mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

In progress

Browse Source
This commit is contained in:
apriestman 2020-11-25 07:50:07 -05:00
parent ad6cd963da
commit 5cb410662b
1 changed files with 46 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
Core/src/org/sleuthkit/autopsy/report/modules/portablecase/PortableCaseReportModule.java
View File

@ -41,6 +41,8 @@ import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
@ -81,6 +83,9 @@ import org.sleuthkit.datamodel.TskDataException;
import org.sleuthkit.datamodel.TskData;
import org.sleuthkit.datamodel.Volume;
import org.sleuthkit.datamodel.VolumeSystem;
import org.sleuthkit.datamodel.blackboardutils.CommunicationArtifactsHelper;
import org.sleuthkit.datamodel.blackboardutils.attributes.BlackboardJsonAttrUtil;
import org.sleuthkit.datamodel.blackboardutils.attributes.MessageAttachments;
/**
* Creates a portable case from tagged files
@ -884,6 +889,9 @@ public class PortableCaseReportModule implements ReportModule {
// Copy the artifact
BlackboardArtifact newArtifact = copyArtifact(newContentId, tag.getArtifact());
// Copy any attachments
copyAttachments(newArtifact);
// Tag the artfiact
if (!oldTagNameToNewTagName.containsKey(tag.getName())) {
throw new TskCoreException("TagName map is missing entry for ID " + tag.getName().getId() + " with display name " + tag.getName().getDisplayName()); // NON-NLS
@ -933,6 +941,11 @@ public class PortableCaseReportModule implements ReportModule {
continue;
}
// Attachments will be re-added later
if (oldAttr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ATTACHMENTS.getTypeID()) {
continue;
}
BlackboardAttribute.Type newAttributeType = getNewAttributeType(oldAttr);
switch (oldAttr.getValueType()) {
case BYTE:
@ -1143,6 +1156,39 @@ public class PortableCaseReportModule implements ReportModule {
return oldIdToNewContent.get(content.getId()).getId();
}
private void copyAttachments(BlackboardArtifact artifact) throws TskCoreException {
// Get the attachments from TSK_ATTACHMENTS attribute.
BlackboardAttribute attachmentsAttr = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ATTACHMENTS));
if (attachmentsAttr != null) {
try {
MessageAttachments msgAttachments = BlackboardJsonAttrUtil.fromAttribute(attachmentsAttr, MessageAttachments.class);
Collection<MessageAttachments.FileAttachment> fileAttachments = msgAttachments.getFileAttachments();
List<MessageAttachments.FileAttachment> newFileAttachments = new ArrayList<>();
for (MessageAttachments.FileAttachment fileAttachment : fileAttachments) {
long attachedFileObjId = fileAttachment.getObjectId();
if (attachedFileObjId >= 0) {
// Copy the file
AbstractFile attachedFile = artifact.getSleuthkitCase().getAbstractFileById(attachedFileObjId);
long newFileID = copyContent(attachedFile);
newFileAttachments.add(new MessageAttachments.FileAttachment(portableSkCase.getAbstractFileById(newFileID)));
}
}
//MessageAttachments newMsgAttachments = BlackboardJsonAttrUtil.toAttribute(attrType, caseName, artifact)
}
catch (BlackboardJsonAttrUtil.InvalidJsonException ex) {
throw new TskCoreException(String.format("Unable to parse json for MessageAttachments object in artifact: %s", artifact.getName()), ex);
}
} else { // backward compatibility - email message attachments are derived files, children of the message.
for (Content childContent : artifact.getChildren()) {
if (childContent instanceof AbstractFile) {
copyContent(childContent);
}
}
}
}
/**
* Return the subfolder name for this file based on MIME type
*