diff --git a/bindings/java/src/org/sleuthkit/datamodel/AbstractFile.java b/bindings/java/src/org/sleuthkit/datamodel/AbstractFile.java
index 06feec8c0cdb7f767c4ec3ed2a5c2381197326df..4d7d0adaa0c6a508520ddfc80f22086f323d2028 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/AbstractFile.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/AbstractFile.java
@@ -97,6 +97,9 @@ public abstract class AbstractFile extends AbstractContent {
protected String sha1Hash;
private boolean sha1HashDirty = false;
+ private TskData.CollectedStatus collected; // Collected status of file data
+ private boolean collectedDirty = false;
+
private String mimeType;
private boolean mimeTypeDirty = false;
private static final Logger LOGGER = Logger.getLogger(AbstractFile.class.getName());
@@ -152,6 +155,7 @@ public abstract class AbstractFile extends AbstractContent {
* including the '.'), can be null.
* @param ownerUid Owner uid/SID, can be null if not available.
* @param osAccountObjectId Object Id of the owner OsAccount, may be null.
+ * @param collected Collected status of file data
*
*/
AbstractFile(SleuthkitCase db,
@@ -175,6 +179,7 @@ public abstract class AbstractFile extends AbstractContent {
String extension,
String ownerUid,
Long osAccountObjectId,
+ TskData.CollectedStatus collected,
List<Attribute> fileAttributes) {
super(db, objId, name);
this.dataSourceObjectId = dataSourceObjectId;
@@ -221,6 +226,7 @@ public abstract class AbstractFile extends AbstractContent {
this.encodingType = TskData.EncodingType.NONE;
this.ownerUid = ownerUid;
this.osAccountObjId = osAccountObjectId;
+ this.collected = collected;
if (Objects.nonNull(fileAttributes) && !fileAttributes.isEmpty()) {
this.fileAttributesCache.addAll(fileAttributes);
loadedAttributesCacheFromDb = true;
@@ -727,6 +733,25 @@ public Content getDataSource() throws TskCoreException {
public long getDataSourceObjectId() {
return dataSourceObjectId;
}
+
+ /**
+ * Gets the collected status of the file data.
+ *
+ * @return The collected.
+ */
+ public TskData.CollectedStatus getCollected() {
+ return collected;
+ }
+
+ /**
+ * Sets the collected status of the file data.
+ *
+ * @param collected The file data's collected status
+ */
+ public void setCollected(TskData.CollectedStatus collected) {
+ this.collected = collected;
+ collectedDirty = true;
+ }
/**
* Gets file ranges associated with the file. File ranges are objects in
@@ -1382,7 +1407,7 @@ public void save() throws TskCoreException {
* properties to the case database.
*/
public void save(CaseDbTransaction transaction) throws TskCoreException {
- if (!(md5HashDirty || sha256HashDirty || sha1HashDirty || mimeTypeDirty || knownStateDirty)) {
+ if (!(md5HashDirty || sha256HashDirty || sha1HashDirty || mimeTypeDirty || knownStateDirty || collectedDirty)) {
return;
}
@@ -1414,6 +1439,12 @@ public void save(CaseDbTransaction transaction) throws TskCoreException {
}
updateSql += "known = '" + this.getKnown().getFileKnownValue() + "'";
}
+ if (collectedDirty) {
+ if (!updateSql.isEmpty()) {
+ updateSql += ", ";
+ }
+ updateSql += "collected = '" + this.getCollected().getType() + "'";
+ }
updateSql = "UPDATE tsk_files SET " + updateSql + " WHERE obj_id = " + this.getId();
SleuthkitCase.CaseDbConnection connection = transaction.getConnection();
@@ -1424,6 +1455,7 @@ public void save(CaseDbTransaction transaction) throws TskCoreException {
sha1HashDirty = false;
mimeTypeDirty = false;
knownStateDirty = false;
+ collectedDirty = false;
} catch (SQLException ex) {
throw new TskCoreException(String.format("Error updating properties of file %s (obj_id = %s)", getName(), getId()), ex);
}
@@ -1673,4 +1705,74 @@ public static String epochToTime(long epoch, TimeZone tzone) {
public static long timeToEpoch(String time) {
return TimeUtilities.timeToEpoch(time);
}
+
+ /**
+ * Initializes common fields used by AbstactFile implementations (objects in
+ * tsk_files table)
+ *
+ * @param db case / db handle where this file belongs to
+ * @param objId object id in tsk_objects table
+ * @param dataSourceObjectId The object id of the root data source of this
+ * file.
+ * @param fileSystemObjectId The object id of the file system. Can be null (or 0 representing null)
+ * @param attrType
+ * @param attrId
+ * @param name name field of the file
+ * @param fileType type of the file
+ * @param metaAddr
+ * @param metaSeq
+ * @param dirType
+ * @param metaType
+ * @param dirFlag
+ * @param metaFlags
+ * @param size
+ * @param ctime
+ * @param crtime
+ * @param atime
+ * @param mtime
+ * @param modes
+ * @param uid
+ * @param gid
+ * @param md5Hash md5sum of the file, or null if not present
+ * @param sha256Hash sha256 hash of the file, or null if not present
+ * @param sha1Hash SHA-1 hash of the file, or null if not present
+ * @param knownState knownState status of the file, or null if
+ * unknown (default)
+ * @param parentPath
+ * @param mimeType The MIME type of the file, can be null.
+ * @param extension The extension part of the file name (not
+ * including the '.'), can be null.
+ * @param ownerUid Owner uid/SID, can be null if not available.
+ * @param osAccountObjectId Object Id of the owner OsAccount, may be null.
+ *
+ * @deprecated
+ */
+ @Deprecated
+ AbstractFile(SleuthkitCase db,
+ long objId,
+ long dataSourceObjectId,
+ Long fileSystemObjectId,
+ TskData.TSK_FS_ATTR_TYPE_ENUM attrType, int attrId,
+ String name,
+ TskData.TSK_DB_FILES_TYPE_ENUM fileType,
+ long metaAddr, int metaSeq,
+ TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType,
+ TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags,
+ long size,
+ long ctime, long crtime, long atime, long mtime,
+ short modes,
+ int uid, int gid,
+ String md5Hash, String sha256Hash, String sha1Hash,
+ FileKnown knownState,
+ String parentPath,
+ String mimeType,
+ String extension,
+ String ownerUid,
+ Long osAccountObjectId,
+ List<Attribute> fileAttributes) {
+ this(db, objId, dataSourceObjectId, fileSystemObjectId, attrType, attrId, name, fileType, metaAddr, metaSeq,
+ dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid,
+ md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, extension,
+ ownerUid, osAccountObjectId, TskData.CollectedStatus.UNKNOWN, fileAttributes);
+ }
}
diff --git a/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties b/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties
index 9d168aa0b29391cf093bf4c4c152bf6de5e2be0a..0616b0d3a56e5a7690a7c3cb7529fcf295e57000 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties
+++ b/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties
@@ -282,6 +282,7 @@ TskData.fileKnown.known=known
TskData.fileKnown.knownBad=notable
TskData.fileKnown.exception.msg1.text=No FileKnown of value\: {0}
TskData.encodingType.exception.msg1.text=No EncodingType of value\: {0}
+TskData.collectedStatus.exception.msg1.text=No CollectedStatus of value\: {0}
TskData.keywordSearchQueryType.exception.msg1.text=No KeywordSearchQueryType of value\: {0}
TskData.tskDbFilesTypeEnum.exception.msg1.text=No TSK_FILE_TYPE_ENUM of value\: {0}
TskData.objectTypeEnum.exception.msg1.text=No ObjectType of value\: {0}
diff --git a/bindings/java/src/org/sleuthkit/datamodel/CaseDatabaseFactory.java b/bindings/java/src/org/sleuthkit/datamodel/CaseDatabaseFactory.java
index 109dff85172420c84f0ea864fc9486283f99944e..f1dc2cfbec3ed560c54fc2e750e3b78f1de2b714 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/CaseDatabaseFactory.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/CaseDatabaseFactory.java
@@ -207,6 +207,8 @@ private void createFileTables(Statement stmt) throws SQLException {
+ "FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id) ON DELETE CASCADE, "
+ "FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE)");
+ stmt.execute("CREATE TABLE file_collection_status_types (collection_status_type INTEGER PRIMARY KEY, name TEXT NOT NULL)");
+
stmt.execute("CREATE TABLE tsk_files (obj_id " + dbQueryHelper.getPrimaryKey() + " PRIMARY KEY, "
+ "fs_obj_id " + dbQueryHelper.getBigIntType() + ", data_source_obj_id " + dbQueryHelper.getBigIntType() + " NOT NULL, "
+ "attr_type INTEGER, attr_id INTEGER, "
@@ -220,10 +222,12 @@ private void createFileTables(Statement stmt) throws SQLException {
+ "parent_path TEXT, mime_type TEXT, extension TEXT, "
+ "owner_uid TEXT DEFAULT NULL, "
+ "os_account_obj_id " + dbQueryHelper.getBigIntType() + " DEFAULT NULL, "
+ + "collected INTEGER NOT NULL, "
+ "FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE, "
+ "FOREIGN KEY(fs_obj_id) REFERENCES tsk_fs_info(obj_id) ON DELETE CASCADE, "
+ "FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id) ON DELETE CASCADE, "
- + "FOREIGN KEY(os_account_obj_id) REFERENCES tsk_os_accounts(os_account_obj_id) ON DELETE SET NULL) " );
+ + "FOREIGN KEY(os_account_obj_id) REFERENCES tsk_os_accounts(os_account_obj_id) ON DELETE SET NULL, "
+ + "FOREIGN KEY(collected) REFERENCES file_collection_status_types (collection_status_type))" );
stmt.execute("CREATE TABLE file_encoding_types (encoding_type INTEGER PRIMARY KEY, name TEXT NOT NULL)");
diff --git a/bindings/java/src/org/sleuthkit/datamodel/DerivedFile.java b/bindings/java/src/org/sleuthkit/datamodel/DerivedFile.java
index 2feba9ba132e587b146cc49feec4dd7a47552054..05676b3ed38bafdf194c08f569756c0bb228fdfb 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/DerivedFile.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/DerivedFile.java
@@ -113,7 +113,7 @@ public class DerivedFile extends AbstractFile {
// through the class hierarchy contructors.
super(db, objId, dataSourceObjectId, fileSystemObjectId, TskData.TSK_FS_ATTR_TYPE_ENUM.TSK_FS_ATTR_TYPE_DEFAULT, 0,
name, TSK_DB_FILES_TYPE_ENUM.DERIVED, 0L, 0, dirType, metaType, dirFlag,
- metaFlags, size, ctime, crtime, atime, mtime, (short) 0, 0, 0, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, extension, ownerUid, osAccountObjId, Collections.emptyList());
+ metaFlags, size, ctime, crtime, atime, mtime, (short) 0, 0, 0, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, extension, ownerUid, osAccountObjId, TskData.CollectedStatus.UNKNOWN, Collections.emptyList());
setLocalFilePath(localPath);
setEncodingType(encodingType);
}
diff --git a/bindings/java/src/org/sleuthkit/datamodel/Directory.java b/bindings/java/src/org/sleuthkit/datamodel/Directory.java
index 321161ebdac33fc94f6971fda74ef3b99570ec64..24612b577adc985b5bf14f08caaf3d4622215071 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/Directory.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/Directory.java
@@ -94,7 +94,7 @@ public class Directory extends FsContent {
String md5Hash, String sha256Hash, String sha1Hash,
FileKnown knownState, String parentPath,
String ownerUid, Long osAccountObjId) {
- super(db, objId, dataSourceObjectId, fsObjId, attrType, attrId, name, TskData.TSK_DB_FILES_TYPE_ENUM.FS, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, null, null, ownerUid, osAccountObjId, Collections.emptyList());
+ super(db, objId, dataSourceObjectId, fsObjId, attrType, attrId, name, TskData.TSK_DB_FILES_TYPE_ENUM.FS, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, null, null, ownerUid, osAccountObjId, TskData.CollectedStatus.UNKNOWN, Collections.emptyList());
}
/**
diff --git a/bindings/java/src/org/sleuthkit/datamodel/File.java b/bindings/java/src/org/sleuthkit/datamodel/File.java
index 341543e0c6071e604cdfc319678b7622b1be7fa3..6fefc6ae807b11093d7e98865a6dfe60665a9d8c 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/File.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/File.java
@@ -101,8 +101,12 @@ public class File extends FsContent {
String extension,
String ownerUid,
Long osAccountObjId,
+ TskData.CollectedStatus collected,
List<Attribute> fileAttributes) {
- super(db, objId, dataSourceObjectId, fsObjId, attrType, attrId, name, TskData.TSK_DB_FILES_TYPE_ENUM.FS, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, extension, ownerUid, osAccountObjId, fileAttributes);
+ super(db, objId, dataSourceObjectId, fsObjId, attrType, attrId, name, TskData.TSK_DB_FILES_TYPE_ENUM.FS,
+ metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime,
+ modes, uid, gid, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, extension,
+ ownerUid, osAccountObjId, collected, fileAttributes);
}
/**
@@ -245,4 +249,84 @@ protected File(SleuthkitCase db,
short modes, int uid, int gid, String md5Hash, FileKnown knownState, String parentPath, String mimeType) {
this(db, objId, dataSourceObjectId, fsObjId, attrType, (int) attrId, name, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, null, null, knownState, parentPath, mimeType, null, OsAccount.NO_OWNER_ID, OsAccount.NO_ACCOUNT, Collections.emptyList());
}
+
+ /**
+ * Constructs a representation of a file system file that has been added to
+ * the case.
+ *
+ * @param db The case database to which the file has been
+ * added.
+ * @param objId The object id of the file in the case database.
+ * @param dataSourceObjectId The object id of the data source for the file.
+ * @param fsObjId The object id of the file system to which this
+ * file belongs.
+ * @param attrType The type attribute given to the file by the
+ * file system.
+ * @param attrId The type id given to the file by the file
+ * system.
+ * @param name The name of the file.
+ * @param metaAddr The meta address of the file.
+ * @param metaSeq The meta sequence number of the file.
+ * @param dirType The type of the file, usually as reported in
+ * the name structure of the file system. May be
+ * set to TSK_FS_NAME_TYPE_ENUM.UNDEF.
+ * @param metaType The type of the file, usually as reported in
+ * the metadata structure of the file system. May
+ * be set to
+ * TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_UNDEF.
+ * @param dirFlag The allocated status of the file, usually as
+ * reported in the name structure of the file
+ * system.
+ * @param metaFlags The allocated status of the file, usually as
+ * reported in the metadata structure of the file
+ * system.
+ * @param size The size of the file.
+ * @param ctime The changed time of the file.
+ * @param crtime The created time of the file.
+ * @param atime The accessed time of the file.
+ * @param mtime The modified time of the file.
+ * @param modes The modes for the file.
+ * @param uid The UID for the file.
+ * @param gid The GID for the file.
+ * @param md5Hash The MD5 hash of the file, null if not yet
+ * calculated.
+ * @param sha256Hash sha256 hash of the file, or null if not present
+ * @param sha1Hash SHA-1 hash of the file, or null if not present
+ * @param knownState The known state of the file from a hash
+ * database lookup, null if not yet looked up.
+ * @param parentPath The path of the parent of the file.
+ * @param mimeType The MIME type of the file, null if it has not
+ * yet been determined.
+ * @param extension The extension part of the file name (not
+ * including the '.'), can be null.
+ * @param ownerUid UID of the file owner as found in the file
+ * system, can be null.
+ * @param osAccountObjId Obj id of the owner OS account, may be null.
+ * @deprecated Do not make subclasses outside of this package.
+ */
+ @Deprecated
+ @SuppressWarnings("deprecation")
+ File(SleuthkitCase db,
+ long objId,
+ long dataSourceObjectId,
+ long fsObjId,
+ TSK_FS_ATTR_TYPE_ENUM attrType, int attrId,
+ String name,
+ long metaAddr, int metaSeq,
+ TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType,
+ TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags,
+ long size,
+ long ctime, long crtime, long atime, long mtime,
+ short modes, int uid, int gid,
+ String md5Hash, String sha256Hash, String sha1Hash,
+ FileKnown knownState, String parentPath, String mimeType,
+ String extension,
+ String ownerUid,
+ Long osAccountObjId,
+ List<Attribute> fileAttributes) {
+ this(db, objId, dataSourceObjectId, fsObjId, attrType, attrId, name,
+ metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime,
+ modes, uid, gid, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, extension,
+ ownerUid, osAccountObjId, null, fileAttributes);
+ }
}
diff --git a/bindings/java/src/org/sleuthkit/datamodel/FsContent.java b/bindings/java/src/org/sleuthkit/datamodel/FsContent.java
index 0d08620cad54c56c041b5c8905ca4aae8ec2abe4..48607515449a400102fd358c74f1e34dd51854de 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/FsContent.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/FsContent.java
@@ -102,6 +102,7 @@ public abstract class FsContent extends AbstractFile {
* @param ownerUid UID of the file owner as found in the file
* system, can be null.
* @param osAccountObjId Obj id of the owner OS account, may be null.
+ * @param collected Collected status of the file data
*/
FsContent(SleuthkitCase db,
long objId,
@@ -123,8 +124,9 @@ public abstract class FsContent extends AbstractFile {
String extension,
String ownerUid,
Long osAccountObjId,
+ TskData.CollectedStatus collected,
List<Attribute> fileAttributes) {
- super(db, objId, dataSourceObjectId, Long.valueOf(fsObjId), attrType, attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, extension, ownerUid, osAccountObjId, fileAttributes);
+ super(db, objId, dataSourceObjectId, Long.valueOf(fsObjId), attrType, attrId, name, fileType, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, extension, ownerUid, osAccountObjId, collected, fileAttributes);
}
/**
@@ -400,4 +402,86 @@ public String toString(boolean preserveState) {
short modes, int uid, int gid, String md5Hash, FileKnown knownState, String parentPath, String mimeType) {
this(db, objId, dataSourceObjectId, fsObjId, attrType, (int) attrId, name, TSK_DB_FILES_TYPE_ENUM.FS, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, null, null, knownState, parentPath, mimeType, null, OsAccount.NO_OWNER_ID, OsAccount.NO_ACCOUNT, Collections.emptyList());
}
+
+ /**
+ * Constructs an abstract base class for representations of a file system
+ * files or directories that have been added to a case.
+ *
+ * @param db The case database to which the file has been
+ * added.
+ * @param objId The object id of the file in the case database.
+ * @param dataSourceObjectId The object id of the data source for the file.
+ * @param fsObjId The object id of the file system to which this
+ * file belongs.
+ * @param attrType The type attribute given to the file by the
+ * file system.
+ * @param attrId The type id given to the file by the file
+ * system.
+ * @param name The name of the file.
+ * @param fileType The type of file
+ * @param metaAddr The meta address of the file.
+ * @param metaSeq The meta sequence number of the file.
+ * @param dirType The type of the file, usually as reported in
+ * the name structure of the file system. May be
+ * set to TSK_FS_NAME_TYPE_ENUM.UNDEF.
+ * @param metaType The type of the file, usually as reported in
+ * the metadata structure of the file system. May
+ * be set to
+ * TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_UNDEF.
+ * @param dirFlag The allocated status of the file, usually as
+ * reported in the name structure of the file
+ * system.
+ * @param metaFlags The allocated status of the file, usually as
+ * reported in the metadata structure of the file
+ * system.
+ * @param size The size of the file.
+ * @param ctime The changed time of the file.
+ * @param crtime The created time of the file.
+ * @param atime The accessed time of the file.
+ * @param mtime The modified time of the file.
+ * @param modes The modes for the file.
+ * @param uid The UID for the file.
+ * @param gid The GID for the file.
+ * @param md5Hash The MD5 hash of the file, null if not yet
+ * calculated.
+ * @param sha256Hash sha256 hash of the file, or null if not present
+ * @param sha1Hash SHA-1 hash of the file, or null if not present
+ * @param knownState The known state of the file from a hash
+ * database lookup, null if not yet looked up.
+ * @param parentPath The path of the parent of the file.
+ * @param mimeType The MIME type of the file, null if it has not
+ * yet been determined.
+ * @param extension The extension part of the file name (not
+ * including the '.'), can be null.
+ * @param ownerUid UID of the file owner as found in the file
+ * system, can be null.
+ * @param osAccountObjId Obj id of the owner OS account, may be null.
+
+ * @deprecated Do not make subclasses outside of this package.
+ */
+ @Deprecated
+ @SuppressWarnings("deprecation")
+ FsContent(SleuthkitCase db,
+ long objId,
+ long dataSourceObjectId,
+ long fsObjId,
+ TSK_FS_ATTR_TYPE_ENUM attrType, int attrId,
+ String name,
+ TSK_DB_FILES_TYPE_ENUM fileType,
+ long metaAddr, int metaSeq,
+ TSK_FS_NAME_TYPE_ENUM dirType, TSK_FS_META_TYPE_ENUM metaType,
+ TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags,
+ long size,
+ long ctime, long crtime, long atime, long mtime,
+ short modes, int uid, int gid,
+ String md5Hash, String sha256Hash, String sha1Hash,
+ FileKnown knownState,
+ String parentPath,
+ String mimeType,
+ String extension,
+ String ownerUid,
+ Long osAccountObjId,
+ List<Attribute> fileAttributes) {
+ this(db, objId, dataSourceObjectId, fsObjId, attrType, attrId, name, TSK_DB_FILES_TYPE_ENUM.FS, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, null, null, knownState, parentPath, mimeType, null, OsAccount.NO_OWNER_ID, OsAccount.NO_ACCOUNT, TskData.CollectedStatus.UNKNOWN, Collections.emptyList());
+ }
}
diff --git a/bindings/java/src/org/sleuthkit/datamodel/LayoutFile.java b/bindings/java/src/org/sleuthkit/datamodel/LayoutFile.java
index 182a8c5b0dea256b87668ee352f6d02d7c55c249..7a19041120f70a7f5f9768002ff39b8b246f5f14 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/LayoutFile.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/LayoutFile.java
@@ -105,7 +105,7 @@ public class LayoutFile extends AbstractFile {
String ownerUid,
Long osAccountObjId) {
- super(db, objId, dataSourceObjectId, fileSystemObjectId, TSK_FS_ATTR_TYPE_ENUM.TSK_FS_ATTR_TYPE_DEFAULT, 0, name, fileType, 0L, 0, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, (short) 0, 0, 0, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, SleuthkitCase.extractExtension(name), ownerUid, osAccountObjId, Collections.emptyList());
+ super(db, objId, dataSourceObjectId, fileSystemObjectId, TSK_FS_ATTR_TYPE_ENUM.TSK_FS_ATTR_TYPE_DEFAULT, 0, name, fileType, 0L, 0, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, (short) 0, 0, 0, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, SleuthkitCase.extractExtension(name), ownerUid, osAccountObjId, TskData.CollectedStatus.UNKNOWN, Collections.emptyList());
}
/**
diff --git a/bindings/java/src/org/sleuthkit/datamodel/LocalFile.java b/bindings/java/src/org/sleuthkit/datamodel/LocalFile.java
index 59ac40deedf2098635503c28b661e4b01766f759..8c22a2e25b45722fe228c5372aefb3d75dac25c5 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/LocalFile.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/LocalFile.java
@@ -99,7 +99,7 @@ public class LocalFile extends AbstractFile {
Long osAccountObjId) {
super(db, objId, dataSourceObjectId, null, TSK_FS_ATTR_TYPE_ENUM.TSK_FS_ATTR_TYPE_DEFAULT, 0,
name, fileType, 0L, 0, dirType, metaType, dirFlag,
- metaFlags, size, ctime, crtime, atime, mtime, (short) 0, 0, 0, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, extension, ownerUid, osAccountObjId, Collections.emptyList());
+ metaFlags, size, ctime, crtime, atime, mtime, (short) 0, 0, 0, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, extension, ownerUid, osAccountObjId, TskData.CollectedStatus.UNKNOWN, Collections.emptyList());
// TODO (AUT-1904): The parent id should be passed to AbstractContent
// through the class hierarchy contructors, using
// AbstractContent.UNKNOWN_ID as needed.
diff --git a/bindings/java/src/org/sleuthkit/datamodel/SlackFile.java b/bindings/java/src/org/sleuthkit/datamodel/SlackFile.java
index 6594e0149bd2545a674f9aaad2f546d0aca11d43..e457191577171806c3f9223e86aafa69c1edcff8 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/SlackFile.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/SlackFile.java
@@ -101,7 +101,7 @@ public class SlackFile extends FsContent {
String extension,
String ownerUid,
Long osAccountObjId) {
- super(db, objId, dataSourceObjectId, fsObjId, attrType, attrId, name, TskData.TSK_DB_FILES_TYPE_ENUM.SLACK, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, extension, ownerUid, osAccountObjId, Collections.emptyList());
+ super(db, objId, dataSourceObjectId, fsObjId, attrType, attrId, name, TskData.TSK_DB_FILES_TYPE_ENUM.SLACK, metaAddr, metaSeq, dirType, metaType, dirFlag, metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, extension, ownerUid, osAccountObjId, TskData.CollectedStatus.UNKNOWN, Collections.emptyList());
}
/**
diff --git a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java
index 1d35554c0bf6a185c3251de4cde544921a0ff8fb..7cdfd79903e6f99f3656877a3823784c9e25951e 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java
@@ -104,7 +104,7 @@ public class SleuthkitCase {
private static final int MAX_DB_NAME_LEN_BEFORE_TIMESTAMP = 47;
static final CaseDbSchemaVersionNumber CURRENT_DB_SCHEMA_VERSION
- = new CaseDbSchemaVersionNumber(9, 3);
+ = new CaseDbSchemaVersionNumber(9, 4);
private static final long BASE_ARTIFACT_ID = Long.MIN_VALUE; // Artifact ids will start at the lowest negative value
private static final Logger logger = Logger.getLogger(SleuthkitCase.class.getName());
@@ -142,6 +142,7 @@ public class SleuthkitCase {
"blackboard_attribute_types",
"data_source_info",
"file_encoding_types",
+ "file_collection_status_types",
"ingest_module_types",
"ingest_job_status_types",
"ingest_modules",
@@ -387,6 +388,7 @@ private void init() throws Exception {
initIngestStatusTypes(connection);
initReviewStatuses(connection);
initEncodingTypes(connection);
+ initCollectedStatusTypes(connection);
populateHasChildrenMap(connection);
updateExaminers(connection);
initDBSchemaCreationVersion(connection);
@@ -761,6 +763,43 @@ private void initEncodingTypes(CaseDbConnection connection) throws SQLException,
}
}
+ /**
+ * Put the collected status types into the table. This must be called after the
+ * database upgrades or the file_collection_status_types table will not exist.
+ *
+ * @throws SQLException
+ * @throws TskCoreException
+ */
+ private void initCollectedStatusTypes(CaseDbConnection connection) throws SQLException, TskCoreException {
+ Statement statement = null;
+ ResultSet resultSet = null;
+ acquireSingleUserCaseWriteLock();
+ try {
+ statement = connection.createStatement();
+ for (TskData.CollectedStatus type : TskData.CollectedStatus.values()) {
+ try {
+ String query = "INSERT INTO file_collection_status_types (collection_status_type, name) VALUES (" + type.getType() + " , '" + type.name() + "')"; // NON-NLS
+ if (getDatabaseType().equals(DbType.POSTGRESQL)) {
+ query += " ON CONFLICT ON CONSTRAINT file_collection_status_types_pkey DO NOTHING"; // NON-NLS
+ }
+ statement.execute(query);
+ } catch (SQLException ex) {
+ resultSet = connection.executeQuery(statement, "SELECT COUNT(*) as count FROM file_collection_status_types WHERE collection_status_type = " + type.getType()); //NON-NLS
+ resultSet.next();
+ if (resultSet.getLong("count") == 0) {
+ throw ex;
+ }
+ resultSet.close();
+ resultSet = null;
+ }
+ }
+ } finally {
+ closeResultSet(resultSet);
+ closeStatement(statement);
+ releaseSingleUserCaseWriteLock();
+ }
+ }
+
/**
* Records the current examiner name in the tsk_examiners table
*
@@ -936,6 +975,7 @@ private void updateDatabaseSchema(String dbPath) throws Exception {
dbSchemaVersion = updateFromSchema9dot0toSchema9dot1(dbSchemaVersion, connection);
dbSchemaVersion = updateFromSchema9dot1toSchema9dot2(dbSchemaVersion, connection);
dbSchemaVersion = updateFromSchema9dot2toSchema9dot3(dbSchemaVersion, connection);
+ dbSchemaVersion = updateFromSchema9dot3toSchema9dot4(dbSchemaVersion, connection);
@@ -2704,6 +2744,34 @@ private CaseDbSchemaVersionNumber updateFromSchema9dot2toSchema9dot3(CaseDbSchem
releaseSingleUserCaseWriteLock();
}
}
+
+ private CaseDbSchemaVersionNumber updateFromSchema9dot3toSchema9dot4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) throws SQLException, TskCoreException {
+ if (schemaVersion.getMajor() != 9) {
+ return schemaVersion;
+ }
+
+ if (schemaVersion.getMinor() != 3) {
+ return schemaVersion;
+ }
+
+ Statement statement = connection.createStatement();
+ acquireSingleUserCaseWriteLock();
+ try {
+ // Add file_collection_status_types table
+ statement.execute("CREATE TABLE file_collection_status_types (collection_status_type INTEGER PRIMARY KEY, name TEXT NOT NULL);");
+ initCollectedStatusTypes(connection);
+
+ // add a new column 'collected' to tsk_files
+ statement.execute("ALTER TABLE tsk_files ADD COLUMN collected INTEGER NOT NULL DEFAULT " +
+ TskData.CollectedStatus.UNKNOWN.getType() + ";");
+
+ return new CaseDbSchemaVersionNumber(9, 4);
+
+ } finally {
+ closeStatement(statement);
+ releaseSingleUserCaseWriteLock();
+ }
+ }
/**
* Inserts a row for the given account type in account_types table, if one
@@ -6334,6 +6402,7 @@ public VirtualDirectory addVirtualDirectory(long parentId, String directoryName,
statement.setString(23, OsAccount.NO_OWNER_ID); // ownerUid
statement.setNull(24, java.sql.Types.BIGINT); // osAccountObjId
+ statement.setLong(25, TskData.CollectedStatus.UNKNOWN.getType()); // collected
connection.executeUpdate(statement);
@@ -6471,6 +6540,7 @@ public LocalDirectory addLocalDirectory(long parentId, String directoryName, Cas
statement.setString(23, OsAccount.NO_OWNER_ID); // ownerUid
statement.setNull(24, java.sql.Types.BIGINT); // osAccountObjId
+ statement.setLong(25, TskData.CollectedStatus.UNKNOWN.getType()); // collected
connection.executeUpdate(statement);
@@ -6587,6 +6657,7 @@ public LocalFilesDataSource addLocalFilesDataSource(String deviceId, String root
preparedStatement.setString(22, null); //extension, just set it to null
preparedStatement.setString(23, OsAccount.NO_OWNER_ID); // ownerUid
preparedStatement.setNull(24, java.sql.Types.BIGINT); // osAccountObjId
+ preparedStatement.setLong(25, TskData.CollectedStatus.UNKNOWN.getType()); // collected
connection.executeUpdate(preparedStatement);
@@ -7064,7 +7135,71 @@ public FsContent addFileSystemFile(long dataSourceObjId, long fsObjId,
Content parent, String ownerUid,
OsAccount osAccount, List<Attribute> fileAttributes,
CaseDbTransaction transaction) throws TskCoreException {
-
+ return addFileSystemFile(dataSourceObjId, fsObjId,
+ fileName,
+ metaAddr, metaSeq,
+ attrType, attrId,
+ dirFlag, metaFlags, size,
+ ctime, crtime, atime, mtime,
+ md5Hash, sha256Hash, sha1Hash,
+ mimeType,
+ isFile, parent, ownerUid,
+ osAccount, TskData.CollectedStatus.UNKNOWN, fileAttributes,
+ transaction);
+ }
+
+ /**
+ * Add a file system file.
+ *
+ * @param dataSourceObjId The object id of the root data source of this
+ * file.
+ * @param fsObjId The file system object id.
+ * @param fileName The name of the file.
+ * @param metaAddr The meta address of the file.
+ * @param metaSeq The meta address sequence of the file.
+ * @param attrType The attributed type of the file.
+ * @param attrId The attribute id.
+ * @param dirFlag The allocated status from the name structure
+ * @param metaFlags The allocated status of the file, usually as
+ * reported in the metadata structure of the file
+ * system.
+ * @param size The size of the file in bytes.
+ * @param ctime The changed time of the file.
+ * @param crtime The creation time of the file.
+ * @param atime The accessed time of the file
+ * @param mtime The modified time of the file.
+ * @param md5Hash The MD5 hash of the file
+ * @param sha256Hash The SHA256 hash of the file
+ * @param sha1Hash SHA1 Hash of the file. May be null.
+ * @param mimeType The MIME type of the file
+ * @param isFile True, unless the file is a directory.
+ * @param parent The parent of the file (e.g., a virtual
+ * directory).
+ * @param ownerUid UID of the file owner as found in the file system,
+ * can be null.
+ * @param osAccount OS account of owner, may be null.
+ * @param collected Collected status for file content, may be null
+ * @param fileAttributes A list of file attributes. May be empty.
+
+ * @param transaction A caller-managed transaction within which the add
+ * file operations are performed.
+ *
+ * @return Newly created file
+ *
+ * @throws TskCoreException
+ */
+ public FsContent addFileSystemFile(long dataSourceObjId, long fsObjId,
+ String fileName,
+ long metaAddr, int metaSeq,
+ TSK_FS_ATTR_TYPE_ENUM attrType, int attrId,
+ TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size,
+ long ctime, long crtime, long atime, long mtime,
+ String md5Hash, String sha256Hash, String sha1Hash,
+ String mimeType, boolean isFile,
+ Content parent, String ownerUid,
+ OsAccount osAccount, TskData.CollectedStatus collected,
+ List<Attribute> fileAttributes,
+ CaseDbTransaction transaction) throws TskCoreException {
TimelineManager timelineManager = getTimelineManager();
Statement queryStatement = null;
@@ -7123,6 +7258,7 @@ public FsContent addFileSystemFile(long dataSourceObjId, long fsObjId,
} else {
statement.setNull(27, java.sql.Types.BIGINT); // osAccountObjId
}
+ statement.setLong(28, collected.getType());
connection.executeUpdate(statement);
@@ -7149,7 +7285,7 @@ public FsContent addFileSystemFile(long dataSourceObjId, long fsObjId,
dirType, metaType, dirFlag, metaFlags,
size, ctime, crtime, atime, mtime,
(short) 0, 0, 0, md5Hash, sha256Hash, sha1Hash, null, parentPath, mimeType,
- extension, ownerUid, osAccountId, fileAttributes);
+ extension, ownerUid, osAccountId, collected, fileAttributes);
} catch (SQLException ex) {
throw new TskCoreException(String.format("Failed to INSERT file system file %s (%s) with parent id %d in tsk_files table", fileName, parentPath, parent.getId()), ex);
@@ -7294,6 +7430,7 @@ public final List<LayoutFile> addLayoutFiles(Content parent, List<TskFileRange>
prepStmt.setString(23, OsAccount.NO_OWNER_ID); // ownerUid
prepStmt.setNull(24, java.sql.Types.BIGINT); // osAccountObjId
+ prepStmt.setLong(25, TskData.CollectedStatus.UNKNOWN.getType()); // collected
connection.executeUpdate(prepStmt);
@@ -7660,6 +7797,7 @@ public final List<LayoutFile> addCarvedFiles(CarvingResult carvingResult) throws
prepStmt.setString(23, OsAccount.NO_OWNER_ID); // ownerUid
prepStmt.setNull(24, java.sql.Types.BIGINT); // osAccountObjId
+ prepStmt.setLong(25, TskData.CollectedStatus.UNKNOWN.getType()); // collected
connection.executeUpdate(prepStmt);
@@ -7862,6 +8000,7 @@ public DerivedFile addDerivedFile(String fileName, String localPath,
statement.setString(23, OsAccount.NO_OWNER_ID); // ownerUid
statement.setNull(24, java.sql.Types.BIGINT); // osAccountObjId
+ statement.setLong(25, TskData.CollectedStatus.UNKNOWN.getType()); // collected
connection.executeUpdate(statement);
@@ -8284,6 +8423,8 @@ public LocalFile addLocalFile(String fileName, String localPath,
statement.setNull(24, java.sql.Types.BIGINT);
}
+ statement.setLong(25, TskData.CollectedStatus.UNKNOWN.getType()); // collected
+
connection.executeUpdate(statement);
addFilePath(connection, objectId, localPath, encodingType);
LocalFile localFile = new LocalFile(this,
@@ -8548,6 +8689,7 @@ public LayoutFile addLayoutFile(String fileName,
prepStmt.setString(23, OsAccount.NO_OWNER_ID); // ownerUid
prepStmt.setNull(24, java.sql.Types.BIGINT); // osAccountObjId
+ prepStmt.setLong(25, TskData.CollectedStatus.UNKNOWN.getType()); // collected
connection.executeUpdate(prepStmt);
@@ -10059,7 +10201,7 @@ org.sleuthkit.datamodel.File file(ResultSet rs, FileSystem fs) throws SQLExcepti
rs.getString("md5"), rs.getString("sha256"), rs.getString("sha1"),
FileKnown.valueOf(rs.getByte("known")), //NON-NLS
rs.getString("parent_path"), rs.getString("mime_type"), rs.getString("extension"), rs.getString("owner_uid"),
- osAccountObjId, Collections.emptyList()); //NON-NLS
+ osAccountObjId, TskData.CollectedStatus.valueOf(rs.getInt("collected")), Collections.emptyList()); //NON-NLS
f.setFileSystem(fs);
return f;
}
@@ -10714,7 +10856,7 @@ public void setFileUnalloc(AbstractFile file) throws TskCoreException {
releaseSingleUserCaseWriteLock();
}
}
-
+
/**
* Store the md5Hash for the file in the database
*
@@ -12915,10 +13057,10 @@ private enum PREPARED_STATEMENT {
SELECT_FILE_DERIVATION_METHOD("SELECT tool_name, tool_version, other FROM tsk_files_derived_method WHERE derived_id = ?"), //NON-NLS
SELECT_MAX_OBJECT_ID("SELECT MAX(obj_id) AS max_obj_id FROM tsk_objects"), //NON-NLS
INSERT_OBJECT("INSERT INTO tsk_objects (par_obj_id, type) VALUES (?, ?)"), //NON-NLS
- INSERT_FILE("INSERT INTO tsk_files (obj_id, fs_obj_id, name, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, md5, sha256, sha1, known, mime_type, parent_path, data_source_obj_id, extension, owner_uid, os_account_obj_id) " //NON-NLS
- + "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"), //NON-NLS
- INSERT_FILE_SYSTEM_FILE("INSERT INTO tsk_files(obj_id, fs_obj_id, data_source_obj_id, attr_type, attr_id, name, meta_addr, meta_seq, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, md5, sha256, sha1, mime_type, parent_path, extension, owner_uid, os_account_obj_id)"
- + " VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"), // NON-NLS
+ INSERT_FILE("INSERT INTO tsk_files (obj_id, fs_obj_id, name, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, md5, sha256, sha1, known, mime_type, parent_path, data_source_obj_id, extension, owner_uid, os_account_obj_id, collected) " //NON-NLS
+ + "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"), //NON-NLS
+ INSERT_FILE_SYSTEM_FILE("INSERT INTO tsk_files(obj_id, fs_obj_id, data_source_obj_id, attr_type, attr_id, name, meta_addr, meta_seq, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, md5, sha256, sha1, mime_type, parent_path, extension, owner_uid, os_account_obj_id, collected)"
+ + " VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"), // NON-NLS
UPDATE_DERIVED_FILE("UPDATE tsk_files SET type = ?, dir_type = ?, meta_type = ?, dir_flags = ?, meta_flags = ?, size= ?, ctime= ?, crtime= ?, atime= ?, mtime= ?, mime_type = ? "
+ "WHERE obj_id = ?"), //NON-NLS
INSERT_LAYOUT_FILE("INSERT INTO tsk_file_layout (obj_id, byte_start, byte_len, sequence) " //NON-NLS
diff --git a/bindings/java/src/org/sleuthkit/datamodel/SpecialDirectory.java b/bindings/java/src/org/sleuthkit/datamodel/SpecialDirectory.java
index 456f06811dac3a733cd9e48d8138e2ccffee26b6..84bbe68642eea09afbdd3f79b08a7d2e0f56c2c0 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/SpecialDirectory.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/SpecialDirectory.java
@@ -50,7 +50,7 @@ public abstract class SpecialDirectory extends AbstractFile {
String mimeType) {
super(db, objId, dataSourceObjectId, fileSystemObjectId, attrType, attrId, name,
fileType, metaAddr, metaSeq, dirType, metaType, dirFlag,
- metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, null, OsAccount.NO_OWNER_ID, OsAccount.NO_ACCOUNT, Collections.emptyList());
+ metaFlags, size, ctime, crtime, atime, mtime, modes, uid, gid, md5Hash, sha256Hash, sha1Hash, knownState, parentPath, mimeType, null, OsAccount.NO_OWNER_ID, OsAccount.NO_ACCOUNT, TskData.CollectedStatus.UNKNOWN, Collections.emptyList());
}
/**
diff --git a/bindings/java/src/org/sleuthkit/datamodel/TskCaseDbBridge.java b/bindings/java/src/org/sleuthkit/datamodel/TskCaseDbBridge.java
index a677de18da7d37522a2a938d9731879d570ef247..a161ecc40a0ee244f9de92528f82b7e5bec37a7a 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/TskCaseDbBridge.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/TskCaseDbBridge.java
@@ -879,8 +879,8 @@ private long addFileToDb(long parentObjId,
// INSERT INTO tsk_objects (par_obj_id, type) VALUES (?, ?)
long objectId = caseDb.addObject(parentObjId, TskData.ObjectType.ABSTRACTFILE.getObjectType(), connection);
- String fileInsert = "INSERT INTO tsk_files (fs_obj_id, obj_id, data_source_obj_id, type, attr_type, attr_id, name, meta_addr, meta_seq, dir_type, meta_type, dir_flags, meta_flags, size, crtime, ctime, atime, mtime, mode, gid, uid, md5, known, parent_path, extension, has_layout, owner_uid, os_account_obj_id)"
- + " VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"; // NON-NLS
+ String fileInsert = "INSERT INTO tsk_files (fs_obj_id, obj_id, data_source_obj_id, type, attr_type, attr_id, name, meta_addr, meta_seq, dir_type, meta_type, dir_flags, meta_flags, size, crtime, ctime, atime, mtime, mode, gid, uid, md5, known, parent_path, extension, has_layout, owner_uid, os_account_obj_id, collected)"
+ + " VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"; // NON-NLS
PreparedStatement preparedStatement = connection.getPreparedStatement(fileInsert, Statement.NO_GENERATED_KEYS);
preparedStatement.clearParameters();
@@ -971,6 +971,8 @@ private long addFileToDb(long parentObjId,
preparedStatement.setNull(28, java.sql.Types.BIGINT);
}
+ preparedStatement.setLong(29, TskData.CollectedStatus.UNKNOWN.getType());
+
connection.executeUpdate(preparedStatement);
// If this is not a slack file create the timeline events
diff --git a/bindings/java/src/org/sleuthkit/datamodel/TskData.java b/bindings/java/src/org/sleuthkit/datamodel/TskData.java
index d71c239fe52360ac9698a87f2bbaa4899f454ebc..5789304dab36412b35e2189c1c8c1d572e0e2ee5 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/TskData.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/TskData.java
@@ -890,6 +890,48 @@ public static EncodingType valueOf(int type) {
}
}
+ /**
+ * CollectedStatus stores where the data for a file can be found or the
+ * reason no data for the file exists.
+ */
+ public enum CollectedStatus{
+
+ UNKNOWN(0),
+ NO_SAVE_ERROR(1),
+ NO_EMPTY_FILE(2),
+ NO_NOT_FOUND(3),
+ NO_UNRESOLVED(4),
+ NO_READ_ERROR(5),
+ NO_READ_ERROR_PARTIAL(6),
+ NO_NOT_ATTEMPTED(7),
+ NO_NOT_REGULAR_FILE(8),
+ NO_FILE_TOO_LARGE(9),
+ NO_ONLY_HASH_COLLECTED(10),
+ NO_UNSUPPORTED_COMPRESSION(11),
+ YES_TSK(12),
+ YES_REPO(13);
+
+ private final int type;
+
+ private CollectedStatus(int type){
+ this.type = type;
+ }
+
+ public int getType(){
+ return type;
+ }
+
+ public static CollectedStatus valueOf(int type) {
+ for (CollectedStatus v : CollectedStatus.values()) {
+ if (v.type == type) {
+ return v;
+ }
+ }
+ throw new IllegalArgumentException(
+ MessageFormat.format(bundle.getString("TskData.collectedStatus.exception.msg1.text"), type));
+ }
+ }
+
/**
* Type of keyword search query
**/