Autopsy  4.19.3
Graphical digital forensics platform for The Sleuth Kit and other tools.
CustomArtifactType.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2017-2021 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.test;
20 
21 import java.util.ArrayList;
22 import java.util.List;
23 import org.apache.commons.codec.DecoderException;
24 import org.apache.commons.codec.binary.Hex;
25 import org.joda.time.DateTime;
27 import org.sleuthkit.datamodel.Blackboard;
28 import org.sleuthkit.datamodel.Blackboard.BlackboardException;
29 import org.sleuthkit.datamodel.BlackboardArtifact;
30 import org.sleuthkit.datamodel.BlackboardAttribute;
31 import org.sleuthkit.datamodel.Content;
32 import org.sleuthkit.datamodel.Score;
33 import org.sleuthkit.datamodel.TskCoreException;
34 
38 final class CustomArtifactType {
39 
40  private static final String MODULE_NAME = CustomArtifactsCreatorIngestModuleFactory.getModuleName();
41  private static final String ADDITIONAL_MODULE_NAME = "Another Module";
42  private static final String ARTIFACT_TYPE_NAME = "CUSTOM_ARTIFACT";
43  private static final String ARTIFACT_DISPLAY_NAME = "Custom Artifact";
44  private static final String INT_ATTR_TYPE_NAME = "CUSTOM_INT_ATTRIBUTE";
45  private static final String INT_ATTR_DISPLAY_NAME = "Custom Integer";
46  private static final String DOUBLE_ATTR_TYPE_NAME = "CUSTOM_DOUBLE_ATTRIBUTE";
47  private static final String DOUBLE_ATTR_DISPLAY_NAME = "Custom Double";
48  private static final String LONG_ATTR_TYPE_NAME = "CUSTOM_LONG_ATTRIBUTE";
49  private static final String LONG_ATTR_DISPLAY_NAME = "Custom Long";
50  private static final String DATETIME_ATTR_TYPE_NAME = "CUSTOM_DATETIME_ATTRIBUTE";
51  private static final String DATETIME_ATTR_DISPLAY_NAME = "Custom Datetime";
52  private static final String BYTES_ATTR_TYPE_NAME = "CUSTOM_BYTES_ATTRIBUTE";
53  private static final String BYTES_ATTR_DISPLAY_NAME = "Custom Bytes";
54  private static final String STRING_ATTR_TYPE_NAME = "CUSTOM_STRING_ATTRIBUTE";
55  private static final String STRING_ATTR_DISPLAY_NAME = "Custom String";
56  private static final String JSON_ATTR_TYPE_NAME = "CUSTOM_JSON_ATTRIBUTE";
57  private static final String JSON_ATTR_DISPLAY_NAME = "Custom Json";
58  private static BlackboardArtifact.Type artifactType;
59  private static BlackboardAttribute.Type intAttrType;
60  private static BlackboardAttribute.Type doubleAttrType;
61  private static BlackboardAttribute.Type longAttributeType;
62  private static BlackboardAttribute.Type dateTimeAttrType;
63  private static BlackboardAttribute.Type bytesAttrType;
64  private static BlackboardAttribute.Type stringAttrType;
65  private static BlackboardAttribute.Type jsonAttrType;
66 
73  static void addToCaseDatabase() throws Blackboard.BlackboardException {
74  Blackboard blackboard = Case.getCurrentCase().getServices().getArtifactsBlackboard();
75  artifactType = blackboard.getOrAddArtifactType(ARTIFACT_TYPE_NAME, ARTIFACT_DISPLAY_NAME);
76  intAttrType = blackboard.getOrAddAttributeType(INT_ATTR_TYPE_NAME, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER, INT_ATTR_DISPLAY_NAME);
77  doubleAttrType = blackboard.getOrAddAttributeType(DOUBLE_ATTR_TYPE_NAME, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE, DOUBLE_ATTR_DISPLAY_NAME);
78  longAttributeType = blackboard.getOrAddAttributeType(LONG_ATTR_TYPE_NAME, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG, LONG_ATTR_DISPLAY_NAME);
79  dateTimeAttrType = blackboard.getOrAddAttributeType(DATETIME_ATTR_TYPE_NAME, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME, DATETIME_ATTR_DISPLAY_NAME);
80  bytesAttrType = blackboard.getOrAddAttributeType(BYTES_ATTR_TYPE_NAME, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE, BYTES_ATTR_DISPLAY_NAME);
81  stringAttrType = blackboard.getOrAddAttributeType(STRING_ATTR_TYPE_NAME, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, STRING_ATTR_DISPLAY_NAME);
82  jsonAttrType = blackboard.getOrAddAttributeType(JSON_ATTR_TYPE_NAME, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.JSON, JSON_ATTR_DISPLAY_NAME);
83  }
84 
99  static BlackboardArtifact createAndPostInstance(Content source, long ingestJobId) throws TskCoreException, Blackboard.BlackboardException, DecoderException {
100  List<BlackboardAttribute> attributes = new ArrayList<>();
101  attributes.add(new BlackboardAttribute(intAttrType, MODULE_NAME, 0));
102  attributes.add(new BlackboardAttribute(doubleAttrType, MODULE_NAME, 0.0));
103  attributes.add(new BlackboardAttribute(longAttributeType, MODULE_NAME, 0L));
104  attributes.add(new BlackboardAttribute(dateTimeAttrType, MODULE_NAME, 60L));
105  attributes.add(new BlackboardAttribute(bytesAttrType, MODULE_NAME, Hex.decodeHex("ABCD")));
106  attributes.add(new BlackboardAttribute(stringAttrType, MODULE_NAME, "Zero"));
107  attributes.add(new BlackboardAttribute(jsonAttrType, MODULE_NAME, "{\"fruit\": \"Apple\",\"size\": \"Large\",\"color\": \"Red\"}"));
108 
109  /*
110  * Add a second source module to the attributes. Try to do it twice. The
111  * second attempt should have no effect on the data.
112  */
113  for (BlackboardAttribute attr : attributes) {
114  attr.addSource(ADDITIONAL_MODULE_NAME);
115  attr.addSource(ADDITIONAL_MODULE_NAME);
116  }
117 
118  BlackboardArtifact artifact;
119  switch (artifactType.getCategory()) {
120  case DATA_ARTIFACT:
121  artifact = source.newDataArtifact(artifactType, attributes);
122  break;
123 
124  case ANALYSIS_RESULT:
125  artifact = source.newAnalysisResult(artifactType, Score.SCORE_UNKNOWN, null, null, null, attributes)
126  .getAnalysisResult();
127  break;
128 
129  default:
130  throw new TskCoreException(String.format("Artifact type: %s has no known category: %s",
131  artifactType.getDisplayName(), artifactType.getCategory().getDisplayName()));
132  }
133 
134  Blackboard blackboard = Case.getCurrentCase().getServices().getArtifactsBlackboard();
135  blackboard.postArtifact(artifact, MODULE_NAME, ingestJobId);
136 
137  return artifact;
138  }
139 
143  private CustomArtifactType() {
144  }
145 
146 }

Copyright © 2012-2022 Basis Technology. Generated on: Tue Jun 27 2023
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.