mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-15 09:17:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

make sure to add all attributes for an artifact from XML, not just one

Browse Source
This commit is contained in:
Samuel H. Kenyon 2014-04-30 16:34:10 -04:00
parent 4bfc6ad8af
commit 9dcd37a008
3 changed files with 38 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsIngestModule.java
View File

@ -78,7 +78,7 @@ public class ExternalResultsIngestModule extends IngestModuleAdapter implements
}
///@todo use a standard name or search for an XML file
importFilePath = importPath + File.separator + "ext-test6.xml";
importFilePath = importPath + File.separator + "ext-test5multi.xml";
}
}

52
Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsUtility.java
View File

@ -23,6 +23,7 @@ package org.sleuthkit.autopsy.modules.externalresults;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.Set;
import java.util.logging.Level;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.coreutils.Logger;
@ -63,7 +64,6 @@ public class ExternalResultsUtility {
Collection<BlackboardAttribute> bbAttributes = new ArrayList<>();
for (ResultsData.AttributeData attr : art.attributes) {
BlackboardAttribute bbAttr = null;
int bbAttrTypeId;
BlackboardAttribute.ATTRIBUTE_TYPE stdAttrType = isStandardAttributeType(attr.typeStr);
if (stdAttrType != null) {
@ -73,28 +73,34 @@ public class ExternalResultsUtility {
bbAttrTypeId = Case.getCurrentCase().getSleuthkitCase().addAttrType(attr.typeStr, attr.typeStr);
}
switch (attr.valueType) {
case "text": //NON-NLS
bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, attr.valueStr);
break;
case "int32": //NON-NLS
int intValue = Integer.parseInt(attr.valueStr);
bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, intValue);
break;
case "int64": //NON-NLS
long longValue = Long.parseLong(attr.valueStr);
bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, longValue);
break;
case "double": //NON-NLS
double doubleValue = Double.parseDouble(attr.valueStr);
bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, doubleValue);
break;
default:
logger.log(Level.WARNING, "Ignoring invalid attribute value type " + attr.valueType);
break;
}
if (bbAttr != null) {
bbAttributes.add(bbAttr);
// Add all attribute values
Set<String> valueTypes = attr.valueStr.keySet();
for (String valueType : valueTypes) {
String valueString = attr.valueStr.get(valueType);
BlackboardAttribute bbAttr = null;
switch (valueType) {
case "text": //NON-NLS
bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, valueString);
break;
case "int32": //NON-NLS
int intValue = Integer.parseInt(valueString);
bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, intValue);
break;
case "int64": //NON-NLS
long longValue = Long.parseLong(valueString);
bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, longValue);
break;
case "double": //NON-NLS
double doubleValue = Double.parseDouble(valueString);
bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, doubleValue);
break;
default:
logger.log(Level.WARNING, "Ignoring invalid attribute value type " + valueType);
break;
}
if (bbAttr != null) {
bbAttributes.add(bbAttr);
}
}
}

15
Core/src/org/sleuthkit/autopsy/modules/externalresults/ResultsData.java
View File

@ -21,6 +21,7 @@
package org.sleuthkit.autopsy.modules.externalresults;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
/**
@ -69,11 +70,11 @@ public class ResultsData {
public void addAttributeValue(int artIndex, int attrIndex, String valueStr, String valueType) {
ArtifactData art = artifacts.get(artIndex);
AttributeData attr = art.attributes.get(attrIndex);
attr.valueStr = valueStr;
if (!valueType.isEmpty()) {
attr.valueType = valueType;
AttributeData attr = art.attributes.get(attrIndex);
if (valueType.isEmpty()) {
valueType = AttributeData.DEFAULT_VALUE_TYPE;
}
attr.valueStr.put(valueType, valueStr);
}
public void addAttributeSource(int artIndex, int attrIndex, String source) {
@ -119,9 +120,9 @@ public class ResultsData {
}
public static class AttributeData {
public String typeStr;
public String valueType = "text"; //default if not specified
public String valueStr; //valueType determines how to interpret it
public static final String DEFAULT_VALUE_TYPE = "text";
public String typeStr;
public HashMap<String, String> valueStr = new HashMap<>(); //valueType determines how to interpret valueStr
public String source;
public String context;
}