mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

7953 base changes for interesting item change

Browse Source
This commit is contained in:
William Schaefer 2021-10-22 14:43:41 -04:00
parent 13829dc4dc
commit dd38063bc4
28 changed files with 226 additions and 151 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeUtil.java
View File

@ -142,7 +142,7 @@ public class CorrelationAttributeUtil {
if (CentralRepository.isEnabled()) { if (CentralRepository.isEnabled()) {
try { try {
int artifactTypeID = analysisResult.getArtifactTypeID(); int artifactTypeID = analysisResult.getArtifactTypeID();
if (artifactTypeID == ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) { if (ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() || artifactTypeID == ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID()) {
//because this attribute retrieval is only occuring when the analysis result is an interesting artifact hit //because this attribute retrieval is only occuring when the analysis result is an interesting artifact hit
//and only one attribute is being retrieved the analysis result's own get attribute method can be used efficently //and only one attribute is being retrieved the analysis result's own get attribute method can be used efficently
BlackboardAttribute assocArtifactAttr = analysisResult.getAttribute(BlackboardAttribute.Type.TSK_ASSOCIATED_ARTIFACT); BlackboardAttribute assocArtifactAttr = analysisResult.getAttribute(BlackboardAttribute.Type.TSK_ASSOCIATED_ARTIFACT);

23
Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationUtils.java
View File

@ -73,6 +73,7 @@ public class AnnotationUtils {
"AnnotationUtils.fileHitEntry.artifactCommentTitle=Artifact Comment", "AnnotationUtils.fileHitEntry.artifactCommentTitle=Artifact Comment",
"AnnotationUtils.fileHitEntry.hashSetHitTitle=Hash Set Hit Comments", "AnnotationUtils.fileHitEntry.hashSetHitTitle=Hash Set Hit Comments",
"AnnotationUtils.fileHitEntry.interestingFileHitTitle=Interesting File Hit Comments", "AnnotationUtils.fileHitEntry.interestingFileHitTitle=Interesting File Hit Comments",
"AnnotationUtils.fileHitEntry.interestingItemTitle=Interesting Item Comments",
"AnnotationUtils.fileHitEntry.setName=Set Name:", "AnnotationUtils.fileHitEntry.setName=Set Name:",
"AnnotationUtils.fileHitEntry.comment=Comment:", "AnnotationUtils.fileHitEntry.comment=Comment:",
"AnnotationUtils.sourceFile.title=Source File", "AnnotationUtils.sourceFile.title=Source File",
@ -94,8 +95,8 @@ public class AnnotationUtils {
private static final SectionConfig<Tag> TAG_CONFIG private static final SectionConfig<Tag> TAG_CONFIG
= new SectionConfig<>(Bundle.AnnotationUtils_tagEntry_title(), TAG_ENTRIES); = new SectionConfig<>(Bundle.AnnotationUtils_tagEntry_title(), TAG_ENTRIES);
// file set attributes and table configurations // Item set attributes and table configurations
private static final List<ItemEntry<BlackboardArtifact>> FILESET_HIT_ENTRIES = Arrays.asList( private static final List<ItemEntry<BlackboardArtifact>> ITEMSET_HIT_ENTRIES = Arrays.asList(
new ItemEntry<>(Bundle.AnnotationUtils_fileHitEntry_setName(), new ItemEntry<>(Bundle.AnnotationUtils_fileHitEntry_setName(),
(bba) -> tryGetAttribute(bba, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)), (bba) -> tryGetAttribute(bba, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)),
new ItemEntry<>(Bundle.AnnotationUtils_fileHitEntry_comment(), new ItemEntry<>(Bundle.AnnotationUtils_fileHitEntry_comment(),
@ -103,13 +104,16 @@ public class AnnotationUtils {
); );
private static final SectionConfig<BlackboardArtifact> INTERESTING_FILE_CONFIG private static final SectionConfig<BlackboardArtifact> INTERESTING_FILE_CONFIG
= new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_interestingFileHitTitle(), FILESET_HIT_ENTRIES); = new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_interestingFileHitTitle(), ITEMSET_HIT_ENTRIES);
private static final SectionConfig<BlackboardArtifact> INTERESTING_ITEM_CONFIG
= new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_interestingItemTitle(), ITEMSET_HIT_ENTRIES);
private static final SectionConfig<BlackboardArtifact> HASHSET_CONFIG private static final SectionConfig<BlackboardArtifact> HASHSET_CONFIG
= new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_hashSetHitTitle(), FILESET_HIT_ENTRIES); = new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_hashSetHitTitle(), ITEMSET_HIT_ENTRIES);
private static final SectionConfig<BlackboardArtifact> ARTIFACT_COMMENT_CONFIG private static final SectionConfig<BlackboardArtifact> ARTIFACT_COMMENT_CONFIG
= new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_artifactCommentTitle(), FILESET_HIT_ENTRIES); = new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_artifactCommentTitle(), ITEMSET_HIT_ENTRIES);
// central repository attributes and table configuration // central repository attributes and table configuration
private static final List<ItemEntry<CorrelationAttributeInstance>> CR_COMMENTS_ENTRIES = Arrays.asList( private static final List<ItemEntry<CorrelationAttributeInstance>> CR_COMMENTS_ENTRIES = Arrays.asList(
@ -211,7 +215,7 @@ public class AnnotationUtils {
// if artifact is a hashset hit or interesting file and has a non-blank comment // if artifact is a hashset hit or interesting file and has a non-blank comment
if ((BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() == bba.getArtifactTypeID() if ((BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() == bba.getArtifactTypeID()
|| BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == bba.getArtifactTypeID()) || BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == bba.getArtifactTypeID() || BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID() == bba.getArtifactTypeID())
&& (hasTskComment(bba))) { && (hasTskComment(bba))) {
boolean filesetRendered = appendEntries(parent, ARTIFACT_COMMENT_CONFIG, Arrays.asList(bba), false, !contentRendered); boolean filesetRendered = appendEntries(parent, ARTIFACT_COMMENT_CONFIG, Arrays.asList(bba), false, !contentRendered);
@ -266,7 +270,12 @@ public class AnnotationUtils {
isSubheader, isSubheader,
!contentRendered); !contentRendered);
contentRendered = contentRendered || hashsetRendered || interestingFileRendered; boolean interestingItemRendered = appendEntries(parent, INTERESTING_ITEM_CONFIG,
getFileSetHits(sourceFile, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM),
isSubheader,
!contentRendered);
contentRendered = contentRendered || hashsetRendered || interestingFileRendered || interestingItemRendered;
} }
return contentRendered; return contentRendered;
} }

3
Core/src/org/sleuthkit/autopsy/contentviewers/annotations/AnnotationsContentViewer.java
View File

@ -75,7 +75,8 @@ public class AnnotationsContentViewer extends javax.swing.JPanel implements Data
private static final Set<BlackboardArtifact.Type> ARTIFACT_TYPES_OF_INTEREST = ImmutableSet.of( private static final Set<BlackboardArtifact.Type> ARTIFACT_TYPES_OF_INTEREST = ImmutableSet.of(
BlackboardArtifact.Type.TSK_HASHSET_HIT, BlackboardArtifact.Type.TSK_HASHSET_HIT,
BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT,
BlackboardArtifact.Type.TSK_INTERESTING_ITEM
); );
private final PropertyChangeListener ingestEventListener = (evt) -> { private final PropertyChangeListener ingestEventListener = (evt) -> {

3
Core/src/org/sleuthkit/autopsy/datamodel/Artifacts.java
View File

@ -250,6 +250,9 @@ public class Artifacts {
KeywordHits.RootNode keywordsNode = new KeywordHits(skCase, dsObjId).new RootNode(); KeywordHits.RootNode keywordsNode = new KeywordHits(skCase, dsObjId).new RootNode();
return new TypeNodeKey(keywordsNode, TSK_KEYWORD_HIT); return new TypeNodeKey(keywordsNode, TSK_KEYWORD_HIT);
} else if (TSK_INTERESTING_ITEM.getTypeID() == typeId) {
InterestingHits.RootNode interestingHitsNode = new InterestingHits(skCase, TSK_INTERESTING_ITEM, dsObjId).new RootNode();
return new TypeNodeKey(interestingHitsNode, TSK_INTERESTING_ITEM);
} else if (TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == typeId) { } else if (TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == typeId) {
InterestingHits.RootNode interestingHitsNode = new InterestingHits(skCase, TSK_INTERESTING_ARTIFACT_HIT, dsObjId).new RootNode(); InterestingHits.RootNode interestingHitsNode = new InterestingHits(skCase, TSK_INTERESTING_ARTIFACT_HIT, dsObjId).new RootNode();
return new TypeNodeKey(interestingHitsNode, TSK_INTERESTING_ARTIFACT_HIT); return new TypeNodeKey(interestingHitsNode, TSK_INTERESTING_ARTIFACT_HIT);

7
Core/src/org/sleuthkit/autopsy/datamodel/BlackboardArtifactNode.java
View File

@ -151,7 +151,8 @@ public class BlackboardArtifactNode extends AbstractContentNode<BlackboardArtifa
* should be displayed in the node's property sheet. * should be displayed in the node's property sheet.
*/ */
private static final Integer[] SHOW_FILE_METADATA = new Integer[]{ private static final Integer[] SHOW_FILE_METADATA = new Integer[]{
BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID(),
BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID()
}; };
private final BlackboardArtifact artifact; private final BlackboardArtifact artifact;
@ -925,7 +926,7 @@ public class BlackboardArtifactNode extends AbstractContentNode<BlackboardArtifa
* hit, add the type and description of the interesting artifact to the * hit, add the type and description of the interesting artifact to the
* sheet. * sheet.
*/ */
if (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) { if (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() || artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID()) {
try { try {
BlackboardAttribute attribute = artifact.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)); BlackboardAttribute attribute = artifact.getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
if (attribute != null) { if (attribute != null) {
@ -946,7 +947,7 @@ public class BlackboardArtifactNode extends AbstractContentNode<BlackboardArtifa
associatedArtifact.getShortDescription())); associatedArtifact.getShortDescription()));
} }
} catch (TskCoreException | NoCurrentCaseException ex) { } catch (TskCoreException | NoCurrentCaseException ex) {
logger.log(Level.SEVERE, MessageFormat.format("Error getting associated artifact of TSK_INTERESTING_ARTIFACT_HIT artifact (objID={0}))", artifact.getId()), ex); //NON-NLS logger.log(Level.SEVERE, MessageFormat.format("Error getting associated artifact of " + artifact.getType().getTypeName() + " artifact (objID={0}))", artifact.getId()), ex); //NON-NLS
} }
} }

2
Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/AnalysisSummary.java
View File

@ -108,7 +108,7 @@ public class AnalysisSummary {
* @throws TskCoreException * @throws TskCoreException
*/ */
public List<Pair<String, Long>> getInterestingItemCounts(DataSource dataSource) throws SleuthkitCaseProviderException, TskCoreException { public List<Pair<String, Long>> getInterestingItemCounts(DataSource dataSource) throws SleuthkitCaseProviderException, TskCoreException {
return getCountsData(dataSource, TYPE_SET_NAME, ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT); return getCountsData(dataSource, TYPE_SET_NAME, ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT, ARTIFACT_TYPE.TSK_INTERESTING_ITEM);
} }
/** /**

1
Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/AnalysisSummaryGetter.java
View File

@ -41,6 +41,7 @@ public class AnalysisSummaryGetter implements DefaultArtifactUpdateGovernor {
private static final Set<Integer> ARTIFACT_UPDATE_TYPE_IDS = new HashSet<>(Arrays.asList( private static final Set<Integer> ARTIFACT_UPDATE_TYPE_IDS = new HashSet<>(Arrays.asList(
ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID(), ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID(),
ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID(), ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID(),
ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID(),
ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID(), ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID(),
ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()
)); ));

3
Core/src/org/sleuthkit/autopsy/datasourcesummary/ui/PastCasesSummaryGetter.java
View File

@ -40,7 +40,8 @@ public class PastCasesSummaryGetter implements DefaultArtifactUpdateGovernor {
private static final Set<Integer> ARTIFACT_UPDATE_TYPE_IDS = new HashSet<>(Arrays.asList( private static final Set<Integer> ARTIFACT_UPDATE_TYPE_IDS = new HashSet<>(Arrays.asList(
ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID(), ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID(),
ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID(),
ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID()
)); ));
private final PastCasesSummary pastSummary; private final PastCasesSummary pastSummary;

8
Core/src/org/sleuthkit/autopsy/directorytree/DirectoryTreeTopComponent.java
View File

@ -1275,7 +1275,7 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
return; return;
} }
} }
final Set<Host> finalHosts = hosts; final Set<Host> finalHosts = hosts;
Optional<Node> osAccountListNodeOpt = Stream.of(em.getRootContext().getChildren().getNodes(true)) Optional<Node> osAccountListNodeOpt = Stream.of(em.getRootContext().getChildren().getNodes(true))
@ -1358,6 +1358,8 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
treeNode = getInterestingItemNode(typesChildren, BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT, art); treeNode = getInterestingItemNode(typesChildren, BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT, art);
} else if (typeID == BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) { } else if (typeID == BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) {
treeNode = getInterestingItemNode(typesChildren, BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT, art); treeNode = getInterestingItemNode(typesChildren, BlackboardArtifact.Type.TSK_INTERESTING_ARTIFACT_HIT, art);
} else if (typeID == BlackboardArtifact.Type.TSK_INTERESTING_ITEM.getTypeID()) {
treeNode = getInterestingItemNode(typesChildren, BlackboardArtifact.Type.TSK_INTERESTING_ITEM, art);
} else if (typeID == BlackboardArtifact.Type.TSK_EMAIL_MSG.getTypeID()) { } else if (typeID == BlackboardArtifact.Type.TSK_EMAIL_MSG.getTypeID()) {
treeNode = getEmailNode(typesChildren, art); treeNode = getEmailNode(typesChildren, art);
} else if (typeID == BlackboardArtifact.Type.TSK_ACCOUNT.getTypeID()) { } else if (typeID == BlackboardArtifact.Type.TSK_ACCOUNT.getTypeID()) {
@ -1495,12 +1497,12 @@ public final class DirectoryTreeTopComponent extends TopComponent implements Dat
private Node getInterestingItemNode(Children typesChildren, BlackboardArtifact.Type artifactType, BlackboardArtifact art) { private Node getInterestingItemNode(Children typesChildren, BlackboardArtifact.Type artifactType, BlackboardArtifact art) {
Node interestingItemsRootNode = typesChildren.findChild(artifactType.getDisplayName()); Node interestingItemsRootNode = typesChildren.findChild(artifactType.getDisplayName());
Children setNodeChildren = (interestingItemsRootNode == null) ? null : interestingItemsRootNode.getChildren(); Children setNodeChildren = (interestingItemsRootNode == null) ? null : interestingItemsRootNode.getChildren();
// set node children for type could not be found, so return null. // set node children for type could not be found, so return null.
if (setNodeChildren == null) { if (setNodeChildren == null) {
return null; return null;
} }
String setName = null; String setName = null;
try { try {
setName = art.getAttributes().stream() setName = art.getAttributes().stream()

4
Core/src/org/sleuthkit/autopsy/discovery/search/DiscoveryAttributes.java
View File

@ -791,8 +791,8 @@ public class DiscoveryAttributes {
CentralRepository centralRepoDb, SearchContext context) throws DiscoveryException, SearchCancellationException { CentralRepository centralRepoDb, SearchContext context) throws DiscoveryException, SearchCancellationException {
// Get pairs of (object ID, interesting item set name) for all files in the list of files that have // Get pairs of (object ID, interesting item set name) for all files in the list of files that have
// interesting file set hits. // interesting item set hits.
String selectQuery = createSetNameClause(results, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID(), String selectQuery = createSetNameClause(results, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID(),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID()); BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID());
InterestingFileSetNamesCallback callback = new InterestingFileSetNamesCallback(results); InterestingFileSetNamesCallback callback = new InterestingFileSetNamesCallback(results);

6
Core/src/org/sleuthkit/autopsy/discovery/search/SearchFiltering.java
View File

@ -875,8 +875,9 @@ public class SearchFiltering {
String intItemSetPart = concatenateNamesForSQL(setNames); String intItemSetPart = concatenateNamesForSQL(setNames);
String queryStr = "(obj_id IN (SELECT obj_id from blackboard_artifacts WHERE artifact_id IN " String queryStr = "(obj_id IN (SELECT obj_id from blackboard_artifacts WHERE artifact_id IN "
+ "(SELECT artifact_id FROM blackboard_attributes WHERE artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() + "(SELECT artifact_id FROM blackboard_attributes WHERE (artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID()
+ " AND attribute_type_ID = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + " " +" OR artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID()
+ ") AND attribute_type_ID = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + " "
+ "AND (" + intItemSetPart + "))))"; // NON-NLS + "AND (" + intItemSetPart + "))))"; // NON-NLS
return queryStr; return queryStr;
@ -964,6 +965,7 @@ public class SearchFiltering {
if (scores.contains(Score.INTERESTING)) { if (scores.contains(Score.INTERESTING)) {
// Matches interesting item artifact // Matches interesting item artifact
intItemQueryPart = " (obj_id IN (SELECT obj_id from blackboard_artifacts WHERE artifact_type_id = " intItemQueryPart = " (obj_id IN (SELECT obj_id from blackboard_artifacts WHERE artifact_type_id = "
+ BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID() + " OR artifact_type_id = "
+ BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() + ")) "; + BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() + ")) ";
} }

3
Core/src/org/sleuthkit/autopsy/discovery/ui/DiscoveryDialog.java
View File

@ -746,7 +746,8 @@ final class DiscoveryDialog extends javax.swing.JDialog {
shouldUpdate = shouldUpdateFilters(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION.getTypeID(), eventData, objectsDetected); shouldUpdate = shouldUpdateFilters(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION.getTypeID(), eventData, objectsDetected);
} else if (eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) { } else if (eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
shouldUpdate = shouldUpdateFilters(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), eventData, hashSets); shouldUpdate = shouldUpdateFilters(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), eventData, hashSets);
} else if (eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() } else if (eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID()
|| eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID()
|| eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) { || eventData.getBlackboardArtifactType().getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) {
shouldUpdate = shouldUpdateFilters(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), eventData, interestingItems); shouldUpdate = shouldUpdateFilters(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), eventData, interestingItems);
} }

2
Core/src/org/sleuthkit/autopsy/discovery/ui/InterestingItemsFilterPanel.java
View File

@ -58,7 +58,7 @@ final class InterestingItemsFilterPanel extends AbstractDiscoveryFilterPanel {
private void setUpInterestingItemsFilter() { private void setUpInterestingItemsFilter() {
try { try {
interestingItemsList.clearList(); interestingItemsList.clearList();
List<String> setNames = DiscoveryUiUtils.getSetNames(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, List<String> setNames = DiscoveryUiUtils.getSetNames(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM,
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME); BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME);
for (String name : setNames) { for (String name : setNames) {
interestingItemsList.addElement(name, null, name); interestingItemsList.addElement(name, null, name);

2
Core/src/org/sleuthkit/autopsy/logicalimager/dsp/AddLogicalImageTask.java
View File

@ -443,7 +443,7 @@ final class AddLogicalImageTask implements Runnable {
BlackboardArtifact artifact; BlackboardArtifact artifact;
try { try {
artifact = this.blackboard.newAnalysisResult( artifact = this.blackboard.newAnalysisResult(
BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT, fileId, dataSourceId, BlackboardArtifact.Type.TSK_INTERESTING_ITEM, fileId, dataSourceId,
Score.SCORE_LIKELY_NOTABLE, Score.SCORE_LIKELY_NOTABLE,
null, ruleSetName, null, null, ruleSetName, null,
Arrays.asList( Arrays.asList(

6
Core/src/org/sleuthkit/autopsy/modules/embeddedfileextractor/SevenZipExtractor.java
View File

@ -69,7 +69,7 @@ import org.sleuthkit.autopsy.modules.filetypeid.FileTypeDetector;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Blackboard; import org.sleuthkit.datamodel.Blackboard;
import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT; import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM;
import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.BlackboardAttribute;
import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT; import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT;
import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION; import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION;
@ -327,10 +327,10 @@ class SevenZipExtractor {
TSK_COMMENT, MODULE_NAME, TSK_COMMENT, MODULE_NAME,
details)); details));
if (!blackboard.artifactExists(archiveFile, TSK_INTERESTING_FILE_HIT, attributes)) { if (!blackboard.artifactExists(archiveFile, TSK_INTERESTING_ITEM, attributes)) {
BlackboardArtifact artifact = rootArchive.getArchiveFile().newAnalysisResult( BlackboardArtifact artifact = rootArchive.getArchiveFile().newAnalysisResult(
BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT, Score.SCORE_LIKELY_NOTABLE, BlackboardArtifact.Type.TSK_INTERESTING_ITEM, Score.SCORE_LIKELY_NOTABLE,
null, setName, null, null, setName, null,
attributes) attributes)
.getAnalysisResult(); .getAnalysisResult();

10
Core/src/org/sleuthkit/autopsy/modules/filetypeid/FileTypeIdIngestModule.java
View File

@ -36,7 +36,7 @@ import org.sleuthkit.autopsy.modules.filetypeid.CustomFileTypesManager.CustomFil
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Blackboard; import org.sleuthkit.datamodel.Blackboard;
import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT; import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM;
import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.BlackboardAttribute;
import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY; import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY;
import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME; import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME;
@ -194,9 +194,9 @@ public class FileTypeIdIngestModule implements FileIngestModule {
Blackboard tskBlackboard = currentCase.getSleuthkitCase().getBlackboard(); Blackboard tskBlackboard = currentCase.getSleuthkitCase().getBlackboard();
// Create artifact if it doesn't already exist. // Create artifact if it doesn't already exist.
if (!tskBlackboard.artifactExists(file, TSK_INTERESTING_FILE_HIT, attributes)) { if (!tskBlackboard.artifactExists(file, TSK_INTERESTING_ITEM, attributes)) {
BlackboardArtifact artifact = file.newAnalysisResult( BlackboardArtifact artifact = file.newAnalysisResult(
BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT, Score.SCORE_LIKELY_NOTABLE, BlackboardArtifact.Type.TSK_INTERESTING_ITEM, Score.SCORE_LIKELY_NOTABLE,
null, fileType.getInterestingFilesSetName(), null, null, fileType.getInterestingFilesSetName(), null,
attributes) attributes)
.getAnalysisResult(); .getAnalysisResult();
@ -208,12 +208,12 @@ public class FileTypeIdIngestModule implements FileIngestModule {
*/ */
tskBlackboard.postArtifact(artifact, FileTypeIdModuleFactory.getModuleName()); tskBlackboard.postArtifact(artifact, FileTypeIdModuleFactory.getModuleName());
} catch (Blackboard.BlackboardException ex) { } catch (Blackboard.BlackboardException ex) {
logger.log(Level.SEVERE, String.format("Unable to index TSK_INTERESTING_FILE_HIT blackboard artifact %d (file obj_id=%d)", artifact.getArtifactID(), file.getId()), ex); //NON-NLS logger.log(Level.SEVERE, String.format("Unable to index TSK_INTERESTING_ITEM blackboard artifact %d (file obj_id=%d)", artifact.getArtifactID(), file.getId()), ex); //NON-NLS
} }
} }
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
logger.log(Level.SEVERE, String.format("Unable to create TSK_INTERESTING_FILE_HIT artifact for file (obj_id=%d)", file.getId()), ex); //NON-NLS logger.log(Level.SEVERE, String.format("Unable to create TSK_INTERESTING_ITEM artifact for file (obj_id=%d)", file.getId()), ex); //NON-NLS
} catch (NoCurrentCaseException ex) { } catch (NoCurrentCaseException ex) {
logger.log(Level.SEVERE, "Exception while getting open case.", ex); //NON-NLS logger.log(Level.SEVERE, "Exception while getting open case.", ex); //NON-NLS
} }

6
Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesIdentifierIngestModule.java
View File

@ -39,7 +39,7 @@ import org.sleuthkit.autopsy.ingest.IngestServices;
import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Blackboard; import org.sleuthkit.datamodel.Blackboard;
import org.sleuthkit.datamodel.BlackboardArtifact; import org.sleuthkit.datamodel.BlackboardArtifact;
import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT; import static org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM;
import org.sleuthkit.datamodel.BlackboardAttribute; import org.sleuthkit.datamodel.BlackboardAttribute;
import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY; import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY;
import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME; import static org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME;
@ -142,9 +142,9 @@ final class FilesIdentifierIngestModule implements FileIngestModule {
); );
// Create artifact if it doesn't already exist. // Create artifact if it doesn't already exist.
if (!blackboard.artifactExists(file, TSK_INTERESTING_FILE_HIT, attributes)) { if (!blackboard.artifactExists(file, TSK_INTERESTING_ITEM, attributes)) {
BlackboardArtifact artifact = file.newAnalysisResult( BlackboardArtifact artifact = file.newAnalysisResult(
BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT, Score.SCORE_LIKELY_NOTABLE, BlackboardArtifact.Type.TSK_INTERESTING_ITEM, Score.SCORE_LIKELY_NOTABLE,
null, filesSet.getName(), null, null, filesSet.getName(), null,
attributes) attributes)
.getAnalysisResult(); .getAnalysisResult();

1
Core/src/org/sleuthkit/autopsy/report/infrastructure/PortableCaseInterestingItemsListPanel.java
View File

@ -108,6 +108,7 @@ class PortableCaseInterestingItemsListPanel extends javax.swing.JPanel {
try { try {
// Get all SET_NAMEs from interesting item artifacts // Get all SET_NAMEs from interesting item artifacts
String innerSelect = "SELECT (value_text) AS set_name FROM blackboard_attributes WHERE (artifact_type_id = '" String innerSelect = "SELECT (value_text) AS set_name FROM blackboard_attributes WHERE (artifact_type_id = '"
+ BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID() + "' OR artifact_type_id = '"
+ BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() + "' OR artifact_type_id = '" + BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() + "' OR artifact_type_id = '"
+ BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() + "') AND attribute_type_id = '" + BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() + "') AND attribute_type_id = '"
+ BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + "'"; // NON-NLS + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + "'"; // NON-NLS

59
Core/src/org/sleuthkit/autopsy/report/infrastructure/TableReportGenerator.java
View File

@ -358,7 +358,7 @@ class TableReportGenerator {
// Give the modules the rows for the content tags. // Give the modules the rows for the content tags.
for (ContentTag tag : tags) { for (ContentTag tag : tags) {
try { try {
if(shouldFilterFromReport(tag.getContent())) { if (shouldFilterFromReport(tag.getContent())) {
continue; continue;
} }
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
@ -366,7 +366,7 @@ class TableReportGenerator {
logger.log(Level.SEVERE, "Failed to access content data from the case database.", ex); //NON-NLS logger.log(Level.SEVERE, "Failed to access content data from the case database.", ex); //NON-NLS
return; return;
} }
// skip tags that we are not reporting on // skip tags that we are not reporting on
String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : ""; String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : "";
if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) == false) { if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) == false) {
@ -451,15 +451,15 @@ class TableReportGenerator {
// Give the modules the rows for the content tags. // Give the modules the rows for the content tags.
for (BlackboardArtifactTag tag : tags) { for (BlackboardArtifactTag tag : tags) {
try { try {
if(shouldFilterFromReport(tag.getContent())) { if (shouldFilterFromReport(tag.getContent())) {
continue; continue;
} }
} catch (TskCoreException ex) { } catch (TskCoreException ex) {
errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetBBArtifactTags")); errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetBBArtifactTags"));
logger.log(Level.SEVERE, "Failed to access content data from the case database.", ex); //NON-NLS logger.log(Level.SEVERE, "Failed to access content data from the case database.", ex); //NON-NLS
return; return;
} }
String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : ""; String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : "";
if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) == false) { if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) == false) {
continue; continue;
@ -813,7 +813,7 @@ class TableReportGenerator {
AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId); AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
if (f != null) { if (f != null) {
uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath(); uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
if(shouldFilterFromReport(f)) { if (shouldFilterFromReport(f)) {
continue; continue;
} }
} }
@ -973,7 +973,7 @@ class TableReportGenerator {
AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId); AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
if (f != null) { if (f != null) {
uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath(); uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
if(shouldFilterFromReport(f)) { if (shouldFilterFromReport(f)) {
continue; continue;
} }
} }
@ -1161,8 +1161,9 @@ class TableReportGenerator {
} }
orderedRowData.add(makeCommaSeparatedList(getTags())); orderedRowData.add(makeCommaSeparatedList(getTags()));
} else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == getArtifact().getArtifactTypeID()) { } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == getArtifact().getArtifactTypeID()
String[] attributeDataArray = new String[5]; || BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID() == getArtifact().getArtifactTypeID()) {
String[] attributeDataArray = new String[7];
// Array is used so that order of the attributes is maintained. // Array is used so that order of the attributes is maintained.
for (BlackboardAttribute attr : attributes) { for (BlackboardAttribute attr : attributes) {
if (attr.getAttributeType().equals(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME))) { if (attr.getAttributeType().equals(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME))) {
@ -1173,6 +1174,10 @@ class TableReportGenerator {
attributeDataArray[3] = attr.getDisplayString(); attributeDataArray[3] = attr.getDisplayString();
} else if (attr.getAttributeType().equals(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION))) { } else if (attr.getAttributeType().equals(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION))) {
attributeDataArray[4] = attr.getDisplayString(); attributeDataArray[4] = attr.getDisplayString();
} else if (attr.getAttributeType().equals(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT))) {
attributeDataArray[5] = attr.getDisplayString();
} else if (attr.getAttributeType().equals(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME))) {
attributeDataArray[6] = attr.getDisplayString();
} }
} }
@ -1218,10 +1223,10 @@ class TableReportGenerator {
List<ArtifactData> artifacts = new ArrayList<>(); List<ArtifactData> artifacts = new ArrayList<>();
try { try {
for (BlackboardArtifact artifact : Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboardArtifacts(type.getTypeID())) { for (BlackboardArtifact artifact : Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboardArtifacts(type.getTypeID())) {
if(shouldFilterFromReport(artifact)) { if (shouldFilterFromReport(artifact)) {
continue; continue;
} }
List<BlackboardArtifactTag> tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getBlackboardArtifactTagsByArtifact(artifact); List<BlackboardArtifactTag> tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getBlackboardArtifactTagsByArtifact(artifact);
HashSet<String> uniqueTagNames = new HashSet<>(); HashSet<String> uniqueTagNames = new HashSet<>();
for (BlackboardArtifactTag tag : tags) { for (BlackboardArtifactTag tag : tags) {
@ -1339,7 +1344,7 @@ class TableReportGenerator {
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH))); new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"), columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED ))); new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
attributeTypeSet.remove(new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID)); attributeTypeSet.remove(new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
} else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID() == artifactTypeId) { } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID() == artifactTypeId) {
@ -1708,6 +1713,28 @@ class TableReportGenerator {
columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"), columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME))); new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
} else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID() == artifactTypeId) {
columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskSetName"),
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.associatedArtifact"),
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskInterestingFilesCategory"),
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskPath"),
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.comment"),
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT)));
columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.description"),
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
} else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == artifactTypeId) { } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == artifactTypeId) {
columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"), columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME))); new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
@ -1817,19 +1844,19 @@ class TableReportGenerator {
return ""; return "";
} }
/** /**
* Indicates if the content should be filtered from the report. * Indicates if the content should be filtered from the report.
*/ */
private boolean shouldFilterFromReport(Content content) throws TskCoreException { private boolean shouldFilterFromReport(Content content) throws TskCoreException {
if(this.settings.getSelectedDataSources() == null) { if (this.settings.getSelectedDataSources() == null) {
return false; return false;
} }
if (content.getDataSource() == null) { if (content.getDataSource() == null) {
return false; return false;
} }
long dataSourceId = content.getDataSource().getId(); long dataSourceId = content.getDataSource().getId();
return !this.settings.getSelectedDataSources().contains(dataSourceId); return !this.settings.getSelectedDataSources().contains(dataSourceId);
} }

38
Core/src/org/sleuthkit/autopsy/report/modules/html/HTMLReport.java
View File

@ -213,7 +213,7 @@ public class HTMLReport implements TableReportModule {
* Copies a suitable icon for the given data type in the output directory * Copies a suitable icon for the given data type in the output directory
* and returns the icon file name to use for the given data type. * and returns the icon file name to use for the given data type.
*/ */
@SuppressWarnings( "deprecation" ) @SuppressWarnings("deprecation")
private String useDataTypeIcon(String dataType) { private String useDataTypeIcon(String dataType) {
String iconFilePath; String iconFilePath;
String iconFileName; String iconFileName;
@ -326,9 +326,10 @@ public class HTMLReport implements TableReportModule {
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/mismatch-16.png"); //NON-NLS in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/mismatch-16.png"); //NON-NLS
break; break;
case TSK_INTERESTING_ARTIFACT_HIT: case TSK_INTERESTING_ARTIFACT_HIT:
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS //fall through deprecated type to TSK_INTERESTING_ITEM
break;
case TSK_INTERESTING_FILE_HIT: case TSK_INTERESTING_FILE_HIT:
//fall through deprecated type to TSK_INTERESTING_ITEM
case TSK_INTERESTING_ITEM:
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS
break; break;
case TSK_PROG_RUN: case TSK_PROG_RUN:
@ -339,25 +340,25 @@ public class HTMLReport implements TableReportModule {
break; break;
case TSK_OS_ACCOUNT: case TSK_OS_ACCOUNT:
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/os-account.png"); //NON-NLS in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/os-account.png"); //NON-NLS
break; break;
case TSK_OBJECT_DETECTED: case TSK_OBJECT_DETECTED:
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/objects.png"); //NON-NLS in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/objects.png"); //NON-NLS
break; break;
case TSK_WEB_FORM_AUTOFILL: case TSK_WEB_FORM_AUTOFILL:
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/web-form.png"); //NON-NLS in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/web-form.png"); //NON-NLS
break; break;
case TSK_WEB_CACHE: case TSK_WEB_CACHE:
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/cache.png"); //NON-NLS in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/cache.png"); //NON-NLS
break; break;
case TSK_USER_CONTENT_SUSPECTED: case TSK_USER_CONTENT_SUSPECTED:
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/user-content.png"); //NON-NLS in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/user-content.png"); //NON-NLS
break; break;
case TSK_METADATA: case TSK_METADATA:
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/metadata.png"); //NON-NLS in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/metadata.png"); //NON-NLS
break; break;
case TSK_CLIPBOARD_CONTENT: case TSK_CLIPBOARD_CONTENT:
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/clipboard.png"); //NON-NLS in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/images/clipboard.png"); //NON-NLS
break; break;
case TSK_ACCOUNT: case TSK_ACCOUNT:
in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/accounts.png"); //NON-NLS in = getClass().getResourceAsStream("/org/sleuthkit/autopsy/report/images/accounts.png"); //NON-NLS
break; break;
@ -506,7 +507,7 @@ public class HTMLReport implements TableReportModule {
* to this page, and setup the web page header. Note: This method is a * to this page, and setup the web page header. Note: This method is a
* temporary workaround to avoid modifying the TableReportModule interface. * temporary workaround to avoid modifying the TableReportModule interface.
* *
* @param name Name of the data type * @param name Name of the data type
* @param description Comment on the data type, may be the empty string * @param description Comment on the data type, may be the empty string
*/ */
@Override @Override
@ -738,9 +739,9 @@ public class HTMLReport implements TableReportModule {
/** /**
* Add a row to the current table. * Add a row to the current table.
* *
* @param row values for each cell in the row * @param row values for each cell in the row
* @param escapeText whether or not the text of the row should be escaped, * @param escapeText whether or not the text of the row should be escaped,
* true for escaped, false for not escaped * true for escaped, false for not escaped
*/ */
private void addRow(List<String> row, boolean escapeText) { private void addRow(List<String> row, boolean escapeText) {
StringBuilder builder = new StringBuilder(); StringBuilder builder = new StringBuilder();
@ -763,9 +764,9 @@ public class HTMLReport implements TableReportModule {
/** /**
* Saves a local copy of a tagged file and adds a row with a hyper link to * Saves a local copy of a tagged file and adds a row with a hyper link to
* the file. * the file.
* *
* @param row Values for each data cell in the row * @param row Values for each data cell in the row
* @param contentTag The tag * @param contentTag The tag
*/ */
public void addRowWithTaggedContentHyperlink(List<String> row, ContentTag contentTag) { public void addRowWithTaggedContentHyperlink(List<String> row, ContentTag contentTag) {
@ -825,6 +826,7 @@ public class HTMLReport implements TableReportModule {
* Finds all associated image tags. * Finds all associated image tags.
* *
* @param contentTags * @param contentTags
*
* @return * @return
*/ */
private List<ImageTagRegion> getTaggedRegions(List<ContentTag> contentTags) { private List<ImageTagRegion> getTaggedRegions(List<ContentTag> contentTags) {
@ -1029,9 +1031,9 @@ public class HTMLReport implements TableReportModule {
/** /**
* Save a local copy of the given file in the reports folder. * Save a local copy of the given file in the reports folder.
* *
* @param file File to save * @param file File to save
* @param dirName Custom top-level folder to use to store the files in (tag * @param dirName Custom top-level folder to use to store the files in (tag
* name, etc.) * name, etc.)
* *
* @return Path to where file was stored (relative to root of HTML folder) * @return Path to where file was stored (relative to root of HTML folder)
*/ */
@ -1574,7 +1576,7 @@ public class HTMLReport implements TableReportModule {
* @param file The file from which to create the thumbnail. * @param file The file from which to create the thumbnail.
* *
* @return The path to the thumbnail file, or null if a thumbnail couldn't * @return The path to the thumbnail file, or null if a thumbnail couldn't
* be created. * be created.
*/ */
private String prepareThumbnail(AbstractFile file) { private String prepareThumbnail(AbstractFile file) {
BufferedImage bufferedThumb = ImageUtils.getThumbnail(file, ImageUtils.ICON_SIZE_MEDIUM); BufferedImage bufferedThumb = ImageUtils.getThumbnail(file, ImageUtils.ICON_SIZE_MEDIUM);

154
Core/src/org/sleuthkit/autopsy/report/modules/portablecase/PortableCaseReportModule.java
View File

@ -111,7 +111,7 @@ public class PortableCaseReportModule implements ReportModule {
// These are the types for the exported file subfolders // These are the types for the exported file subfolders
private static final List<FileTypeCategory> FILE_TYPE_CATEGORIES = Arrays.asList(FileTypeCategory.AUDIO, FileTypeCategory.DOCUMENTS, private static final List<FileTypeCategory> FILE_TYPE_CATEGORIES = Arrays.asList(FileTypeCategory.AUDIO, FileTypeCategory.DOCUMENTS,
FileTypeCategory.EXECUTABLE, FileTypeCategory.IMAGE, FileTypeCategory.VIDEO); FileTypeCategory.EXECUTABLE, FileTypeCategory.IMAGE, FileTypeCategory.VIDEO);
// These are attribute types that have special handling and should not be copied // These are attribute types that have special handling and should not be copied
// into the new artifact directly. // into the new artifact directly.
private static final List<Integer> SPECIALLY_HANDLED_ATTRS = Arrays.asList(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID(), private static final List<Integer> SPECIALLY_HANDLED_ATTRS = Arrays.asList(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID(),
@ -140,13 +140,13 @@ public class PortableCaseReportModule implements ReportModule {
// Map of old artifact ID to new artifact // Map of old artifact ID to new artifact
private final Map<Long, BlackboardArtifact> oldArtifactIdToNewArtifact = new HashMap<>(); private final Map<Long, BlackboardArtifact> oldArtifactIdToNewArtifact = new HashMap<>();
// Map of old OS account id to new OS account // Map of old OS account id to new OS account
private final Map<Long, OsAccount> oldOsAccountIdToNewOsAccount = new HashMap<>(); private final Map<Long, OsAccount> oldOsAccountIdToNewOsAccount = new HashMap<>();
// Map of old OS account realm id to new OS account ream id // Map of old OS account realm id to new OS account ream id
private final Map<Long, OsAccountRealm> oldRealmIdToNewRealm = new HashMap<>(); private final Map<Long, OsAccountRealm> oldRealmIdToNewRealm = new HashMap<>();
// Map of the old host id to the new host // Map of the old host id to the new host
private final Map<Long, Host> oldHostIdToNewHost = new HashMap<>(); private final Map<Long, Host> oldHostIdToNewHost = new HashMap<>();
@ -444,6 +444,24 @@ public class PortableCaseReportModule implements ReportModule {
handleError("Error copying interesting results", Bundle.PortableCaseReportModule_generateReport_errorCopyingInterestingResults(), ex, progressPanel); // NON-NLS handleError("Error copying interesting results", Bundle.PortableCaseReportModule_generateReport_errorCopyingInterestingResults(), ex, progressPanel); // NON-NLS
return; return;
} }
try {
List<AnalysisResult> interestingResults = currentCase.getSleuthkitCase().getBlackboard().getAnalysisResultsByType(BlackboardArtifact.Type.TSK_INTERESTING_ITEM.getTypeID());
for (AnalysisResult art : interestingResults) {
// Check for cancellation
if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
handleCancellation(progressPanel);
return;
}
BlackboardAttribute setAttr = art.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME));
if (setNames.contains(setAttr.getValueString())) {
copyContentToPortableCase(art, progressPanel);
}
}
} catch (TskCoreException ex) {
handleError("Error copying interesting items", Bundle.PortableCaseReportModule_generateReport_errorCopyingInterestingResults(), ex, progressPanel); // NON-NLS
return;
}
} }
// Check for cancellation // Check for cancellation
@ -469,7 +487,7 @@ public class PortableCaseReportModule implements ReportModule {
if (options.shouldCompress()) { if (options.shouldCompress()) {
progressPanel.updateStatusLabel(Bundle.PortableCaseReportModule_generateReport_compressingCase()); progressPanel.updateStatusLabel(Bundle.PortableCaseReportModule_generateReport_compressingCase());
if(!compressCase(progressPanel, options.includeApplication() ? outputDir.getAbsolutePath() : caseFolder.getAbsolutePath())){ if (!compressCase(progressPanel, options.includeApplication() ? outputDir.getAbsolutePath() : caseFolder.getAbsolutePath())) {
// Errors have been handled already // Errors have been handled already
return; return;
} }
@ -594,6 +612,8 @@ public class PortableCaseReportModule implements ReportModule {
BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT); BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
allArtifacts.addAll(skCase.getBlackboardArtifacts( allArtifacts.addAll(skCase.getBlackboardArtifacts(
BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT)); BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT));
allArtifacts.addAll(skCase.getBlackboardArtifacts(
BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM));
for (BlackboardArtifact bArt : allArtifacts) { for (BlackboardArtifact bArt : allArtifacts) {
BlackboardAttribute setAttr = bArt.getAttribute( BlackboardAttribute setAttr = bArt.getAttribute(
@ -660,6 +680,7 @@ public class PortableCaseReportModule implements ReportModule {
// Get all SET_NAMEs from interesting item artifacts // Get all SET_NAMEs from interesting item artifacts
String innerSelect = "SELECT (value_text) AS set_name FROM blackboard_attributes WHERE (artifact_type_id = '" String innerSelect = "SELECT (value_text) AS set_name FROM blackboard_attributes WHERE (artifact_type_id = '"
+ BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() + "' OR artifact_type_id = '" + BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() + "' OR artifact_type_id = '"
+ BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID() + "' OR artifact_type_id = '"
+ BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() + "') AND attribute_type_id = '" + BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() + "') AND attribute_type_id = '"
+ BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + "'"; // NON-NLS + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + "'"; // NON-NLS
@ -910,10 +931,10 @@ public class PortableCaseReportModule implements ReportModule {
// Copy the artifact // Copy the artifact
BlackboardArtifact newArtifact = copyArtifact(newContentId, tag.getArtifact()); BlackboardArtifact newArtifact = copyArtifact(newContentId, tag.getArtifact());
// Copy any attachments // Copy any attachments
copyAttachments(newArtifact, tag.getArtifact(), portableSkCase.getAbstractFileById(newContentId)); copyAttachments(newArtifact, tag.getArtifact(), portableSkCase.getAbstractFileById(newContentId));
// Copy any files associated with this artifact through the TSK_PATH_ID attribute // Copy any files associated with this artifact through the TSK_PATH_ID attribute
copyPathID(newArtifact, tag.getArtifact()); copyPathID(newArtifact, tag.getArtifact());
@ -991,7 +1012,7 @@ public class PortableCaseReportModule implements ReportModule {
throw new TskCoreException("Unexpected attribute value type found: " + oldAttr.getValueType().getLabel()); // NON-NLS throw new TskCoreException("Unexpected attribute value type found: " + oldAttr.getValueType().getLabel()); // NON-NLS
} }
} }
// Figure out the data source ID. We can't always get it from newContent because it could be null // Figure out the data source ID. We can't always get it from newContent because it could be null
// for OS accounts, which means we also can't assume it's been added to the case already. // for OS accounts, which means we also can't assume it's been added to the case already.
Long newDataSourceId; Long newDataSourceId;
@ -1007,13 +1028,12 @@ public class PortableCaseReportModule implements ReportModule {
} }
newDataSourceId = copyContent(artifactToCopy.getDataSource()); newDataSourceId = copyContent(artifactToCopy.getDataSource());
} }
// Create the new artifact // Create the new artifact
int newArtifactTypeId = getNewArtifactTypeId(artifactToCopy); int newArtifactTypeId = getNewArtifactTypeId(artifactToCopy);
BlackboardArtifact.Type newArtifactType = portableSkCase.getBlackboard().getArtifactType(newArtifactTypeId); BlackboardArtifact.Type newArtifactType = portableSkCase.getBlackboard().getArtifactType(newArtifactTypeId);
BlackboardArtifact newArtifact; BlackboardArtifact newArtifact;
// First, check if the artifact being copied is an AnalysisResult or a DataArtifact. If it // First, check if the artifact being copied is an AnalysisResult or a DataArtifact. If it
// is neither, attempt to reload it as the appropriate subclass. // is neither, attempt to reload it as the appropriate subclass.
if (!((artifactToCopy instanceof AnalysisResult) || (artifactToCopy instanceof DataArtifact))) { if (!((artifactToCopy instanceof AnalysisResult) || (artifactToCopy instanceof DataArtifact))) {
@ -1033,13 +1053,13 @@ public class PortableCaseReportModule implements ReportModule {
// If the lookup failed, just use the orginal BlackboardArtifact // If the lookup failed, just use the orginal BlackboardArtifact
} }
} }
try { try {
if (artifactToCopy instanceof AnalysisResult) { if (artifactToCopy instanceof AnalysisResult) {
AnalysisResult analysisResultToCopy = (AnalysisResult) artifactToCopy; AnalysisResult analysisResultToCopy = (AnalysisResult) artifactToCopy;
newArtifact = portableSkCase.getBlackboard().newAnalysisResult(newArtifactType, newContentId, newArtifact = portableSkCase.getBlackboard().newAnalysisResult(newArtifactType, newContentId,
newDataSourceId, analysisResultToCopy.getScore(), newDataSourceId, analysisResultToCopy.getScore(),
analysisResultToCopy.getConclusion(), analysisResultToCopy.getConfiguration(), analysisResultToCopy.getConclusion(), analysisResultToCopy.getConfiguration(),
analysisResultToCopy.getJustification(), newAttrs).getAnalysisResult(); analysisResultToCopy.getJustification(), newAttrs).getAnalysisResult();
} else if (artifactToCopy instanceof DataArtifact) { } else if (artifactToCopy instanceof DataArtifact) {
DataArtifact dataArtifactToCopy = (DataArtifact) artifactToCopy; DataArtifact dataArtifactToCopy = (DataArtifact) artifactToCopy;
@ -1048,20 +1068,20 @@ public class PortableCaseReportModule implements ReportModule {
copyOsAccount(dataArtifactToCopy.getOsAccountObjectId().get()); copyOsAccount(dataArtifactToCopy.getOsAccountObjectId().get());
newOsAccountId = oldOsAccountIdToNewOsAccount.get((dataArtifactToCopy.getOsAccountObjectId().get())).getId(); newOsAccountId = oldOsAccountIdToNewOsAccount.get((dataArtifactToCopy.getOsAccountObjectId().get())).getId();
} }
newArtifact = portableSkCase.getBlackboard().newDataArtifact(newArtifactType, newContentId, newArtifact = portableSkCase.getBlackboard().newDataArtifact(newArtifactType, newContentId,
newDataSourceId, newDataSourceId,
newAttrs, newOsAccountId); newAttrs, newOsAccountId);
} else { } else {
if (newArtifactType.getCategory().equals(BlackboardArtifact.Category.ANALYSIS_RESULT)) { if (newArtifactType.getCategory().equals(BlackboardArtifact.Category.ANALYSIS_RESULT)) {
newArtifact = portableSkCase.getBlackboard().newAnalysisResult(newArtifactType, newContentId, newArtifact = portableSkCase.getBlackboard().newAnalysisResult(newArtifactType, newContentId,
newDataSourceId, Score.SCORE_NONE, newDataSourceId, Score.SCORE_NONE,
null, null, null, newAttrs).getAnalysisResult(); null, null, null, newAttrs).getAnalysisResult();
} else { } else {
newArtifact = portableSkCase.getBlackboard().newDataArtifact(newArtifactType, newContentId, newArtifact = portableSkCase.getBlackboard().newDataArtifact(newArtifactType, newContentId,
newDataSourceId, newDataSourceId,
newAttrs, null); newAttrs, null);
} }
} }
} catch (BlackboardException ex) { } catch (BlackboardException ex) {
throw new TskCoreException("Error copying artifact with ID: " + artifactToCopy.getId()); throw new TskCoreException("Error copying artifact with ID: " + artifactToCopy.getId());
} }
@ -1171,17 +1191,17 @@ public class PortableCaseReportModule implements ReportModule {
// Get or create the host (if needed) before beginning transaction. // Get or create the host (if needed) before beginning transaction.
Host newHost = null; Host newHost = null;
if (content instanceof DataSource) { if (content instanceof DataSource) {
newHost = copyHost(((DataSource)content).getHost()); newHost = copyHost(((DataSource) content).getHost());
} }
// Copy the associated OS account (if needed) before beginning transaction. // Copy the associated OS account (if needed) before beginning transaction.
if (content instanceof AbstractFile) { if (content instanceof AbstractFile) {
AbstractFile file = (AbstractFile) content; AbstractFile file = (AbstractFile) content;
if (file.getOsAccountObjectId().isPresent()) { if (file.getOsAccountObjectId().isPresent()) {
copyOsAccount(file.getOsAccountObjectId().get()); copyOsAccount(file.getOsAccountObjectId().get());
} }
} }
// Load the hashes if we have an image to avoid getting new connections with an open transaction. // Load the hashes if we have an image to avoid getting new connections with an open transaction.
String md5 = ""; String md5 = "";
String sha1 = ""; String sha1 = "";
@ -1191,7 +1211,7 @@ public class PortableCaseReportModule implements ReportModule {
sha1 = ((Image) content).getSha1(); sha1 = ((Image) content).getSha1();
sha256 = ((Image) content).getSha256(); sha256 = ((Image) content).getSha256();
} }
CaseDbTransaction trans = portableSkCase.beginTransaction(); CaseDbTransaction trans = portableSkCase.beginTransaction();
try { try {
if (content instanceof Image) { if (content instanceof Image) {
@ -1248,11 +1268,11 @@ public class PortableCaseReportModule implements ReportModule {
if (abstractFile.getOsAccountObjectId().isPresent()) { if (abstractFile.getOsAccountObjectId().isPresent()) {
newOsAccountId = oldOsAccountIdToNewOsAccount.get(abstractFile.getOsAccountObjectId().get()).getId(); newOsAccountId = oldOsAccountIdToNewOsAccount.get(abstractFile.getOsAccountObjectId().get()).getId();
} }
newContent = portableSkCase.addLocalFile(abstractFile.getName(), relativePath, abstractFile.getSize(), newContent = portableSkCase.addLocalFile(abstractFile.getName(), relativePath, abstractFile.getSize(),
abstractFile.getCtime(), abstractFile.getCrtime(), abstractFile.getAtime(), abstractFile.getMtime(), abstractFile.getCtime(), abstractFile.getCrtime(), abstractFile.getAtime(), abstractFile.getMtime(),
abstractFile.getMd5Hash(), abstractFile.getSha256Hash(), abstractFile.getKnown(), abstractFile.getMIMEType(), abstractFile.getMd5Hash(), abstractFile.getSha256Hash(), abstractFile.getKnown(), abstractFile.getMIMEType(),
true, TskData.EncodingType.NONE, true, TskData.EncodingType.NONE,
newOsAccountId, abstractFile.getOwnerUid().orElse(null), newOsAccountId, abstractFile.getOwnerUid().orElse(null),
newParent, trans); newParent, trans);
} catch (IOException ex) { } catch (IOException ex) {
@ -1276,14 +1296,16 @@ public class PortableCaseReportModule implements ReportModule {
newIdToContent.put(newContent.getId(), newContent); newIdToContent.put(newContent.getId(), newContent);
return oldIdToNewContent.get(content.getId()).getId(); return oldIdToNewContent.get(content.getId()).getId();
} }
/** /**
* Copy a host into the portable case and add it to the oldHostIdToNewHost map. * Copy a host into the portable case and add it to the oldHostIdToNewHost
* * map.
*
* @param oldHost The host to copy * @param oldHost The host to copy
* *
* @return The new host * @return The new host
* @throws TskCoreException *
* @throws TskCoreException
*/ */
private Host copyHost(Host oldHost) throws TskCoreException { private Host copyHost(Host oldHost) throws TskCoreException {
Host newHost; Host newHost;
@ -1295,11 +1317,11 @@ public class PortableCaseReportModule implements ReportModule {
} }
return newHost; return newHost;
} }
/** /**
* Copy an OS Account to the new case and add it to the oldOsAccountIdToNewOsAccountId map. * Copy an OS Account to the new case and add it to the
* Will also copy the associated realm. * oldOsAccountIdToNewOsAccountId map. Will also copy the associated realm.
* *
* @param oldOsAccountId The OS account id in the current case. * @param oldOsAccountId The OS account id in the current case.
*/ */
private OsAccount copyOsAccount(Long oldOsAccountId) throws TskCoreException { private OsAccount copyOsAccount(Long oldOsAccountId) throws TskCoreException {
@ -1307,19 +1329,19 @@ public class PortableCaseReportModule implements ReportModule {
if (oldOsAccountIdToNewOsAccount.containsKey(oldOsAccountId)) { if (oldOsAccountIdToNewOsAccount.containsKey(oldOsAccountId)) {
return oldOsAccountIdToNewOsAccount.get(oldOsAccountId); return oldOsAccountIdToNewOsAccount.get(oldOsAccountId);
} }
// Load the OS account from the current case. // Load the OS account from the current case.
OsAccountManager oldOsAcctManager = currentCase.getSleuthkitCase().getOsAccountManager(); OsAccountManager oldOsAcctManager = currentCase.getSleuthkitCase().getOsAccountManager();
OsAccount oldOsAccount = oldOsAcctManager.getOsAccountByObjectId(oldOsAccountId); OsAccount oldOsAccount = oldOsAcctManager.getOsAccountByObjectId(oldOsAccountId);
// Load the realm associated with the OS account. // Load the realm associated with the OS account.
OsAccountRealmManager oldRealmManager = currentCase.getSleuthkitCase().getOsAccountRealmManager(); OsAccountRealmManager oldRealmManager = currentCase.getSleuthkitCase().getOsAccountRealmManager();
OsAccountRealm oldRealm = oldRealmManager.getRealmByRealmId(oldOsAccount.getRealmId()); OsAccountRealm oldRealm = oldRealmManager.getRealmByRealmId(oldOsAccount.getRealmId());
// Copy the realm to the portable case if necessary. // Copy the realm to the portable case if necessary.
if (!oldRealmIdToNewRealm.containsKey(oldOsAccount.getRealmId())) { if (!oldRealmIdToNewRealm.containsKey(oldOsAccount.getRealmId())) {
OsAccountRealmManager newRealmManager = portableSkCase.getOsAccountRealmManager(); OsAccountRealmManager newRealmManager = portableSkCase.getOsAccountRealmManager();
Host newHost = null; Host newHost = null;
if (oldRealm.getScopeHost().isPresent()) { if (oldRealm.getScopeHost().isPresent()) {
Host host = oldRealm.getScopeHost().get(); Host host = oldRealm.getScopeHost().get();
@ -1334,7 +1356,7 @@ public class PortableCaseReportModule implements ReportModule {
throw new TskCoreException("Failed to copy OsAccountRealm with ID=" + oldOsAccount.getRealmId() + " because it is non-domain scoped but has no scope host"); throw new TskCoreException("Failed to copy OsAccountRealm with ID=" + oldOsAccount.getRealmId() + " because it is non-domain scoped but has no scope host");
} }
} }
// We currently only support one realm name. // We currently only support one realm name.
String realmName = null; String realmName = null;
List<String> names = oldRealm.getRealmNames(); List<String> names = oldRealm.getRealmNames();
@ -1349,11 +1371,11 @@ public class PortableCaseReportModule implements ReportModule {
throw new TskCoreException("Failed to copy OsAccountRealm with ID=" + oldOsAccount.getRealmId(), ex); throw new TskCoreException("Failed to copy OsAccountRealm with ID=" + oldOsAccount.getRealmId(), ex);
} }
} }
OsAccountManager newOsAcctManager = portableSkCase.getOsAccountManager(); OsAccountManager newOsAcctManager = portableSkCase.getOsAccountManager();
try { try {
OsAccount newOsAccount = newOsAcctManager.newWindowsOsAccount(oldOsAccount.getAddr().orElse(null), OsAccount newOsAccount = newOsAcctManager.newWindowsOsAccount(oldOsAccount.getAddr().orElse(null),
oldOsAccount.getLoginName().orElse(null), oldRealmIdToNewRealm.get(oldOsAccount.getRealmId())); oldOsAccount.getLoginName().orElse(null), oldRealmIdToNewRealm.get(oldOsAccount.getRealmId()));
oldOsAccountIdToNewOsAccount.put(oldOsAccountId, newOsAccount); oldOsAccountIdToNewOsAccount.put(oldOsAccountId, newOsAccount);
return newOsAccount; return newOsAccount;
} catch (NotUserSIDException ex) { } catch (NotUserSIDException ex) {
@ -1363,12 +1385,13 @@ public class PortableCaseReportModule implements ReportModule {
/** /**
* Copy path ID attribute to new case along with the referenced file. * Copy path ID attribute to new case along with the referenced file.
* *
* @param newArtifact The new artifact in the portable case. Should not have a TSK_PATH_ID attribute. * @param newArtifact The new artifact in the portable case. Should not have
* a TSK_PATH_ID attribute.
* @param oldArtifact The old artifact. * @param oldArtifact The old artifact.
* *
* @throws TskCoreException * @throws TskCoreException
*/ */
private void copyPathID(BlackboardArtifact newArtifact, BlackboardArtifact oldArtifact) throws TskCoreException { private void copyPathID(BlackboardArtifact newArtifact, BlackboardArtifact oldArtifact) throws TskCoreException {
// Get the path ID attribute // Get the path ID attribute
BlackboardAttribute oldPathIdAttr = oldArtifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID)); BlackboardAttribute oldPathIdAttr = oldArtifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
@ -1383,15 +1406,17 @@ public class PortableCaseReportModule implements ReportModule {
} }
} }
} }
/** /**
* Copy attachments to the portable case. * Copy attachments to the portable case.
* *
* @param newArtifact The new artifact in the portable case. Should not have a TSK_ATTACHMENTS attribute. * @param newArtifact The new artifact in the portable case. Should not have
* a TSK_ATTACHMENTS attribute.
* @param oldArtifact The old artifact. * @param oldArtifact The old artifact.
* @param newFile The new file in the portable case associated with the artifact. * @param newFile The new file in the portable case associated with the
* * artifact.
* @throws TskCoreException *
* @throws TskCoreException
*/ */
private void copyAttachments(BlackboardArtifact newArtifact, BlackboardArtifact oldArtifact, AbstractFile newFile) throws TskCoreException { private void copyAttachments(BlackboardArtifact newArtifact, BlackboardArtifact oldArtifact, AbstractFile newFile) throws TskCoreException {
// Get the attachments from TSK_ATTACHMENTS attribute. // Get the attachments from TSK_ATTACHMENTS attribute.
@ -1414,20 +1439,19 @@ public class PortableCaseReportModule implements ReportModule {
newFileAttachments.add(new MessageAttachments.FileAttachment(portableSkCase.getAbstractFileById(newFileID))); newFileAttachments.add(new MessageAttachments.FileAttachment(portableSkCase.getAbstractFileById(newFileID)));
} }
} }
// Get the name of the module(s) that created the attachment // Get the name of the module(s) that created the attachment
String newSourceStr = ""; String newSourceStr = "";
List<String> oldSources = attachmentsAttr.getSources(); List<String> oldSources = attachmentsAttr.getSources();
if (! oldSources.isEmpty()) { if (!oldSources.isEmpty()) {
newSourceStr = String.join(",", oldSources); newSourceStr = String.join(",", oldSources);
} }
// Add the attachment. The account type specified in the constructor will not be used. // Add the attachment. The account type specified in the constructor will not be used.
CommunicationArtifactsHelper communicationArtifactsHelper = new CommunicationArtifactsHelper(currentCase.getSleuthkitCase(), CommunicationArtifactsHelper communicationArtifactsHelper = new CommunicationArtifactsHelper(currentCase.getSleuthkitCase(),
newSourceStr, newFile, Account.Type.EMAIL); newSourceStr, newFile, Account.Type.EMAIL);
communicationArtifactsHelper.addAttachments(newArtifact, new MessageAttachments(newFileAttachments, msgAttachments.getUrlAttachments())); communicationArtifactsHelper.addAttachments(newArtifact, new MessageAttachments(newFileAttachments, msgAttachments.getUrlAttachments()));
} } catch (BlackboardJsonAttrUtil.InvalidJsonException ex) {
catch (BlackboardJsonAttrUtil.InvalidJsonException ex) {
throw new TskCoreException(String.format("Unable to parse json for MessageAttachments object in artifact: %s", oldArtifact.getName()), ex); throw new TskCoreException(String.format("Unable to parse json for MessageAttachments object in artifact: %s", oldArtifact.getName()), ex);
} }
} else { // backward compatibility - email message attachments are derived files, children of the message. } else { // backward compatibility - email message attachments are derived files, children of the message.
@ -1601,7 +1625,7 @@ public class PortableCaseReportModule implements ReportModule {
"PortableCaseReportModule.compressCase.errorCompressingCase=Error compressing case", "PortableCaseReportModule.compressCase.errorCompressingCase=Error compressing case",
"PortableCaseReportModule.compressCase.canceled=Compression canceled by user",}) "PortableCaseReportModule.compressCase.canceled=Compression canceled by user",})
private boolean compressCase(ReportProgressPanel progressPanel, String folderToCompress) { private boolean compressCase(ReportProgressPanel progressPanel, String folderToCompress) {
closePortableCaseDatabase(); closePortableCaseDatabase();
// Make a temporary folder for the compressed case // Make a temporary folder for the compressed case

4
Core/src/org/sleuthkit/autopsy/test/InterestingArtifactCreatorIngestModule.java
View File

@ -48,8 +48,8 @@ final class InterestingArtifactCreatorIngestModule extends FileIngestModuleAdapt
private static final String MODULE_NAME = InterestingArtifactCreatorIngestModuleFactory.getModuleName(); private static final String MODULE_NAME = InterestingArtifactCreatorIngestModuleFactory.getModuleName();
private static final String[] ARTIFACT_TYPE_NAMES = {"TSK_WEB_BOOKMARK", "TSK_KEYWORD_HIT", "TSK_CALLLOG"}; private static final String[] ARTIFACT_TYPE_NAMES = {"TSK_WEB_BOOKMARK", "TSK_KEYWORD_HIT", "TSK_CALLLOG"};
private static final String[] ARTIFACT_DISPLAY_NAMES = {"Web Bookmarks", "Keyword Hits", "Call Logs"}; private static final String[] ARTIFACT_DISPLAY_NAMES = {"Web Bookmarks", "Keyword Hits", "Call Logs"};
private static final String INT_ARTIFACT_TYPE_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getLabel(); private static final String INT_ARTIFACT_TYPE_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getLabel();
private static final String INT_ARTIFACT_DISPLAY_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName(); private static final String INT_ARTIFACT_DISPLAY_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getDisplayName();
private BlackboardArtifact.Type artifactType; private BlackboardArtifact.Type artifactType;
@Override @Override

2
Core/test/qa-functional/src/org/sleuthkit/autopsy/ingest/EmbeddedFileTest.java
View File

@ -134,7 +134,7 @@ public class EmbeddedFileTest extends NbTestCase {
ArrayList<BlackboardArtifact> artifacts = file.getAllArtifacts(); ArrayList<BlackboardArtifact> artifacts = file.getAllArtifacts();
assertEquals("Zip bomb " + file.getName() + " has incorrect number of artifacts", 1, artifacts.size()); assertEquals("Zip bomb " + file.getName() + " has incorrect number of artifacts", 1, artifacts.size());
for (BlackboardArtifact artifact : artifacts) { for (BlackboardArtifact artifact : artifacts) {
assertEquals("Artifact for Zip bomb " + file.getName() + " has incorrect type ID", artifact.getArtifactTypeID(), BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID()); assertEquals("Artifact for Zip bomb " + file.getName() + " has incorrect type ID", artifact.getArtifactTypeID(), BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID());
BlackboardAttribute attribute = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)); BlackboardAttribute attribute = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME));
assertNotNull("No attribute found for artifact on zip bomb " + file.getName(), attribute); assertNotNull("No attribute found for artifact on zip bomb " + file.getName(), attribute);
assertEquals("Interesting artifact on file, " + file.getName() + ", does not reflect it being a zip bomb", zipBombSetName, attribute.getDisplayString()); assertEquals("Interesting artifact on file, " + file.getName() + ", does not reflect it being a zip bomb", zipBombSetName, attribute.getDisplayString());

4
Experimental/src/org/sleuthkit/autopsy/experimental/volatilityDSP/VolatilityProcessor.java
View File

@ -381,9 +381,9 @@ class VolatilityProcessor {
Collection<BlackboardAttribute> attributes = singleton(new BlackboardAttribute(TSK_SET_NAME, VOLATILITY, setName)); Collection<BlackboardAttribute> attributes = singleton(new BlackboardAttribute(TSK_SET_NAME, VOLATILITY, setName));
// Create artifact if it doesn't already exist. // Create artifact if it doesn't already exist.
if (!blackboard.artifactExists(resolvedFile, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, attributes)) { if (!blackboard.artifactExists(resolvedFile, BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM, attributes)) {
BlackboardArtifact volArtifact = resolvedFile.newAnalysisResult( BlackboardArtifact volArtifact = resolvedFile.newAnalysisResult(
BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT, Score.SCORE_LIKELY_NOTABLE, BlackboardArtifact.Type.TSK_INTERESTING_ITEM, Score.SCORE_LIKELY_NOTABLE,
null, setName, null, null, setName, null,
attributes) attributes)
.getAnalysisResult(); .getAnalysisResult();

8
docs/doxygen/modFileIngestTutorial.dox
View File

@ -82,9 +82,9 @@ Now that we have found the files, we want to do something with them. In our situ
A list of standard artifact types can be found in the <a href="http://sleuthkit.org/sleuthkit/docs/jni-docs/latest/artifact_catalog_page.html">artifact catalog</a>. It is important to note the catagory for the artifact you want to since this affects which method you will use to create the artifact. A list of standard artifact types can be found in the <a href="http://sleuthkit.org/sleuthkit/docs/jni-docs/latest/artifact_catalog_page.html">artifact catalog</a>. It is important to note the catagory for the artifact you want to since this affects which method you will use to create the artifact.
For our example, we are going to make an artifact of type "TSK_INTERESTING_FILE", which is an analysis result, whenever we find a big and round file. These are one of the most generic artifact types and are simply a way of alerting the user that a file is interesting for some reason. Once you make the artifact, it will be shown in the UI. The below code makes an artifact for the file and puts it into the set of "Big and Round Files". You can create whatever set names you want. The Autopsy GUI organizes Interesting Files by their set name. For our example, we are going to make an artifact of type "TSK_INTERESTING_ITEM", which is an analysis result, whenever we find a big and round file. These are one of the most generic artifact types and are simply a way of alerting the user that a file is interesting for some reason. Once you make the artifact, it will be shown in the UI. The below code makes an artifact for the file and puts it into the set of "Big and Round Files". You can create whatever set names you want. The Autopsy GUI organizes Interesting Files by their set name.
\verbatim \verbatim
art = file.newAnalysisResult(BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT, Score.SCORE_LIKELY_NOTABLE, art = file.newAnalysisResult(BlackboardArtifact.Type.TSK_INTERESTING_ITEM, Score.SCORE_LIKELY_NOTABLE,
None, "Big and Round Files", None, None, "Big and Round Files", None,
Arrays.asList( Arrays.asList(
BlackboardAttribute(BlackboardAttribute.Type.TSK_SET_NAME, BlackboardAttribute(BlackboardAttribute.Type.TSK_SET_NAME,
@ -111,9 +111,9 @@ That's it. Your process() method should look something like this:
# Look for files bigger than 10MB that are a multiple of 4096 # Look for files bigger than 10MB that are a multiple of 4096
if ((file.getSize() > 10485760) and ((file.getSize() % 4096) == 0)): if ((file.getSize() > 10485760) and ((file.getSize() % 4096) == 0)):
# Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of # Make an artifact on the blackboard. TSK_INTERESTING_ITEM is a generic type of
# artifact. Refer to the developer docs for other examples. # artifact. Refer to the developer docs for other examples.
art = file.newAnalysisResult(BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT, Score.SCORE_LIKELY_NOTABLE, art = file.newAnalysisResult(BlackboardArtifact.Type.TSK_INTERESTING_ITEM, Score.SCORE_LIKELY_NOTABLE,
None, "Big and Round Files", None, None, "Big and Round Files", None,
Arrays.asList( Arrays.asList(
BlackboardAttribute(BlackboardAttribute.Type.TSK_SET_NAME, BlackboardAttribute(BlackboardAttribute.Type.TSK_SET_NAME,

4
pythonExamples/July2015FileTutorial_BigRound/FindBigRoundFiles.py
View File

@ -120,9 +120,9 @@ class FindBigRoundFilesIngestModule(FileIngestModule):
# Look for files bigger than 10MB that are a multiple of 4096 # Look for files bigger than 10MB that are a multiple of 4096
if ((file.getSize() > 10485760) and ((file.getSize() % 4096) == 0)): if ((file.getSize() > 10485760) and ((file.getSize() % 4096) == 0)):
# Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of # Make an artifact on the blackboard. TSK_INTERESTING_ITEM is a generic type of
# artifact. Refer to the developer docs for other examples. # artifact. Refer to the developer docs for other examples.
art = file.newAnalysisResult(BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT, Score.SCORE_LIKELY_NOTABLE, art = file.newAnalysisResult(BlackboardArtifact.Type.TSK_INTERESTING_ITEM, Score.SCORE_LIKELY_NOTABLE,
None, "Big and Round Files", None, None, "Big and Round Files", None,
Arrays.asList( Arrays.asList(
BlackboardAttribute(BlackboardAttribute.Type.TSK_SET_NAME, BlackboardAttribute(BlackboardAttribute.Type.TSK_SET_NAME,

6
pythonExamples/dataSourceIngestModule.py
View File

@ -137,12 +137,12 @@ class SampleJythonDataSourceIngestModule(DataSourceIngestModule):
self.log(Level.INFO, "Processing file: " + file.getName()) self.log(Level.INFO, "Processing file: " + file.getName())
fileCount += 1 fileCount += 1
# Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of # Make an artifact on the blackboard. TSK_INTERESTING_ITEM is a generic type of
# artfiact. Refer to the developer docs for other examples. # artifact. Refer to the developer docs for other examples.
attrs = Arrays.asList(BlackboardAttribute(BlackboardAttribute.Type.TSK_SET_NAME, attrs = Arrays.asList(BlackboardAttribute(BlackboardAttribute.Type.TSK_SET_NAME,
SampleJythonDataSourceIngestModuleFactory.moduleName, SampleJythonDataSourceIngestModuleFactory.moduleName,
"Test file")) "Test file"))
art = file.newAnalysisResult(BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT, Score.SCORE_LIKELY_NOTABLE, art = file.newAnalysisResult(BlackboardArtifact.Type.TSK_INTERESTING_ITEM, Score.SCORE_LIKELY_NOTABLE,
None, "Test file", None, attrs).getAnalysisResult() None, "Test file", None, attrs).getAnalysisResult()
try: try:

6
pythonExamples/fileIngestModule.py
View File

@ -125,12 +125,12 @@ class SampleJythonFileIngestModule(FileIngestModule):
self.log(Level.INFO, "Found a text file: " + file.getName()) self.log(Level.INFO, "Found a text file: " + file.getName())
self.filesFound+=1 self.filesFound+=1
# Make an artifact on the blackboard. TSK_INTERESTING_FILE_HIT is a generic type of # Make an artifact on the blackboard. TSK_INTERESTING_ITEM is a generic type of
# artifact. Refer to the developer docs for other examples. # artifact. Refer to the developer docs for other examples.
attrs = Arrays.asList(BlackboardAttribute(BlackboardAttribute.Type.TSK_SET_NAME, attrs = Arrays.asList(BlackboardAttribute(BlackboardAttribute.Type.TSK_SET_NAME,
SampleJythonFileIngestModuleFactory.moduleName, "Text Files")) SampleJythonFileIngestModuleFactory.moduleName, "Text Files"))
art = file.newAnalysisResult(BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT, Score.SCORE_LIKELY_NOTABLE, art = file.newAnalysisResult(BlackboardArtifact.Type.TSK_INTERESTING_ITEM, Score.SCORE_LIKELY_NOTABLE,
None, "Text Files", None, attrs).getAnalysisResult() None, "Text Files", None, attrs).getAnalysisResult()
try: try:
@ -142,7 +142,7 @@ class SampleJythonFileIngestModule(FileIngestModule):
# For the example (this wouldn't be needed normally), we'll query the blackboard for data that was added # For the example (this wouldn't be needed normally), we'll query the blackboard for data that was added
# by other modules. We then iterate over its attributes. We'll just print them, but you would probably # by other modules. We then iterate over its attributes. We'll just print them, but you would probably
# want to do something with them. # want to do something with them.
artifactList = file.getArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT) artifactList = file.getArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM)
for artifact in artifactList: for artifact in artifactList:
attributeList = artifact.getAttributes() attributeList = artifact.getAttributes()
for attrib in attributeList: for attrib in attributeList: