diff --git a/Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerArtifact.java b/Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerArtifact.java index b6a1373236..04715f1f4a 100644 --- a/Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerArtifact.java +++ b/Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerArtifact.java @@ -501,24 +501,37 @@ public class DataContentViewerArtifact extends javax.swing.JPanel implements Dat Lookup lookup = selectedNode.getLookup(); // Get the content. We may get BlackboardArtifacts, ignore those here. - ArrayList artifacts = new ArrayList<>(); Collection contents = lookup.lookupAll(Content.class); if (contents.isEmpty()) { return new ViewUpdate(getArtifactContents().size(), currentPage, ERROR_TEXT); } Content underlyingContent = null; + //find the first non-artifact content from the lookup results for (Content content : contents) { if ((content != null) && (!(content instanceof BlackboardArtifact))) { - // Get all of the blackboard artifacts associated with the content. These are what this - // viewer displays. - try { - artifacts = content.getAllArtifacts(); - underlyingContent = content; - break; - } catch (TskException ex) { - logger.log(Level.SEVERE, "Couldn't get artifacts", ex); //NON-NLS - return new ViewUpdate(getArtifactContents().size(), currentPage, ERROR_TEXT); + underlyingContent = content; + break; + } + } + ArrayList contentArtifacts = new ArrayList<>(); + if (underlyingContent != null) { + try { + //get the artifacts seperately for the use case where an artifact is about a file that exists other than its parent such as a TSK_WEB_DOWNLOAD or TSK_WEB_CACHE + Collection nodeArtifacts = lookup.lookupAll(BlackboardArtifact.class); + if (!nodeArtifacts.isEmpty()) { + BlackboardArtifact originalArtifact = nodeArtifacts.iterator().next(); + if (!underlyingContent.equals(originalArtifact.getParent())) { + contentArtifacts.add(originalArtifact); + } } + if (contentArtifacts.isEmpty()) { + // Get all of the blackboard artifacts associated with the content. These are what this + // viewer displays. + contentArtifacts = underlyingContent.getAllArtifacts(); + } + } catch (TskException ex) { + logger.log(Level.SEVERE, "Couldn't get artifacts", ex); //NON-NLS + return new ViewUpdate(getArtifactContents().size(), currentPage, ERROR_TEXT); } } @@ -528,7 +541,7 @@ public class DataContentViewerArtifact extends javax.swing.JPanel implements Dat // Build the new artifact contents cache. ArrayList artifactContents = new ArrayList<>(); - for (BlackboardArtifact artifact : artifacts) { + for (BlackboardArtifact artifact : contentArtifacts) { artifactContents.add(artifact); } @@ -537,7 +550,7 @@ public class DataContentViewerArtifact extends javax.swing.JPanel implements Dat int index = 0; BlackboardArtifact artifact = lookup.lookup(BlackboardArtifact.class); if (artifact != null) { - index = artifacts.indexOf(artifact); + index = contentArtifacts.indexOf(artifact); if (index == -1) { index = 0; } else { @@ -547,9 +560,9 @@ public class DataContentViewerArtifact extends javax.swing.JPanel implements Dat if (attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID()) { long assocArtifactId = attr.getValueLong(); int assocArtifactIndex = -1; - for (BlackboardArtifact art : artifacts) { + for (BlackboardArtifact art : contentArtifacts) { if (assocArtifactId == art.getArtifactID()) { - assocArtifactIndex = artifacts.indexOf(art); + assocArtifactIndex = contentArtifacts.indexOf(art); break; } }