From d8b7b5c6552a4ba67449c4c501bff4b5c1f07f88 Mon Sep 17 00:00:00 2001 From: Kelly Kelly Date: Fri, 2 Apr 2021 14:37:36 -0400 Subject: [PATCH] Fixed custom artifact RA issue --- .../autopsy/recentactivity/Extract.java | 24 +++++++++++++++---- .../recentactivity/ExtractRecycleBin.java | 2 +- .../recentactivity/ExtractRegistry.java | 5 +--- 3 files changed, 22 insertions(+), 9 deletions(-) diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Extract.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Extract.java index e152a146fa..c2abe0223d 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Extract.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Extract.java @@ -143,11 +143,27 @@ abstract class Extract { * @return The newly created artifact. */ BlackboardArtifact createArtifactWithAttributes(BlackboardArtifact.ARTIFACT_TYPE type, Content content, Collection attributes) throws TskCoreException { - Optional optional = getOsAccount(content); - if (optional.isPresent() && type.getCategory() == BlackboardArtifact.Category.DATA_ARTIFACT) { - return content.newDataArtifact(new BlackboardArtifact.Type(type), attributes, optional.get()); + return createArtifactWithAttributes(new BlackboardArtifact.Type(type), content, attributes); + } + + /** + * Generic method for creating artifacts. + * + * @param type The type of artifact. + * @param content The file the artifact originated from. + * @param attributes A list of the attributes to associate with the + * artifact. + * + * @return The newly created artifact. + * + * @throws TskCoreException + */ + BlackboardArtifact createArtifactWithAttributes(BlackboardArtifact.Type type, Content content, Collection attributes) throws TskCoreException { + Optional optional = getOsAccount(content); + if (optional.isPresent() && type.getCategory() == BlackboardArtifact.Category.DATA_ARTIFACT) { + return content.newDataArtifact(type, attributes, optional.get()); } else { - BlackboardArtifact bbart = content.newArtifact(type); + BlackboardArtifact bbart = content.newArtifact(type.getTypeID()); bbart.addAttributes(attributes); return bbart; } diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRecycleBin.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRecycleBin.java index 4478f49278..1ced615661 100755 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRecycleBin.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRecycleBin.java @@ -441,7 +441,7 @@ final class ExtractRecycleBin extends Extract { attributes.add(new BlackboardAttribute(TSK_PATH, getName(), fileName)); attributes.add(new BlackboardAttribute(TSK_DATETIME_DELETED, getName(), dateTime)); attributes.add(new BlackboardAttribute(TSK_USER_NAME, getName(), userName == null || userName.isEmpty() ? "" : userName)); - return createArtifactWithAttributes(BlackboardArtifact.ARTIFACT_TYPE.fromID(type.getTypeID()), rFile, attributes); + return createArtifactWithAttributes(type, rFile, attributes); } /** diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java index 0c5cd988db..8865d8eea0 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java @@ -1751,7 +1751,6 @@ class ExtractRegistry extends Extract { try { for (ShellBag bag : shellbags) { Collection attributes = new ArrayList<>(); - BlackboardArtifact artifact = regFile.newArtifact(getShellBagArtifact().getTypeID()); attributes.add(new BlackboardAttribute(TSK_PATH, getName(), bag.getResource())); attributes.add(new BlackboardAttribute(getKeyAttribute(), getName(), bag.getKey())); @@ -1776,9 +1775,7 @@ class ExtractRegistry extends Extract { attributes.add(new BlackboardAttribute(TSK_DATETIME_ACCESSED, getName(), time)); } - artifact.addAttributes(attributes); - - artifacts.add(artifact); + artifacts.add(createArtifactWithAttributes(getShellBagArtifact(), regFile, attributes)); } } finally { if(!context.dataSourceIngestIsCancelled()) {