Autopsy  4.10.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.report.CreatePortableCaseModule Class Reference

Inherits org.sleuthkit.autopsy.report.GeneralReportModule.

Classes

class  StoreMaxIdCallback
 

Public Member Functions

 CreatePortableCaseModule ()
 
void generateReport (String reportPath, ReportProgressPanel progressPanel)
 
JPanel getConfigurationPanel ()
 
String getDescription ()
 
String getName ()
 
String getRelativeFilePath ()
 

Private Member Functions

void addArtifactsToPortableCase (TagName oldTagName, ReportProgressPanel progressPanel) throws TskCoreException
 
void addFilesToPortableCase (TagName oldTagName, ReportProgressPanel progressPanel) throws TskCoreException
 
void cleanup ()
 
BlackboardArtifact copyArtifact (long newContentId, BlackboardArtifact artifactToCopy) throws TskCoreException
 
long copyContent (Content content, CaseDbTransaction trans) throws TskCoreException
 
long copyContentToPortableCase (Content content, ReportProgressPanel progressPanel) throws TskCoreException
 
void createCase (File outputDir, ReportProgressPanel progressPanel)
 
String getExportSubfolder (AbstractFile abstractFile)
 
int getNewArtifactTypeId (BlackboardArtifact oldArtifact) throws TskCoreException
 
BlackboardAttribute.Type getNewAttributeType (BlackboardAttribute oldAttribute) throws TskCoreException
 
void handleError (String logWarning, String dialogWarning, Exception ex, ReportProgressPanel progressPanel)
 
void saveHighestIds () throws TskCoreException
 

Private Attributes

File caseFolder = null
 
CreatePortableCasePanel configPanel
 
File copiedFilesFolder = null
 
Case currentCase = null
 
final Map< Long, Content > newIdToContent = new HashMap<>()
 
final Map< Long, BlackboardArtifact > oldArtifactIdToNewArtifact = new HashMap<>()
 
final Map< Integer, Integer > oldArtTypeIdToNewArtTypeId = new HashMap<>()
 
final Map< Integer, BlackboardAttribute.Type > oldAttrTypeIdToNewAttrType = new HashMap<>()
 
final Map< Long, Content > oldIdToNewContent = new HashMap<>()
 
final Map< TagName, TagName > oldTagNameToNewTagName = new HashMap<>()
 
SleuthkitCase portableSkCase = null
 

Static Private Attributes

static final String FILE_FOLDER_NAME = "PortableCaseFiles"
 
static final List< FileTypeCategoryFILE_TYPE_CATEGORIES
 
static final Logger logger = Logger.getLogger(CreatePortableCaseModule.class.getName())
 
static final String MAX_ID_TABLE_NAME = "portable_case_max_ids"
 
static final String UNKNOWN_FILE_TYPE_FOLDER = "Other"
 

Detailed Description

Creates a portable case from tagged files

Definition at line 65 of file CreatePortableCaseModule.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.report.CreatePortableCaseModule.CreatePortableCaseModule ( )

Definition at line 99 of file CreatePortableCaseModule.java.

Member Function Documentation

void org.sleuthkit.autopsy.report.CreatePortableCaseModule.addArtifactsToPortableCase ( TagName  oldTagName,
ReportProgressPanel  progressPanel 
) throws TskCoreException
private
void org.sleuthkit.autopsy.report.CreatePortableCaseModule.addFilesToPortableCase ( TagName  oldTagName,
ReportProgressPanel  progressPanel 
) throws TskCoreException
private
void org.sleuthkit.autopsy.report.CreatePortableCaseModule.cleanup ( )
private

Clear out the maps and other fields and close the database connections.

Definition at line 707 of file CreatePortableCaseModule.java.

References org.sleuthkit.autopsy.casemodule.Case.close().

BlackboardArtifact org.sleuthkit.autopsy.report.CreatePortableCaseModule.copyArtifact ( long  newContentId,
BlackboardArtifact  artifactToCopy 
) throws TskCoreException
private

Copy an artifact into the new case. Will also copy any associated artifacts

Parameters
newContentIdThe content ID (in the portable case) of the source content
artifactToCopyThe artifact to copy
Returns
The new artifact in the portable case
Exceptions
TskCoreException

Definition at line 454 of file CreatePortableCaseModule.java.

References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

long org.sleuthkit.autopsy.report.CreatePortableCaseModule.copyContent ( Content  content,
CaseDbTransaction  trans 
) throws TskCoreException
private

Returns the object ID for the given content object in the portable case.

Parameters
contentThe content object to copy into the portable case
transThe current transaction
Returns
the new object ID for this content
Exceptions
TskCoreException

Definition at line 603 of file CreatePortableCaseModule.java.

References org.sleuthkit.autopsy.coreutils.FileUtil.escapeFileName(), and org.sleuthkit.autopsy.datamodel.ContentUtils.writeToFile().

long org.sleuthkit.autopsy.report.CreatePortableCaseModule.copyContentToPortableCase ( Content  content,
ReportProgressPanel  progressPanel 
) throws TskCoreException
private

Top level method to copy a content object to the portable case.

Parameters
contentThe content object to copy
progressPanelThe progress panel
Returns
The object ID of the copied content in the portable case
Exceptions
TskCoreException

Definition at line 578 of file CreatePortableCaseModule.java.

References org.sleuthkit.autopsy.report.ReportProgressPanel.updateStatusLabel().

void org.sleuthkit.autopsy.report.CreatePortableCaseModule.createCase ( File  outputDir,
ReportProgressPanel  progressPanel 
)
private

Create the case directory and case database. portableSkCase will be set if this completes without error.

Parameters
outputDirThe parent for the case folder
progressPanel

Definition at line 299 of file CreatePortableCaseModule.java.

References org.sleuthkit.autopsy.casemodule.Case.createPortableCase(), and org.sleuthkit.autopsy.casemodule.Case.getDisplayName().

void org.sleuthkit.autopsy.report.CreatePortableCaseModule.generateReport ( String  baseReportDir,
ReportProgressPanel  progressPanel 
)
JPanel org.sleuthkit.autopsy.report.CreatePortableCaseModule.getConfigurationPanel ( )

Definition at line 725 of file CreatePortableCaseModule.java.

String org.sleuthkit.autopsy.report.CreatePortableCaseModule.getDescription ( )

Definition at line 115 of file CreatePortableCaseModule.java.

String org.sleuthkit.autopsy.report.CreatePortableCaseModule.getExportSubfolder ( AbstractFile  abstractFile)
private

Return the subfolder name for this file based on MIME type

Parameters
abstractFilethe file
Returns
the name of the appropriate subfolder for this file type

Definition at line 691 of file CreatePortableCaseModule.java.

String org.sleuthkit.autopsy.report.CreatePortableCaseModule.getName ( )

Definition at line 107 of file CreatePortableCaseModule.java.

int org.sleuthkit.autopsy.report.CreatePortableCaseModule.getNewArtifactTypeId ( BlackboardArtifact  oldArtifact) throws TskCoreException
private

Get the artifact type ID in the portable case and create new artifact type if needed. For built-in artifacts this will be the same as the original.

Parameters
oldArtifactTypeIdThe artifact type ID in the current case
Returns
The corresponding artifact type ID in the portable case

Definition at line 525 of file CreatePortableCaseModule.java.

References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

BlackboardAttribute.Type org.sleuthkit.autopsy.report.CreatePortableCaseModule.getNewAttributeType ( BlackboardAttribute  oldAttribute) throws TskCoreException
private

Get the attribute type ID in the portable case and create new attribute type if needed. For built-in attributes this will be the same as the original.

Parameters
oldAttributeTypeIdThe attribute type ID in the current case
Returns
The corresponding attribute type in the portable case

Definition at line 548 of file CreatePortableCaseModule.java.

String org.sleuthkit.autopsy.report.CreatePortableCaseModule.getRelativeFilePath ( )

Definition at line 120 of file CreatePortableCaseModule.java.

void org.sleuthkit.autopsy.report.CreatePortableCaseModule.handleError ( String  logWarning,
String  dialogWarning,
Exception  ex,
ReportProgressPanel  progressPanel 
)
private

Convenience method to avoid code duplication. Assumes that if an exception is supplied then the error is SEVERE. Otherwise it is logged as a WARNING.

Parameters
logWarningWarning to write to the log
dialogWarningWarning to write to a pop-up window
exThe exception (can be null)
progressPanelThe report progress panel

Definition at line 134 of file CreatePortableCaseModule.java.

References org.sleuthkit.autopsy.report.ReportProgressPanel.complete(), org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.ERROR, org.sleuthkit.autopsy.coreutils.MessageNotifyUtil.Message.error(), and org.sleuthkit.autopsy.report.ReportProgressPanel.setIndeterminate().

void org.sleuthkit.autopsy.report.CreatePortableCaseModule.saveHighestIds ( ) throws TskCoreException
private

Save the current highest IDs to the portable case.

Exceptions
TskCoreException

Definition at line 360 of file CreatePortableCaseModule.java.

References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Member Data Documentation

File org.sleuthkit.autopsy.report.CreatePortableCaseModule.caseFolder = null
private

Definition at line 78 of file CreatePortableCaseModule.java.

CreatePortableCasePanel org.sleuthkit.autopsy.report.CreatePortableCaseModule.configPanel
private

Definition at line 70 of file CreatePortableCaseModule.java.

File org.sleuthkit.autopsy.report.CreatePortableCaseModule.copiedFilesFolder = null
private

Definition at line 79 of file CreatePortableCaseModule.java.

Case org.sleuthkit.autopsy.report.CreatePortableCaseModule.currentCase = null
private

Definition at line 76 of file CreatePortableCaseModule.java.

final String org.sleuthkit.autopsy.report.CreatePortableCaseModule.FILE_FOLDER_NAME = "PortableCaseFiles"
staticprivate

Definition at line 67 of file CreatePortableCaseModule.java.

final List<FileTypeCategory> org.sleuthkit.autopsy.report.CreatePortableCaseModule.FILE_TYPE_CATEGORIES
staticprivate
Initial value:
= Arrays.asList(FileTypeCategory.AUDIO, FileTypeCategory.DOCUMENTS,
FileTypeCategory.EXECUTABLE, FileTypeCategory.IMAGE, FileTypeCategory.VIDEO)

Definition at line 73 of file CreatePortableCaseModule.java.

final Logger org.sleuthkit.autopsy.report.CreatePortableCaseModule.logger = Logger.getLogger(CreatePortableCaseModule.class.getName())
staticprivate

Definition at line 66 of file CreatePortableCaseModule.java.

final String org.sleuthkit.autopsy.report.CreatePortableCaseModule.MAX_ID_TABLE_NAME = "portable_case_max_ids"
staticprivate

Definition at line 69 of file CreatePortableCaseModule.java.

final Map<Long, Content> org.sleuthkit.autopsy.report.CreatePortableCaseModule.newIdToContent = new HashMap<>()
private

Definition at line 85 of file CreatePortableCaseModule.java.

final Map<Long, BlackboardArtifact> org.sleuthkit.autopsy.report.CreatePortableCaseModule.oldArtifactIdToNewArtifact = new HashMap<>()
private

Definition at line 97 of file CreatePortableCaseModule.java.

final Map<Integer, Integer> org.sleuthkit.autopsy.report.CreatePortableCaseModule.oldArtTypeIdToNewArtTypeId = new HashMap<>()
private

Definition at line 91 of file CreatePortableCaseModule.java.

final Map<Integer, BlackboardAttribute.Type> org.sleuthkit.autopsy.report.CreatePortableCaseModule.oldAttrTypeIdToNewAttrType = new HashMap<>()
private

Definition at line 94 of file CreatePortableCaseModule.java.

final Map<Long, Content> org.sleuthkit.autopsy.report.CreatePortableCaseModule.oldIdToNewContent = new HashMap<>()
private

Definition at line 82 of file CreatePortableCaseModule.java.

final Map<TagName, TagName> org.sleuthkit.autopsy.report.CreatePortableCaseModule.oldTagNameToNewTagName = new HashMap<>()
private

Definition at line 88 of file CreatePortableCaseModule.java.

SleuthkitCase org.sleuthkit.autopsy.report.CreatePortableCaseModule.portableSkCase = null
private

Definition at line 77 of file CreatePortableCaseModule.java.

final String org.sleuthkit.autopsy.report.CreatePortableCaseModule.UNKNOWN_FILE_TYPE_FOLDER = "Other"
staticprivate

Definition at line 68 of file CreatePortableCaseModule.java.


The documentation for this class was generated from the following file:

Copyright © 2012-2018 Basis Technology. Generated on: Fri Mar 22 2019
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.