mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-14 17:06:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '4381-MacAddressCorrelationAttr' of https://github.com/wschaeferB/autopsy into 4402-FlagPastOccurences

Browse Source
This commit is contained in:
William Schaefer 2018-11-26 16:46:47 -05:00
commit 46bd72cd40
3 changed files with 52 additions and 53 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeInstance.java
View File

@ -233,7 +233,7 @@ public class CorrelationAttributeInstance implements Serializable {
"CorrelationType.PHONE.displayName=Phone Numbers", "CorrelationType.PHONE.displayName=Phone Numbers",
"CorrelationType.USBID.displayName=USB Devices", "CorrelationType.USBID.displayName=USB Devices",
"CorrelationType.SSID.displayName=Wireless Networks", "CorrelationType.SSID.displayName=Wireless Networks",
"CorrelationType.MAC.displayName=Mac Addresses", "CorrelationType.MAC.displayName=MAC Addresses",
"CorrelationType.IMEI.displayName=IMEI Number", "CorrelationType.IMEI.displayName=IMEI Number",
"CorrelationType.IMSI.displayName=IMSI Number", "CorrelationType.IMSI.displayName=IMSI Number",
"CorrelationType.ICCID.displayName=ICCID Number"}) "CorrelationType.ICCID.displayName=ICCID Number"})

92
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamArtifactUtil.java
View File

@ -61,41 +61,41 @@ public class EamArtifactUtil {
* *
* @return List of EamArtifacts * @return List of EamArtifacts
*/ */
public static List<CorrelationAttributeInstance> makeInstancesFromBlackboardArtifact(BlackboardArtifact bbArtifact, public static List<CorrelationAttributeInstance> makeInstancesFromBlackboardArtifact(BlackboardArtifact artifact,
boolean checkEnabled) { boolean checkEnabled) {
List<CorrelationAttributeInstance> eamArtifacts = new ArrayList<>(); List<CorrelationAttributeInstance> eamArtifacts = new ArrayList<>();
try { try {
BlackboardArtifact artifact = null; BlackboardArtifact artifactForInstance = null;
if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == bbArtifact.getArtifactTypeID()) { if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == artifact.getArtifactTypeID()) {
// Get the associated artifact // Get the associated artifactForInstance
BlackboardAttribute attribute = bbArtifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)); BlackboardAttribute attribute = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
if (attribute != null) { if (attribute != null) {
artifact = Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboardArtifact(attribute.getValueLong()); artifactForInstance = Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboardArtifact(attribute.getValueLong());
} }
} else { } else {
artifact = bbArtifact; artifactForInstance = artifact;
} }
if (artifact != null) { if (artifactForInstance != null) {
switch (BlackboardArtifact.ARTIFACT_TYPE.fromID(artifact.getArtifactTypeID())) { switch (BlackboardArtifact.ARTIFACT_TYPE.fromID(artifactForInstance.getArtifactTypeID())) {
case TSK_KEYWORD_HIT: { case TSK_KEYWORD_HIT: {
BlackboardAttribute setNameAttr = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)); BlackboardAttribute setNameAttr = artifactForInstance.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME));
if (setNameAttr != null if (setNameAttr != null
&& EamArtifactUtil.getEmailAddressAttrString().equals(setNameAttr.getValueString())) { && EamArtifactUtil.getEmailAddressAttrString().equals(setNameAttr.getValueString())) {
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD, CorrelationAttributeInstance.EMAIL_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD, CorrelationAttributeInstance.EMAIL_TYPE_ID);
} }
break; break;
} }
case TSK_WEB_BOOKMARK: case TSK_WEB_BOOKMARK:
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN, CorrelationAttributeInstance.DOMAIN_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN, CorrelationAttributeInstance.DOMAIN_TYPE_ID);
break; break;
case TSK_WEB_COOKIE: case TSK_WEB_COOKIE:
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN, CorrelationAttributeInstance.DOMAIN_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN, CorrelationAttributeInstance.DOMAIN_TYPE_ID);
break; break;
case TSK_WEB_DOWNLOAD: case TSK_WEB_DOWNLOAD:
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN, CorrelationAttributeInstance.DOMAIN_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN, CorrelationAttributeInstance.DOMAIN_TYPE_ID);
break; break;
case TSK_WEB_HISTORY: case TSK_WEB_HISTORY:
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN, CorrelationAttributeInstance.DOMAIN_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN, CorrelationAttributeInstance.DOMAIN_TYPE_ID);
break; break;
case TSK_CONTACT: case TSK_CONTACT:
//generates the same correlation attrs as tsk_message //generates the same correlation attrs as tsk_message
@ -103,12 +103,12 @@ public class EamArtifactUtil {
//generates the same correlation attrs as tsk_message //generates the same correlation attrs as tsk_message
case TSK_MESSAGE: { case TSK_MESSAGE: {
String value = null; String value = null;
if (null != artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER))) { if (null != artifactForInstance.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER))) {
value = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)).getValueString(); value = artifactForInstance.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)).getValueString();
} else if (null != artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM))) { } else if (null != artifactForInstance.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM))) {
value = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)).getValueString(); value = artifactForInstance.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)).getValueString();
} else if (null != artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO))) { } else if (null != artifactForInstance.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO))) {
value = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)).getValueString(); value = artifactForInstance.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)).getValueString();
} }
// Remove all non-numeric symbols to semi-normalize phone numbers, preserving leading "+" character // Remove all non-numeric symbols to semi-normalize phone numbers, preserving leading "+" character
if (value != null) { if (value != null) {
@ -120,35 +120,35 @@ public class EamArtifactUtil {
// Only add the correlation attribute if the resulting phone number large enough to be of use // Only add the correlation attribute if the resulting phone number large enough to be of use
// (these 3-5 digit numbers can be valid, but are not useful for correlation) // (these 3-5 digit numbers can be valid, but are not useful for correlation)
if (value.length() > 5) { if (value.length() > 5) {
eamArtifacts.add(makeCorrelationAttributeInstanceUsingTypeValue(artifact, EamDb.getInstance().getCorrelationTypeById(CorrelationAttributeInstance.PHONE_TYPE_ID), value)); eamArtifacts.add(makeCorrelationAttributeInstanceUsingTypeValue(artifactForInstance, EamDb.getInstance().getCorrelationTypeById(CorrelationAttributeInstance.PHONE_TYPE_ID), value));
} }
} }
break; break;
} }
case TSK_DEVICE_ATTACHED: case TSK_DEVICE_ATTACHED:
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID, CorrelationAttributeInstance.USBID_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID, CorrelationAttributeInstance.USBID_TYPE_ID);
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MAC_ADDRESS, CorrelationAttributeInstance.MAC_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MAC_ADDRESS, CorrelationAttributeInstance.MAC_TYPE_ID);
break; break;
case TSK_WIFI_NETWORK: case TSK_WIFI_NETWORK:
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SSID, CorrelationAttributeInstance.SSID_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SSID, CorrelationAttributeInstance.SSID_TYPE_ID);
break; break;
case TSK_WIFI_NETWORK_ADAPTER: case TSK_WIFI_NETWORK_ADAPTER:
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MAC_ADDRESS, CorrelationAttributeInstance.MAC_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MAC_ADDRESS, CorrelationAttributeInstance.MAC_TYPE_ID);
break; break;
case TSK_BLUETOOTH_PAIRING: case TSK_BLUETOOTH_PAIRING:
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MAC_ADDRESS, CorrelationAttributeInstance.MAC_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MAC_ADDRESS, CorrelationAttributeInstance.MAC_TYPE_ID);
break; break;
case TSK_BLUETOOTH_ADAPTER: case TSK_BLUETOOTH_ADAPTER:
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MAC_ADDRESS, CorrelationAttributeInstance.MAC_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MAC_ADDRESS, CorrelationAttributeInstance.MAC_TYPE_ID);
break; break;
case TSK_DEVICE_INFO: case TSK_DEVICE_INFO:
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_IMEI, CorrelationAttributeInstance.IMEI_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_IMEI, CorrelationAttributeInstance.IMEI_TYPE_ID);
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_IMSI, CorrelationAttributeInstance.IMSI_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_IMSI, CorrelationAttributeInstance.IMSI_TYPE_ID);
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ICCID, CorrelationAttributeInstance.ICCID_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ICCID, CorrelationAttributeInstance.ICCID_TYPE_ID);
break; break;
case TSK_SIM_ATTACHED: case TSK_SIM_ATTACHED:
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_IMSI, CorrelationAttributeInstance.IMSI_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_IMSI, CorrelationAttributeInstance.IMSI_TYPE_ID);
addCorrelationAttributeToList(eamArtifacts, artifact, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ICCID, CorrelationAttributeInstance.ICCID_TYPE_ID); addCorrelationAttributeToList(eamArtifacts, artifactForInstance, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ICCID, CorrelationAttributeInstance.ICCID_TYPE_ID);
break; break;
default: default:
break; break;
@ -169,13 +169,13 @@ public class EamArtifactUtil {
/** /**
* Add a CorrelationAttributeInstance of the specified type to the provided * Add a CorrelationAttributeInstance of the specified type to the provided
* list if the artifact has an Attribute of the given type with a non empty list if the artifactForInstance has an Attribute of the given type with a non empty
* value. value.
* *
* @param eamArtifacts the list of CorrelationAttributeInstance objects * @param eamArtifacts the list of CorrelationAttributeInstance objects
* which should be added to * which should be added to
* @param artifact the blackboard artifact which we are creating a * @param artifact the blackboard artifactForInstance which we are creating a
* CorrelationAttributeInstance for CorrelationAttributeInstance for
* @param bbAttributeType the type of BlackboardAttribute we expect to exist * @param bbAttributeType the type of BlackboardAttribute we expect to exist
* for a CorrelationAttributeInstance of this type * for a CorrelationAttributeInstance of this type
* generated from this Blackboard Artifact * generated from this Blackboard Artifact
@ -199,9 +199,9 @@ public class EamArtifactUtil {
* Uses the determined type and vallue, then looks up instance details to * Uses the determined type and vallue, then looks up instance details to
* create proper CorrelationAttributeInstance. * create proper CorrelationAttributeInstance.
* *
* @param bbArtifact the blackboard artifact * @param bbArtifact the blackboard artifactForInstance
* @param correlationType the given type * @param correlationType the given type
* @param value the artifact value * @param value the artifactForInstance value
* *
* @return CorrelationAttributeInstance from details * @return CorrelationAttributeInstance from details
*/ */
@ -305,12 +305,12 @@ public class EamArtifactUtil {
/** /**
* Create an EamArtifact from the given Content. Will return null if an * Create an EamArtifact from the given Content. Will return null if an
* artifact can not be created - this is not necessarily an error case, it artifactForInstance can not be created - this is not necessarily an error case, it
* just means an artifact can't be made. If creation fails due to an error just means an artifactForInstance can't be made. If creation fails due to an error
* (and not that the file is the wrong type or it has no hash), the error (and not that the file is the wrong type or it has no hash), the error
* will be logged before returning. will be logged before returning.
*
* Does not add the artifact to the database. Does not add the artifactForInstance to the database.
* *
* @param content The content object * @param content The content object
* *
@ -328,7 +328,7 @@ public class EamArtifactUtil {
return null; return null;
} }
// We need a hash to make the artifact // We need a hash to make the artifactForInstance
String md5 = af.getMd5Hash(); String md5 = af.getMd5Hash();
if (md5 == null || md5.isEmpty() || HashUtility.isNoDataMd5(md5)) { if (md5 == null || md5.isEmpty() || HashUtility.isNoDataMd5(md5)) {
return null; return null;

11
Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java
View File

@ -322,11 +322,10 @@ public class BlackboardArtifactNode extends AbstractContentNode<BlackboardArtifa
} }
@NbBundle.Messages({ @NbBundle.Messages({
"BlackboardArtifactNode.createSheet.artifactType.displayName=Artifact Type", "BlackboardArtifactNode.createSheet.artifactType.displayName=Result Type",
"BlackboardArtifactNode.createSheet.artifactType.name=Artifact Type", "BlackboardArtifactNode.createSheet.artifactType.name=Result Type",
"BlackboardArtifactNode.createSheet.artifactDetails.displayName=Artifact Details", "BlackboardArtifactNode.createSheet.artifactDetails.displayName=Result Details",
"BlackboardArtifactNode.createSheet.artifactDetails.name=Artifact Details", "BlackboardArtifactNode.createSheet.artifactDetails.name=Result Details",
"BlackboardArtifactNode.artifact.displayName=Artifact",
"BlackboardArtifactNode.createSheet.artifactMD5.displayName=MD5 Hash", "BlackboardArtifactNode.createSheet.artifactMD5.displayName=MD5 Hash",
"BlackboardArtifactNode.createSheet.artifactMD5.name=MD5 Hash", "BlackboardArtifactNode.createSheet.artifactMD5.name=MD5 Hash",
"BlackboardArtifactNode.createSheet.fileSize.name=Size", "BlackboardArtifactNode.createSheet.fileSize.name=Size",
@ -372,7 +371,7 @@ public class BlackboardArtifactNode extends AbstractContentNode<BlackboardArtifa
sheetSet.put(new NodeProperty<>(NbBundle.getMessage(BlackboardArtifactNode.class, "BlackboardArtifactNode.createSheet.artifactType.name"), sheetSet.put(new NodeProperty<>(NbBundle.getMessage(BlackboardArtifactNode.class, "BlackboardArtifactNode.createSheet.artifactType.name"),
NbBundle.getMessage(BlackboardArtifactNode.class, "BlackboardArtifactNode.createSheet.artifactType.displayName"), NbBundle.getMessage(BlackboardArtifactNode.class, "BlackboardArtifactNode.createSheet.artifactType.displayName"),
NO_DESCR, NO_DESCR,
associatedArtifact.getDisplayName() + " " + NbBundle.getMessage(BlackboardArtifactNode.class, "BlackboardArtifactNode.artifact.displayName"))); associatedArtifact.getDisplayName()));
sheetSet.put(new NodeProperty<>(NbBundle.getMessage(BlackboardArtifactNode.class, "BlackboardArtifactNode.createSheet.artifactDetails.name"), sheetSet.put(new NodeProperty<>(NbBundle.getMessage(BlackboardArtifactNode.class, "BlackboardArtifactNode.createSheet.artifactDetails.name"),
NbBundle.getMessage(BlackboardArtifactNode.class, "BlackboardArtifactNode.createSheet.artifactDetails.displayName"), NbBundle.getMessage(BlackboardArtifactNode.class, "BlackboardArtifactNode.createSheet.artifactDetails.displayName"),
NO_DESCR, NO_DESCR,