diff --git a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesIdentifierIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesIdentifierIngestModule.java index 88eea65dda..0e0160b9b9 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesIdentifierIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesIdentifierIngestModule.java @@ -106,12 +106,15 @@ final class FilesIdentifierIngestModule implements FileIngestModule { @Override @Messages({"FilesIdentifierIngestModule.indexError.message=Failed to index interesting file hit artifact for keyword search."}) public ProcessResult process(AbstractFile file) { + Case currentCase; try { - blackboard = Case.getCurrentCaseThrows().getServices().getBlackboard(); + currentCase = Case.getCurrentCaseThrows(); } catch (NoCurrentCaseException ex) { logger.log(Level.SEVERE, "Exception while getting open case.", ex); //NON-NLS return ProcessResult.ERROR; } + blackboard = currentCase.getServices().getBlackboard(); + // Skip slack space files. if (file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK)) { return ProcessResult.OK; @@ -126,7 +129,7 @@ final class FilesIdentifierIngestModule implements FileIngestModule { // Post an interesting files set hit artifact to the // blackboard. String moduleName = InterestingItemsIngestModuleFactory.getModuleName(); - BlackboardArtifact artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT); + Collection attributes = new ArrayList<>(); // Add a set name attribute to the artifact. This adds a @@ -141,29 +144,34 @@ final class FilesIdentifierIngestModule implements FileIngestModule { // interesting files set membership rule that was satisfied. BlackboardAttribute ruleNameAttribute = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY, moduleName, ruleSatisfied); attributes.add(ruleNameAttribute); + + org.sleuthkit.datamodel.Blackboard tskBlackboard = currentCase.getSleuthkitCase().getBlackboard(); + // Create artifact if it doesn't already exist. + if (!tskBlackboard.artifactExists(file, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, attributes)) { + BlackboardArtifact artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT); + artifact.addAttributes(attributes); + + try { + // index the artifact for keyword search + blackboard.indexArtifact(artifact); + } catch (Blackboard.BlackboardException ex) { + logger.log(Level.SEVERE, "Unable to index blackboard artifact " + artifact.getArtifactID(), ex); //NON-NLS + MessageNotifyUtil.Notify.error(Bundle.FilesIdentifierIngestModule_indexError_message(), artifact.getDisplayName()); + } - artifact.addAttributes(attributes); - try { - // index the artifact for keyword search - blackboard.indexArtifact(artifact); - } catch (Blackboard.BlackboardException ex) { - logger.log(Level.SEVERE, "Unable to index blackboard artifact " + artifact.getArtifactID(), ex); //NON-NLS - MessageNotifyUtil.Notify.error(Bundle.FilesIdentifierIngestModule_indexError_message(), artifact.getDisplayName()); + services.fireModuleDataEvent(new ModuleDataEvent(moduleName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, Collections.singletonList(artifact))); + + // make an ingest inbox message + StringBuilder detailsSb = new StringBuilder(); + detailsSb.append("File: " + file.getParentPath() + file.getName() + "
\n"); + detailsSb.append("Rule Set: " + filesSet.getName()); + + services.postMessage(IngestMessage.createDataMessage(InterestingItemsIngestModuleFactory.getModuleName(), + "Interesting File Match: " + filesSet.getName() + "(" + file.getName() +")", + detailsSb.toString(), + file.getName(), + artifact)); } - - services.fireModuleDataEvent(new ModuleDataEvent(moduleName, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, Collections.singletonList(artifact))); - - // make an ingest inbox message - StringBuilder detailsSb = new StringBuilder(); - detailsSb.append("File: " + file.getParentPath() + file.getName() + "
\n"); - detailsSb.append("Rule Set: " + filesSet.getName()); - - services.postMessage(IngestMessage.createDataMessage(InterestingItemsIngestModuleFactory.getModuleName(), - "Interesting File Match: " + filesSet.getName() + "(" + file.getName() +")", - detailsSb.toString(), - file.getName(), - artifact)); - } catch (TskCoreException ex) { FilesIdentifierIngestModule.logger.log(Level.SEVERE, "Error posting to the blackboard", ex); //NOI18N NON-NLS }