Examples of org.sleuthkit.datamodel.BlackboardArtifact

org.sleuthkit.datamodel.BlackboardArtifact
Represents an artifact as stored in the Blackboard. Artifacts are a collection of name value pairs and have a type that represents the type of data they are storing. This class is used to create artifacts on the blackboard and is used to represent artifacts queried from the blackboard.

    @Override
    public KeywordCachedArtifact writeSingleFileHitsToBlackBoard(String termHit, AbstractFile newFsHit, String snippet, String listName) {
        final String MODULE_NAME = KeywordSearchModuleFactory.getModuleName();


        //there is match actually in this file, create artifact only then
        BlackboardArtifact bba;
        KeywordCachedArtifact writeResult;
        Collection<BlackboardAttribute> attributes = new ArrayList<>();
        try {
            bba = newFsHit.newArtifact(ARTIFACT_TYPE.TSK_KEYWORD_HIT);
            writeResult = new KeywordCachedArtifact(bba);
        } catch (Exception e) {
            logger.log(Level.WARNING, "Error adding bb artifact for keyword hit", e); //NON-NLS
            return null;
        }


        //regex match
        attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID(), MODULE_NAME, termHit));
        
        if ((listName != null) && (listName.equals("") == false)) {
            attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), MODULE_NAME, listName));
        }
        
        //preview
        if (snippet != null) {
            attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID(), MODULE_NAME, snippet));
        }
        //regex keyword
        attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP.getTypeID(), MODULE_NAME, keyword.getQuery()));


        try {
            bba.addAttributes(attributes);
            writeResult.add(attributes);
            return writeResult;
        } catch (TskException e) {
            logger.log(Level.WARNING, "Error adding bb attributes for terms search artifact", e); //NON-NLS
        }

View Full Code Here

                
                read = resultSet.getInt("read");
                subject = resultSet.getString("subject");
                body = resultSet.getString("body");


                BlackboardArtifact bba = f.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE); //create Message artifact and then add attributes from result set.
                if (resultSet.getString("type").equals("1")) {
                    bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION.getTypeID(), moduleName, "Incoming"));
                    bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM.getTypeID(), moduleName, address));
                } else {
                    bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION.getTypeID(), moduleName, "Outgoing"));
                    bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO.getTypeID(), moduleName, address));
                }
                bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID(), moduleName, date));
                
                bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_READ_STATUS.getTypeID(), moduleName, read));
                bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT.getTypeID(), moduleName, subject));
                bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT.getTypeID(), moduleName, body));
                bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE.getTypeID(), moduleName, "SMS Message"));
            }


        } catch (Exception e) {
            logger.log(Level.SEVERE, "Error parsing text messages to Blackboard", e);
        } finally {

View Full Code Here

            if (skCase == null) {
                return null;   
            }
            
            try {
                BlackboardArtifact art = skCase.getBlackboardArtifact(artifactId);
                BlackboardArtifactNode n = new BlackboardArtifactNode(art);
                AbstractFile file;
                try {
                    file = skCase.getAbstractFileById(art.getObjectID());
                } catch (TskCoreException ex) {
                    logger.log(Level.SEVERE, "TskCoreException while constructing BlackboardArtifact Node from KeywordHitsKeywordChildren"); //NON-NLS
                    return n;
                }

View Full Code Here

     */
    public synchronized String detectAndSave(AbstractFile abstractFile) throws TskCoreException {
        String mimeType = detect(abstractFile);
        if (mimeType != null) {
            // add artifact
            BlackboardArtifact getInfoArt = abstractFile.getGenInfoArtifact();
            BlackboardAttribute batt = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG.getTypeID(), FileTypeIdModuleFactory.getModuleName(), mimeType);
            getInfoArt.addAttribute(batt);


            // we don't fire the event because we just updated TSK_GEN_INFO, which isn't displayed in the tree and is vague.
        }
        return mimeType;
    }

View Full Code Here


            //merge predefined specific node actions if bban subclasses have their own
            for (Action a : ban.getActions(true)) {
                actions.add(a);
            }
            BlackboardArtifact ba = ban.getLookup().lookup(BlackboardArtifact.class);
            final int artifactTypeID = ba.getArtifactTypeID();


            if (artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()
                    || artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
                actions.add(new ViewContextAction(
                        NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewFileInDir.text"), ban));

View Full Code Here


            return actions;
        }


        private Content findLinked(BlackboardArtifactNode ba) {
            BlackboardArtifact art = ba.getLookup().lookup(BlackboardArtifact.class);
            Content c = null;
            try {
                for (BlackboardAttribute attr : art.getAttributes()) {
                    if (attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID()) {
                        switch (attr.getValueType()) {
                            case INTEGER:
                                int i = attr.getValueInt();
                                if (i != -1) {
                                    c = art.getSleuthkitCase().getContentById(i);
                                }
                                break;
                            case LONG:
                                long l = attr.getValueLong();
                                if (l != -1) {
                                    c = art.getSleuthkitCase().getContentById(l);
                                }
                                break;
                        }
                    }
                }

View Full Code Here

        
    private void postHashSetHitToBlackboard(AbstractFile abstractFile, String md5Hash, String hashSetName, String comment, boolean showInboxMessage) {
        try {
            String MODULE_NAME = NbBundle.getMessage(HashDbIngestModule.class, "HashDbIngestModule.moduleName");
            
            BlackboardArtifact badFile = abstractFile.newArtifact(ARTIFACT_TYPE.TSK_HASHSET_HIT);
            //TODO Revisit usage of deprecated constructor as per TSK-583
            //BlackboardAttribute att2 = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), MODULE_NAME, "Known Bad", hashSetName);
            BlackboardAttribute att2 = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), MODULE_NAME, hashSetName);
            badFile.addAttribute(att2);
            BlackboardAttribute att3 = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_HASH_MD5.getTypeID(), MODULE_NAME, md5Hash);
            badFile.addAttribute(att3);
            BlackboardAttribute att4 = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID(), MODULE_NAME, comment);
            badFile.addAttribute(att4);
            
            if (showInboxMessage) {
                StringBuilder detailsSb = new StringBuilder();
                //details
                detailsSb.append("<table border='0' cellpadding='4' width='280'>"); //NON-NLS

View Full Code Here

        return false;
    }


    @Override
    public int isPreferred(Node node) {
        BlackboardArtifact artifact = node.getLookup().lookup(BlackboardArtifact.class);
        if(artifact == null) {
            return 3;
        } 
        else {
            return 5;

View Full Code Here

            }


            // If the node has an underlying blackboard artifact, show it. If not,
            // show the first artifact.
            int index = 0;
            BlackboardArtifact artifact = lookup.lookup(BlackboardArtifact.class);
            if (artifact != null) {
                index = artifacts.indexOf(artifact);
                if (index == -1) {
                    index = 0;
                } else {
                    // if the artifact has an ASSOCIATED ARTIFACT, then we display the associated artifact instead
                    try {
                        for (BlackboardAttribute attr : artifact.getAttributes()) {
                           if (attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID()) {
                               long assocArtifactId = attr.getValueLong();
                               int assocArtifactIndex = -1;
                               for (BlackboardArtifact art: artifacts) {
                                   if (assocArtifactId == art.getArtifactID()) {

View Full Code Here

    private void viewArtifact(java.awt.event.ActionEvent evt) {
        artifactViewerInvoked();
        
        final IngestMessageGroup messageGroup = mainPanel.getMessagePanel().getSelectedMessage();
        if (messageGroup != null) {
            BlackboardArtifact art = messageGroup.getData();
            if (art != null) {
                BlackboardResultViewer v = Lookup.getDefault().lookup(BlackboardResultViewer.class);
                v.viewArtifact(art);
            }
        }

View Full Code Here

0 1 2 3

TOP

Related Classes of org.sleuthkit.datamodel.BlackboardArtifact

org.sleuthkit.autopsy.corecomponents.DataContentViewerArtifact

org.sleuthkit.autopsy.corecomponents.DataContentViewerArtifact$SelectedNodeChangedTask

org.sleuthkit.autopsy.datamodel.EmailExtracted$MessageFactory

org.sleuthkit.autopsy.datamodel.HashsetHits$HitFactory

org.sleuthkit.autopsy.datamodel.KeywordHits$HitsFactory

org.sleuthkit.autopsy.directorytree.DataResultFilterNode$GetPopupActionsDisplayableItemNodeVisitor

org.sleuthkit.autopsy.examples.SampleFileIngestModule

org.sleuthkit.autopsy.externalresults.ExternalResultsImporter

org.sleuthkit.autopsy.ingest.IngestMessageDetailsPanel

org.sleuthkit.autopsy.keywordsearch.ExtractedContentViewer

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.