mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-17 10:17:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1828 from BasisOlivers/aut-1862

Browse Source 
Added methods for adding new types via blackboard, tested with module
This commit is contained in:
Richard Cordovano 2016-01-21 09:50:52 -05:00
commit ad7c704b65
2 changed files with 58 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
Core/src/org/sleuthkit/autopsy/casemodule/services/Blackboard.java
View File

@ -22,9 +22,12 @@ import java.io.Closeable;
import java.io.IOException;
import org.openide.util.Lookup;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.keywordsearchservice.KeywordSearchService;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskDataException;
/**
* Provides utility methods for blackboard artifact indexing.
@ -44,7 +47,7 @@ public final class Blackboard implements Closeable {
if (null == searchService) {
throw new BlackboardException(NbBundle.getMessage(this.getClass(), "Blackboard.keywordSearchNotFound.exception.msg"));
}
try {
searchService.indexArtifact(artifact);
} catch (TskCoreException ex) {
@ -52,6 +55,42 @@ public final class Blackboard implements Closeable {
}
}
/**
* Adds a new artifact type based upon the parameters given
*
* @param typeName The name of the new artifact type
* @param displayName The name displayed for the new attribute type
* @return A type object representing the artifact type added
* @throws
* org.sleuthkit.autopsy.casemodule.services.Blackboard.BlackboardException
*/
public BlackboardArtifact.Type addArtifactType(String typeName, String displayName) throws BlackboardException {
try {
return Case.getCurrentCase().getSleuthkitCase().addBlackboardArtifactType(typeName, displayName);
} catch (TskCoreException ex) {
throw new BlackboardException("New artifact type could not be added", ex);
}
}
/**
* Adds a new attribute type based upon the parameters given
*
* @param attrTypeString The type name of the attribute type
* @param valueType The type of any attribute of this type's value
* @param displayName The name displayed for the new attribute type
* @throws
* org.sleuthkit.autopsy.casemodule.services.Blackboard.BlackboardException
*/
public BlackboardAttribute.Type addAttributeType(String attrTypeString, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName) throws BlackboardException {
try {
return Case.getCurrentCase().getSleuthkitCase().addArtifactAttributeType(attrTypeString, valueType, displayName);
} catch (TskDataException ex) {
throw new BlackboardException("New artifact type could not be added", ex);
} catch (TskCoreException ex) {
throw new BlackboardException("New artifact type could not be added", ex);
}
}
@Override
public void close() throws IOException {
}
@ -83,7 +122,7 @@ public final class Blackboard implements Closeable {
* Constructs a new exception with the specified message and cause.
*
* @param message The message.
* @param cause The cause.
* @param cause The cause.
*/
public BlackboardException(String message, Throwable cause) {
super(message, cause);

34
Core/src/org/sleuthkit/autopsy/modules/UserArtifacts/UserArtifactIngestModule.java
View File

@ -10,6 +10,7 @@ import java.util.List;
import org.openide.util.Exceptions;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.services.Blackboard.BlackboardException;
import org.sleuthkit.autopsy.casemodule.services.FileManager;
import org.sleuthkit.autopsy.ingest.DataSourceIngestModule;
import org.sleuthkit.autopsy.ingest.DataSourceIngestModuleProgress;
@ -35,7 +36,6 @@ public class UserArtifactIngestModule implements DataSourceIngestModule {
private IngestJobContext context = null;
private BlackboardArtifact.Type type1, type2;
int type1ID, type2ID;
@Override
public ProcessResult process(Content dataSource, DataSourceIngestModuleProgress progressBar) {
@ -47,21 +47,22 @@ public class UserArtifactIngestModule implements DataSourceIngestModule {
BlackboardArtifact art1;
BlackboardArtifact art2;
if (!file1.isEmpty()) {
art1 = file1.get(0).newArtifact(type1ID);
art1 = file1.get(0).newArtifact(type1.getTypeID());
} else {
art1 = dataSource.newArtifact(type1ID);
art1 = dataSource.newArtifact(type1.getTypeID());
}
if (!file2.isEmpty()) {
art2 = file2.get(0).newArtifact(type2ID);
art2 = file2.get(0).newArtifact(type2.getTypeID());
} else {
art2 = dataSource.newArtifact(type2ID);
art2 = dataSource.newArtifact(type2.getTypeID());
}
BlackboardAttribute.Type type = Case.getCurrentCase().getSleuthkitCase().addArtifactAttributeType("TEST1", TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER, "TEST2");
art1.addAttribute(new BlackboardAttribute(type,
UserArtifactIngestModuleFactory.getModuleName(), -1));
BlackboardAttribute.Type attributeType = Case.getCurrentCase().getServices().getBlackboard().addAttributeType("Test", TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG, "2");
BlackboardAttribute.Type attributeType2 = Case.getCurrentCase().getServices().getBlackboard().addAttributeType("Test2", TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE, "3");
art1.addAttribute(new BlackboardAttribute(attributeType,
UserArtifactIngestModuleFactory.getModuleName(), -1L));
progressBar.progress(1);
art2.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_MIN_COUNT,
UserArtifactIngestModuleFactory.getModuleName(), 4));
art2.addAttribute(new BlackboardAttribute(attributeType2,
UserArtifactIngestModuleFactory.getModuleName(), new byte[7]));
progressBar.progress(1);
IngestServices.getInstance().postMessage(IngestMessage.createDataMessage(
"name",
@ -72,6 +73,8 @@ public class UserArtifactIngestModule implements DataSourceIngestModule {
return ProcessResult.OK;
} catch (TskCoreException ex) {
return ProcessResult.ERROR;
} catch (BlackboardException ex) {
return ProcessResult.ERROR;
} catch (TskDataException ex) {
return ProcessResult.ERROR;
}
@ -80,14 +83,11 @@ public class UserArtifactIngestModule implements DataSourceIngestModule {
@Override
public void startUp(IngestJobContext context) throws IngestModuleException {
this.context = context;
type1 = new BlackboardArtifact.Type(39, "TSK_TEST1", "Test 1");
type2 = new BlackboardArtifact.Type(40, "TSK_TEST2", "Test 2");
try {
type1ID = Case.getCurrentCase().getSleuthkitCase().addArtifactType(type1.getTypeName(), type1.getDisplayName());
type2ID = Case.getCurrentCase().getSleuthkitCase().addArtifactType(type2.getTypeName(), type2.getDisplayName());
}
catch (TskCoreException ex) {
type1 = Case.getCurrentCase().getServices().getBlackboard().addArtifactType("This is", "a test");
type2 = Case.getCurrentCase().getServices().getBlackboard().addArtifactType("Another", "kinda test");
} catch (BlackboardException ex) {
Logger.logMsg(Logger.ERROR, "Startup failed");
}
}
}
}