19 package org.sleuthkit.autopsy.report.infrastructure;
22 import com.google.common.collect.ListMultimap;
23 import com.google.common.collect.Lists;
24 import com.google.common.collect.Multimaps;
25 import java.sql.ResultSet;
26 import java.sql.SQLException;
27 import java.util.ArrayList;
28 import java.util.Arrays;
29 import java.util.Collection;
30 import java.util.Collections;
31 import java.util.Comparator;
32 import java.util.HashMap;
33 import java.util.HashSet;
34 import java.util.Iterator;
35 import java.util.List;
37 import java.util.Objects;
39 import java.util.TreeSet;
40 import java.util.logging.Level;
41 import org.openide.util.NbBundle;
42 import org.openide.util.NbBundle.Messages;
64 class TableReportGenerator {
66 private List<BlackboardArtifact.Type> artifactTypes =
new ArrayList<>();
67 private HashSet<String> tagNamesFilter =
new HashSet<>();
69 private final Set<Content> images =
new HashSet<>();
70 private final ReportProgressPanel progressPanel;
71 private final TableReportModule tableReport;
72 private final TableReportSettings settings;
73 private final Map<Integer, List<Column>> columnHeaderMap;
74 private static final Logger logger = Logger.getLogger(TableReportGenerator.class.getName());
76 private final List<String> errorList;
78 TableReportGenerator(TableReportSettings settings, ReportProgressPanel progressPanel, TableReportModule tableReport) {
80 this.progressPanel = progressPanel;
81 this.tableReport = tableReport;
82 this.columnHeaderMap =
new HashMap<>();
83 errorList =
new ArrayList<>();
84 this.settings = settings;
87 private void getAllExistingTags() throws NoCurrentCaseException, TskCoreException {
88 List<String> tagNames =
new ArrayList<>();
91 List<TagName> tagNamesInUse = Case.getCurrentCaseThrows().getServices().getTagsManager().getTagNamesInUse();
93 String notableString =
"";
94 for (TagName tagName : tagNamesInUse) {
95 notableString = tagName.getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() :
"";
96 tagNames.add(tagName.getDisplayName() + notableString);
98 tagNamesFilter =
new HashSet<>(tagNames);
101 @SuppressWarnings(
"deprecation")
102 private
void getAllExistingArtiactTypes() throws NoCurrentCaseException, TskCoreException {
104 ArrayList<BlackboardArtifact.Type> doNotReport =
new ArrayList<>();
105 doNotReport.add(
new BlackboardArtifact.Type(BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.getTypeID(),
106 BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.getLabel(),
107 BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO.getDisplayName()));
108 doNotReport.add(
new BlackboardArtifact.Type(BlackboardArtifact.ARTIFACT_TYPE.TSK_TOOL_OUTPUT.getTypeID(),
109 BlackboardArtifact.ARTIFACT_TYPE.TSK_TOOL_OUTPUT.getLabel(),
110 BlackboardArtifact.ARTIFACT_TYPE.TSK_TOOL_OUTPUT.getDisplayName()));
111 doNotReport.add(
new BlackboardArtifact.Type(
112 BlackboardArtifact.ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT.getTypeID(),
113 BlackboardArtifact.ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT.getLabel(),
114 BlackboardArtifact.ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT.getDisplayName()));
115 doNotReport.add(
new BlackboardArtifact.Type(
116 BlackboardArtifact.ARTIFACT_TYPE.TSK_TL_EVENT.getTypeID(),
117 BlackboardArtifact.ARTIFACT_TYPE.TSK_TL_EVENT.getLabel(),
118 BlackboardArtifact.ARTIFACT_TYPE.TSK_TL_EVENT.getDisplayName()));
120 Case.getCurrentCaseThrows().getSleuthkitCase().getArtifactTypes().forEach(artifactTypes::add);
121 artifactTypes.removeAll(doNotReport);
124 protected void execute() {
126 progressPanel.start();
127 progressPanel.updateStatusLabel(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.readingTagsArtifacts.text"));
129 if (settings.useStoredTagsAndArtifactsLists()) {
131 artifactTypes = settings.getArtifactSelections();
134 tagNamesFilter =
new HashSet<>(settings.getTagSelections());
139 if (settings.getSelectedReportOption() == TableReportSettings.TableReportOption.ALL_TAGGED_RESULTS) {
140 getAllExistingTags();
144 getAllExistingArtiactTypes();
145 }
catch (NoCurrentCaseException | TskCoreException ex) {
146 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAllTagsArtifacts"));
147 logger.log(Level.SEVERE,
"Failed get all possible tag names and artifact types", ex);
153 progressPanel.setIndeterminate(
false);
154 progressPanel.setMaximumProgress(this.artifactTypes.size() + 2);
157 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
158 makeBlackboardArtifactTables();
162 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
163 makeContentTagsTables();
166 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
167 makeBlackboardArtifactTagsTables();
170 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
172 makeThumbnailTable();
179 private void makeBlackboardArtifactTables() {
182 if (!tagNamesFilter.isEmpty()) {
183 comment += NbBundle.getMessage(this.getClass(),
"ReportGenerator.artifactTable.taggedResults.text");
184 comment += makeCommaSeparatedList(tagNamesFilter);
188 for (BlackboardArtifact.Type type : artifactTypes) {
191 if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
195 progressPanel.updateStatusLabel(
196 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
197 type.getDisplayName()));
200 if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
201 writeKeywordHits(tableReport, comment, tagNamesFilter);
203 }
else if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
204 writeHashsetHits(tableReport, comment, tagNamesFilter);
208 List<ArtifactData> artifactList = getFilteredArtifacts(type, tagNamesFilter);
210 if (artifactList.isEmpty()) {
219 if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
221 ListMultimap<String, ArtifactData> groupedArtifacts = Multimaps.index(artifactList,
224 return artifactData.getArtifact().getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE)).getValueString();
225 }
catch (TskCoreException ex) {
226 logger.log(Level.SEVERE,
"Unable to get value of TSK_ACCOUNT_TYPE attribute. Defaulting to \"unknown\"", ex);
230 for (String accountTypeStr : groupedArtifacts.keySet()) {
237 String accountDisplayname = accountTypeStr;
238 if (accountTypeStr != null) {
240 Account.Type acctType = Case.getCurrentCaseThrows().getSleuthkitCase().getCommunicationsManager().getAccountType(accountTypeStr);
241 if (acctType != null) {
242 accountDisplayname = acctType.getDisplayName();
244 }
catch (TskCoreException | NoCurrentCaseException ex) {
245 logger.log(Level.SEVERE,
"Unable to get display name for account type " + accountTypeStr, ex);
249 final String compundDataTypeName = BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getDisplayName() +
": " + accountDisplayname;
250 writeTableForDataType(
new ArrayList<>(groupedArtifacts.get(accountTypeStr)), type, compundDataTypeName, comment);
254 writeTableForDataType(artifactList, type, type.getDisplayName(), comment);
269 private void writeTableForDataType(List<ArtifactData> artifactList, BlackboardArtifact.Type type, String tableName, String comment) {
274 Set<BlackboardAttribute.Type> attrTypeSet =
new TreeSet<>(Comparator.comparing(BlackboardAttribute.Type::getDisplayName));
275 for (ArtifactData data : artifactList) {
276 List<BlackboardAttribute> attributes = data.getAttributes();
277 for (BlackboardAttribute attribute : attributes) {
278 attrTypeSet.add(attribute.getAttributeType());
286 List<Column> columns = getArtifactTableColumns(type.getTypeID(), attrTypeSet);
287 if (columns.isEmpty()) {
290 columnHeaderMap.put(type.getTypeID(), columns);
296 Collections.sort(artifactList);
298 tableReport.startDataType(tableName, comment);
301 for (ArtifactData artifactData : artifactList) {
304 List<String> rowData = artifactData.getRow();
305 if (rowData.isEmpty()) {
309 tableReport.addRow(rowData);
312 progressPanel.increment();
313 tableReport.endTable();
314 tableReport.endDataType();
320 @Messages({
"ReportGenerator.tagTable.header.userName=User Name"})
321 @SuppressWarnings(
"deprecation")
322 private
void makeContentTagsTables() {
325 List<ContentTag> tags;
327 tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getAllContentTags();
328 }
catch (TskCoreException | NoCurrentCaseException ex) {
329 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetContentTags"));
330 logger.log(Level.SEVERE,
"failed to get content tags", ex);
337 progressPanel.updateStatusLabel(
338 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
339 BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName()));
340 ArrayList<String> columnHeaders =
new ArrayList<>(Arrays.asList(
341 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.tag"),
342 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.file"),
343 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.comment"),
344 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.userName"),
345 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeModified"),
346 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeChanged"),
347 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeAccessed"),
348 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeCreated"),
349 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.size"),
350 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.hash")));
352 StringBuilder comment =
new StringBuilder();
353 if (!tagNamesFilter.isEmpty()) {
355 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.makeContTagTab.taggedFiles.msg"));
356 comment.append(makeCommaSeparatedList(tagNamesFilter));
358 if (tableReport instanceof HTMLReport) {
359 HTMLReport htmlReportModule = (HTMLReport) tableReport;
360 htmlReportModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
361 htmlReportModule.startContentTagsTable(columnHeaders);
363 tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
364 tableReport.startTable(columnHeaders);
368 for (ContentTag tag : tags) {
370 String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() :
"";
371 if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) ==
false) {
377 fileName = tag.getContent().getUniquePath();
378 }
catch (TskCoreException ex) {
379 fileName = tag.getContent().getName();
382 ArrayList<String> rowData =
new ArrayList<>(Arrays.asList(tag.getName().getDisplayName() + notableString, fileName, tag.getComment(), tag.getUserName()));
383 Content content = tag.getContent();
384 if (content instanceof AbstractFile) {
385 AbstractFile file = (AbstractFile) content;
388 rowData.add(file.getMtimeAsDate());
389 rowData.add(file.getCtimeAsDate());
390 rowData.add(file.getAtimeAsDate());
391 rowData.add(file.getCrtimeAsDate());
392 rowData.add(Long.toString(file.getSize()));
393 rowData.add(file.getMd5Hash());
396 if (tableReport instanceof HTMLReport) {
397 HTMLReport htmlReportModule = (HTMLReport) tableReport;
398 htmlReportModule.addRowWithTaggedContentHyperlink(rowData, tag);
400 tableReport.addRow(rowData);
404 checkIfTagHasImage(tag);
408 progressPanel.increment();
409 tableReport.endTable();
410 tableReport.endDataType();
416 @SuppressWarnings(
"deprecation")
417 private
void makeBlackboardArtifactTagsTables() {
419 List<BlackboardArtifactTag> tags;
421 tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getAllBlackboardArtifactTags();
422 }
catch (TskCoreException | NoCurrentCaseException ex) {
423 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBArtifactTags"));
424 logger.log(Level.SEVERE,
"failed to get blackboard artifact tags", ex);
430 progressPanel.updateStatusLabel(
431 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
432 BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName()));
433 StringBuilder comment =
new StringBuilder();
434 if (!tagNamesFilter.isEmpty()) {
436 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.makeBbArtTagTab.taggedRes.msg"));
437 comment.append(makeCommaSeparatedList(tagNamesFilter));
439 tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName(), comment.toString());
440 tableReport.startTable(
new ArrayList<>(Arrays.asList(
441 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.resultType"),
442 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.tag"),
443 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.comment"),
444 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.srcFile"),
445 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.userName"))));
448 for (BlackboardArtifactTag tag : tags) {
449 String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() :
"";
450 if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) ==
false) {
455 row =
new ArrayList<>(Arrays.asList(tag.getArtifact().getArtifactTypeName(), tag.getName().getDisplayName() + notableString,
456 tag.getComment(), tag.getContent().getName(), tag.getUserName()));
457 tableReport.addRow(row);
460 checkIfTagHasImage(tag);
464 progressPanel.increment();
465 tableReport.endTable();
466 tableReport.endDataType();
476 private boolean passesTagNamesFilter(String tagName) {
477 return tagNamesFilter.isEmpty() || tagNamesFilter.contains(tagName);
483 private void makeThumbnailTable() {
484 progressPanel.updateStatusLabel(
485 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.createdThumb.text"));
487 if (tableReport instanceof HTMLReport) {
488 HTMLReport htmlModule = (HTMLReport) tableReport;
489 htmlModule.startDataType(
490 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.thumbnailTable.name"),
491 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.thumbnailTable.desc"));
492 List<String> emptyHeaders =
new ArrayList<>();
493 for (
int i = 0; i < HTMLReport.THUMBNAIL_COLUMNS; i++) {
494 emptyHeaders.add(
"");
496 htmlModule.startTable(emptyHeaders);
498 htmlModule.addThumbnailRows(images);
500 htmlModule.endTable();
501 htmlModule.endDataType();
512 private void checkIfTagHasImage(BlackboardArtifactTag artifactTag) {
515 file = Case.getCurrentCaseThrows().getSleuthkitCase().getAbstractFileById(artifactTag.getArtifact().getObjectID());
516 }
catch (TskCoreException | NoCurrentCaseException ex) {
518 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.errGetContentFromBBArtifact"));
519 logger.log(Level.WARNING,
"Error while getting content from a blackboard artifact to report on.", ex);
524 checkIfFileIsImage(file);
535 private void checkIfTagHasImage(ContentTag contentTag) {
536 Content c = contentTag.getContent();
537 if (c instanceof AbstractFile ==
false) {
540 checkIfFileIsImage((AbstractFile) c);
548 private void checkIfFileIsImage(AbstractFile file) {
551 || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS
552 || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS) {
556 if (ImageUtils.thumbnailSupported(file)) {
569 private String makeCommaSeparatedList(Collection<String> items) {
571 for (Iterator<String> iterator = items.iterator(); iterator.hasNext();) {
572 list += iterator.next() + (iterator.hasNext() ?
", " :
"");
582 @SuppressWarnings(
"deprecation")
583 @NbBundle.Messages({
"ReportGenerator.errList.noOpenCase=No open case available."})
584 private void writeKeywordHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
591 String orderByClause;
594 openCase = Case.getCurrentCaseThrows();
595 }
catch (NoCurrentCaseException ex) {
596 errorList.add(Bundle.ReportGenerator_errList_noOpenCase());
597 logger.log(Level.SEVERE,
"Exception while getting open case: ", ex);
602 String tagIDList =
"";
603 if (!tagNamesFilter.isEmpty()) {
605 Map<String, TagName> tagNamesMap = Case.getCurrentCaseThrows().getServices().getTagsManager().getDisplayNamesToTagNamesMap();
606 for (String tagDisplayName : tagNamesFilter) {
607 if (tagNamesMap.containsKey(tagDisplayName)) {
608 if (!tagIDList.isEmpty()) {
611 tagIDList += tagNamesMap.get(tagDisplayName).getId();
614 if (tagDisplayName.endsWith(getNotableTagLabel())) {
615 String editedDisplayName = tagDisplayName.substring(0, tagDisplayName.length() - getNotableTagLabel().length());
616 if (tagNamesMap.containsKey(editedDisplayName)) {
617 if (!tagIDList.isEmpty()) {
620 tagIDList += tagNamesMap.get(editedDisplayName).getId();
625 }
catch (NoCurrentCaseException | TskCoreException ex) {
626 logger.log(Level.SEVERE,
"Exception while getting tag info - proceeding without tag filter: ", ex);
632 String adHocCountQuery =
"SELECT COUNT(*) FROM "
634 "(SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 ";
635 if (!tagIDList.isEmpty()) {
636 adHocCountQuery +=
", blackboard_artifact_tags as tag ";
638 adHocCountQuery +=
"WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") ";
639 if (!tagIDList.isEmpty()) {
640 adHocCountQuery +=
" AND (art.artifact_id = tag.artifact_id) AND (tag.tag_name_id IN (" + tagIDList +
")) ";
642 adHocCountQuery +=
"EXCEPT "
644 "SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
")) AS adHocHits";
647 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(adHocCountQuery)) {
648 ResultSet adHocCountResultSet = dbQuery.getResultSet();
649 if (adHocCountResultSet.next()) {
650 adHocCount = adHocCountResultSet.getInt(1);
652 throw new TskCoreException(
"Error counting ad hoc keywords");
654 }
catch (TskCoreException | SQLException ex) {
655 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryKWLists"));
656 logger.log(Level.SEVERE,
"Failed to count ad hoc searches with query " + adHocCountQuery, ex);
661 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
662 orderByClause =
"ORDER BY convert_to(list, 'SQL_ASCII') ASC NULLS FIRST";
664 orderByClause =
"ORDER BY list ASC";
666 String keywordListQuery
667 =
"SELECT att.value_text AS list "
669 "FROM blackboard_attributes AS att, blackboard_artifacts AS art ";
670 if (!tagIDList.isEmpty()) {
671 keywordListQuery +=
", blackboard_artifact_tags as tag ";
673 keywordListQuery +=
"WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
" "
675 "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
" "
677 "AND att.artifact_id = art.artifact_id ";
678 if (!tagIDList.isEmpty()) {
679 keywordListQuery +=
"AND (art.artifact_id = tag.artifact_id) "
681 "AND (tag.tag_name_id IN (" + tagIDList +
")) ";
683 if (adHocCount > 0) {
684 keywordListQuery +=
" UNION SELECT \'\' AS list ";
686 keywordListQuery =
"SELECT * FROM ( " + keywordListQuery +
" ) kwListNames ";
687 keywordListQuery +=
"GROUP BY list " + orderByClause;
690 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(keywordListQuery)) {
691 ResultSet listsRs = dbQuery.getResultSet();
692 List<String> lists =
new ArrayList<>();
693 while (listsRs.next()) {
694 String list = listsRs.getString(
"list");
695 if (list.isEmpty()) {
696 list = NbBundle.getMessage(this.getClass(),
"ReportGenerator.writeKwHits.userSrchs");
702 tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), comment);
703 tableModule.addSetIndex(lists);
704 progressPanel.updateStatusLabel(
705 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
706 BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName()));
707 }
catch (TskCoreException | SQLException ex) {
708 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryKWLists"));
709 logger.log(Level.SEVERE,
"Failed to query keyword lists with query " + keywordListQuery, ex);
714 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
715 orderByClause =
"ORDER BY convert_to(list, 'SQL_ASCII') ASC NULLS FIRST, "
716 +
"convert_to(keyword, 'SQL_ASCII') ASC NULLS FIRST, "
717 +
"convert_to(parent_path, 'SQL_ASCII') ASC NULLS FIRST, "
718 +
"convert_to(name, 'SQL_ASCII') ASC NULLS FIRST, "
719 +
"convert_to(preview, 'SQL_ASCII') ASC NULLS FIRST";
721 orderByClause =
"ORDER BY list ASC, keyword ASC, parent_path ASC, name ASC, preview ASC";
725 String keywordListsQuery
726 =
"SELECT art.artifact_id AS artifact_id, art.obj_id AS obj_id, att1.value_text AS keyword, att2.value_text AS preview, att3.value_text AS list, f.name AS name, f.parent_path AS parent_path "
728 "FROM blackboard_artifacts AS art, blackboard_attributes AS att1, blackboard_attributes AS att2, blackboard_attributes AS att3, tsk_files AS f "
730 "WHERE (att1.artifact_id = art.artifact_id) "
732 "AND (att2.artifact_id = art.artifact_id) "
734 "AND (att3.artifact_id = art.artifact_id) "
736 "AND (f.obj_id = art.obj_id) "
738 "AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID() +
") "
740 "AND (att2.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID() +
") "
742 "AND (att3.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
") "
744 "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") ";
747 String keywordAdHocQuery
748 =
"SELECT art.artifact_id AS artifact_id, art.obj_id AS obj_id, att1.value_text AS keyword, att2.value_text AS preview, \'\' AS list, f.name AS name, f.parent_path AS parent_path "
750 "FROM blackboard_artifacts AS art, blackboard_attributes AS att1, blackboard_attributes AS att2, tsk_files AS f "
754 " (art.artifact_id IN (SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") "
758 "SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
"))) "
760 "AND (att1.artifact_id = art.artifact_id) "
762 "AND (att2.artifact_id = art.artifact_id) "
764 "AND (f.obj_id = art.obj_id) "
766 "AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID() +
") "
768 "AND (att2.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID() +
") "
770 "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") ";
772 String keywordsQuery =
"SELECT * FROM ( " + keywordListsQuery +
" UNION " + keywordAdHocQuery +
" ) kwHits " + orderByClause;
774 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(keywordsQuery)) {
775 ResultSet resultSet = dbQuery.getResultSet();
777 String currentKeyword =
"";
778 String currentList =
"";
779 while (resultSet.next()) {
781 if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
786 HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong(
"artifact_id"));
787 if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
790 String tagsList = makeCommaSeparatedList(uniqueTagNames);
792 Long objId = resultSet.getLong(
"obj_id");
793 String keyword = resultSet.getString(
"keyword");
794 String preview = resultSet.getString(
"preview");
795 String list = resultSet.getString(
"list");
796 String uniquePath =
"";
799 AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
801 uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
803 }
catch (TskCoreException ex) {
805 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAbstractFileByID"));
806 logger.log(Level.WARNING,
"Failed to get Abstract File by ID.", ex);
810 if ((!list.equals(currentList) && !list.isEmpty()) || (list.isEmpty() && !currentList.equals(
811 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.writeKwHits.userSrchs")))) {
812 if (!currentList.isEmpty()) {
813 tableModule.endTable();
814 tableModule.endSet();
816 currentList = list.isEmpty() ? NbBundle
817 .getMessage(this.getClass(),
"ReportGenerator.writeKwHits.userSrchs") : list;
819 tableModule.startSet(currentList);
820 progressPanel.updateStatusLabel(
821 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processingList",
822 BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), currentList));
824 if (!keyword.equals(currentKeyword)) {
826 if (!currentKeyword.equals(
"")) {
827 tableModule.endTable();
831 currentKeyword = keyword;
832 tableModule.addSetElement(currentKeyword);
833 List<String> columnHeaderNames =
new ArrayList<>();
834 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.preview"));
835 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.srcFile"));
836 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags"));
837 tableModule.startTable(columnHeaderNames);
840 tableModule.addRow(Arrays.asList(
new String[]{preview, uniquePath, tagsList}));
844 if (!currentKeyword.isEmpty()) {
845 tableModule.endTable();
849 progressPanel.increment();
850 tableModule.endDataType();
851 }
catch (TskCoreException | SQLException ex) {
852 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryKWs"));
853 logger.log(Level.SEVERE,
"Failed to query keywords with query " + keywordsQuery, ex);
862 @SuppressWarnings(
"deprecation")
863 private
void writeHashsetHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
864 String orderByClause;
867 openCase = Case.getCurrentCaseThrows();
868 }
catch (NoCurrentCaseException ex) {
869 errorList.add(Bundle.ReportGenerator_errList_noOpenCase());
870 logger.log(Level.SEVERE,
"Exception while getting open case: ", ex);
873 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
874 orderByClause =
"ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST";
876 orderByClause =
"ORDER BY att.value_text ASC";
879 =
"SELECT att.value_text AS list "
881 "FROM blackboard_attributes AS att, blackboard_artifacts AS art "
883 "WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
" "
885 "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() +
" "
887 "AND att.artifact_id = art.artifact_id "
889 "GROUP BY list " + orderByClause;
891 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(hashsetsQuery)) {
893 ResultSet listsRs = dbQuery.getResultSet();
894 List<String> lists =
new ArrayList<>();
895 while (listsRs.next()) {
896 lists.add(listsRs.getString(
"list"));
899 tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), comment);
900 tableModule.addSetIndex(lists);
901 progressPanel.updateStatusLabel(
902 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
903 BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName()));
904 }
catch (TskCoreException | SQLException ex) {
905 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryHashsetLists"));
906 logger.log(Level.SEVERE,
"Failed to query hashset lists: ", ex);
910 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
911 orderByClause =
"ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST, "
912 +
"convert_to(f.parent_path, 'SQL_ASCII') ASC NULLS FIRST, "
913 +
"convert_to(f.name, 'SQL_ASCII') ASC NULLS FIRST, "
914 +
"size ASC NULLS FIRST";
916 orderByClause =
"ORDER BY att.value_text ASC, f.parent_path ASC, f.name ASC, size ASC";
918 String hashsetHitsQuery
919 =
"SELECT art.artifact_id, art.obj_id, att.value_text AS setname, f.name AS name, f.size AS size, f.parent_path AS parent_path "
921 "FROM blackboard_artifacts AS art, blackboard_attributes AS att, tsk_files AS f "
923 "WHERE (att.artifact_id = art.artifact_id) "
925 "AND (f.obj_id = art.obj_id) "
927 "AND (att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
") "
929 "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() +
") "
933 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(hashsetHitsQuery)) {
935 ResultSet resultSet = dbQuery.getResultSet();
936 String currentSet =
"";
937 while (resultSet.next()) {
939 if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
944 HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong(
"artifact_id"));
945 if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
948 String tagsList = makeCommaSeparatedList(uniqueTagNames);
950 Long objId = resultSet.getLong(
"obj_id");
951 String set = resultSet.getString(
"setname");
952 String size = resultSet.getString(
"size");
953 String uniquePath =
"";
956 AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
958 uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
960 }
catch (TskCoreException ex) {
962 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAbstractFileFromID"));
963 logger.log(Level.WARNING,
"Failed to get Abstract File from ID.", ex);
968 if (!set.equals(currentSet)) {
969 if (!currentSet.isEmpty()) {
970 tableModule.endTable();
971 tableModule.endSet();
974 tableModule.startSet(currentSet);
975 List<String> columnHeaderNames =
new ArrayList<>();
976 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.file"));
977 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.size"));
978 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags"));
979 tableModule.startTable(columnHeaderNames);
980 progressPanel.updateStatusLabel(
981 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processingList",
982 BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), currentSet));
986 tableModule.addRow(Arrays.asList(
new String[]{uniquePath, size, tagsList}));
990 progressPanel.increment();
991 tableModule.endDataType();
992 }
catch (TskCoreException | SQLException ex) {
993 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryHashsetHits"));
994 logger.log(Level.SEVERE,
"Failed to query hashsets hits: ", ex);
1001 List<String> getErrorList() {
1014 private List<String> rowData = null;
1017 ArtifactData(BlackboardArtifact artifact, List<BlackboardAttribute> attrs, HashSet<String> tags) {
1019 this.attributes = attrs;
1023 }
catch (TskCoreException | NoCurrentCaseException ex) {
1024 logger.log(Level.SEVERE,
"Could not get content from database", ex);
1041 return artifact.getArtifactID();
1045 return artifact.getObjectID();
1066 List<String> thisRow =
getRow();
1067 List<String> otherRow = otherArtifactData.
getRow();
1068 for (
int i = 0; i < thisRow.size(); i++) {
1069 int compare = thisRow.get(i).compareTo(otherRow.get(i));
1085 if (rowData == null) {
1090 if (rowData.size() > 0) {
1092 for (
int i = 0; i < rowData.size(); i++) {
1093 if (rowData.get(i) == null) {
1099 return new ArrayList<>();
1101 }
catch (TskCoreException ex) {
1103 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.coreExceptionWhileGenRptRow"));
1104 logger.log(Level.WARNING,
"Core exception while generating row data for artifact report.", ex);
1105 rowData = Collections.<String>emptyList();
1122 List<String> orderedRowData =
new ArrayList<>();
1123 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() ==
getArtifact().getArtifactTypeID()) {
1124 if (content != null && content instanceof AbstractFile) {
1125 AbstractFile file = (AbstractFile) content;
1126 orderedRowData.add(file.getName());
1127 orderedRowData.add(file.getNameExtension());
1128 String mimeType = file.getMIMEType();
1129 if (mimeType == null) {
1130 orderedRowData.add(
"");
1132 orderedRowData.add(mimeType);
1134 orderedRowData.add(file.getUniquePath());
1137 orderedRowData.add(null);
1138 orderedRowData.add(null);
1139 orderedRowData.add(null);
1140 orderedRowData.add(null);
1142 orderedRowData.add(makeCommaSeparatedList(
getTags()));
1144 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() ==
getArtifact().getArtifactTypeID()) {
1145 String[] attributeDataArray =
new String[5];
1147 for (BlackboardAttribute attr : attributes) {
1148 if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME))) {
1149 attributeDataArray[0] = attr.getDisplayString();
1150 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY))) {
1151 attributeDataArray[1] = attr.getDisplayString();
1152 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT))) {
1153 attributeDataArray[3] = attr.getDisplayString();
1154 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION))) {
1155 attributeDataArray[4] = attr.getDisplayString();
1159 attributeDataArray[2] = content.getUniquePath();
1160 orderedRowData.addAll(Arrays.asList(attributeDataArray));
1162 HashSet<String> allTags =
getTags();
1165 for (ContentTag ct : contentTags) {
1167 allTags.add(ct.getName().getDisplayName() + notableString);
1169 }
catch (TskCoreException | NoCurrentCaseException ex) {
1170 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetContentTags"));
1171 logger.log(Level.SEVERE,
"Failed to get content tags", ex);
1173 orderedRowData.add(makeCommaSeparatedList(allTags));
1175 }
else if (columnHeaderMap.containsKey(
this.artifact.getArtifactTypeID())) {
1177 for (
Column currColumn : columnHeaderMap.get(
this.artifact.getArtifactTypeID())) {
1178 String cellData = currColumn.getCellData(
this);
1179 orderedRowData.add(cellData);
1183 return orderedRowData;
1197 private List<ArtifactData> getFilteredArtifacts(BlackboardArtifact.Type type, HashSet<String> tagNamesFilter) {
1198 List<ArtifactData> artifacts =
new ArrayList<>();
1202 HashSet<String> uniqueTagNames =
new HashSet<>();
1203 for (BlackboardArtifactTag tag : tags) {
1205 uniqueTagNames.add(tag.getName().getDisplayName() + notableString);
1207 if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
1211 artifacts.add(
new ArtifactData(artifact, Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboardAttributes(artifact), uniqueTagNames));
1212 }
catch (TskCoreException ex) {
1213 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBAttribs"));
1214 logger.log(Level.SEVERE,
"Failed to get Blackboard Attributes when generating report.", ex);
1217 }
catch (TskCoreException | NoCurrentCaseException ex) {
1218 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBArtifacts"));
1219 logger.log(Level.SEVERE,
"Failed to get Blackboard Artifacts when generating report.", ex);
1224 private Boolean failsTagFilter(HashSet<String> tagNames, HashSet<String> tagsNamesFilter) {
1225 if (null == tagsNamesFilter || tagsNamesFilter.isEmpty()) {
1229 HashSet<String> filteredTagNames =
new HashSet<>(tagNames);
1230 filteredTagNames.retainAll(tagsNamesFilter);
1231 return filteredTagNames.isEmpty();
1244 @Messages({
"ReportGenerator.artTableColHdr.comment=Comment"})
1245 @SuppressWarnings(
"deprecation")
1246 private List<Column> getArtifactTableColumns(
int artifactTypeId, Set<BlackboardAttribute.Type> attributeTypeSet) {
1247 ArrayList<Column> columns =
new ArrayList<>();
1251 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID() == artifactTypeId) {
1252 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1253 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1255 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.title"),
1256 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1258 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateCreated"),
1259 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1261 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1262 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1264 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID() == artifactTypeId) {
1265 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1266 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1268 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1269 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1271 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1272 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1274 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.value"),
1275 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE)));
1277 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1278 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1280 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID() == artifactTypeId) {
1281 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1282 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1284 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateAccessed"),
1285 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1287 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.referrer"),
1288 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REFERRER)));
1290 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.title"),
1291 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1293 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1294 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1296 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.urlDomainDecoded"),
1297 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL_DECODED)));
1299 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifactTypeId) {
1300 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dest"),
1301 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1303 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.sourceUrl"),
1304 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1306 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateAccessed"),
1307 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1309 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1310 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1312 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
1313 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == artifactTypeId) {
1314 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.path"),
1315 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1317 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1318 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1320 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
1321 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID() == artifactTypeId) {
1322 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.progName"),
1323 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1325 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.instDateTime"),
1326 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1328 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() == artifactTypeId) {
1329 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.preview")));
1331 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() == artifactTypeId) {
1332 columns.add(
new SourceFileColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.file")));
1334 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.size")));
1336 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID() == artifactTypeId) {
1337 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devMake"),
1338 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1340 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devModel"),
1341 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1343 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.deviceId"),
1344 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1346 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1347 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1349 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID() == artifactTypeId) {
1350 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.text"),
1351 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1353 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.domain"),
1354 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)));
1356 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateAccessed"),
1357 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1359 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.progName"),
1360 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1362 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID() == artifactTypeId) {
1363 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTaken"),
1364 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1366 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devManufacturer"),
1367 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1369 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devModel"),
1370 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1372 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1373 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1375 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1376 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1378 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1379 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1381 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID() == artifactTypeId) {
1382 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1383 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1385 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumber"),
1386 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1388 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumHome"),
1389 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_HOME)));
1391 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumOffice"),
1392 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_OFFICE)));
1394 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumMobile"),
1395 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_MOBILE)));
1397 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.email"),
1398 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL)));
1400 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() == artifactTypeId) {
1401 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.msgType"),
1402 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)));
1404 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.direction"),
1405 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1407 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.readStatus"),
1408 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_READ_STATUS)));
1410 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1411 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1413 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.fromPhoneNum"),
1414 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1416 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.fromEmail"),
1417 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1419 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.toPhoneNum"),
1420 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1422 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.toEmail"),
1423 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1425 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.subject"),
1426 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1428 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.text"),
1429 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1431 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID() == artifactTypeId) {
1432 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1433 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1435 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.fromPhoneNum"),
1436 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1438 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.toPhoneNum"),
1439 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1441 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1442 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1444 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.direction"),
1445 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1447 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID() == artifactTypeId) {
1448 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.calendarEntryType"),
1449 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CALENDAR_ENTRY_TYPE)));
1451 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1452 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1454 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.startDateTime"),
1455 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1457 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.endDateTime"),
1458 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_END)));
1460 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.location"),
1461 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1463 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID() == artifactTypeId) {
1464 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.shortCut"),
1465 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SHORTCUT)));
1467 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1468 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME_PERSON)));
1470 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumber"),
1471 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1473 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID() == artifactTypeId) {
1474 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.deviceName"),
1475 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_NAME)));
1477 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.deviceAddress"),
1478 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1480 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1481 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1483 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID() == artifactTypeId) {
1484 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1485 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1487 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1488 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1490 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1491 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1493 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID() == artifactTypeId) {
1494 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1495 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1497 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1498 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1500 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1501 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1503 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1504 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1506 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.locationAddress"),
1507 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1509 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1510 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1512 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID() == artifactTypeId) {
1513 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1514 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1516 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1517 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1519 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1520 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1522 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1523 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1525 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.locationAddress"),
1526 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1528 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1529 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1531 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID() == artifactTypeId) {
1532 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1533 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1535 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1536 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1538 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1539 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1541 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1542 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1544 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.locationAddress"),
1545 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1547 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1548 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1550 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID() == artifactTypeId) {
1551 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.category"),
1552 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1554 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.userId"),
1555 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1557 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.password"),
1558 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PASSWORD)));
1560 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1561 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1563 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.appName"),
1564 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1566 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1567 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1569 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.appPath"),
1570 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1572 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1573 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1575 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.replytoAddress"),
1576 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_REPLYTO)));
1578 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.mailServer"),
1579 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SERVER_NAME)));
1581 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID() == artifactTypeId
1582 || BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID() == artifactTypeId) {
1583 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1584 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1586 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() == artifactTypeId) {
1587 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.file")));
1589 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.extension.text")));
1591 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.mimeType.text")));
1593 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.path")));
1595 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID() == artifactTypeId) {
1596 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.processorArchitecture.text"),
1597 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROCESSOR_ARCHITECTURE)));
1599 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.osName.text"),
1600 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1602 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.osInstallDate.text"),
1603 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1605 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == artifactTypeId) {
1606 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailTo"),
1607 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1609 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailFrom"),
1610 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1612 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSubject"),
1613 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1615 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskDateTimeSent"),
1616 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)));
1618 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskDateTimeRcvd"),
1619 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_RCVD)));
1621 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskPath"),
1622 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1624 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailCc"),
1625 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_CC)));
1627 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailBcc"),
1628 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_BCC)));
1630 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskMsgId"),
1631 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MSG_ID)));
1633 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == artifactTypeId) {
1634 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSetName"),
1635 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1637 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskInterestingFilesCategory"),
1638 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1640 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskPath"),
1641 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1643 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.comment"),
1644 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT)));
1646 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1647 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1649 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_ROUTE.getTypeID() == artifactTypeId) {
1650 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskGpsRouteCategory"),
1651 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1653 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1654 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1656 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitudeEnd"),
1657 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END)));
1659 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitudeEnd"),
1660 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END)));
1662 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitudeStart"),
1663 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START)));
1665 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitudeStart"),
1666 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START)));
1668 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1669 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1671 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.location"),
1672 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1674 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1675 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1677 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == artifactTypeId) {
1678 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSetName"),
1679 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1681 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.associatedArtifact"),
1682 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1684 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1685 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1687 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == artifactTypeId) {
1688 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1689 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1691 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.associatedArtifact"),
1692 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1694 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1695 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1697 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.count"),
1698 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COUNT)));
1700 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_ACCOUNT.getTypeID() == artifactTypeId) {
1701 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.userName"),
1702 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME)));
1704 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.userId"),
1705 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1707 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_REMOTE_DRIVE.getTypeID() == artifactTypeId) {
1708 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.localPath"),
1709 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCAL_PATH)));
1711 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.remotePath"),
1712 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REMOTE_PATH)));
1713 }
else if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
1714 columns.add(
new StatusColumn());
1715 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE));
1716 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
1717 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME));
1718 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_SEARCH_DOCUMENT_ID));
1719 }
else if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID()) {
1720 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
1724 for (BlackboardAttribute.Type type : attributeTypeSet) {
1725 columns.add(
new AttributeColumn(type.getDisplayName(), type));
1727 columns.add(
new SourceFileColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.srcFile")));
1728 columns.add(
new TaggedResultsColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags")));
1736 for (Column column : columns) {
1737 attributeTypeSet = column.removeTypeFromSet(attributeTypeSet);
1740 for (BlackboardAttribute.Type type : attributeTypeSet) {
1741 columns.add(
new AttributeColumn(type.getDisplayName(), type));
1744 if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()
1745 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()
1746 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()
1747 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()
1748 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()
1749 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()
1750 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()
1751 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID()
1752 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID()
1753 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID()
1754 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()
1755 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID()
1756 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID()
1757 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID()
1758 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID()
1759 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID()
1760 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID()
1761 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID()
1762 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID()
1763 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID()
1764 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID()
1765 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID()
1766 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID()) {
1767 columns.add(
new SourceFileColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.srcFile")));
1769 columns.add(
new TaggedResultsColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags")));
1781 private String getFileUniquePath(Content content) {
1783 if (content != null) {
1784 return content.getUniquePath();
1788 }
catch (TskCoreException ex) {
1789 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAbstractFileByID"));
1790 logger.log(Level.WARNING,
"Failed to get Abstract File by ID.", ex);
1805 @SuppressWarnings(
"deprecation")
1806 private HashSet<String> getUniqueTagNames(
long artifactId) throws TskCoreException {
1807 HashSet<String> uniqueTagNames =
new HashSet<>();
1809 String query =
"SELECT display_name, artifact_id, knownStatus FROM tag_names AS tn, blackboard_artifact_tags AS bat "
1811 "WHERE tn.tag_name_id = bat.tag_name_id AND bat.artifact_id = " + artifactId;
1813 try (SleuthkitCase.CaseDbQuery dbQuery = Case.getCurrentCaseThrows().getSleuthkitCase().executeQuery(query)) {
1814 ResultSet tagNameRows = dbQuery.getResultSet();
1815 while (tagNameRows.next()) {
1816 String notableString = tagNameRows.getInt(
"knownStatus") == TskData.FileKnown.BAD.ordinal() ? getNotableTagLabel() :
"";
1817 uniqueTagNames.add(tagNameRows.getString(
"display_name") + notableString);
1819 }
catch (TskCoreException | SQLException | NoCurrentCaseException ex) {
1820 throw new TskCoreException(
"Error getting tag names for artifact: ", ex);
1823 return uniqueTagNames;
1833 Set<BlackboardAttribute.Type>
removeTypeFromSet(Set<BlackboardAttribute.Type> types);
1838 @NbBundle.Messages(
"TableReportGenerator.StatusColumn.Header=Review Status")
1841 return Bundle.TableReportGenerator_StatusColumn_Header();
1846 return artData.
getArtifact().getReviewStatus().getDisplayName();
1869 this.columnHeader = Objects.requireNonNull(columnHeader);
1880 List<BlackboardAttribute> attributes = artData.
getAttributes();
1881 for (BlackboardAttribute attribute : attributes) {
1882 if (attribute.getAttributeType().equals(this.
attributeType)) {
1883 if (attribute.getAttributeType().getValueType() != BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
1884 return attribute.getDisplayString();
1915 return getFileUniquePath(artData.
getContent());
1940 return makeCommaSeparatedList(artData.
getTags());
1965 throw new UnsupportedOperationException(
"Cannot get cell data of unspecified column");
BlackboardArtifact getArtifact()
final String columnHeader
String getCellData(ArtifactData artData)
List< String > getOrderedRowDataAsStrings()
List< BlackboardAttribute > attributes
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
static String getStringTime(long epochSeconds, TimeZone tzone)
String getCellData(ArtifactData artData)
int compareTo(ArtifactData otherArtifactData)
final BlackboardAttribute.Type attributeType
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
String getCellData(ArtifactData artData)
HashSet< String > getTags()
List< BlackboardAttribute > getAttributes()
String getCellData(ArtifactData artData)
String getCellData(ArtifactData artData)
final String columnHeader
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
BlackboardArtifact artifact
final String columnHeader
TagsManager getTagsManager()
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
SleuthkitCase getSleuthkitCase()
String getCellData(ArtifactData artData)
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
static Case getCurrentCaseThrows()
final String columnHeader