startSector, long lengthInSectors, long flags, String desc)
Definition: Volume.java:50
final SleuthkitCase db
static int readVsPart(long volHandle, byte[] readBuffer, long offset, long len)
List< Long > getChildrenIds()
Definition: Volume.java:264
final String name
static void closeVs(long vsHandle)
static String vsFlagToValue(long vsFlag)
Definition: Volume.java:188
Definition: TskData.java:329
List< Content > getChildren()
Definition: Volume.java:259
SleuthkitCase getSleuthkitCase()
Definition: Content.java:32
String uniquePath
volatile long volumeHandle
Definition: Volume.java:36
static long openVsPart(long vsHandle, long volId)
TSK_VS_PART_FLAG_UNALLOC
Sectors are not allocated to a volume.
Definition: TskData.java:332
synchronized String getUniquePath()
Definition: Volume.java:107
static String vsFlagToString(long vsFlag)
Definition: Volume.java:226
String getUniquePath()

Copyright © 2011-2015 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.

AltStyle によって変換されたページ (->オリジナル) /