Detecting a deleted file in an ingest module


Can I detect if a file is deleted?

I would have expected there to be some kind of property that told me whether the file was deleted. For example,

def process(self, file):

    self.Log(Level.INFO, "Success!")

Does anyone know the correct way to do this?

I’ve been sniffing around the TSK_DB_FILES_TYPE_ENUM.UNALLOC_FILES but this isn’t giving me the results that I expect.

Thanks for any help!

In Java you can do it like this (from

if ((abstractFile.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.UNALLOC))
    || (abstractFile.isDirNameFlagSet(TskData.TSK_FS_NAME_FLAG_ENUM.UNALLOC))) {
    return ProcessResult.OK;

Hi Ann

This has done the trick! Many thanks :slight_smile: