Autopsy  4.19.3
Graphical digital forensics platform for The Sleuth Kit and other tools.
ExportUserActivity.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2021 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.report.modules.datasourcesummaryexport;
20 
21 import java.text.DateFormat;
22 import java.text.SimpleDateFormat;
23 import java.util.Arrays;
24 import java.util.Date;
25 import java.util.List;
26 import java.util.Locale;
27 import java.util.function.Function;
28 import java.util.stream.Collectors;
29 import java.util.stream.Stream;
30 import org.apache.commons.lang.StringUtils;
31 import org.openide.util.NbBundle.Messages;
32 import org.sleuthkit.datamodel.DataSource;
42 
46 @Messages({
47  "ExportUserActivity_tab_title=User Activity",
48  "ExportUserActivity_TopProgramsTableModel_tabName=Recent Programs",
49  "ExportUserActivity_TopDomainsTableModel_tabName=Recent Domains",
50  "ExportUserActivity_TopWebSearchTableModel_tabName=Recent Web Searches",
51  "ExportUserActivity_TopDeviceAttachedTableModel_tabName=Recent Devices Attached",
52  "ExportUserActivity_TopAccountTableModel_tabName=Recent Account Types Used",
53  "ExportUserActivity_TopProgramsTableModel_name_header=Program",
54  "ExportUserActivity_TopProgramsTableModel_folder_header=Folder",
55  "ExportUserActivity_TopProgramsTableModel_count_header=Run Times",
56  "ExportUserActivity_TopProgramsTableModel_lastrun_header=Last Run",
57  "ExportUserActivity_TopDomainsTableModel_domain_header=Domain",
58  "ExportUserActivity_TopDomainsTableModel_count_header=Visits",
59  "ExportUserActivity_TopDomainsTableModel_lastAccess_header=Last Accessed",
60  "ExportUserActivity_TopWebSearchTableModel_searchString_header=Search String",
61  "ExportUserActivity_TopWebSearchTableModel_dateAccessed_header=Date Accessed",
62  "ExportUserActivity_TopWebSearchTableModel_translatedResult_header=Translated",
63  "ExportUserActivity_TopDeviceAttachedTableModel_deviceId_header=Device Id",
64  "ExportUserActivity_TopDeviceAttachedTableModel_makeModel_header=Make and Model",
65  "ExportUserActivity_TopDeviceAttachedTableModel_dateAccessed_header=Last Accessed",
66  "ExportUserActivity_TopAccountTableModel_accountType_header=Account Type",
67  "ExportUserActivity_TopAccountTableModel_lastAccess_header=Last Accessed",
68  "ExportUserActivity_noDataExists=No communication data exists"})
69 class ExportUserActivity {
70 
71  private final UserActivitySummary userSummary;
72 
73  private static final String DATETIME_FORMAT_STR = "yyyy/MM/dd HH:mm:ss";
74  private static final DateFormat DATETIME_FORMAT = new SimpleDateFormat(DATETIME_FORMAT_STR, Locale.getDefault());
75  private static final int TOP_PROGS_COUNT = 10;
76  private static final int TOP_DOMAINS_COUNT = 10;
77  private static final int TOP_SEARCHES_COUNT = 10;
78  private static final int TOP_ACCOUNTS_COUNT = 5;
79  private static final int TOP_DEVICES_COUNT = 10;
80 
81  // set up recent programs
82  private static final List<ColumnModel<TopProgramsResult, DefaultCellModel<?>>> topProgramsTemplate = Arrays.asList(
83  // program name column
84  new ColumnModel<>(
85  Bundle.ExportUserActivity_TopProgramsTableModel_name_header(),
86  (prog) -> {
87  return new DefaultCellModel<>(prog.getProgramName());
88  },
89  250),
90  // program folder column
91  new ColumnModel<>(
92  Bundle.ExportUserActivity_TopProgramsTableModel_folder_header(),
93  (prog) -> {
94  return new DefaultCellModel<>(
95  UserActivitySummary.getShortFolderName(
96  prog.getProgramPath(),
97  prog.getProgramName()));
98  },
99  150),
100  // run count column
101  new ColumnModel<>(
102  Bundle.ExportUserActivity_TopProgramsTableModel_count_header(),
103  (prog) -> {
104  return new DefaultCellModel<>(prog.getRunTimes(), (num) -> num == null ? "" : num.toString());
105  },
106  80),
107  // last run date column
108  new ColumnModel<>(
109  Bundle.ExportUserActivity_TopProgramsTableModel_lastrun_header(),
110  getDateFunct(),
111  150)
112  );
113 
114  // set up recent domains
115  private static final List<ColumnModel<TopDomainsResult, DefaultCellModel<?>>> topDomainsTemplate = Arrays.asList(
116  // domain column
117  new ColumnModel<>(
118  Bundle.ExportUserActivity_TopDomainsTableModel_domain_header(),
119  (recentDomain) -> {
120  return new DefaultCellModel<>(recentDomain.getDomain());
121  },
122  250),
123  // count column
124  new ColumnModel<>(
125  Bundle.ExportUserActivity_TopDomainsTableModel_count_header(),
126  (recentDomain) -> {
127  return new DefaultCellModel<>(recentDomain.getVisitTimes(), (num) -> num == null ? "" : num.toString());
128  },
129  100),
130  // last accessed column
131  new ColumnModel<>(
132  Bundle.ExportUserActivity_TopDomainsTableModel_lastAccess_header(),
133  getDateFunct(),
134  150)
135  );
136 
137  // top web searches
138  private static final List<ColumnModel<TopWebSearchResult, DefaultCellModel<?>>> topWebSearchesTemplate = Arrays.asList(
139  // search string column
140  new ColumnModel<>(
141  Bundle.ExportUserActivity_TopWebSearchTableModel_searchString_header(),
142  (webSearch) -> {
143  return new DefaultCellModel<>(webSearch.getSearchString());
144  },
145  250
146  ),
147  // last accessed
148  new ColumnModel<>(
149  Bundle.ExportUserActivity_TopWebSearchTableModel_dateAccessed_header(),
150  getDateFunct(),
151  150
152  ),
153  // translated value
154  new ColumnModel<>(
155  Bundle.ExportUserActivity_TopWebSearchTableModel_translatedResult_header(),
156  (webSearch) -> {
157  return new DefaultCellModel<>(webSearch.getTranslatedResult());
158  },
159  250
160  )
161  );
162 
163  // top devices attached
164  private static final List<ColumnModel<TopDeviceAttachedResult, DefaultCellModel<?>>> topDevicesTemplate = Arrays.asList(
165  // device id column
166  new ColumnModel<>(
167  Bundle.ExportUserActivity_TopDeviceAttachedTableModel_deviceId_header(),
168  (device) -> {
169  return new DefaultCellModel<>(device.getDeviceId());
170  },
171  250
172  ),
173  // last accessed
174  new ColumnModel<>(
175  Bundle.ExportUserActivity_TopDeviceAttachedTableModel_dateAccessed_header(),
176  getDateFunct(),
177  150
178  ),
179  // make and model
180  new ColumnModel<>(
181  Bundle.ExportUserActivity_TopDeviceAttachedTableModel_makeModel_header(),
182  (device) -> {
183  String make = StringUtils.isBlank(device.getDeviceMake()) ? "" : device.getDeviceMake().trim();
184  String model = StringUtils.isBlank(device.getDeviceModel()) ? "" : device.getDeviceModel().trim();
185  String makeModelString = (make.isEmpty() || model.isEmpty())
186  ? make + model
187  : String.format("%s - %s", make, model);
188  return new DefaultCellModel<>(makeModelString);
189  },
190  250
191  )
192  );
193 
194  // top accounts
195  private static final List<ColumnModel<TopAccountResult, DefaultCellModel<?>>> topAccountsTemplate = Arrays.asList(
196  // account type column
197  new ColumnModel<>(
198  Bundle.ExportUserActivity_TopAccountTableModel_accountType_header(),
199  (account) -> {
200  return new DefaultCellModel<>(account.getAccountType());
201  },
202  250
203  ),
204  // last accessed
205  new ColumnModel<>(
206  Bundle.ExportUserActivity_TopAccountTableModel_lastAccess_header(),
207  getDateFunct(),
208  150
209  )
210  );
211 
212  ExportUserActivity() {
213  userSummary = new UserActivitySummary();
214  }
215 
216  private static <T extends LastAccessedArtifact> Function<T, DefaultCellModel<?>> getDateFunct() {
217  return (T lastAccessed) -> {
218  Function<Date, String> dateParser = (dt) -> dt == null ? "" : DATETIME_FORMAT.format(dt);
219  return new DefaultCellModel<>(lastAccessed.getLastAccessed(), dateParser, DATETIME_FORMAT_STR);
220  };
221  }
222 
223  List<ExcelExport.ExcelSheetExport> getExports(DataSource dataSource) {
224 
225  DataFetcher<DataSource, List<TopProgramsResult>> topProgramsFetcher = (ds) -> userSummary.getTopPrograms(ds, TOP_PROGS_COUNT);
226  DataFetcher<DataSource, List<TopDomainsResult>> topDomainsFetcher = (ds) -> userSummary.getRecentDomains(ds, TOP_DOMAINS_COUNT);
227  DataFetcher<DataSource, List<TopWebSearchResult>> topWebSearchesFetcher = (ds) -> userSummary.getMostRecentWebSearches(ds, TOP_SEARCHES_COUNT);
228  DataFetcher<DataSource, List<TopDeviceAttachedResult>> topDevicesAttachedFetcher = (ds) -> userSummary.getRecentDevices(ds, TOP_DEVICES_COUNT);
229  DataFetcher<DataSource, List<TopAccountResult>> topAccountsFetcher = (ds) -> userSummary.getRecentAccounts(ds, TOP_ACCOUNTS_COUNT);
230 
231  return Stream.of(
232  getTableExport(topProgramsFetcher, topProgramsTemplate, Bundle.ExportUserActivity_TopProgramsTableModel_tabName(), dataSource),
233  getTableExport(topDomainsFetcher, topDomainsTemplate, Bundle.ExportUserActivity_TopDomainsTableModel_tabName(), dataSource),
234  getTableExport(topWebSearchesFetcher, topWebSearchesTemplate, Bundle.ExportUserActivity_TopWebSearchTableModel_tabName(), dataSource),
235  getTableExport(topDevicesAttachedFetcher, topDevicesTemplate, Bundle.ExportUserActivity_TopDeviceAttachedTableModel_tabName(), dataSource),
236  getTableExport(topAccountsFetcher, topAccountsTemplate, Bundle.ExportUserActivity_TopAccountTableModel_tabName(), dataSource))
237  .filter(sheet -> sheet != null)
238  .collect(Collectors.toList());
239  }
240 }

Copyright © 2012-2022 Basis Technology. Generated on: Tue Oct 4 2022
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.