Autopsy  4.19.3
Graphical digital forensics platform for The Sleuth Kit and other tools.
NodeData.java
Go to the documentation of this file.
1 /*
2  * Central Repository
3  *
4  * Copyright 2018-2021 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.centralrepository.application;
20 
24 import org.sleuthkit.datamodel.AbstractFile;
25 import org.sleuthkit.datamodel.DataSource;
26 import org.sleuthkit.datamodel.TskCoreException;
27 import org.sleuthkit.datamodel.TskData;
28 import org.sleuthkit.datamodel.TskDataException;
29 
33 public class NodeData {
34 
35  // For now hard code the string for the central repo files type, since
36  // getting it dynamically can fail.
37  private static final String FILE_TYPE_STR = "Files";
38  private static final String CSV_ITEM_SEPARATOR = "\",\"";
39 
40  private final String caseName;
41  private String deviceID;
42  private String dataSourceName;
43  private final String filePath;
44  private final String typeStr;
45  private final String value;
46  private TskData.FileKnown known;
47  private String comment;
48 
49  private AbstractFile originalAbstractFile = null;
51 
60  caseName = instance.getCorrelationCase().getDisplayName();
61  deviceID = instance.getCorrelationDataSource().getDeviceID();
62  dataSourceName = instance.getCorrelationDataSource().getName();
63  filePath = instance.getFilePath();
64  this.typeStr = type.getDisplayName();
65  this.value = value;
66  known = instance.getKnownStatus();
67  comment = instance.getComment();
68 
69  originalCorrelationInstance = instance;
70  }
71 
80  NodeData(AbstractFile newFile, Case autopsyCase) throws CentralRepoException {
81  caseName = autopsyCase.getDisplayName();
82  try {
83  DataSource dataSource = autopsyCase.getSleuthkitCase().getDataSource(newFile.getDataSource().getId());
84  deviceID = dataSource.getDeviceId();
85  dataSourceName = dataSource.getName();
86  } catch (TskDataException | TskCoreException ex) {
87  throw new CentralRepoException("Error loading data source for abstract file ID " + newFile.getId(), ex);
88  }
89 
90  filePath = newFile.getParentPath() + newFile.getName();
91  typeStr = FILE_TYPE_STR;
92  value = newFile.getMd5Hash();
93  known = newFile.getKnown();
94  comment = "";
95 
96  originalAbstractFile = newFile;
97  }
98 
104  boolean isFileType() {
105  return FILE_TYPE_STR.equals(typeStr);
106  }
107 
113  void updateKnown(TskData.FileKnown newKnownStatus) {
114  known = newKnownStatus;
115  }
116 
122  public void updateComment(String newComment) {
123  comment = newComment;
124  }
125 
131  public String getCaseName() {
132  return caseName;
133  }
134 
140  public String getDeviceID() {
141  return deviceID;
142  }
143 
149  public String getDataSourceName() {
150  return dataSourceName;
151  }
152 
158  public String getFilePath() {
159  return filePath;
160  }
161 
167  public String getType() {
168  return typeStr;
169  }
170 
176  public String getValue() {
177  return value;
178  }
179 
185  public TskData.FileKnown getKnown() {
186  return known;
187  }
188 
194  public String getComment() {
195  return comment;
196  }
197 
204  public AbstractFile getAbstractFile() throws CentralRepoException {
205  if (originalAbstractFile == null) {
206  throw new CentralRepoException("AbstractFile is null");
207  }
208  return originalAbstractFile;
209  }
210 
220  if (originalCorrelationInstance == null) {
221  throw new CentralRepoException("CorrelationAttributeInstance is null");
222  }
224  }
225 
232  public static String getCsvItemSeparator() {
233  return CSV_ITEM_SEPARATOR;
234  }
235 
242  String toCsvString() {
243  StringBuilder line = new StringBuilder("\"");
244  line.append(getCaseName()).append(CSV_ITEM_SEPARATOR)
245  .append(getDataSourceName()).append(CSV_ITEM_SEPARATOR)
246  .append(getType()).append(CSV_ITEM_SEPARATOR)
247  .append(getValue()).append(CSV_ITEM_SEPARATOR)
248  .append(getKnown().toString()).append(CSV_ITEM_SEPARATOR)
249  .append(getFilePath()).append(CSV_ITEM_SEPARATOR)
250  .append(getComment()).append('"')
251  .append(System.getProperty("line.separator"));
252  return line.toString();
253  }
254 }
NodeData(CorrelationAttributeInstance instance, CorrelationAttributeInstance.Type type, String value)
Definition: NodeData.java:59
CorrelationAttributeInstance getCorrelationAttributeInstance()
Definition: NodeData.java:219

Copyright © 2012-2022 Basis Technology. Generated on: Sat Sep 24 2022
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.