Autopsy  4.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
ArtifactStringContent.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2016 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 import java.text.SimpleDateFormat;
22 import java.util.Arrays;
23 import java.util.TimeZone;
24 import java.util.logging.Level;
25 
26 import org.openide.util.NbBundle;
27 import org.sleuthkit.autopsy.coreutils.Logger;
28 import org.sleuthkit.datamodel.BlackboardArtifact;
29 import org.sleuthkit.datamodel.BlackboardAttribute;
30 import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
31 import org.sleuthkit.datamodel.Content;
32 import org.sleuthkit.datamodel.TskCoreException;
33 import org.sleuthkit.datamodel.TskException;
34 
41 public class ArtifactStringContent implements StringContent {
42 
43  BlackboardArtifact artifact;
44  private String stringContent = "";
45  static final Logger logger = Logger.getLogger(ArtifactStringContent.class.getName());
46  private static SimpleDateFormat dateFormatter = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
47 
48  public ArtifactStringContent(BlackboardArtifact art) {
49  artifact = art;
50  }
51 
52  @Override
53  @SuppressWarnings("deprecation")
54  public String getString() {
55  if (stringContent.isEmpty()) {
56  try {
57  StringBuilder buffer = new StringBuilder();
58  buffer.append("<html>\n"); //NON-NLS
59  buffer.append("<body>\n"); //NON-NLS
60 
61  // artifact name header
62  buffer.append("<h4>"); //NON-NLS
63  buffer.append(artifact.getDisplayName());
64  buffer.append("</h4>\n"); //NON-NLS
65 
66  // start table for attributes
67  buffer.append("<table border='0'>"); //NON-NLS
68  buffer.append("<tr>"); //NON-NLS
69  buffer.append("</tr>\n"); //NON-NLS
70 
71  // cycle through each attribute and display in a row in the table.
72  for (BlackboardAttribute attr : artifact.getAttributes()) {
73 
74  // name column
75  buffer.append("<tr><td>"); //NON-NLS
76  buffer.append(attr.getAttributeType().getDisplayName());
77  buffer.append("</td>"); //NON-NLS
78 
79  // value column
80  buffer.append("<td>"); //NON-NLS
81  if (attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID()
82  || attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID()
83  || attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_CREATED.getTypeID()
84  || attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_MODIFIED.getTypeID()
85  || attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_RCVD.getTypeID()
86  || attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_SENT.getTypeID()
87  || attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_START.getTypeID()
88  || attr.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_END.getTypeID()) {
89  long epoch = attr.getValueLong();
90  String time = "0000-00-00 00:00:00";
91  if (epoch != 0) {
92  dateFormatter.setTimeZone(getTimeZone(artifact));
93  time = dateFormatter.format(new java.util.Date(epoch * 1000));
94  }
95  buffer.append(time);
96  } else {
97  switch (attr.getAttributeType().getValueType()) {
98  case STRING:
99  String str = attr.getValueString();
100  str = str.replaceAll(" ", "&nbsp;"); //NON-NLS
101  str = str.replaceAll("<", "&lt;"); //NON-NLS
102  str = str.replaceAll(">", "&gt;"); //NON-NLS
103  str = str.replaceAll("(\r\n|\n)", "<br />"); //NON-NLS
104  buffer.append(str);
105  break;
106  case INTEGER:
107  buffer.append(attr.getValueInt());
108  break;
109  case LONG:
110  buffer.append(attr.getValueLong());
111  break;
112  case DOUBLE:
113  buffer.append(attr.getValueDouble());
114  break;
115  case BYTE:
116  buffer.append(Arrays.toString(attr.getValueBytes()));
117  break;
118  case DATETIME:
119  buffer.append(attr.getValueLong());
120  break;
121 
122  }
123  }
124  if (!"".equals(attr.getContext())) {
125  buffer.append(" (");
126  buffer.append(attr.getContext());
127  buffer.append(")");
128  }
129  buffer.append("</td>"); //NON-NLS
130  buffer.append("</tr>\n"); //NON-NLS
131  }
132 
133  final Content content = getAssociatedContent(artifact);
134 
135  String path = "";
136  try {
137  path = content.getUniquePath();
138  } catch (TskCoreException ex) {
139  logger.log(Level.SEVERE, "Exception while calling Content.getUniquePath() on {0} : {1}", new Object[]{content, ex.getLocalizedMessage()}); //NON-NLS
140  }
141 
142  //add file path
143  buffer.append("<tr>"); //NON-NLS
144  buffer.append("<td>"); //NON-NLS
145  buffer.append(NbBundle.getMessage(this.getClass(), "ArtifactStringContent.getStr.srcFilePath.text"));
146  buffer.append("</td>"); //NON-NLS
147  buffer.append("<td>"); //NON-NLS
148  buffer.append(path);
149  buffer.append("</td>"); //NON-NLS
150  buffer.append("</tr>\n"); //NON-NLS
151 
152  // add artifact ID (useful for debugging)
153  buffer.append("<tr><td>"); //NON-NLS
154  buffer.append(NbBundle.getMessage(this.getClass(), "ArtifactStringContent.getStr.artifactId.text"));
155  buffer.append("</td><td>"); //NON-NLS
156  buffer.append(artifact.getArtifactID());
157  buffer.append("</td>"); //NON-NLS
158  buffer.append("</tr>\n"); //NON-NLS
159 
160  buffer.append("</table>"); //NON-NLS
161  buffer.append("</html>\n"); //NON-NLS
162 
163  stringContent = buffer.toString();
164  } catch (TskException ex) {
165  stringContent = NbBundle.getMessage(this.getClass(), "ArtifactStringContent.getStr.err");
166  }
167  }
168 
169  return stringContent;
170  }
171 
172  private static Content getAssociatedContent(BlackboardArtifact artifact) {
173  try {
174  return artifact.getSleuthkitCase().getContentById(artifact.getObjectID());
175  } catch (TskException ex) {
176  logger.log(Level.WARNING, "Getting file failed", ex); //NON-NLS
177  }
178  throw new IllegalArgumentException(NbBundle.getMessage(ArtifactStringContent.class, "ArtifactStringContent.exception.msg"));
179  }
180 
181  private static TimeZone getTimeZone(BlackboardArtifact artifact) {
182  return ContentUtils.getTimeZone(getAssociatedContent(artifact));
183 
184  }
185 }
org.sleuthkit.autopsy.datamodel.ArtifactStringContent.dateFormatter
static SimpleDateFormat dateFormatter
Definition: ArtifactStringContent.java:46
org.sleuthkit.autopsy.datamodel.ContentUtils
Definition: ContentUtils.java:51
org.sleuthkit.autopsy.datamodel.StringContent
Definition: StringContent.java:13
org.sleuthkit.autopsy.datamodel.ArtifactStringContent.getAssociatedContent
static Content getAssociatedContent(BlackboardArtifact artifact)
Definition: ArtifactStringContent.java:172
org.sleuthkit.autopsy.datamodel.ArtifactStringContent.getString
String getString()
Definition: ArtifactStringContent.java:54
org.sleuthkit.autopsy.datamodel.ArtifactStringContent
Definition: ArtifactStringContent.java:41
org.sleuthkit.autopsy.datamodel.ArtifactStringContent.getTimeZone
static TimeZone getTimeZone(BlackboardArtifact artifact)
Definition: ArtifactStringContent.java:181
org.sleuthkit.autopsy.datamodel.ArtifactStringContent.stringContent
String stringContent
Definition: ArtifactStringContent.java:44
org.sleuthkit.autopsy.coreutils.Logger.getLogger
synchronized static Logger getLogger(String name)
Definition: Logger.java:166
org.sleuthkit.autopsy.datamodel.ContentUtils.getTimeZone
static TimeZone getTimeZone(Content c)
Definition: ContentUtils.java:130
org.sleuthkit.autopsy.datamodel.ArtifactStringContent.ArtifactStringContent
ArtifactStringContent(BlackboardArtifact art)
Definition: ArtifactStringContent.java:48

Copyright © 2012-2015 Basis Technology. Generated on: Wed Apr 6 2016
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.