Autopsy  4.19.3
Graphical digital forensics platform for The Sleuth Kit and other tools.
CustomArtifactType.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2017-2021 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.test;
20 
21 import java.util.ArrayList;
22 import java.util.List;
23 import javax.xml.bind.DatatypeConverter;
24 import org.joda.time.DateTime;
26 import org.sleuthkit.datamodel.Blackboard;
27 import org.sleuthkit.datamodel.Blackboard.BlackboardException;
28 import org.sleuthkit.datamodel.BlackboardArtifact;
29 import org.sleuthkit.datamodel.BlackboardAttribute;
30 import org.sleuthkit.datamodel.Content;
31 import org.sleuthkit.datamodel.Score;
32 import org.sleuthkit.datamodel.TskCoreException;
33 
37 final class CustomArtifactType {
38 
39  private static final String MODULE_NAME = CustomArtifactsCreatorIngestModuleFactory.getModuleName();
40  private static final String ADDITIONAL_MODULE_NAME = "Another Module";
41  private static final String ARTIFACT_TYPE_NAME = "CUSTOM_ARTIFACT";
42  private static final String ARTIFACT_DISPLAY_NAME = "Custom Artifact";
43  private static final String INT_ATTR_TYPE_NAME = "CUSTOM_INT_ATTRIBUTE";
44  private static final String INT_ATTR_DISPLAY_NAME = "Custom Integer";
45  private static final String DOUBLE_ATTR_TYPE_NAME = "CUSTOM_DOUBLE_ATTRIBUTE";
46  private static final String DOUBLE_ATTR_DISPLAY_NAME = "Custom Double";
47  private static final String LONG_ATTR_TYPE_NAME = "CUSTOM_LONG_ATTRIBUTE";
48  private static final String LONG_ATTR_DISPLAY_NAME = "Custom Long";
49  private static final String DATETIME_ATTR_TYPE_NAME = "CUSTOM_DATETIME_ATTRIBUTE";
50  private static final String DATETIME_ATTR_DISPLAY_NAME = "Custom Datetime";
51  private static final String BYTES_ATTR_TYPE_NAME = "CUSTOM_BYTES_ATTRIBUTE";
52  private static final String BYTES_ATTR_DISPLAY_NAME = "Custom Bytes";
53  private static final String STRING_ATTR_TYPE_NAME = "CUSTOM_STRING_ATTRIBUTE";
54  private static final String STRING_ATTR_DISPLAY_NAME = "Custom String";
55  private static final String JSON_ATTR_TYPE_NAME = "CUSTOM_JSON_ATTRIBUTE";
56  private static final String JSON_ATTR_DISPLAY_NAME = "Custom Json";
57  private static BlackboardArtifact.Type artifactType;
58  private static BlackboardAttribute.Type intAttrType;
59  private static BlackboardAttribute.Type doubleAttrType;
60  private static BlackboardAttribute.Type longAttributeType;
61  private static BlackboardAttribute.Type dateTimeAttrType;
62  private static BlackboardAttribute.Type bytesAttrType;
63  private static BlackboardAttribute.Type stringAttrType;
64  private static BlackboardAttribute.Type jsonAttrType;
65 
72  static void addToCaseDatabase() throws Blackboard.BlackboardException {
73  Blackboard blackboard = Case.getCurrentCase().getServices().getArtifactsBlackboard();
74  artifactType = blackboard.getOrAddArtifactType(ARTIFACT_TYPE_NAME, ARTIFACT_DISPLAY_NAME);
75  intAttrType = blackboard.getOrAddAttributeType(INT_ATTR_TYPE_NAME, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER, INT_ATTR_DISPLAY_NAME);
76  doubleAttrType = blackboard.getOrAddAttributeType(DOUBLE_ATTR_TYPE_NAME, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE, DOUBLE_ATTR_DISPLAY_NAME);
77  longAttributeType = blackboard.getOrAddAttributeType(LONG_ATTR_TYPE_NAME, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG, LONG_ATTR_DISPLAY_NAME);
78  dateTimeAttrType = blackboard.getOrAddAttributeType(DATETIME_ATTR_TYPE_NAME, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME, DATETIME_ATTR_DISPLAY_NAME);
79  bytesAttrType = blackboard.getOrAddAttributeType(BYTES_ATTR_TYPE_NAME, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE, BYTES_ATTR_DISPLAY_NAME);
80  stringAttrType = blackboard.getOrAddAttributeType(STRING_ATTR_TYPE_NAME, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, STRING_ATTR_DISPLAY_NAME);
81  jsonAttrType = blackboard.getOrAddAttributeType(JSON_ATTR_TYPE_NAME, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.JSON, JSON_ATTR_DISPLAY_NAME);
82  }
83 
98  static BlackboardArtifact createAndPostInstance(Content source, long ingestJobId) throws TskCoreException, Blackboard.BlackboardException {
99  List<BlackboardAttribute> attributes = new ArrayList<>();
100  attributes.add(new BlackboardAttribute(intAttrType, MODULE_NAME, 0));
101  attributes.add(new BlackboardAttribute(doubleAttrType, MODULE_NAME, 0.0));
102  attributes.add(new BlackboardAttribute(longAttributeType, MODULE_NAME, 0L));
103  attributes.add(new BlackboardAttribute(dateTimeAttrType, MODULE_NAME, DateTime.now().getMillis()/1000));
104  attributes.add(new BlackboardAttribute(bytesAttrType, MODULE_NAME, DatatypeConverter.parseHexBinary("ABCD")));
105  attributes.add(new BlackboardAttribute(stringAttrType, MODULE_NAME, "Zero"));
106  attributes.add(new BlackboardAttribute(jsonAttrType, MODULE_NAME, "{\"fruit\": \"Apple\",\"size\": \"Large\",\"color\": \"Red\"}"));
107 
108  /*
109  * Add a second source module to the attributes. Try to do it twice. The
110  * second attempt should have no effect on the data.
111  */
112  for (BlackboardAttribute attr : attributes) {
113  attr.addSource(ADDITIONAL_MODULE_NAME);
114  attr.addSource(ADDITIONAL_MODULE_NAME);
115  }
116 
117  BlackboardArtifact artifact;
118  switch (artifactType.getCategory()) {
119  case DATA_ARTIFACT:
120  artifact = source.newDataArtifact(artifactType, attributes);
121  break;
122 
123  case ANALYSIS_RESULT:
124  artifact = source.newAnalysisResult(artifactType, Score.SCORE_UNKNOWN, null, null, null, attributes)
125  .getAnalysisResult();
126  break;
127 
128  default:
129  throw new TskCoreException(String.format("Artifact type: %s has no known category: %s",
130  artifactType.getDisplayName(), artifactType.getCategory().getDisplayName()));
131  }
132 
133  Blackboard blackboard = Case.getCurrentCase().getServices().getArtifactsBlackboard();
134  blackboard.postArtifact(artifact, MODULE_NAME, ingestJobId);
135 
136  return artifact;
137  }
138 
142  private CustomArtifactType() {
143  }
144 
145 }

Copyright © 2012-2022 Basis Technology. Generated on: Wed Oct 5 2022
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.