From ab2dafbd4ea3ab9bc1a21fa81534a94f12eeb1e0 Mon Sep 17 00:00:00 2001 From: jmillman Date: Tue, 1 Mar 2016 13:51:12 -0500 Subject: [PATCH 1/4] refactor ArtifactEventType to work with custom attributes --- .../eventtype/ArtifactEventType.java | 94 ++++++----- .../datamodel/eventtype/MiscTypes.java | 158 +++++++++--------- .../datamodel/eventtype/TypeUtils.java | 23 +++ .../datamodel/eventtype/WebTypes.java | 80 ++++----- .../autopsy/timeline/db/EventsRepository.java | 2 +- 5 files changed, 196 insertions(+), 161 deletions(-) create mode 100644 Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/TypeUtils.java diff --git a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java index d0029d305e..9717249ae0 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2014 Basis Technology Corp. + * Copyright 2014-16 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -18,10 +18,9 @@ */ package org.sleuthkit.autopsy.timeline.datamodel.eventtype; -import java.util.HashMap; -import java.util.List; -import java.util.Map; -import java.util.function.BiFunction; +import java.text.MessageFormat; +import java.util.Optional; +import java.util.function.Function; import java.util.logging.Level; import org.apache.commons.lang3.StringUtils; import org.sleuthkit.autopsy.coreutils.Logger; @@ -38,9 +37,9 @@ public interface ArtifactEventType extends EventType { * @return the Artifact type this event type is derived form, or null if * there is no artifact type (eg file system events) */ - public BlackboardArtifact.ARTIFACT_TYPE getArtifactType(); + public BlackboardArtifact.Type getArtifactType(); - public BlackboardAttribute.ATTRIBUTE_TYPE getDateTimeAttrubuteType(); + public BlackboardAttribute.Type getDateTimeAttrubuteType(); /** * given an artifact, and a map from attribute types to attributes, pull out @@ -57,13 +56,13 @@ public interface ArtifactEventType extends EventType { * * @throws TskCoreException */ - default AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf, Map attrMap) throws TskCoreException { - final BlackboardAttribute dateTimeAttr = attrMap.get(getDateTimeAttrubuteType()); + default AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf) throws TskCoreException { + final BlackboardAttribute dateTimeAttr = artf.getAttribute(getDateTimeAttrubuteType()); long time = dateTimeAttr.getValueLong(); - String shortDescription = getShortExtractor().apply(artf, attrMap); - String medDescription = shortDescription + " : " + getMedExtractor().apply(artf, attrMap); - String fullDescription = medDescription + " : " + getFullExtractor().apply(artf, attrMap); + String shortDescription = getShortExtractor().apply(artf); + String medDescription = shortDescription + " : " + getMedExtractor().apply(artf); + String fullDescription = medDescription + " : " + getFullExtractor().apply(artf); return new AttributeEventDescription(time, shortDescription, medDescription, fullDescription); } @@ -71,19 +70,19 @@ public interface ArtifactEventType extends EventType { * @return a function from an artifact and a map of its attributes, to a * String to use as part of the full event description */ - BiFunction, String> getFullExtractor(); + AttrExtractor getFullExtractor(); /** * @return a function from an artifact and a map of its attributes, to a * String to use as part of the medium event description */ - BiFunction, String> getMedExtractor(); + AttrExtractor getMedExtractor(); /** * @return a function from an artifact and a map of its attributes, to a * String to use as part of the short event description */ - BiFunction, String> getShortExtractor(); + AttrExtractor getShortExtractor(); /** * bundles the per event information derived from a BlackBoard Artifact into @@ -150,46 +149,59 @@ public interface ArtifactEventType extends EventType { throw new IllegalArgumentException(); } - /* - * build a map from attribute type to attribute, this makes implementing - * the parseAttributeHelper easier but could be ineffecient if we don't - * need most of the attributes. This would be unnessecary if there was - * an api on Blackboard artifacts to get specific attributes by type - */ - List attributes = artf.getAttributes(); - Map attrMap = new HashMap<>(); - for (BlackboardAttribute attr : attributes) { - attrMap.put(BlackboardAttribute.ATTRIBUTE_TYPE.fromLabel(attr. - getAttributeTypeName()), attr); - } - - if (attrMap.get(type.getDateTimeAttrubuteType()) == null) { - Logger.getLogger(AttributeEventDescription.class.getName()).log(Level.WARNING, "Artifact {0} has no date/time attribute, skipping it.", artf.getArtifactID()); // NON-NLS + if (artf.getAttribute(type.getDateTimeAttrubuteType()) == null) { + LOGGER.log(Level.WARNING, "Artifact {0} has no date/time attribute, skipping it.", artf.getArtifactID()); // NON-NLS return null; } //use the hook provided by this subtype implementation - return type.parseAttributesHelper(artf, attrMap); + return type.parseAttributesHelper(artf); } - public static class AttributeExtractor implements BiFunction, String> { + @FunctionalInterface + public interface AttrExtractor extends Function { @Override - public String apply(BlackboardArtifact artf, Map attrMap) { - final BlackboardAttribute attr = attrMap.get(attribute); - return (attr != null) ? StringUtils.defaultString(attr.getDisplayString()) : " "; + default String apply(BlackboardArtifact t) { + try { + return applyBare(t); + } catch (TskCoreException ex) { + LOGGER.log(Level.SEVERE, MessageFormat.format("Error getting extracting attribute from artifact {0}.", t.getArtifactID()), ex); // NON-NLS + return ""; + } } - private final BlackboardAttribute.ATTRIBUTE_TYPE attribute; + String applyBare(BlackboardArtifact t) throws TskCoreException; - public AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE attribute) { - this.attribute = attribute; - } } - public static class EmptyExtractor implements BiFunction, String> { + public static class AttributeExtractor implements Function { + + public String apply(BlackboardArtifact artf) { + BlackboardAttribute attr = null; + try { + attr = artf.getAttribute(attributeType); + } catch (TskCoreException ex) { + LOGGER.log(Level.SEVERE, MessageFormat.format("Error getting extracting attribute from artifact {0}.", artf.getArtifactID()), ex); // NON-NLS + } + return Optional.ofNullable(attr) + .map(BlackboardAttribute::getDisplayString) + .map(StringUtils::defaultString) + .orElse(""); + } + + private final BlackboardAttribute.Type attributeType; + + public AttributeExtractor(BlackboardAttribute.Type attribute) { + this.attributeType = attribute; + } + + } + public static final Logger LOGGER = Logger.getLogger(AttributeEventDescription.class.getName()); + + public static class EmptyExtractor implements Function { @Override - public String apply(BlackboardArtifact t, Map u) { + public String apply(BlackboardArtifact t) { return ""; } } diff --git a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/MiscTypes.java b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/MiscTypes.java index 35e49360d3..3279beb1f7 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/MiscTypes.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/MiscTypes.java @@ -21,17 +21,17 @@ package org.sleuthkit.autopsy.timeline.datamodel.eventtype; import java.util.Arrays; import java.util.Collections; import java.util.List; -import java.util.Map; -import java.util.function.BiFunction; import java.util.logging.Level; +import java.util.logging.Logger; import javafx.scene.image.Image; import org.apache.commons.lang3.StringUtils; import org.openide.util.NbBundle; -import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.timeline.zooming.EventTypeZoomLevel; import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.BlackboardArtifact; +import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE; import org.sleuthkit.datamodel.BlackboardAttribute; +import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE; import org.sleuthkit.datamodel.TskCoreException; /** @@ -40,65 +40,65 @@ import org.sleuthkit.datamodel.TskCoreException; public enum MiscTypes implements EventType, ArtifactEventType { MESSAGE(NbBundle.getMessage(MiscTypes.class, "MiscTypes.message.name"), "message.png", // NON-NLS - BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE, - BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE), - (artf, attrMap) -> { - final BlackboardAttribute dir = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION); - final BlackboardAttribute readStatus = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_READ_STATUS); - final BlackboardAttribute name = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME); - final BlackboardAttribute phoneNumber = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER); - final BlackboardAttribute subject = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT); + TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_MESSAGE), + new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)), + (artf) -> { + final BlackboardAttribute dir = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DIRECTION)); + final BlackboardAttribute readStatus = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_READ_STATUS)); + final BlackboardAttribute name = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_NAME)); + final BlackboardAttribute phoneNumber = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)); + final BlackboardAttribute subject = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SUBJECT)); List asList = Arrays.asList(stringValueOf(dir), stringValueOf(readStatus), name != null || phoneNumber != null ? toFrom(dir) : "", stringValueOf(name != null ? name : phoneNumber), (subject == null ? "" : stringValueOf(subject))); return StringUtils.join(asList, " "); }, - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_TEXT))), GPS_ROUTE(NbBundle.getMessage(MiscTypes.class, "MiscTypes.GPSRoutes.name"), "gps-search.png", // NON-NLS - BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_ROUTE, - BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION), - (artf, attrMap) -> { - final BlackboardAttribute latStart = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START); - final BlackboardAttribute longStart = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START); - final BlackboardAttribute latEnd = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END); - final BlackboardAttribute longEnd = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END); + TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_GPS_ROUTE), + new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_LOCATION)), + (artf) -> { + final BlackboardAttribute latStart = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START)); + final BlackboardAttribute longStart = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START)); + final BlackboardAttribute latEnd = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END)); + final BlackboardAttribute longEnd = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END)); return String.format("from %1$g %2$g to %3$g %4$g", latStart.getValueDouble(), longStart.getValueDouble(), latEnd.getValueDouble(), longEnd.getValueDouble()); // NON-NLS }), GPS_TRACKPOINT(NbBundle.getMessage(MiscTypes.class, "MiscTypes.GPSTrackpoint.name"), "gps-trackpoint.png", // NON-NLS - BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT, - BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME), - (artf, attrMap) -> { - final BlackboardAttribute longitude = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE); - final BlackboardAttribute latitude = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE); + TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_GPS_TRACKPOINT), + new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)), + (artf) -> { + final BlackboardAttribute longitude = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)); + final BlackboardAttribute latitude = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)); return (latitude != null ? latitude.getValueDouble() : "") + " " + (longitude != null ? longitude.getValueDouble() : ""); // NON-NLS }, - (artf, attrMap) -> ""), + (artf) -> ""), CALL_LOG(NbBundle.getMessage(MiscTypes.class, "MiscTypes.Calls.name"), "calllog.png", // NON-NLS - BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG, - BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START, - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)), + TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_CALLLOG), + new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_START), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_NAME)), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DIRECTION))), EMAIL(NbBundle.getMessage(MiscTypes.class, "MiscTypes.Email.name"), "mail-icon-16.png", // NON-NLS - BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG, - BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT, - (artifact, attrMap) -> { - final BlackboardAttribute emailFrom = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM); - final BlackboardAttribute emailTo = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO); + TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_EMAIL_MSG), + new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_SENT), + (artf) -> { + final BlackboardAttribute emailFrom = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_FROM)); + final BlackboardAttribute emailTo = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_TO)); return (emailFrom != null ? emailFrom.getValueString() : "") + " to " + (emailTo != null ? emailTo.getValueString() : ""); // NON-NLS }, - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_PLAIN)), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SUBJECT)), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_PLAIN))), RECENT_DOCUMENTS(NbBundle.getMessage(MiscTypes.class, "MiscTypes.recentDocuments.name"), "recent_docs.png", // NON-NLS - BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT, - BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH).andThen( + TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_RECENT_OBJECT), + new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH)).andThen( (String t) -> (StringUtils.substringBeforeLast(StringUtils.substringBeforeLast(t, "\\"), "\\"))), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH).andThen( + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH)).andThen( (String t) -> StringUtils.substringBeforeLast(t, "\\")), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)) { + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH))) { /** * Override @@ -106,31 +106,31 @@ public enum MiscTypes implements EventType, ArtifactEventType { * with non-default description construction */ @Override - public AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf, Map attrMap) throws TskCoreException { - final BlackboardAttribute dateTimeAttr = attrMap.get(getDateTimeAttrubuteType()); + public AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf) throws TskCoreException { + final BlackboardAttribute dateTimeAttr = artf.getAttribute(getDateTimeAttrubuteType()); long time = dateTimeAttr.getValueLong(); //Non-default description construction - String shortDescription = getShortExtractor().apply(artf, attrMap); - String medDescription = getMedExtractor().apply(artf, attrMap); - String fullDescription = getFullExtractor().apply(artf, attrMap); + String shortDescription = getShortExtractor().apply(artf); + String medDescription = getMedExtractor().apply(artf); + String fullDescription = getFullExtractor().apply(artf); return new AttributeEventDescription(time, shortDescription, medDescription, fullDescription); } }, INSTALLED_PROGRAM(NbBundle.getMessage(MiscTypes.class, "MiscTypes.installedPrograms.name"), "programs.png", // NON-NLS - BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG, - BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME), + TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_INSTALLED_PROG), + new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)), new EmptyExtractor(), new EmptyExtractor()), EXIF(NbBundle.getMessage(MiscTypes.class, "MiscTypes.exif.name"), "camera-icon-16.png", // NON-NLS - BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF, - BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL), - (artifact, attributeMap) -> { + TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_METADATA_EXIF), + new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_CREATED), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)), + (artifact) -> { try { AbstractFile file = artifact.getSleuthkitCase().getAbstractFileById(artifact.getObjectID()); if (file != null) { @@ -142,11 +142,11 @@ public enum MiscTypes implements EventType, ArtifactEventType { return " error loading file name"; // NON-NLS }), DEVICES_ATTACHED(NbBundle.getMessage(MiscTypes.class, "MiscTypes.devicesAttached.name"), "usb_devices.png", // NON-NLS - BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED, - BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)); + TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_DEVICE_ATTACHED), + new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)), + new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_ID))); static public String stringValueOf(BlackboardAttribute attr) { return attr != null ? attr.getDisplayString() : ""; @@ -167,7 +167,7 @@ public enum MiscTypes implements EventType, ArtifactEventType { } } - private final BlackboardAttribute.ATTRIBUTE_TYPE dateTimeAttributeType; + private final BlackboardAttribute.Type dateTimeAttributeType; private final String iconBase; @@ -178,17 +178,17 @@ public enum MiscTypes implements EventType, ArtifactEventType { return image; } - private final BiFunction, String> longExtractor; + private final Function longExtractor; - private final BiFunction, String> medExtractor; + private final Function medExtractor; - private final BiFunction, String> shortExtractor; + private final Function shortExtractor; /** * {@inheritDoc } */ @Override - public BiFunction, String> getFullExtractor() { + public Function getFullExtractor() { return longExtractor; } @@ -196,7 +196,7 @@ public enum MiscTypes implements EventType, ArtifactEventType { * {@inheritDoc } */ @Override - public BiFunction, String> getMedExtractor() { + public Function getMedExtractor() { return medExtractor; } @@ -204,7 +204,7 @@ public enum MiscTypes implements EventType, ArtifactEventType { * {@inheritDoc } */ @Override - public BiFunction, String> getShortExtractor() { + public Function getShortExtractor() { return shortExtractor; } @@ -212,7 +212,7 @@ public enum MiscTypes implements EventType, ArtifactEventType { * {@inheritDoc } */ @Override - public BlackboardAttribute.ATTRIBUTE_TYPE getDateTimeAttrubuteType() { + public BlackboardAttribute.Type getDateTimeAttrubuteType() { return dateTimeAttributeType; } @@ -226,7 +226,7 @@ public enum MiscTypes implements EventType, ArtifactEventType { private final String displayName; - private final BlackboardArtifact.ARTIFACT_TYPE artifactType; + private final BlackboardArtifact.Type artifactType; @Override public String getDisplayName() { @@ -243,11 +243,11 @@ public enum MiscTypes implements EventType, ArtifactEventType { return MiscTypes.valueOf(string); } - private MiscTypes(String displayName, String iconBase, BlackboardArtifact.ARTIFACT_TYPE artifactType, - BlackboardAttribute.ATTRIBUTE_TYPE dateTimeAttributeType, - BiFunction, String> shortExtractor, - BiFunction, String> medExtractor, - BiFunction, String> longExtractor) { + private MiscTypes(String displayName, String iconBase, BlackboardArtifact.Type artifactType, + BlackboardAttribute.Type dateTimeAttributeType, + Function shortExtractor, + Function medExtractor, + Function longExtractor) { this.displayName = displayName; this.iconBase = iconBase; this.artifactType = artifactType; @@ -269,7 +269,7 @@ public enum MiscTypes implements EventType, ArtifactEventType { } @Override - public BlackboardArtifact.ARTIFACT_TYPE getArtifactType() { + public BlackboardArtifact.Type getArtifactType() { return artifactType; } diff --git a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/TypeUtils.java b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/TypeUtils.java new file mode 100644 index 0000000000..fede703f61 --- /dev/null +++ b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/TypeUtils.java @@ -0,0 +1,23 @@ +/* + * To change this license header, choose License Headers in Project Properties. + * To change this template file, choose Tools | Templates + * and open the template in the editor. + */ +package org.sleuthkit.autopsy.timeline.datamodel.eventtype; + +import org.sleuthkit.datamodel.BlackboardArtifact; + +/** + * + */ +public class TypeUtils { + + + + static BlackboardArtifact.Type fromEnum(BlackboardArtifact.ARTIFACT_TYPE type) { + return new BlackboardArtifact.Type(type.getTypeID(), type.getLabel(), type.getDisplayName()); + } + + private TypeUtils() { + } +} diff --git a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/WebTypes.java b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/WebTypes.java index 1876a35381..f36d6492f6 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/WebTypes.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/WebTypes.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2014 Basis Technology Corp. + * Copyright 2014-16 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -37,11 +37,11 @@ public enum WebTypes implements EventType, ArtifactEventType { WEB_DOWNLOADS(NbBundle.getMessage(WebTypes.class, "WebTypes.webDownloads.name"), "downloads.png", // NON-NLS - BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD, - BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED, + TypeUtils.fromEnum(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD), + TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED), TopPrivateDomainExtractor.getInstance(), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)) { + new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)), + new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL))) { /** * Override @@ -49,8 +49,8 @@ public enum WebTypes implements EventType, ArtifactEventType { * with non default description construction */ @Override - public AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf, Map attrMap) { - long time = attrMap.get(getDateTimeAttrubuteType()).getValueLong(); + public AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf, Map attrMap) { + long time = attrMap.get(getDateTimeAttrubuteType()).getValueLong(); String domain = getShortExtractor().apply(artf, attrMap); String path = getMedExtractor().apply(artf, attrMap); String fileName = StringUtils.substringAfterLast(path, "/"); @@ -66,37 +66,37 @@ public enum WebTypes implements EventType, ArtifactEventType { //TODO: review description separators WEB_COOKIE(NbBundle.getMessage(WebTypes.class, "WebTypes.webCookies.name"), "cookies.png", // NON-NLS - BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE, - BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, + TypeUtils.fromEnum(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE), + TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME), TopPrivateDomainExtractor.getInstance(), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE)), + new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)), + new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE))), //TODO: review description separators WEB_BOOKMARK(NbBundle.getMessage(WebTypes.class, "WebTypes.webBookmarks.name"), "bookmarks.png", // NON-NLS - BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK, - BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, + TypeUtils.fromEnum(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK), + TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED), TopPrivateDomainExtractor.getInstance(), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)), + new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)), + new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE))), //TODO: review description separators WEB_HISTORY(NbBundle.getMessage(WebTypes.class, "WebTypes.webHistory.name"), "history.png", // NON-NLS - BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY, - BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED, + TypeUtils.fromEnum(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY), + TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED), TopPrivateDomainExtractor.getInstance(), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)), + new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)), + new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE))), //TODO: review description separators WEB_SEARCH(NbBundle.getMessage(WebTypes.class, "WebTypes.webSearch.name"), "searchquery.png", // NON-NLS - BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY, - BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED, - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT), + TypeUtils.fromEnum(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY), + TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED), + new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)), TopPrivateDomainExtractor.getInstance(), - new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)); + new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME))); - private final BlackboardAttribute.ATTRIBUTE_TYPE dateTimeAttributeType; + private final BlackboardAttribute.Type dateTimeAttributeType; private final String iconBase; @@ -108,7 +108,7 @@ public enum WebTypes implements EventType, ArtifactEventType { } @Override - public BlackboardAttribute.ATTRIBUTE_TYPE getDateTimeAttrubuteType() { + public BlackboardAttribute.Type getDateTimeAttrubuteType() { return dateTimeAttributeType; } @@ -117,30 +117,30 @@ public enum WebTypes implements EventType, ArtifactEventType { return EventTypeZoomLevel.SUB_TYPE; } - private final BiFunction, String> longExtractor; + private final BiFunction, String> longExtractor; - private final BiFunction, String> medExtractor; + private final BiFunction, String> medExtractor; - private final BiFunction, String> shortExtractor; + private final BiFunction, String> shortExtractor; @Override - public BiFunction, String> getFullExtractor() { + public BiFunction, String> getFullExtractor() { return longExtractor; } @Override - public BiFunction, String> getMedExtractor() { + public BiFunction, String> getMedExtractor() { return medExtractor; } @Override - public BiFunction, String> getShortExtractor() { + public BiFunction, String> getShortExtractor() { return shortExtractor; } private final String displayName; - BlackboardArtifact.ARTIFACT_TYPE artifactType; + private final BlackboardArtifact.Type artifactType; @Override public String getIconBase() { @@ -148,15 +148,15 @@ public enum WebTypes implements EventType, ArtifactEventType { } @Override - public BlackboardArtifact.ARTIFACT_TYPE getArtifactType() { + public BlackboardArtifact.Type getArtifactType() { return artifactType; } - private WebTypes(String displayName, String iconBase, BlackboardArtifact.ARTIFACT_TYPE artifactType, - BlackboardAttribute.ATTRIBUTE_TYPE dateTimeAttributeType, - BiFunction, String> shortExtractor, - BiFunction, String> medExtractor, - BiFunction, String> longExtractor) { + private WebTypes(String displayName, String iconBase, BlackboardArtifact.Type artifactType, + BlackboardAttribute.Type dateTimeAttributeType, + BiFunction, String> shortExtractor, + BiFunction, String> medExtractor, + BiFunction, String> longExtractor) { this.displayName = displayName; this.iconBase = iconBase; this.artifactType = artifactType; @@ -196,7 +196,7 @@ public enum WebTypes implements EventType, ArtifactEventType { } @Override - public String apply(BlackboardArtifact artf, Map attrMap) { + public String apply(BlackboardArtifact artf, Map attrMap) { String domainString = StringUtils.substringBefore(super.apply(artf, attrMap), "/"); if (InternetDomainName.isValid(domainString)) { InternetDomainName domain = InternetDomainName.from(domainString); @@ -209,7 +209,7 @@ public enum WebTypes implements EventType, ArtifactEventType { } TopPrivateDomainExtractor() { - super(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN); + super(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)); } } diff --git a/Core/src/org/sleuthkit/autopsy/timeline/db/EventsRepository.java b/Core/src/org/sleuthkit/autopsy/timeline/db/EventsRepository.java index c34b5dba12..6946ded64d 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/db/EventsRepository.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/db/EventsRepository.java @@ -655,7 +655,7 @@ public class EventsRepository { private void populateEventType(final ArtifactEventType type, EventDB.EventTransaction trans) { try { //get all the blackboard artifacts corresponding to the given event sub_type - final ArrayList blackboardArtifacts = skCase.getBlackboardArtifacts(type.getArtifactType()); + final ArrayList blackboardArtifacts = skCase.getBlackboardArtifacts(type.getArtifactType().getTypeID()); final int numArtifacts = blackboardArtifacts.size(); restartProgressHandle(Bundle.progressWindow_populatingXevents(type.getDisplayName()), "", 0D, numArtifacts, true); for (int i = 0; i < numArtifacts; i++) { From 23a1a8e3299f40a4a0bd8b5dfd343c73c34c2319 Mon Sep 17 00:00:00 2001 From: jmillman Date: Tue, 1 Mar 2016 14:51:12 -0500 Subject: [PATCH 2/4] cleanup Javadocs --- .../eventtype/ArtifactEventType.java | 75 +++++++------------ .../datamodel/eventtype/MiscTypes.java | 55 +++++--------- .../datamodel/eventtype/WebTypes.java | 73 ++++++++---------- 3 files changed, 80 insertions(+), 123 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java index 9717249ae0..4124226667 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java @@ -33,23 +33,22 @@ import org.sleuthkit.datamodel.TskCoreException; */ public interface ArtifactEventType extends EventType { + public static final Logger LOGGER = Logger.getLogger(ArtifactEventType.class.getName()); + /** - * @return the Artifact type this event type is derived form, or null if - * there is no artifact type (eg file system events) + * @return the Artifact type this event type is derived from */ public BlackboardArtifact.Type getArtifactType(); public BlackboardAttribute.Type getDateTimeAttrubuteType(); /** - * given an artifact, and a map from attribute types to attributes, pull out - * the time stamp, and compose the descriptions. Each implementation of - * {@link ArtifactEventType} needs to implement parseAttributesHelper() as - * hook for {@link buildEventDescription(org.sleuthkit.datamodel.BlackboardArtifact) + * given an artifact, pull out the time stamp, and compose the descriptions. + * Each implementation of {@link ArtifactEventType} needs to implement + * parseAttributesHelper() as hook for {@link buildEventDescription(org.sleuthkit.datamodel.BlackboardArtifact) * to invoke. Most subtypes can use this default implementation. * * @param artf - * @param attrMap * * @return an {@link AttributeEventDescription} containing the timestamp * and description information @@ -67,22 +66,22 @@ public interface ArtifactEventType extends EventType { } /** - * @return a function from an artifact and a map of its attributes, to a - * String to use as part of the full event description + * @return a function from an artifact to a String to use as part of the + * full event description */ - AttrExtractor getFullExtractor(); + Function getFullExtractor(); /** - * @return a function from an artifact and a map of its attributes, to a - * String to use as part of the medium event description + * @return a function from an artifact to a String to use as part of the + * medium event description */ - AttrExtractor getMedExtractor(); + Function getMedExtractor(); /** - * @return a function from an artifact and a map of its attributes, to a - * String to use as part of the short event description + * @return a function from an artifact to a String to use as part of the + * short event description */ - AttrExtractor getShortExtractor(); + Function getShortExtractor(); /** * bundles the per event information derived from a BlackBoard Artifact into @@ -123,14 +122,13 @@ public interface ArtifactEventType extends EventType { this.medDescription = medDescription; this.fullDescription = fullDescription; } - } /** * Build a {@link AttributeEventDescription} derived from a * {@link BlackboardArtifact}. This is a template method that relies on each - * {@link SubType}'s implementation of - * {@link SubType#parseAttributesHelper()} to know how to go from + * {@link ArtifactEventType}'s implementation of + * {@link ArtifactEventType#parseAttributesHelper()} to know how to go from * {@link BlackboardAttribute}s to the event description. * * @param artf the {@link BlackboardArtifact} to derive the event @@ -157,33 +155,10 @@ public interface ArtifactEventType extends EventType { return type.parseAttributesHelper(artf); } - @FunctionalInterface - public interface AttrExtractor extends Function { - - @Override - default String apply(BlackboardArtifact t) { - try { - return applyBare(t); - } catch (TskCoreException ex) { - LOGGER.log(Level.SEVERE, MessageFormat.format("Error getting extracting attribute from artifact {0}.", t.getArtifactID()), ex); // NON-NLS - return ""; - } - } - - String applyBare(BlackboardArtifact t) throws TskCoreException; - - } - - public static class AttributeExtractor implements Function { + static class AttributeExtractor implements Function { public String apply(BlackboardArtifact artf) { - BlackboardAttribute attr = null; - try { - attr = artf.getAttribute(attributeType); - } catch (TskCoreException ex) { - LOGGER.log(Level.SEVERE, MessageFormat.format("Error getting extracting attribute from artifact {0}.", artf.getArtifactID()), ex); // NON-NLS - } - return Optional.ofNullable(attr) + return Optional.ofNullable(getAttributeSafe(artf, attributeType)) .map(BlackboardAttribute::getDisplayString) .map(StringUtils::defaultString) .orElse(""); @@ -196,13 +171,21 @@ public interface ArtifactEventType extends EventType { } } - public static final Logger LOGGER = Logger.getLogger(AttributeEventDescription.class.getName()); - public static class EmptyExtractor implements Function { + static class EmptyExtractor implements Function { @Override public String apply(BlackboardArtifact t) { return ""; } } + + static BlackboardAttribute getAttributeSafe(BlackboardArtifact artf, BlackboardAttribute.Type attrType) { + try { + return artf.getAttribute(attrType); + } catch (TskCoreException ex) { + LOGGER.log(Level.SEVERE, MessageFormat.format("Error getting extracting attribute from artifact {0}.", artf.getArtifactID()), ex); // NON-NLS + return null; + } + } } diff --git a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/MiscTypes.java b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/MiscTypes.java index 3279beb1f7..f7fd306961 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/MiscTypes.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/MiscTypes.java @@ -1,7 +1,7 @@ /* * Autopsy Forensic Browser * - * Copyright 2014 Basis Technology Corp. + * Copyright 2014-16 Basis Technology Corp. * Contact: carrier sleuthkit org * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -21,11 +21,12 @@ package org.sleuthkit.autopsy.timeline.datamodel.eventtype; import java.util.Arrays; import java.util.Collections; import java.util.List; +import java.util.function.Function; import java.util.logging.Level; -import java.util.logging.Logger; import javafx.scene.image.Image; import org.apache.commons.lang3.StringUtils; import org.openide.util.NbBundle; +import static org.sleuthkit.autopsy.timeline.datamodel.eventtype.ArtifactEventType.getAttributeSafe; import org.sleuthkit.autopsy.timeline.zooming.EventTypeZoomLevel; import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.BlackboardArtifact; @@ -44,11 +45,11 @@ public enum MiscTypes implements EventType, ArtifactEventType { new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)), (artf) -> { - final BlackboardAttribute dir = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DIRECTION)); - final BlackboardAttribute readStatus = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_READ_STATUS)); - final BlackboardAttribute name = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_NAME)); - final BlackboardAttribute phoneNumber = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)); - final BlackboardAttribute subject = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SUBJECT)); + final BlackboardAttribute dir = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DIRECTION)); + final BlackboardAttribute readStatus = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_READ_STATUS)); + final BlackboardAttribute name = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_NAME)); + final BlackboardAttribute phoneNumber = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)); + final BlackboardAttribute subject = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SUBJECT)); List asList = Arrays.asList(stringValueOf(dir), stringValueOf(readStatus), name != null || phoneNumber != null ? toFrom(dir) : "", stringValueOf(name != null ? name : phoneNumber), (subject == null ? "" : stringValueOf(subject))); return StringUtils.join(asList, " "); }, @@ -59,10 +60,10 @@ public enum MiscTypes implements EventType, ArtifactEventType { new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_LOCATION)), (artf) -> { - final BlackboardAttribute latStart = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START)); - final BlackboardAttribute longStart = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START)); - final BlackboardAttribute latEnd = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END)); - final BlackboardAttribute longEnd = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END)); + final BlackboardAttribute latStart = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START)); + final BlackboardAttribute longStart = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START)); + final BlackboardAttribute latEnd = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END)); + final BlackboardAttribute longEnd = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END)); return String.format("from %1$g %2$g to %3$g %4$g", latStart.getValueDouble(), longStart.getValueDouble(), latEnd.getValueDouble(), longEnd.getValueDouble()); // NON-NLS }), GPS_TRACKPOINT(NbBundle.getMessage(MiscTypes.class, "MiscTypes.GPSTrackpoint.name"), "gps-trackpoint.png", // NON-NLS @@ -70,8 +71,8 @@ public enum MiscTypes implements EventType, ArtifactEventType { new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)), (artf) -> { - final BlackboardAttribute longitude = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)); - final BlackboardAttribute latitude = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)); + final BlackboardAttribute longitude = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)); + final BlackboardAttribute latitude = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)); return (latitude != null ? latitude.getValueDouble() : "") + " " + (longitude != null ? longitude.getValueDouble() : ""); // NON-NLS }, (artf) -> ""), @@ -85,8 +86,8 @@ public enum MiscTypes implements EventType, ArtifactEventType { TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_EMAIL_MSG), new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_SENT), (artf) -> { - final BlackboardAttribute emailFrom = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_FROM)); - final BlackboardAttribute emailTo = artf.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_TO)); + final BlackboardAttribute emailFrom = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_FROM)); + final BlackboardAttribute emailTo = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_TO)); return (emailFrom != null ? emailFrom.getValueString() : "") + " to " + (emailTo != null ? emailTo.getValueString() : ""); // NON-NLS }, new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SUBJECT)), @@ -100,14 +101,9 @@ public enum MiscTypes implements EventType, ArtifactEventType { (String t) -> StringUtils.substringBeforeLast(t, "\\")), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH))) { - /** - * Override - * {@link ArtifactEventType#parseAttributesHelper(org.sleuthkit.datamodel.BlackboardArtifact, java.util.Map)} - * with non-default description construction - */ @Override public AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf) throws TskCoreException { - final BlackboardAttribute dateTimeAttr = artf.getAttribute(getDateTimeAttrubuteType()); + final BlackboardAttribute dateTimeAttr = getAttributeSafe(artf, getDateTimeAttrubuteType()); long time = dateTimeAttr.getValueLong(); @@ -137,7 +133,7 @@ public enum MiscTypes implements EventType, ArtifactEventType { return file.getName(); } } catch (TskCoreException ex) { - Logger.getLogger(MiscTypes.class.getName()).log(Level.SEVERE, "Exif event type failed to look up backing file name", ex); //NON-NLS + LOGGER.log(Level.SEVERE, "Exif event type failed to look up backing file name", ex); //NON-NLS } return " error loading file name"; // NON-NLS }), @@ -184,41 +180,26 @@ public enum MiscTypes implements EventType, ArtifactEventType { private final Function shortExtractor; - /** - * {@inheritDoc } - */ @Override public Function getFullExtractor() { return longExtractor; } - /** - * {@inheritDoc } - */ @Override public Function getMedExtractor() { return medExtractor; } - /** - * {@inheritDoc } - */ @Override public Function getShortExtractor() { return shortExtractor; } - /** - * {@inheritDoc } - */ @Override public BlackboardAttribute.Type getDateTimeAttrubuteType() { return dateTimeAttributeType; } - /** - * {@inheritDoc } - */ @Override public EventTypeZoomLevel getZoomLevel() { return EventTypeZoomLevel.SUB_TYPE; diff --git a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/WebTypes.java b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/WebTypes.java index f36d6492f6..ed214c283c 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/WebTypes.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/WebTypes.java @@ -21,8 +21,7 @@ package org.sleuthkit.autopsy.timeline.datamodel.eventtype; import com.google.common.net.InternetDomainName; import java.util.Collections; import java.util.List; -import java.util.Map; -import java.util.function.BiFunction; +import java.util.function.Function; import javafx.scene.image.Image; import org.apache.commons.lang3.StringUtils; import org.openide.util.NbBundle; @@ -38,23 +37,18 @@ public enum WebTypes implements EventType, ArtifactEventType { WEB_DOWNLOADS(NbBundle.getMessage(WebTypes.class, "WebTypes.webDownloads.name"), "downloads.png", // NON-NLS TypeUtils.fromEnum(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD), - TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED), + new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED), TopPrivateDomainExtractor.getInstance(), - new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)), - new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL))) { + new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)), + new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL))) { - /** - * Override - * {@link ArtifactEventType#parseAttributesHelper(org.sleuthkit.datamodel.BlackboardArtifact, java.util.Map)} - * with non default description construction - */ @Override - public AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf, Map attrMap) { - long time = attrMap.get(getDateTimeAttrubuteType()).getValueLong(); - String domain = getShortExtractor().apply(artf, attrMap); - String path = getMedExtractor().apply(artf, attrMap); + public AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf) { + long time = ArtifactEventType.getAttributeSafe(artf, getDateTimeAttrubuteType()).getValueLong(); + String domain = getShortExtractor().apply(artf); + String path = getMedExtractor().apply(artf); String fileName = StringUtils.substringAfterLast(path, "/"); - String url = getFullExtractor().apply(artf, attrMap); + String url = getFullExtractor().apply(artf); //TODO: review non default description construction String shortDescription = fileName + " from " + domain; // NON-NLS @@ -67,34 +61,34 @@ public enum WebTypes implements EventType, ArtifactEventType { WEB_COOKIE(NbBundle.getMessage(WebTypes.class, "WebTypes.webCookies.name"), "cookies.png", // NON-NLS TypeUtils.fromEnum(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE), - TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME), + new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME), TopPrivateDomainExtractor.getInstance(), - new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)), - new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE))), + new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)), + new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE))), //TODO: review description separators WEB_BOOKMARK(NbBundle.getMessage(WebTypes.class, "WebTypes.webBookmarks.name"), "bookmarks.png", // NON-NLS TypeUtils.fromEnum(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK), - TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED), + new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED), TopPrivateDomainExtractor.getInstance(), - new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)), - new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE))), + new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)), + new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE))), //TODO: review description separators WEB_HISTORY(NbBundle.getMessage(WebTypes.class, "WebTypes.webHistory.name"), "history.png", // NON-NLS TypeUtils.fromEnum(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY), - TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED), + new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED), TopPrivateDomainExtractor.getInstance(), - new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)), - new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE))), + new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)), + new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE))), //TODO: review description separators WEB_SEARCH(NbBundle.getMessage(WebTypes.class, "WebTypes.webSearch.name"), "searchquery.png", // NON-NLS TypeUtils.fromEnum(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY), - TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED), - new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)), + new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED), + new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)), TopPrivateDomainExtractor.getInstance(), - new AttributeExtractor(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME))); + new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME))); private final BlackboardAttribute.Type dateTimeAttributeType; @@ -117,24 +111,24 @@ public enum WebTypes implements EventType, ArtifactEventType { return EventTypeZoomLevel.SUB_TYPE; } - private final BiFunction, String> longExtractor; + private final Function longExtractor; - private final BiFunction, String> medExtractor; + private final Function medExtractor; - private final BiFunction, String> shortExtractor; + private final Function shortExtractor; @Override - public BiFunction, String> getFullExtractor() { + public Function getFullExtractor() { return longExtractor; } @Override - public BiFunction, String> getMedExtractor() { + public Function getMedExtractor() { return medExtractor; } @Override - public BiFunction, String> getShortExtractor() { + public Function getShortExtractor() { return shortExtractor; } @@ -154,9 +148,9 @@ public enum WebTypes implements EventType, ArtifactEventType { private WebTypes(String displayName, String iconBase, BlackboardArtifact.Type artifactType, BlackboardAttribute.Type dateTimeAttributeType, - BiFunction, String> shortExtractor, - BiFunction, String> medExtractor, - BiFunction, String> longExtractor) { + Function shortExtractor, + Function medExtractor, + Function longExtractor) { this.displayName = displayName; this.iconBase = iconBase; this.artifactType = artifactType; @@ -196,8 +190,8 @@ public enum WebTypes implements EventType, ArtifactEventType { } @Override - public String apply(BlackboardArtifact artf, Map attrMap) { - String domainString = StringUtils.substringBefore(super.apply(artf, attrMap), "/"); + public String apply(BlackboardArtifact artf) { + String domainString = StringUtils.substringBefore(super.apply(artf), "/"); if (InternetDomainName.isValid(domainString)) { InternetDomainName domain = InternetDomainName.from(domainString); return (domain.isUnderPublicSuffix()) @@ -209,8 +203,7 @@ public enum WebTypes implements EventType, ArtifactEventType { } TopPrivateDomainExtractor() { - super(TypeUtils.fromEnum(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)); + super(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)); } } - } From 77df50c923ed3569f9c3a94df12abc247785014f Mon Sep 17 00:00:00 2001 From: jmillman Date: Tue, 1 Mar 2016 15:17:42 -0500 Subject: [PATCH 3/4] more cleanup and null safety --- .../eventtype/ArtifactEventType.java | 5 +-- .../datamodel/eventtype/MiscTypes.java | 33 ++++++++++--------- .../datamodel/eventtype/TypeUtils.java | 26 +++++++++++---- .../datamodel/eventtype/WebTypes.java | 5 +-- 4 files changed, 43 insertions(+), 26 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java index 4124226667..0739a3580c 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java @@ -34,6 +34,7 @@ import org.sleuthkit.datamodel.TskCoreException; public interface ArtifactEventType extends EventType { public static final Logger LOGGER = Logger.getLogger(ArtifactEventType.class.getName()); + static final EmptyExtractor EMPTY_EXTRACTOR = new EmptyExtractor(); /** * @return the Artifact type this event type is derived from @@ -155,7 +156,7 @@ public interface ArtifactEventType extends EventType { return type.parseAttributesHelper(artf); } - static class AttributeExtractor implements Function { + static class AttributeExtractor implements Function { public String apply(BlackboardArtifact artf) { return Optional.ofNullable(getAttributeSafe(artf, attributeType)) @@ -172,7 +173,7 @@ public interface ArtifactEventType extends EventType { } - static class EmptyExtractor implements Function { + static class EmptyExtractor implements Function { @Override public String apply(BlackboardArtifact t) { diff --git a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/MiscTypes.java b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/MiscTypes.java index f7fd306961..3d73982bf5 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/MiscTypes.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/MiscTypes.java @@ -21,6 +21,7 @@ package org.sleuthkit.autopsy.timeline.datamodel.eventtype; import java.util.Arrays; import java.util.Collections; import java.util.List; +import java.util.Optional; import java.util.function.Function; import java.util.logging.Level; import javafx.scene.image.Image; @@ -44,7 +45,7 @@ public enum MiscTypes implements EventType, ArtifactEventType { TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_MESSAGE), new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)), - (artf) -> { + artf -> { final BlackboardAttribute dir = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DIRECTION)); final BlackboardAttribute readStatus = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_READ_STATUS)); final BlackboardAttribute name = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_NAME)); @@ -59,23 +60,23 @@ public enum MiscTypes implements EventType, ArtifactEventType { new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_LOCATION)), - (artf) -> { + artf -> { final BlackboardAttribute latStart = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START)); final BlackboardAttribute longStart = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START)); final BlackboardAttribute latEnd = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END)); final BlackboardAttribute longEnd = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END)); - return String.format("from %1$g %2$g to %3$g %4$g", latStart.getValueDouble(), longStart.getValueDouble(), latEnd.getValueDouble(), longEnd.getValueDouble()); // NON-NLS + return String.format("from %1$s %2$s to %3$s %4$s", stringValueOf(latStart), stringValueOf(longStart), stringValueOf(latEnd), stringValueOf(longEnd)); // NON-NLS }), GPS_TRACKPOINT(NbBundle.getMessage(MiscTypes.class, "MiscTypes.GPSTrackpoint.name"), "gps-trackpoint.png", // NON-NLS TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_GPS_TRACKPOINT), new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)), - (artf) -> { + artf -> { final BlackboardAttribute longitude = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)); final BlackboardAttribute latitude = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)); - return (latitude != null ? latitude.getValueDouble() : "") + " " + (longitude != null ? longitude.getValueDouble() : ""); // NON-NLS + return stringValueOf(latitude) + " " + stringValueOf(longitude); // NON-NLS }, - (artf) -> ""), + EMPTY_EXTRACTOR), CALL_LOG(NbBundle.getMessage(MiscTypes.class, "MiscTypes.Calls.name"), "calllog.png", // NON-NLS TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_CALLLOG), new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_START), @@ -85,10 +86,10 @@ public enum MiscTypes implements EventType, ArtifactEventType { EMAIL(NbBundle.getMessage(MiscTypes.class, "MiscTypes.Email.name"), "mail-icon-16.png", // NON-NLS TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_EMAIL_MSG), new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_SENT), - (artf) -> { + artf -> { final BlackboardAttribute emailFrom = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_FROM)); final BlackboardAttribute emailTo = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_TO)); - return (emailFrom != null ? emailFrom.getValueString() : "") + " to " + (emailTo != null ? emailTo.getValueString() : ""); // NON-NLS + return stringValueOf(emailFrom) + " to " + stringValueOf(emailTo); // NON-NLS }, new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SUBJECT)), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_PLAIN))), @@ -103,7 +104,7 @@ public enum MiscTypes implements EventType, ArtifactEventType { @Override public AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf) throws TskCoreException { - final BlackboardAttribute dateTimeAttr = getAttributeSafe(artf, getDateTimeAttrubuteType()); + final BlackboardAttribute dateTimeAttr = artf.getAttribute(getDateTimeAttrubuteType()); long time = dateTimeAttr.getValueLong(); @@ -119,23 +120,23 @@ public enum MiscTypes implements EventType, ArtifactEventType { TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_INSTALLED_PROG), new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)), - new EmptyExtractor(), - new EmptyExtractor()), + EMPTY_EXTRACTOR, + EMPTY_EXTRACTOR), EXIF(NbBundle.getMessage(MiscTypes.class, "MiscTypes.exif.name"), "camera-icon-16.png", // NON-NLS TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_METADATA_EXIF), new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_CREATED), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)), - (artifact) -> { + artf -> { try { - AbstractFile file = artifact.getSleuthkitCase().getAbstractFileById(artifact.getObjectID()); + AbstractFile file = artf.getSleuthkitCase().getAbstractFileById(artf.getObjectID()); if (file != null) { return file.getName(); } } catch (TskCoreException ex) { LOGGER.log(Level.SEVERE, "Exif event type failed to look up backing file name", ex); //NON-NLS } - return " error loading file name"; // NON-NLS + return "error loading file name"; }), DEVICES_ATTACHED(NbBundle.getMessage(MiscTypes.class, "MiscTypes.devicesAttached.name"), "usb_devices.png", // NON-NLS TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_DEVICE_ATTACHED), @@ -145,7 +146,9 @@ public enum MiscTypes implements EventType, ArtifactEventType { new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_ID))); static public String stringValueOf(BlackboardAttribute attr) { - return attr != null ? attr.getDisplayString() : ""; + return Optional.ofNullable(attr) + .map(BlackboardAttribute::getDisplayString) + .orElse(""); } public static String toFrom(BlackboardAttribute dir) { diff --git a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/TypeUtils.java b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/TypeUtils.java index fede703f61..889511f037 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/TypeUtils.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/TypeUtils.java @@ -1,7 +1,20 @@ /* - * To change this license header, choose License Headers in Project Properties. - * To change this template file, choose Tools | Templates - * and open the template in the editor. + * Autopsy Forensic Browser + * + * Copyright 2016 Basis Technology Corp. + * Contact: carrier sleuthkit org + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. */ package org.sleuthkit.autopsy.timeline.datamodel.eventtype; @@ -10,11 +23,10 @@ import org.sleuthkit.datamodel.BlackboardArtifact; /** * */ -public class TypeUtils { +class TypeUtils { - - - static BlackboardArtifact.Type fromEnum(BlackboardArtifact.ARTIFACT_TYPE type) { +//TODO: this will be unncessary once their is BlackboardArtifact.Type constructr that takes a BlackboardArtifact.ARTIFACT_TYPE + static BlackboardArtifact.Type fromEnum(BlackboardArtifact.ARTIFACT_TYPE type) { return new BlackboardArtifact.Type(type.getTypeID(), type.getLabel(), type.getDisplayName()); } diff --git a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/WebTypes.java b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/WebTypes.java index ed214c283c..2bb3b92ef4 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/WebTypes.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/WebTypes.java @@ -28,6 +28,7 @@ import org.openide.util.NbBundle; import org.sleuthkit.autopsy.timeline.zooming.EventTypeZoomLevel; import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardAttribute; +import org.sleuthkit.datamodel.TskCoreException; /** * @@ -43,8 +44,8 @@ public enum WebTypes implements EventType, ArtifactEventType { new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL))) { @Override - public AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf) { - long time = ArtifactEventType.getAttributeSafe(artf, getDateTimeAttrubuteType()).getValueLong(); + public AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf) throws TskCoreException { + long time = artf.getAttribute(getDateTimeAttrubuteType()).getValueLong(); String domain = getShortExtractor().apply(artf); String path = getMedExtractor().apply(artf); String fileName = StringUtils.substringAfterLast(path, "/"); From 7d2d8f065892e068bbebdb70c9eaabae14c4c441 Mon Sep 17 00:00:00 2001 From: Oliver Spohngellert Date: Tue, 1 Mar 2016 16:24:58 -0500 Subject: [PATCH 4/4] Deprecation fixes --- .../DataContentViewerArtifact.java | 2 +- .../datamodel/ArtifactStringContent.java | 22 +++++++++---------- .../datamodel/BlackboardArtifactNode.java | 20 ++++++++--------- .../directorytree/DataResultFilterNode.java | 4 ++-- .../DirectoryTreeTopComponent.java | 6 ++--- .../autopsy/modules/stix/EvalAccountObj.java | 6 ++--- .../autopsy/modules/stix/EvalAddressObj.java | 2 +- .../autopsy/modules/stix/EvalDomainObj.java | 2 +- .../modules/stix/EvalNetworkShareObj.java | 4 ++-- .../autopsy/modules/stix/EvalURIObj.java | 2 +- .../modules/stix/EvalURLHistoryObj.java | 14 ++++++------ .../autopsy/report/ReportGenerator.java | 2 +- .../sleuthkit/autopsy/report/ReportKML.java | 20 ++++++++--------- .../eventtype/ArtifactEventType.java | 3 +-- .../imagegallery/datamodel/DrawableFile.java | 4 ++-- .../keywordsearch/KeywordCachedArtifact.java | 4 ++-- .../keywordsearch/SolrSearchService.java | 18 +++++++-------- .../SearchEngineURLQueryAnalyzer.java | 8 +++---- 18 files changed, 71 insertions(+), 72 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerArtifact.java b/Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerArtifact.java index 635a8b0e37..c7226483ef 100644 --- a/Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerArtifact.java +++ b/Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerArtifact.java @@ -488,7 +488,7 @@ public class DataContentViewerArtifact extends javax.swing.JPanel implements Dat // if the artifact has an ASSOCIATED ARTIFACT, then we display the associated artifact instead try { for (BlackboardAttribute attr : artifact.getAttributes()) { - if (attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID()) { + if (attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID()) { long assocArtifactId = attr.getValueLong(); int assocArtifactIndex = -1; for (BlackboardArtifact art : artifacts) { diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactStringContent.java b/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactStringContent.java index 502a7828a4..db8607cd93 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactStringContent.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/ArtifactStringContent.java @@ -72,19 +72,19 @@ public class ArtifactStringContent implements StringContent { // name column buffer.append(""); //NON-NLS - buffer.append(attr.getAttributeTypeDisplayName()); + buffer.append(attr.getAttributeType().getDisplayName()); buffer.append(""); //NON-NLS // value column buffer.append(""); //NON-NLS - if (attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID() - || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID() - || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_CREATED.getTypeID() - || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_MODIFIED.getTypeID() - || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_RCVD.getTypeID() - || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_SENT.getTypeID() - || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_START.getTypeID() - || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_END.getTypeID()) { + if (attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID() + || attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID() + || attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_CREATED.getTypeID() + || attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_MODIFIED.getTypeID() + || attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_RCVD.getTypeID() + || attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_SENT.getTypeID() + || attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_START.getTypeID() + || attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_END.getTypeID()) { long epoch = attr.getValueLong(); String time = "0000-00-00 00:00:00"; if (epoch != 0) { @@ -93,7 +93,7 @@ public class ArtifactStringContent implements StringContent { } buffer.append(time); } else { - switch (attr.getValueType()) { + switch (attr.getAttributeType().getValueType()) { case STRING: String str = attr.getValueString(); str = str.replaceAll(" ", " "); //NON-NLS @@ -117,7 +117,7 @@ public class ArtifactStringContent implements StringContent { case DATETIME: buffer.append(attr.getValueLong()); break; - + } } if (!"".equals(attr.getContext())) { diff --git a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java index 198baaf923..7101b3c023 100644 --- a/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java +++ b/Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java @@ -117,7 +117,7 @@ public class BlackboardArtifactNode extends DisplayableItemNode { if (artifact != null && artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) { try { for (BlackboardAttribute attribute : artifact.getAttributes()) { - if (attribute.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID()) { + if (attribute.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID()) { BlackboardArtifact associatedArtifact = Case.getCurrentCase().getSleuthkitCase().getBlackboardArtifact(attribute.getValueLong()); if (associatedArtifact != null) { displayName = associatedArtifact.getDisplayName() + " Artifact"; // NON-NLS @@ -171,7 +171,7 @@ public class BlackboardArtifactNode extends DisplayableItemNode { AbstractFile af = (AbstractFile) associated; ext = af.getNameExtension(); actualMimeType = af.getMIMEType(); - if(actualMimeType == null) { + if (actualMimeType == null) { actualMimeType = ""; } } @@ -179,11 +179,11 @@ public class BlackboardArtifactNode extends DisplayableItemNode { NbBundle.getMessage(this.getClass(), "BlackboardArtifactNode.createSheet.ext.displayName"), NO_DESCR, ext)); - ss.put(new NodeProperty<>( - NbBundle.getMessage(this.getClass(), "BlackboardArtifactNode.createSheet.mimeType.name"), - NbBundle.getMessage(this.getClass(), "BlackboardArtifactNode.createSheet.mimeType.displayName"), - NO_DESCR, - actualMimeType)); + ss.put(new NodeProperty<>( + NbBundle.getMessage(this.getClass(), "BlackboardArtifactNode.createSheet.mimeType.name"), + NbBundle.getMessage(this.getClass(), "BlackboardArtifactNode.createSheet.mimeType.displayName"), + NO_DESCR, + actualMimeType)); } if (Arrays.asList(SHOW_UNIQUE_PATH).contains(artifactTypeId)) { @@ -282,8 +282,8 @@ public class BlackboardArtifactNode extends DisplayableItemNode { /** * Fill map with Artifact properties * - * @param map map with preserved ordering, where property names/values are - * put + * @param map map with preserved ordering, where property names/values + * are put * @param artifact to extract properties from */ @SuppressWarnings("deprecation") // TODO: Remove this when TSK_TAGGED_ARTIFACT rows are removed in a database upgrade. @@ -384,7 +384,7 @@ public class BlackboardArtifactNode extends DisplayableItemNode { String keyword = null; String regexp = null; for (BlackboardAttribute att : attributes) { - final int attributeTypeID = att.getAttributeTypeID(); + final int attributeTypeID = att.getAttributeType().getTypeID(); if (attributeTypeID == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID()) { keyword = att.getValueString(); } else if (attributeTypeID == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP.getTypeID()) { diff --git a/Core/src/org/sleuthkit/autopsy/directorytree/DataResultFilterNode.java b/Core/src/org/sleuthkit/autopsy/directorytree/DataResultFilterNode.java index e4c34ebce9..52b1954188 100755 --- a/Core/src/org/sleuthkit/autopsy/directorytree/DataResultFilterNode.java +++ b/Core/src/org/sleuthkit/autopsy/directorytree/DataResultFilterNode.java @@ -271,8 +271,8 @@ public class DataResultFilterNode extends FilterNode { Content c = null; try { for (BlackboardAttribute attr : art.getAttributes()) { - if (attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID()) { - switch (attr.getValueType()) { + if (attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID()) { + switch (attr.getAttributeType().getValueType()) { case INTEGER: int i = attr.getValueInt(); if (i != -1) { diff --git a/Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeTopComponent.java b/Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeTopComponent.java index cabc5cc3d4..57de4e760e 100644 --- a/Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeTopComponent.java +++ b/Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeTopComponent.java @@ -865,7 +865,7 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat String setName = null; List attributes = art.getAttributes(); for (BlackboardAttribute att : attributes) { - int typeId = att.getAttributeTypeID(); + int typeId = att.getAttributeType().getTypeID(); if (typeId == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID()) { setName = att.getValueString(); } @@ -882,7 +882,7 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat String keywordName = null; List attributes = art.getAttributes(); for (BlackboardAttribute att : attributes) { - int typeId = att.getAttributeTypeID(); + int typeId = att.getAttributeType().getTypeID(); if (typeId == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID()) { listName = att.getValueString(); } else if (typeId == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID()) { @@ -909,7 +909,7 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat String setName = null; List attributes = art.getAttributes(); for (BlackboardAttribute att : attributes) { - int typeId = att.getAttributeTypeID(); + int typeId = att.getAttributeType().getTypeID(); if (typeId == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID()) { setName = att.getValueString(); } diff --git a/Core/src/org/sleuthkit/autopsy/modules/stix/EvalAccountObj.java b/Core/src/org/sleuthkit/autopsy/modules/stix/EvalAccountObj.java index eaec84d5d1..d2a6b19551 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/stix/EvalAccountObj.java +++ b/Core/src/org/sleuthkit/autopsy/modules/stix/EvalAccountObj.java @@ -115,15 +115,15 @@ class EvalAccountObj extends EvaluatableObject { boolean foundSIDMatch = false; for (BlackboardAttribute attr : art.getAttributes()) { - if ((attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH.getTypeID()) + if ((attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH.getTypeID()) && (haveHomeDir)) { foundHomeDirMatch = compareStringObject(userAccountObj.getHomeDirectory(), attr.getValueString()); } - if ((attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME.getTypeID()) + if ((attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME.getTypeID()) && (haveUsername)) { foundUsernameMatch = compareStringObject(userAccountObj.getUsername(), attr.getValueString()); } - if ((attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID.getTypeID()) + if ((attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID.getTypeID()) && (haveSID) && (winUserObj != null)) { foundSIDMatch = compareStringObject(winUserObj.getSecurityID(), attr.getValueString()); } diff --git a/Core/src/org/sleuthkit/autopsy/modules/stix/EvalAddressObj.java b/Core/src/org/sleuthkit/autopsy/modules/stix/EvalAddressObj.java index 2df8ffe93e..faaac1dc4e 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/stix/EvalAddressObj.java +++ b/Core/src/org/sleuthkit/autopsy/modules/stix/EvalAddressObj.java @@ -117,7 +117,7 @@ class EvalAddressObj extends EvaluatableObject { for (BlackboardArtifact art : artList) { for (BlackboardAttribute attr : art.getAttributes()) { - if (attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID()) { + if (attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID()) { if (compareStringObject(addressStr, obj.getAddressValue().getCondition(), obj.getAddressValue().getApplyCondition(), attr.getValueString())) { finalHits.add(art); diff --git a/Core/src/org/sleuthkit/autopsy/modules/stix/EvalDomainObj.java b/Core/src/org/sleuthkit/autopsy/modules/stix/EvalDomainObj.java index 03a8041c1f..2dd6c7f680 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/stix/EvalDomainObj.java +++ b/Core/src/org/sleuthkit/autopsy/modules/stix/EvalDomainObj.java @@ -80,7 +80,7 @@ class EvalDomainObj extends EvaluatableObject { for (BlackboardArtifact art : artList) { for (BlackboardAttribute attr : art.getAttributes()) { - if (attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID()) { + if (attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID()) { String url = attr.getValueString(); // Check whether the domain name is a substring of the URL (regardless diff --git a/Core/src/org/sleuthkit/autopsy/modules/stix/EvalNetworkShareObj.java b/Core/src/org/sleuthkit/autopsy/modules/stix/EvalNetworkShareObj.java index 98c0d9d95a..843f19c293 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/stix/EvalNetworkShareObj.java +++ b/Core/src/org/sleuthkit/autopsy/modules/stix/EvalNetworkShareObj.java @@ -98,11 +98,11 @@ class EvalNetworkShareObj extends EvaluatableObject { boolean foundLocalPathMatch = false; for (BlackboardAttribute attr : art.getAttributes()) { - if ((attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REMOTE_PATH.getTypeID()) + if ((attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REMOTE_PATH.getTypeID()) && (obj.getNetname() != null)) { foundRemotePathMatch = compareStringObject(obj.getNetname(), attr.getValueString()); } - if ((attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCAL_PATH.getTypeID()) + if ((attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCAL_PATH.getTypeID()) && (obj.getLocalPath() != null)) { foundLocalPathMatch = compareStringObject(obj.getLocalPath(), attr.getValueString()); } diff --git a/Core/src/org/sleuthkit/autopsy/modules/stix/EvalURIObj.java b/Core/src/org/sleuthkit/autopsy/modules/stix/EvalURIObj.java index d7ce6b8c7e..c5e598b034 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/stix/EvalURIObj.java +++ b/Core/src/org/sleuthkit/autopsy/modules/stix/EvalURIObj.java @@ -108,7 +108,7 @@ class EvalURIObj extends EvaluatableObject { for (BlackboardArtifact art : artList) { for (BlackboardAttribute attr : art.getAttributes()) { - if (attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID()) { + if (attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID()) { String modifiedAttrString = attr.getValueString(); if (modifiedAttrString != null) { diff --git a/Core/src/org/sleuthkit/autopsy/modules/stix/EvalURLHistoryObj.java b/Core/src/org/sleuthkit/autopsy/modules/stix/EvalURLHistoryObj.java index 416784dd81..f6a6b67075 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/stix/EvalURLHistoryObj.java +++ b/Core/src/org/sleuthkit/autopsy/modules/stix/EvalURLHistoryObj.java @@ -152,7 +152,7 @@ class EvalURLHistoryObj extends EvaluatableObject { boolean foundBrowserNameMatch = false; for (BlackboardAttribute attr : art.getAttributes()) { - if ((attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL.getTypeID()) + if ((attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL.getTypeID()) && (haveURL)) { if (entry.getURL().getValue() instanceof AnyURIObjectPropertyType) { foundURLMatch = compareStringObject(entry.getURL().getValue().getValue().toString(), @@ -163,12 +163,12 @@ class EvalURLHistoryObj extends EvaluatableObject { addWarning("Non-AnyURIObjectPropertyType found in URL value field"); //NON-NLS } } - if ((attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN.getTypeID()) + if ((attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN.getTypeID()) && (haveHostname)) { foundHostnameMatch = compareStringObject(entry.getHostname().getHostnameValue(), attr.getValueString()); } - if ((attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REFERRER.getTypeID()) + if ((attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REFERRER.getTypeID()) && (haveReferrer)) { if (entry.getReferrerURL().getValue() instanceof AnyURIObjectPropertyType) { foundReferrerMatch = compareStringObject(entry.getReferrerURL().getValue().getValue().toString(), @@ -179,17 +179,17 @@ class EvalURLHistoryObj extends EvaluatableObject { addWarning("Non-AnyURIObjectPropertyType found in URL value field"); //NON-NLS } } - if ((attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE.getTypeID()) + if ((attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE.getTypeID()) && (havePageTitle)) { foundPageTitleMatch = compareStringObject(entry.getPageTitle(), attr.getValueString()); } - if ((attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME.getTypeID()) + if ((attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME.getTypeID()) && (haveUserProfile)) { foundUserProfileMatch = compareStringObject(entry.getUserProfileName(), attr.getValueString()); } - if ((attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID()) + if ((attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID()) && (haveBrowserName)) { foundBrowserNameMatch = compareStringObject(obj.getBrowserInformation().getName(), null, null, attr.getValueString()); @@ -240,7 +240,7 @@ class EvalURLHistoryObj extends EvaluatableObject { boolean foundBrowserNameMatch = false; for (BlackboardAttribute attr : art.getAttributes()) { - if ((attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID()) + if ((attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID()) && (haveBrowserName)) { foundBrowserNameMatch = compareStringObject(obj.getBrowserInformation().getName(), null, null, attr.getValueString()); diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java b/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java index 13aaf200dc..59472416cc 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportGenerator.java @@ -1506,7 +1506,7 @@ class ReportGenerator { } for (BlackboardAttribute tempatt : attList) { String value = ""; - Integer type = tempatt.getAttributeTypeID(); + Integer type = tempatt.getAttributeType().getTypeID(); if (type.equals(ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID()) || type.equals(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID()) || type.equals(ATTRIBUTE_TYPE.TSK_DATETIME_CREATED.getTypeID()) diff --git a/Core/src/org/sleuthkit/autopsy/report/ReportKML.java b/Core/src/org/sleuthkit/autopsy/report/ReportKML.java index 117263bcd0..abdd7dee96 100644 --- a/Core/src/org/sleuthkit/autopsy/report/ReportKML.java +++ b/Core/src/org/sleuthkit/autopsy/report/ReportKML.java @@ -113,12 +113,12 @@ class ReportKML implements GeneralReportModule { geoPath = ""; String extractedToPath; for (BlackboardAttribute attribute : artifact.getAttributes()) { - if (attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE.getTypeID()) //latitude + if (attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE.getTypeID()) //latitude { lat = attribute.getValueDouble(); } - if (attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE.getTypeID()) //longitude + if (attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE.getTypeID()) //longitude { lon = attribute.getValueDouble(); } @@ -150,11 +150,11 @@ class ReportKML implements GeneralReportModule { lat = 0; lon = 0; for (BlackboardAttribute attribute : artifact.getAttributes()) { - if (attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE.getTypeID()) //latitude + if (attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE.getTypeID()) //latitude { lat = attribute.getValueDouble(); } - if (attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE.getTypeID()) //longitude + if (attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE.getTypeID()) //longitude { lon = attribute.getValueDouble(); } @@ -172,22 +172,22 @@ class ReportKML implements GeneralReportModule { String name = ""; String location = ""; for (BlackboardAttribute attribute : artifact.getAttributes()) { - if (attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START.getTypeID()) //latitude + if (attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START.getTypeID()) //latitude { lat = attribute.getValueDouble(); - } else if (attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END.getTypeID()) //longitude + } else if (attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END.getTypeID()) //longitude { destlat = attribute.getValueDouble(); - } else if (attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START.getTypeID()) //longitude + } else if (attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START.getTypeID()) //longitude { lon = attribute.getValueDouble(); - } else if (attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END.getTypeID()) //longitude + } else if (attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END.getTypeID()) //longitude { destlon = attribute.getValueDouble(); - } else if (attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME.getTypeID()) //longitude + } else if (attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME.getTypeID()) //longitude { name = attribute.getValueString(); - } else if (attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION.getTypeID()) //longitude + } else if (attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION.getTypeID()) //longitude { location = attribute.getValueString(); } diff --git a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java index d0029d305e..505855ac4c 100644 --- a/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java +++ b/Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java @@ -159,8 +159,7 @@ public interface ArtifactEventType extends EventType { List attributes = artf.getAttributes(); Map attrMap = new HashMap<>(); for (BlackboardAttribute attr : attributes) { - attrMap.put(BlackboardAttribute.ATTRIBUTE_TYPE.fromLabel(attr. - getAttributeTypeName()), attr); + attrMap.put(BlackboardAttribute.ATTRIBUTE_TYPE.fromLabel(attr.getAttributeType().getTypeName()), attr); } if (attrMap.get(type.getDateTimeAttrubuteType()) == null) { diff --git a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java index e02e752930..678069db9d 100644 --- a/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java +++ b/ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java @@ -189,8 +189,8 @@ public abstract class DrawableFile { for (BlackboardArtifact artf : artifacts) { if (artf.getArtifactTypeID() == artType.getTypeID()) { for (BlackboardAttribute attr : artf.getAttributes()) { - if (attr.getAttributeTypeID() == attrType.getTypeID()) { - switch (attr.getValueType()) { + if (attr.getAttributeType().getTypeID() == attrType.getTypeID()) { + switch (attr.getAttributeType().getValueType()) { case BYTE: return attr.getValueBytes(); case DOUBLE: diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordCachedArtifact.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordCachedArtifact.java index 93a83a25b2..68f85dd29a 100644 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordCachedArtifact.java +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordCachedArtifact.java @@ -52,12 +52,12 @@ class KeywordCachedArtifact { } void add(BlackboardAttribute attribute) { - attributes.put(attribute.getAttributeTypeID(), attribute); + attributes.put(attribute.getAttributeType().getTypeID(), attribute); } void add(Collection attributes) { for (BlackboardAttribute attr : attributes) { - this.attributes.put(attr.getAttributeTypeID(), attr); + this.attributes.put(attr.getAttributeType().getTypeID(), attr); } } } diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/SolrSearchService.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/SolrSearchService.java index e86ef70c52..d38d38b10b 100644 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/SolrSearchService.java +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/SolrSearchService.java @@ -94,7 +94,7 @@ public class SolrSearchService implements KeywordSearchService { StringBuilder artifactContents = new StringBuilder(); for (BlackboardAttribute attribute : artifact.getAttributes()) { - artifactContents.append(attribute.getAttributeTypeDisplayName()); + artifactContents.append(attribute.getAttributeType().getDisplayName()); artifactContents.append(" : "); // This is ugly since it will need to updated any time a new @@ -109,14 +109,14 @@ public class SolrSearchService implements KeywordSearchService { // the fact that BlackboardAttribute exists in Sleuthkit data model // while the utility to determine the timezone to use is in ContentUtils // in the Autopsy datamodel. - if (attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID() - || attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID() - || attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED.getTypeID() - || attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_MODIFIED.getTypeID() - || attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_RCVD.getTypeID() - || attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT.getTypeID() - || attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START.getTypeID() - || attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_END.getTypeID()) { + if (attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID() + || attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID() + || attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED.getTypeID() + || attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_MODIFIED.getTypeID() + || attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_RCVD.getTypeID() + || attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT.getTypeID() + || attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START.getTypeID() + || attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_END.getTypeID()) { artifactContents.append(ContentUtils.getStringTime(attribute.getValueLong(), dataSource)); } else { diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/SearchEngineURLQueryAnalyzer.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/SearchEngineURLQueryAnalyzer.java index def7610d11..fdd1a018cd 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/SearchEngineURLQueryAnalyzer.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/SearchEngineURLQueryAnalyzer.java @@ -309,7 +309,7 @@ class SearchEngineURLQueryAnalyzer extends Extract { Collection listAttributes = currentCase.getSleuthkitCase().getMatchingAttributes("WHERE artifact_id = " + artifact.getArtifactID()); //NON-NLS for (BlackboardAttribute attribute : listAttributes) { - if (attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL.getTypeID()) { + if (attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL.getTypeID()) { final String urlString = attribute.getValueString(); se = getSearchEngineFromUrl(urlString); if (se == null) { @@ -322,11 +322,11 @@ class SearchEngineURLQueryAnalyzer extends Extract { break; } - } else if (attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID()) { + } else if (attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME.getTypeID()) { browser = attribute.getValueString(); - } else if (attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN.getTypeID()) { + } else if (attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN.getTypeID()) { searchEngineDomain = attribute.getValueString(); - } else if (attribute.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID()) { + } else if (attribute.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID()) { last_accessed = attribute.getValueLong(); } }