Skip to content
Snippets Groups Projects
Select Git revision
  • xfs_support default
  • develop protected
  • ntfs_time_range_fix
  • ct-3.9.0
  • new_table_load
  • master
  • ct-3.8.0
  • ct-3.7.0
  • tgist
  • ct-3.6.0
  • ct-3.5.0
  • case-0.4.0
  • revert-2654-8271-removeVisitorCode
  • release-4.11.1
  • new_cr_artifacts
  • libewf-upgrade
  • file-repository
  • ignore_idx_root
  • installer_size_reduction
  • sleuthkit-4.12.1
  • sleuthkit-4.12.0
  • sleuthkit-4.11.1
  • sleuthkit-4.11.0
  • sleuthkit-4.10.2
  • sleuthkit-4.10.1
  • sleuthkit-4.10.0
  • sleuthkit-4.9.0
  • sleuthkit-4.8.0-fixed
  • sleuthkit-4.8.0
  • sleuthkit-4.7.0
  • sleuthkit-4.6.7
  • sleuthkit-4.6.6
  • sleuthkit-4.6.5
  • sleuthkit-4.6.4
  • sleuthkit-4.6.3
  • sleuthkit-4.6.2
  • sleuthkit-4.6.1
  • sleuthkit-4.6.0
  • sleuthkit-4.5.0
39 results
Blame Permalink
Code owners
Assign users and groups as approvers for specific file changes. Learn more.
main.dox 3.00 KiB 
/*! \mainpage The Sleuth Kit Java Bindings Developer's Guide and API Reference

<h3>Overview</h3>

These classes allow Java programs to access data extracted by The Sleuth Kit.

The Sleuth Kit is primarily a C/C++ library and set of command line tools. These classes allow programs to obtain the data that TSK can produce.   The typical steps would be to use JNI to cause the TSK library to create and populate a SQLite database.  The Java classes then directly open the SQLite database and perform queries on it. 

Expand on this to mention what classes to use, etc.

\section jni_hierarchy Class Hierarchy

Flush out here on general layout. 

- org.sleuthkit.datamodel.Content is top-level interface and gets more specific as it goes down.
- Types disk and file system organization concepts (org.sleuthkit.datamodel.FileSystem, org.sleuthkit.datamodel.Image, etc. )
- org.sleuthkit.datamodel.AbstractFile is interface for various types of files with more specific classes below it ( org.sleuthkit.datamodel.DerivedFile, org.sleuthkit.datamodel.FsContent, etc.)

\section jni_blackboard The Blackboard

The blackboard in the database is used to communicate with modules in The Sleuth Kit framework and in Autopsy.  The blackboard concepts are described in the framework documentation (http://sleuthkit.org/sleuthkit/docs/framework-docs/mod_bbpage.html).
This section provides a high-level overview of the relevant topics from the Java perspective (since the previous document focuses on the C++ APIs). 

To make an artifact, one first calls the org.sleuthkit.datamodel.AbstractContent.newArtifact() method for the object that the artifact is being added to.  This returns a org.sleuthkit.datamodel.BlackboardArtifact object.  Attributes of type org.sleuthkit.datamodel.BlackboardAttribute are then created and added to the artifact.  

To find artifacts, you have two general options.  If you have an org.sleuthkit.datamodel.AbstractContent object or a derived object, then you can use the org.sleuthkit.datamodel.AbstractContent.getArtifacts() methods to perform various queries. If you want artifacts beyond those for a single file, then you must use the various org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts() methods.

If you want to create an artifact type that is not defined in the framework/bindings, then use org.sleuthkit.datamodel.SleuthkitCase.addArtifactType() to define the type.  This will return back an artifact ID that you can pass in to create actual artifacts.  Note that each database instance could assign a different ID for the custom attributes and artifacts.  It all depends on what modules were run before it and if they added their own types.  Later modules will need the ID of the new type if they want to find artifacts on the blackboard.  They can get the ID for that database using org.sleuthkit.datamodel.SleuthkitCase.getArtifactTypeID().   Similarly, you can add custom attributes with org.sleuthkit.datamodel.SleuthkitCase.addAttrType() and find the ID using org.sleuthkit.datamodel.SleuthkitCase.getAttrTypeID().


*/