Detecting a deleted file in an ingest module

Autopsy Development
1

Hi

Can I detect if a file is deleted?

I would have expected there to be some kind of property that told me whether the file was deleted. For example,

def process(self, file):

if (file.properties == TskData.TSK_FILEPROPERTY.FILE_DELETED):
    self.Log(Level.INFO, "Success!")

Does anyone know the correct way to do this?

I’ve been sniffing around the TSK_DB_FILES_TYPE_ENUM.UNALLOC_FILES but this isn’t giving me the results that I expect.

Thanks for any help!

2

In Java you can do it like this (from https://github.com/sleuthkit/autopsy/blob/develop/Core/src/org/sleuthkit/autopsy/modules/fileextmismatch/FileExtMismatchIngestModule.java)

if ((abstractFile.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.UNALLOC))
    || (abstractFile.isDirNameFlagSet(TskData.TSK_FS_NAME_FLAG_ENUM.UNALLOC))) {
    return ProcessResult.OK;
}
3

Hi Ann

This has done the trick! Many thanks :slight_smile: