From 3c1a7b8c59d5dda46a7a40af40b1a9b89317dafc Mon Sep 17 00:00:00 2001 From: Ann Priestman Date: Fri, 28 Jul 2017 09:00:17 -0400 Subject: [PATCH] For interesting artifacts, use the associated artifact to make correlation artifacts --- .../centralrepository/datamodel/EamArtifactUtil.java | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/CentralRepository/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamArtifactUtil.java b/CentralRepository/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamArtifactUtil.java index a60d0b5251..59b9e39839 100644 --- a/CentralRepository/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamArtifactUtil.java +++ b/CentralRepository/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamArtifactUtil.java @@ -118,9 +118,17 @@ public class EamArtifactUtil { public static EamArtifact getTypeFromBlackboardArtifact(EamArtifact.Type aType, BlackboardArtifact bbArtifact) { String value = null; int artifactTypeID = bbArtifact.getArtifactTypeID(); - + try { - if (aType.getId() == EamArtifact.EMAIL_TYPE_ID + if(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == artifactTypeID){ + // Get the associated artifact + BlackboardAttribute attribute = bbArtifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)); + if (attribute != null) { + BlackboardArtifact associatedArtifact = Case.getCurrentCase().getSleuthkitCase().getBlackboardArtifact(attribute.getValueLong()); + return getTypeFromBlackboardArtifact(aType, associatedArtifact); + } + + } else if (aType.getId() == EamArtifact.EMAIL_TYPE_ID && BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() == artifactTypeID) { BlackboardAttribute setNameAttr = bbArtifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME));