DSP python module

Autopsy Help
1

I’m trying to write data source processing module in python, can somone give me a tip how to add files to case, but with their properties like size, ctime, mtime etc.?
Thanks

2

Are you looking at adding a few files or a lot of files that may reside in a directory?

3

Lot of files in directories. It’s a copy of filesystem, files are in folders and their properties in xml file. I would like to add files with their orginal properties from xml file.

4

Look at addDerivedFile

skCase = Case.getCurrentCase().getSleuthkitCase()
derived_file = skCase.addDerivedFile(see parameters below)
IngestServices.getInstance().fireModuleContentEvent(ModuleContentEvent(derived_file))

/**
* Adds a derived file to the case.
*
* @param fileName The name of the file.
* @param localPath The local path of the file, relative to the case
* folder and including the file name.
* @param size The size of the file in bytes.
* @param ctime The change time of the file.
* @param crtime The create time of the file
* @param atime The accessed time of the file.
* @param mtime The modified time of the file.
* @param isFile True if a file, false if a directory.
* @param parentObj The parent object from which the file was derived.
* @param rederiveDetails The details needed to re-derive file (will be
* specific to the derivation method), currently
* unused.
* @param toolName The name of the derivation method or tool,
* currently unused.
* @param toolVersion The version of the derivation method or tool,
* currently unused.
* @param otherDetails Other details of the derivation method or tool,
* currently unused.
* @param encodingType Type of encoding used on the file, use this TskData.EncodingType.NONE
*
* @return A DerivedFile object representing the derived file.
*
* @throws TskCoreException if there is a problem adding the file to the
* case database.
*/
public DerivedFile addDerivedFile(String fileName,
String localPath,
long size,
long ctime, long crtime, long atime, long mtime,
boolean isFile,
Content parentObj,
String rederiveDetails, String toolName, String toolVersion, String otherDetails,
TskData.EncodingType encodingType)

5

Thank you Mark.
What should I pass as

  • @param parentObj The parent object from which the file was derived.

to addDerivedFile method ?