mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-15 09:17:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Content viewer displays the "associated artifact", in case the selected node has an artifact with ASSOCAITED_ARTIFACT attribute.

Browse Source
This commit is contained in:
raman-bt 2013-12-13 15:48:55 -05:00
parent eae37fdc76
commit be83a65e2e
2 changed files with 27 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
Core/src/org/sleuthkit/autopsy/corecomponents/DataContentViewerArtifact.java
View File

@ -34,12 +34,16 @@ import javax.swing.SwingWorker;
import org.openide.nodes.Node; import org.openide.nodes.Node;
import org.openide.util.Lookup; import org.openide.util.Lookup;
import org.openide.util.lookup.ServiceProvider; import org.openide.util.lookup.ServiceProvider;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.contentviewers.Utilities; import org.sleuthkit.autopsy.contentviewers.Utilities;
import org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer; import org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer;
import org.sleuthkit.autopsy.datamodel.ArtifactStringContent; import org.sleuthkit.autopsy.datamodel.ArtifactStringContent;
import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.Content; import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.TskException; import org.sleuthkit.datamodel.TskException;
import org.sleuthkit.datamodel.TskCoreException;
/** /**
* Instances of this class display the BlackboardArtifacts associated with the Content represented by a Node. * Instances of this class display the BlackboardArtifacts associated with the Content represented by a Node.
@ -471,7 +475,27 @@ public class DataContentViewerArtifact extends javax.swing.JPanel implements Dat
index = artifacts.indexOf(artifact); index = artifacts.indexOf(artifact);
if (index == -1) { if (index == -1) {
index = 0; index = 0;
} else {
SleuthkitCase skCase = Case.getCurrentCase().getSleuthkitCase();
// if the artifact has an ASSOCIATED ARTIFACT, then we display the associated artifact instead
try {
for (BlackboardAttribute attr : artifact.getAttributes()) {
if (attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID()) {
long assocArtifactId = attr.getValueLong();
BlackboardArtifact assocArtifact = skCase.getBlackboardArtifact(assocArtifactId);
int assocArtifactIndex = artifacts.indexOf(assocArtifact);
if (assocArtifactIndex >= 0) {
index = assocArtifactIndex;
} }
break;
}
}
}
catch (TskCoreException ex) {
logger.log(Level.WARNING, "Couldn't get associated artifact to display in Content Viewer.", ex);
}
}
} }
if (isCancelled()) { if (isCancelled()) {

3
Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java
View File

@ -203,7 +203,8 @@ public class BlackboardArtifactNode extends DisplayableItemNode {
final int attributeTypeID = attribute.getAttributeTypeID(); final int attributeTypeID = attribute.getAttributeTypeID();
//skip some internal attributes that user shouldn't see //skip some internal attributes that user shouldn't see
if (attributeTypeID == ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID() if (attributeTypeID == ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID()
|| attributeTypeID == ATTRIBUTE_TYPE.TSK_TAGGED_ARTIFACT.getTypeID()) { || attributeTypeID == ATTRIBUTE_TYPE.TSK_TAGGED_ARTIFACT.getTypeID()
|| attributeTypeID == ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID()) {
continue; continue;
} else { } else {
switch (attribute.getValueType()) { switch (attribute.getValueType()) {