mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-14 17:06:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Resolved merge conficts

Browse Source
This commit is contained in:
Oliver Spohngellert 2016-03-02 08:58:37 -05:00
commit 51e301c225
6 changed files with 230 additions and 221 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

110
Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/ArtifactEventType.java
View File

@ -1,7 +1,7 @@
/* /*
* Autopsy Forensic Browser * Autopsy Forensic Browser
* *
* Copyright 2014 Basis Technology Corp. * Copyright 2014-16 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org * Contact: carrier <at> sleuthkit <dot> org
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
@ -18,10 +18,9 @@
*/ */
package org.sleuthkit.autopsy.timeline.datamodel.eventtype; package org.sleuthkit.autopsy.timeline.datamodel.eventtype;
import java.util.HashMap; import java.text.MessageFormat;
import java.util.List; import java.util.Optional;
import java.util.Map; import java.util.function.Function;
import java.util.function.BiFunction;
import java.util.logging.Level; import java.util.logging.Level;
import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.StringUtils;
import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.Logger;
@ -34,56 +33,56 @@ import org.sleuthkit.datamodel.TskCoreException;
*/ */
public interface ArtifactEventType extends EventType { public interface ArtifactEventType extends EventType {
public static final Logger LOGGER = Logger.getLogger(ArtifactEventType.class.getName());
static final EmptyExtractor EMPTY_EXTRACTOR = new EmptyExtractor();
/** /**
* @return the Artifact type this event type is derived form, or null if * @return the Artifact type this event type is derived from
* there is no artifact type (eg file system events)
*/ */
public BlackboardArtifact.ARTIFACT_TYPE getArtifactType(); public BlackboardArtifact.Type getArtifactType();
public BlackboardAttribute.ATTRIBUTE_TYPE getDateTimeAttrubuteType(); public BlackboardAttribute.Type getDateTimeAttrubuteType();
/** /**
* given an artifact, and a map from attribute types to attributes, pull out * given an artifact, pull out the time stamp, and compose the descriptions.
* the time stamp, and compose the descriptions. Each implementation of * Each implementation of {@link ArtifactEventType} needs to implement
* {@link ArtifactEventType} needs to implement parseAttributesHelper() as * parseAttributesHelper() as hook for {@link buildEventDescription(org.sleuthkit.datamodel.BlackboardArtifact)
* hook for {@link buildEventDescription(org.sleuthkit.datamodel.BlackboardArtifact)
* to invoke. Most subtypes can use this default implementation. * to invoke. Most subtypes can use this default implementation.
* *
* @param artf * @param artf
* @param attrMap
* *
* @return an {@link AttributeEventDescription} containing the timestamp * @return an {@link AttributeEventDescription} containing the timestamp
* and description information * and description information
* *
* @throws TskCoreException * @throws TskCoreException
*/ */
default AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attrMap) throws TskCoreException { default AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf) throws TskCoreException {
final BlackboardAttribute dateTimeAttr = attrMap.get(getDateTimeAttrubuteType()); final BlackboardAttribute dateTimeAttr = artf.getAttribute(getDateTimeAttrubuteType());
long time = dateTimeAttr.getValueLong(); long time = dateTimeAttr.getValueLong();
String shortDescription = getShortExtractor().apply(artf, attrMap); String shortDescription = getShortExtractor().apply(artf);
String medDescription = shortDescription + " : " + getMedExtractor().apply(artf, attrMap); String medDescription = shortDescription + " : " + getMedExtractor().apply(artf);
String fullDescription = medDescription + " : " + getFullExtractor().apply(artf, attrMap); String fullDescription = medDescription + " : " + getFullExtractor().apply(artf);
return new AttributeEventDescription(time, shortDescription, medDescription, fullDescription); return new AttributeEventDescription(time, shortDescription, medDescription, fullDescription);
} }
/** /**
* @return a function from an artifact and a map of its attributes, to a * @return a function from an artifact to a String to use as part of the
* String to use as part of the full event description * full event description
*/ */
BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> getFullExtractor(); Function<BlackboardArtifact, String> getFullExtractor();
/** /**
* @return a function from an artifact and a map of its attributes, to a * @return a function from an artifact to a String to use as part of the
* String to use as part of the medium event description * medium event description
*/ */
BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> getMedExtractor(); Function<BlackboardArtifact, String> getMedExtractor();
/** /**
* @return a function from an artifact and a map of its attributes, to a * @return a function from an artifact to a String to use as part of the
* String to use as part of the short event description * short event description
*/ */
BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> getShortExtractor(); Function<BlackboardArtifact, String> getShortExtractor();
/** /**
* bundles the per event information derived from a BlackBoard Artifact into * bundles the per event information derived from a BlackBoard Artifact into
@ -124,14 +123,13 @@ public interface ArtifactEventType extends EventType {
this.medDescription = medDescription; this.medDescription = medDescription;
this.fullDescription = fullDescription; this.fullDescription = fullDescription;
} }
} }
/** /**
* Build a {@link AttributeEventDescription} derived from a * Build a {@link AttributeEventDescription} derived from a
* {@link BlackboardArtifact}. This is a template method that relies on each * {@link BlackboardArtifact}. This is a template method that relies on each
* {@link SubType}'s implementation of * {@link ArtifactEventType}'s implementation of
* {@link SubType#parseAttributesHelper()} to know how to go from * {@link ArtifactEventType#parseAttributesHelper()} to know how to go from
* {@link BlackboardAttribute}s to the event description. * {@link BlackboardAttribute}s to the event description.
* *
* @param artf the {@link BlackboardArtifact} to derive the event * @param artf the {@link BlackboardArtifact} to derive the event
@ -149,47 +147,45 @@ public interface ArtifactEventType extends EventType {
if (type.getArtifactType().getTypeID() != artf.getArtifactTypeID()) { if (type.getArtifactType().getTypeID() != artf.getArtifactTypeID()) {
throw new IllegalArgumentException(); throw new IllegalArgumentException();
} }
if (artf.getAttribute(type.getDateTimeAttrubuteType()) == null) {
/* LOGGER.log(Level.WARNING, "Artifact {0} has no date/time attribute, skipping it.", artf.getArtifactID()); // NON-NLS
* build a map from attribute type to attribute, this makes implementing
* the parseAttributeHelper easier but could be ineffecient if we don't
* need most of the attributes. This would be unnessecary if there was
* an api on Blackboard artifacts to get specific attributes by type
*/
List<BlackboardAttribute> attributes = artf.getAttributes();
Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attrMap = new HashMap<>();
for (BlackboardAttribute attr : attributes) {
attrMap.put(BlackboardAttribute.ATTRIBUTE_TYPE.fromLabel(attr.getAttributeType().getTypeName()), attr);
}
if (attrMap.get(type.getDateTimeAttrubuteType()) == null) {
Logger.getLogger(AttributeEventDescription.class.getName()).log(Level.WARNING, "Artifact {0} has no date/time attribute, skipping it.", artf.getArtifactID()); // NON-NLS
return null; return null;
} }
//use the hook provided by this subtype implementation //use the hook provided by this subtype implementation
return type.parseAttributesHelper(artf, attrMap); return type.parseAttributesHelper(artf);
} }
public static class AttributeExtractor implements BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> { static class AttributeExtractor implements Function<BlackboardArtifact, String> {
@Override public String apply(BlackboardArtifact artf) {
public String apply(BlackboardArtifact artf, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attrMap) { return Optional.ofNullable(getAttributeSafe(artf, attributeType))
final BlackboardAttribute attr = attrMap.get(attribute); .map(BlackboardAttribute::getDisplayString)
return (attr != null) ? StringUtils.defaultString(attr.getDisplayString()) : " "; .map(StringUtils::defaultString)
.orElse("");
} }
private final BlackboardAttribute.ATTRIBUTE_TYPE attribute; private final BlackboardAttribute.Type attributeType;
public AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE attribute) { public AttributeExtractor(BlackboardAttribute.Type attribute) {
this.attribute = attribute; this.attributeType = attribute;
} }
} }
public static class EmptyExtractor implements BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> { static class EmptyExtractor implements Function<BlackboardArtifact, String> {
@Override @Override
public String apply(BlackboardArtifact t, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> u) { public String apply(BlackboardArtifact t) {
return ""; return "";
} }
} }
static BlackboardAttribute getAttributeSafe(BlackboardArtifact artf, BlackboardAttribute.Type attrType) {
try {
return artf.getAttribute(attrType);
} catch (TskCoreException ex) {
LOGGER.log(Level.SEVERE, MessageFormat.format("Error getting extracting attribute from artifact {0}.", artf.getArtifactID()), ex); // NON-NLS
return null;
}
}
} }

202
Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/MiscTypes.java
View File

@ -1,7 +1,7 @@
/* /*
* Autopsy Forensic Browser * Autopsy Forensic Browser
* *
* Copyright 2014 Basis Technology Corp. * Copyright 2014-16 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org * Contact: carrier <at> sleuthkit <dot> org
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
@ -21,17 +21,19 @@ package org.sleuthkit.autopsy.timeline.datamodel.eventtype;
import java.util.Arrays; import java.util.Arrays;
import java.util.Collections; import java.util.Collections;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Optional;
import java.util.function.BiFunction; import java.util.function.Function;
import java.util.logging.Level; import java.util.logging.Level;
import javafx.scene.image.Image; import javafx.scene.image.Image;
import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.StringUtils;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.coreutils.Logger; import static org.sleuthkit.autopsy.timeline.datamodel.eventtype.ArtifactEventType.getAttributeSafe;
import org.sleuthkit.autopsy.timeline.zooming.EventTypeZoomLevel; import org.sleuthkit.autopsy.timeline.zooming.EventTypeZoomLevel;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
import org.sleuthkit.datamodel.TskCoreException; import org.sleuthkit.datamodel.TskCoreException;
/** /**
@ -40,116 +42,113 @@ import org.sleuthkit.datamodel.TskCoreException;
public enum MiscTypes implements EventType, ArtifactEventType { public enum MiscTypes implements EventType, ArtifactEventType {
MESSAGE(NbBundle.getMessage(MiscTypes.class, "MiscTypes.message.name"), "message.png", // NON-NLS MESSAGE(NbBundle.getMessage(MiscTypes.class, "MiscTypes.message.name"), "message.png", // NON-NLS
BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE, TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_MESSAGE),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)),
(artf, attrMap) -> { artf -> {
final BlackboardAttribute dir = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION); final BlackboardAttribute dir = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DIRECTION));
final BlackboardAttribute readStatus = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_READ_STATUS); final BlackboardAttribute readStatus = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_READ_STATUS));
final BlackboardAttribute name = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME); final BlackboardAttribute name = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_NAME));
final BlackboardAttribute phoneNumber = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER); final BlackboardAttribute phoneNumber = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER));
final BlackboardAttribute subject = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT); final BlackboardAttribute subject = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SUBJECT));
List<String> asList = Arrays.asList(stringValueOf(dir), stringValueOf(readStatus), name != null || phoneNumber != null ? toFrom(dir) : "", stringValueOf(name != null ? name : phoneNumber), (subject == null ? "" : stringValueOf(subject))); List<String> asList = Arrays.asList(stringValueOf(dir), stringValueOf(readStatus), name != null || phoneNumber != null ? toFrom(dir) : "", stringValueOf(name != null ? name : phoneNumber), (subject == null ? "" : stringValueOf(subject)));
return StringUtils.join(asList, " "); return StringUtils.join(asList, " ");
}, },
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_TEXT))),
GPS_ROUTE(NbBundle.getMessage(MiscTypes.class, "MiscTypes.GPSRoutes.name"), "gps-search.png", // NON-NLS GPS_ROUTE(NbBundle.getMessage(MiscTypes.class, "MiscTypes.GPSRoutes.name"), "gps-search.png", // NON-NLS
BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_ROUTE, TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_GPS_ROUTE),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_LOCATION)),
(artf, attrMap) -> { artf -> {
final BlackboardAttribute latStart = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START); final BlackboardAttribute latStart = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START));
final BlackboardAttribute longStart = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START); final BlackboardAttribute longStart = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START));
final BlackboardAttribute latEnd = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END); final BlackboardAttribute latEnd = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END));
final BlackboardAttribute longEnd = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END); final BlackboardAttribute longEnd = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END));
return String.format("from %1$g %2$g to %3$g %4$g", latStart.getValueDouble(), longStart.getValueDouble(), latEnd.getValueDouble(), longEnd.getValueDouble()); // NON-NLS return String.format("from %1$s %2$s to %3$s %4$s", stringValueOf(latStart), stringValueOf(longStart), stringValueOf(latEnd), stringValueOf(longEnd)); // NON-NLS
}), }),
GPS_TRACKPOINT(NbBundle.getMessage(MiscTypes.class, "MiscTypes.GPSTrackpoint.name"), "gps-trackpoint.png", // NON-NLS GPS_TRACKPOINT(NbBundle.getMessage(MiscTypes.class, "MiscTypes.GPSTrackpoint.name"), "gps-trackpoint.png", // NON-NLS
BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT, TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_GPS_TRACKPOINT),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)),
(artf, attrMap) -> { artf -> {
final BlackboardAttribute longitude = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE); final BlackboardAttribute longitude = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE));
final BlackboardAttribute latitude = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE); final BlackboardAttribute latitude = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE));
return (latitude != null ? latitude.getValueDouble() : "") + " " + (longitude != null ? longitude.getValueDouble() : ""); // NON-NLS return stringValueOf(latitude) + " " + stringValueOf(longitude); // NON-NLS
}, },
(artf, attrMap) -> ""), EMPTY_EXTRACTOR),
CALL_LOG(NbBundle.getMessage(MiscTypes.class, "MiscTypes.Calls.name"), "calllog.png", // NON-NLS CALL_LOG(NbBundle.getMessage(MiscTypes.class, "MiscTypes.Calls.name"), "calllog.png", // NON-NLS
BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG, TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_CALLLOG),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_START),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_NAME)),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DIRECTION))),
EMAIL(NbBundle.getMessage(MiscTypes.class, "MiscTypes.Email.name"), "mail-icon-16.png", // NON-NLS EMAIL(NbBundle.getMessage(MiscTypes.class, "MiscTypes.Email.name"), "mail-icon-16.png", // NON-NLS
BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG, TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_EMAIL_MSG),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_SENT),
(artifact, attrMap) -> { artf -> {
final BlackboardAttribute emailFrom = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM); final BlackboardAttribute emailFrom = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_FROM));
final BlackboardAttribute emailTo = attrMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO); final BlackboardAttribute emailTo = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_TO));
return (emailFrom != null ? emailFrom.getValueString() : "") + " to " + (emailTo != null ? emailTo.getValueString() : ""); // NON-NLS return stringValueOf(emailFrom) + " to " + stringValueOf(emailTo); // NON-NLS
}, },
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SUBJECT)),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_PLAIN)), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_PLAIN))),
RECENT_DOCUMENTS(NbBundle.getMessage(MiscTypes.class, "MiscTypes.recentDocuments.name"), "recent_docs.png", // NON-NLS RECENT_DOCUMENTS(NbBundle.getMessage(MiscTypes.class, "MiscTypes.recentDocuments.name"), "recent_docs.png", // NON-NLS
BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT, TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_RECENT_OBJECT),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH).andThen( new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH)).andThen(
(String t) -> (StringUtils.substringBeforeLast(StringUtils.substringBeforeLast(t, "\\"), "\\"))), (String t) -> (StringUtils.substringBeforeLast(StringUtils.substringBeforeLast(t, "\\"), "\\"))),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH).andThen( new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH)).andThen(
(String t) -> StringUtils.substringBeforeLast(t, "\\")), (String t) -> StringUtils.substringBeforeLast(t, "\\")),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)) { new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH))) {
/**
* Override
* {@link ArtifactEventType#parseAttributesHelper(org.sleuthkit.datamodel.BlackboardArtifact, java.util.Map)}
* with non-default description construction
*/
@Override @Override
public AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attrMap) throws TskCoreException { public AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf) throws TskCoreException {
final BlackboardAttribute dateTimeAttr = attrMap.get(getDateTimeAttrubuteType()); final BlackboardAttribute dateTimeAttr = artf.getAttribute(getDateTimeAttrubuteType());
long time = dateTimeAttr.getValueLong(); long time = dateTimeAttr.getValueLong();
//Non-default description construction //Non-default description construction
String shortDescription = getShortExtractor().apply(artf, attrMap); String shortDescription = getShortExtractor().apply(artf);
String medDescription = getMedExtractor().apply(artf, attrMap); String medDescription = getMedExtractor().apply(artf);
String fullDescription = getFullExtractor().apply(artf, attrMap); String fullDescription = getFullExtractor().apply(artf);
return new AttributeEventDescription(time, shortDescription, medDescription, fullDescription); return new AttributeEventDescription(time, shortDescription, medDescription, fullDescription);
} }
}, },
INSTALLED_PROGRAM(NbBundle.getMessage(MiscTypes.class, "MiscTypes.installedPrograms.name"), "programs.png", // NON-NLS INSTALLED_PROGRAM(NbBundle.getMessage(MiscTypes.class, "MiscTypes.installedPrograms.name"), "programs.png", // NON-NLS
BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG, TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_INSTALLED_PROG),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)),
new EmptyExtractor(), EMPTY_EXTRACTOR,
new EmptyExtractor()), EMPTY_EXTRACTOR),
EXIF(NbBundle.getMessage(MiscTypes.class, "MiscTypes.exif.name"), "camera-icon-16.png", // NON-NLS EXIF(NbBundle.getMessage(MiscTypes.class, "MiscTypes.exif.name"), "camera-icon-16.png", // NON-NLS
BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF, TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_METADATA_EXIF),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_CREATED),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)),
(artifact, attributeMap) -> { artf -> {
try { try {
AbstractFile file = artifact.getSleuthkitCase().getAbstractFileById(artifact.getObjectID()); AbstractFile file = artf.getSleuthkitCase().getAbstractFileById(artf.getObjectID());
if (file != null) { if (file != null) {
return file.getName(); return file.getName();
} }
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
Logger.getLogger(MiscTypes.class.getName()).log(Level.SEVERE, "Exif event type failed to look up backing file name", ex); //NON-NLS LOGGER.log(Level.SEVERE, "Exif event type failed to look up backing file name", ex); //NON-NLS
} }
return " error loading file name"; // NON-NLS return "error loading file name";
}), }),
DEVICES_ATTACHED(NbBundle.getMessage(MiscTypes.class, "MiscTypes.devicesAttached.name"), "usb_devices.png", // NON-NLS DEVICES_ATTACHED(NbBundle.getMessage(MiscTypes.class, "MiscTypes.devicesAttached.name"), "usb_devices.png", // NON-NLS
BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED, TypeUtils.fromEnum(ARTIFACT_TYPE.TSK_DEVICE_ATTACHED),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL), new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)); new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
static public String stringValueOf(BlackboardAttribute attr) { static public String stringValueOf(BlackboardAttribute attr) {
return attr != null ? attr.getDisplayString() : ""; return Optional.ofNullable(attr)
.map(BlackboardAttribute::getDisplayString)
.orElse("");
} }
public static String toFrom(BlackboardAttribute dir) { public static String toFrom(BlackboardAttribute dir) {
@ -167,7 +166,7 @@ public enum MiscTypes implements EventType, ArtifactEventType {
} }
} }
private final BlackboardAttribute.ATTRIBUTE_TYPE dateTimeAttributeType; private final BlackboardAttribute.Type dateTimeAttributeType;
private final String iconBase; private final String iconBase;
@ -178,47 +177,32 @@ public enum MiscTypes implements EventType, ArtifactEventType {
return image; return image;
} }
private final BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> longExtractor; private final Function<BlackboardArtifact, String> longExtractor;
private final BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> medExtractor; private final Function<BlackboardArtifact, String> medExtractor;
private final BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> shortExtractor; private final Function<BlackboardArtifact, String> shortExtractor;
/**
* {@inheritDoc }
*/
@Override @Override
public BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> getFullExtractor() { public Function<BlackboardArtifact, String> getFullExtractor() {
return longExtractor; return longExtractor;
} }
/**
* {@inheritDoc }
*/
@Override @Override
public BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> getMedExtractor() { public Function<BlackboardArtifact, String> getMedExtractor() {
return medExtractor; return medExtractor;
} }
/**
* {@inheritDoc }
*/
@Override @Override
public BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> getShortExtractor() { public Function<BlackboardArtifact, String> getShortExtractor() {
return shortExtractor; return shortExtractor;
} }
/**
* {@inheritDoc }
*/
@Override @Override
public BlackboardAttribute.ATTRIBUTE_TYPE getDateTimeAttrubuteType() { public BlackboardAttribute.Type getDateTimeAttrubuteType() {
return dateTimeAttributeType; return dateTimeAttributeType;
} }
/**
* {@inheritDoc }
*/
@Override @Override
public EventTypeZoomLevel getZoomLevel() { public EventTypeZoomLevel getZoomLevel() {
return EventTypeZoomLevel.SUB_TYPE; return EventTypeZoomLevel.SUB_TYPE;
@ -226,7 +210,7 @@ public enum MiscTypes implements EventType, ArtifactEventType {
private final String displayName; private final String displayName;
private final BlackboardArtifact.ARTIFACT_TYPE artifactType; private final BlackboardArtifact.Type artifactType;
@Override @Override
public String getDisplayName() { public String getDisplayName() {
@ -243,11 +227,11 @@ public enum MiscTypes implements EventType, ArtifactEventType {
return MiscTypes.valueOf(string); return MiscTypes.valueOf(string);
} }
private MiscTypes(String displayName, String iconBase, BlackboardArtifact.ARTIFACT_TYPE artifactType, private MiscTypes(String displayName, String iconBase, BlackboardArtifact.Type artifactType,
BlackboardAttribute.ATTRIBUTE_TYPE dateTimeAttributeType, BlackboardAttribute.Type dateTimeAttributeType,
BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> shortExtractor, Function<BlackboardArtifact, String> shortExtractor,
BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> medExtractor, Function<BlackboardArtifact, String> medExtractor,
BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> longExtractor) { Function<BlackboardArtifact, String> longExtractor) {
this.displayName = displayName; this.displayName = displayName;
this.iconBase = iconBase; this.iconBase = iconBase;
this.artifactType = artifactType; this.artifactType = artifactType;
@ -269,7 +253,7 @@ public enum MiscTypes implements EventType, ArtifactEventType {
} }
@Override @Override
public BlackboardArtifact.ARTIFACT_TYPE getArtifactType() { public BlackboardArtifact.Type getArtifactType() {
return artifactType; return artifactType;
} }

35
Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/TypeUtils.java Normal file
View File

@ -0,0 +1,35 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2016 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.timeline.datamodel.eventtype;
import org.sleuthkit.datamodel.BlackboardArtifact;
/**
*
*/
class TypeUtils {
//TODO: this will be unncessary once their is BlackboardArtifact.Type constructr that takes a BlackboardArtifact.ARTIFACT_TYPE
static BlackboardArtifact.Type fromEnum(BlackboardArtifact.ARTIFACT_TYPE type) {
return new BlackboardArtifact.Type(type.getTypeID(), type.getLabel(), type.getDisplayName());
}
private TypeUtils() {
}
}

98
Core/src/org/sleuthkit/autopsy/timeline/datamodel/eventtype/WebTypes.java
View File

@ -1,7 +1,7 @@
/* /*
* Autopsy Forensic Browser * Autopsy Forensic Browser
* *
* Copyright 2014 Basis Technology Corp. * Copyright 2014-16 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org * Contact: carrier <at> sleuthkit <dot> org
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
@ -21,14 +21,14 @@ package org.sleuthkit.autopsy.timeline.datamodel.eventtype;
import com.google.common.net.InternetDomainName; import com.google.common.net.InternetDomainName;
import java.util.Collections; import java.util.Collections;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.function.Function;
import java.util.function.BiFunction;
import javafx.scene.image.Image; import javafx.scene.image.Image;
import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.StringUtils;
import org.openide.util.NbBundle; import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.timeline.zooming.EventTypeZoomLevel; import org.sleuthkit.autopsy.timeline.zooming.EventTypeZoomLevel;
import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.TskCoreException;
/** /**
* *
@ -37,24 +37,19 @@ public enum WebTypes implements EventType, ArtifactEventType {
WEB_DOWNLOADS(NbBundle.getMessage(WebTypes.class, "WebTypes.webDownloads.name"), WEB_DOWNLOADS(NbBundle.getMessage(WebTypes.class, "WebTypes.webDownloads.name"),
"downloads.png", // NON-NLS "downloads.png", // NON-NLS
BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD, TypeUtils.fromEnum(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED, new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED),
TopPrivateDomainExtractor.getInstance(), TopPrivateDomainExtractor.getInstance(),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH), new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)) { new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL))) {
/**
* Override
* {@link ArtifactEventType#parseAttributesHelper(org.sleuthkit.datamodel.BlackboardArtifact, java.util.Map)}
* with non default description construction
*/
@Override @Override
public AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attrMap) { public AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf) throws TskCoreException {
long time = attrMap.get(getDateTimeAttrubuteType()).getValueLong(); long time = artf.getAttribute(getDateTimeAttrubuteType()).getValueLong();
String domain = getShortExtractor().apply(artf, attrMap); String domain = getShortExtractor().apply(artf);
String path = getMedExtractor().apply(artf, attrMap); String path = getMedExtractor().apply(artf);
String fileName = StringUtils.substringAfterLast(path, "/"); String fileName = StringUtils.substringAfterLast(path, "/");
String url = getFullExtractor().apply(artf, attrMap); String url = getFullExtractor().apply(artf);
//TODO: review non default description construction //TODO: review non default description construction
String shortDescription = fileName + " from " + domain; // NON-NLS String shortDescription = fileName + " from " + domain; // NON-NLS
@ -66,37 +61,37 @@ public enum WebTypes implements EventType, ArtifactEventType {
//TODO: review description separators //TODO: review description separators
WEB_COOKIE(NbBundle.getMessage(WebTypes.class, "WebTypes.webCookies.name"), WEB_COOKIE(NbBundle.getMessage(WebTypes.class, "WebTypes.webCookies.name"),
"cookies.png", // NON-NLS "cookies.png", // NON-NLS
BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE, TypeUtils.fromEnum(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME),
TopPrivateDomainExtractor.getInstance(), TopPrivateDomainExtractor.getInstance(),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME), new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE)), new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE))),
//TODO: review description separators //TODO: review description separators
WEB_BOOKMARK(NbBundle.getMessage(WebTypes.class, "WebTypes.webBookmarks.name"), WEB_BOOKMARK(NbBundle.getMessage(WebTypes.class, "WebTypes.webBookmarks.name"),
"bookmarks.png", // NON-NLS "bookmarks.png", // NON-NLS
BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK, TypeUtils.fromEnum(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED),
TopPrivateDomainExtractor.getInstance(), TopPrivateDomainExtractor.getInstance(),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL), new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)), new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE))),
//TODO: review description separators //TODO: review description separators
WEB_HISTORY(NbBundle.getMessage(WebTypes.class, "WebTypes.webHistory.name"), WEB_HISTORY(NbBundle.getMessage(WebTypes.class, "WebTypes.webHistory.name"),
"history.png", // NON-NLS "history.png", // NON-NLS
BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY, TypeUtils.fromEnum(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED, new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED),
TopPrivateDomainExtractor.getInstance(), TopPrivateDomainExtractor.getInstance(),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL), new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)), new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE))),
//TODO: review description separators //TODO: review description separators
WEB_SEARCH(NbBundle.getMessage(WebTypes.class, "WebTypes.webSearch.name"), WEB_SEARCH(NbBundle.getMessage(WebTypes.class, "WebTypes.webSearch.name"),
"searchquery.png", // NON-NLS "searchquery.png", // NON-NLS
BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY, TypeUtils.fromEnum(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED, new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT), new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)),
TopPrivateDomainExtractor.getInstance(), TopPrivateDomainExtractor.getInstance(),
new AttributeExtractor(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)); new AttributeExtractor(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
private final BlackboardAttribute.ATTRIBUTE_TYPE dateTimeAttributeType; private final BlackboardAttribute.Type dateTimeAttributeType;
private final String iconBase; private final String iconBase;
@ -108,7 +103,7 @@ public enum WebTypes implements EventType, ArtifactEventType {
} }
@Override @Override
public BlackboardAttribute.ATTRIBUTE_TYPE getDateTimeAttrubuteType() { public BlackboardAttribute.Type getDateTimeAttrubuteType() {
return dateTimeAttributeType; return dateTimeAttributeType;
} }
@ -117,30 +112,30 @@ public enum WebTypes implements EventType, ArtifactEventType {
return EventTypeZoomLevel.SUB_TYPE; return EventTypeZoomLevel.SUB_TYPE;
} }
private final BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> longExtractor; private final Function<BlackboardArtifact, String> longExtractor;
private final BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> medExtractor; private final Function<BlackboardArtifact, String> medExtractor;
private final BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> shortExtractor; private final Function<BlackboardArtifact, String> shortExtractor;
@Override @Override
public BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> getFullExtractor() { public Function<BlackboardArtifact, String> getFullExtractor() {
return longExtractor; return longExtractor;
} }
@Override @Override
public BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> getMedExtractor() { public Function<BlackboardArtifact, String> getMedExtractor() {
return medExtractor; return medExtractor;
} }
@Override @Override
public BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> getShortExtractor() { public Function<BlackboardArtifact, String> getShortExtractor() {
return shortExtractor; return shortExtractor;
} }
private final String displayName; private final String displayName;
BlackboardArtifact.ARTIFACT_TYPE artifactType; private final BlackboardArtifact.Type artifactType;
@Override @Override
public String getIconBase() { public String getIconBase() {
@ -148,15 +143,15 @@ public enum WebTypes implements EventType, ArtifactEventType {
} }
@Override @Override
public BlackboardArtifact.ARTIFACT_TYPE getArtifactType() { public BlackboardArtifact.Type getArtifactType() {
return artifactType; return artifactType;
} }
private WebTypes(String displayName, String iconBase, BlackboardArtifact.ARTIFACT_TYPE artifactType, private WebTypes(String displayName, String iconBase, BlackboardArtifact.Type artifactType,
BlackboardAttribute.ATTRIBUTE_TYPE dateTimeAttributeType, BlackboardAttribute.Type dateTimeAttributeType,
BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> shortExtractor, Function<BlackboardArtifact, String> shortExtractor,
BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> medExtractor, Function<BlackboardArtifact, String> medExtractor,
BiFunction<BlackboardArtifact, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>, String> longExtractor) { Function<BlackboardArtifact, String> longExtractor) {
this.displayName = displayName; this.displayName = displayName;
this.iconBase = iconBase; this.iconBase = iconBase;
this.artifactType = artifactType; this.artifactType = artifactType;
@ -196,8 +191,8 @@ public enum WebTypes implements EventType, ArtifactEventType {
} }
@Override @Override
public String apply(BlackboardArtifact artf, Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attrMap) { public String apply(BlackboardArtifact artf) {
String domainString = StringUtils.substringBefore(super.apply(artf, attrMap), "/"); String domainString = StringUtils.substringBefore(super.apply(artf), "/");
if (InternetDomainName.isValid(domainString)) { if (InternetDomainName.isValid(domainString)) {
InternetDomainName domain = InternetDomainName.from(domainString); InternetDomainName domain = InternetDomainName.from(domainString);
return (domain.isUnderPublicSuffix()) return (domain.isUnderPublicSuffix())
@ -209,8 +204,7 @@ public enum WebTypes implements EventType, ArtifactEventType {
} }
TopPrivateDomainExtractor() { TopPrivateDomainExtractor() {
super(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN); super(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN));
} }
} }
} }

2
Core/src/org/sleuthkit/autopsy/timeline/db/EventsRepository.java
View File

@ -655,7 +655,7 @@ public class EventsRepository {
private void populateEventType(final ArtifactEventType type, EventDB.EventTransaction trans) { private void populateEventType(final ArtifactEventType type, EventDB.EventTransaction trans) {
try { try {
//get all the blackboard artifacts corresponding to the given event sub_type //get all the blackboard artifacts corresponding to the given event sub_type
final ArrayList<BlackboardArtifact> blackboardArtifacts = skCase.getBlackboardArtifacts(type.getArtifactType()); final ArrayList<BlackboardArtifact> blackboardArtifacts = skCase.getBlackboardArtifacts(type.getArtifactType().getTypeID());
final int numArtifacts = blackboardArtifacts.size(); final int numArtifacts = blackboardArtifacts.size();
restartProgressHandle(Bundle.progressWindow_populatingXevents(type.getDisplayName()), "", 0D, numArtifacts, true); restartProgressHandle(Bundle.progressWindow_populatingXevents(type.getDisplayName()), "", 0D, numArtifacts, true);
for (int i = 0; i < numArtifacts; i++) { for (int i = 0; i < numArtifacts; i++) {

4
ImageGallery/src/org/sleuthkit/autopsy/imagegallery/datamodel/DrawableFile.java
View File

@ -189,8 +189,8 @@ public abstract class DrawableFile {
for (BlackboardArtifact artf : artifacts) { for (BlackboardArtifact artf : artifacts) {
if (artf.getArtifactTypeID() == artType.getTypeID()) { if (artf.getArtifactTypeID() == artType.getTypeID()) {
for (BlackboardAttribute attr : artf.getAttributes()) { for (BlackboardAttribute attr : artf.getAttributes()) {
if (attr.getAttributeTypeID() == attrType.getTypeID()) { if (attr.getAttributeType().getTypeID() == attrType.getTypeID()) {
switch (attr.getValueType()) { switch (attr.getAttributeType().getValueType()) {
case BYTE: case BYTE:
return attr.getValueBytes(); return attr.getValueBytes();
case DOUBLE: case DOUBLE: