Autopsy  4.19.3
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Static Public Member Functions | Private Member Functions | Static Private Member Functions | Static Private Attributes | List of all members
org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils Class Reference

Classes

class  DisplayTskItems
 
class  ItemEntry
 
class  SectionConfig
 

Static Public Member Functions

static Document buildDocument (Node node)
 
static boolean isSupported (Node node)
 

Private Member Functions

 AnnotationUtils ()
 

Static Private Member Functions

static< T > boolean appendEntries (Element parent, AnnotationUtils.SectionConfig< T > config, List<?extends T > items, boolean isSubsection, boolean isFirstSection)
 
static Element appendRow (Element rowParent, List< String > data, int columnNumber, boolean isHeader)
 
static Element appendSection (Element parent, String headerText)
 
static Element appendSubsection (Element parent, String headerText)
 
static Element appendTable (Element parent, int columnNumber, List< List< String >> content, List< String > columnHeaders)
 
static< T > Element appendVerticalEntryTables (Element parent, List<?extends T > items, List< ItemEntry< T >> rowHeaders)
 
static List< CorrelationAttributeInstancegetCentralRepositoryData (BlackboardArtifact artifact)
 
static List< CorrelationAttributeInstancegetCentralRepositoryData (AbstractFile sourceFile)
 
static List< CorrelationAttributeInstancegetCorrelationAttributeComments (List< Pair< CorrelationAttributeInstance.Type, String >> lookupKeys)
 
static List< BlackboardArtifact > getFileSetHits (AbstractFile sourceFile, BlackboardArtifact.ARTIFACT_TYPE type)
 
static List< ContentTag > getTags (Content sourceContent)
 
static List< BlackboardArtifactTag > getTags (BlackboardArtifact bba)
 
static boolean hasTskComment (BlackboardArtifact artifact)
 
static boolean hasTskSet (BlackboardArtifact artifact)
 
static boolean renderArtifact (Element parent, BlackboardArtifact bba, Content sourceContent)
 
static boolean renderContent (Element parent, Content sourceContent, boolean isSubheader)
 
static String tryGetAttribute (BlackboardArtifact artifact, BlackboardAttribute.ATTRIBUTE_TYPE attributeType)
 

Static Private Attributes

static final SectionConfig< BlackboardArtifact > ARTIFACT_COMMENT_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_artifactCommentTitle(), ITEMSET_HIT_ENTRIES)
 
static final SectionConfig< CorrelationAttributeInstanceCR_COMMENTS_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_centralRepositoryEntry_title(), CR_COMMENTS_ENTRIES)
 
static final List< ItemEntry< CorrelationAttributeInstance > > CR_COMMENTS_ENTRIES
 
static final String EMPTY_HTML = "<html><head></head><body></body></html>"
 
static final SectionConfig< BlackboardArtifact > HASHSET_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_hashSetHitTitle(), ITEMSET_HIT_ENTRIES)
 
static final SectionConfig< BlackboardArtifact > INTERESTING_FILE_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_interestingFileHitTitle(), ITEMSET_HIT_ENTRIES)
 
static final SectionConfig< BlackboardArtifact > INTERESTING_ITEM_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_interestingItemTitle(), ITEMSET_HIT_ENTRIES)
 
static final List< ItemEntry< BlackboardArtifact > > ITEMSET_HIT_ENTRIES
 
static final Logger logger = Logger.getLogger(AnnotationUtils.class.getName())
 
static final SectionConfig< Tag > TAG_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_tagEntry_title(), TAG_ENTRIES)
 
static final List< ItemEntry< Tag > > TAG_ENTRIES
 

Detailed Description

The business logic for the Annotations content panel.

Definition at line 59 of file AnnotationUtils.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.AnnotationUtils ( )
private

Definition at line 132 of file AnnotationUtils.java.

Member Function Documentation

static <T> boolean org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendEntries ( Element  parent,
AnnotationUtils.SectionConfig< T >  config,
List<?extends T >  items,
boolean  isSubsection,
boolean  isFirstSection 
)
staticprivate

Append entries to the parent element in the annotations viewer. Entries will be formatted as a table in the format specified in the SectionConfig.

Parameters
parentThe parent element for which the entries will be attached.
configThe display configuration for this entry type (i.e. table type, name, if data is not present).
itemsThe items to display.
isSubsectionWhether or not this should be displayed as a subsection. If not displayed as a top-level section.
isFirstSectionWhether or not this is the first section appended.
Returns
If there was actual content rendered for this set of entries.

Definition at line 515 of file AnnotationUtils.java.

References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendSection(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendSubsection(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendVerticalEntryTables(), org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getIndentedClassName(), and org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getSpacedSectionClassName().

Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent().

static Element org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendRow ( Element  rowParent,
List< String >  data,
int  columnNumber,
boolean  isHeader 
)
staticprivate

Appends a row to the parent element (should be thead or tbody).

Parameters
rowParentThe parent table element.
dataThe data to place in columns within the table.
columnNumberThe number of columns to append.
isHeaderWhether or not this should have header cells ('th') instead of regular cells ('td').
Returns
The row created.

Definition at line 607 of file AnnotationUtils.java.

References org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getKeyColumnClassName(), and org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getTextClassName().

Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendTable().

static Element org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendSection ( Element  parent,
String  headerText 
)
staticprivate

Appends a new section with a section header to the parent element.

Parameters
parentThe element to append this section to.
headerTextThe text for the section.
Returns
The div for the new section.

Definition at line 634 of file AnnotationUtils.java.

References org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getHeaderClassName().

Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendEntries(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact().

static Element org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendSubsection ( Element  parent,
String  headerText 
)
staticprivate

Appends a new subsection with a subsection header to the parent element.

Parameters
parentThe element to append this subsection to.
headerTextThe text for the subsection.
Returns
The div for the new subsection.

Definition at line 650 of file AnnotationUtils.java.

References org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getHeaderClassName().

Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendEntries().

static Element org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendTable ( Element  parent,
int  columnNumber,
List< List< String >>  content,
List< String >  columnHeaders 
)
staticprivate

Appends a generic table to the parent element.

Parameters
parentThe parent element that will have a table appended to it.
columnNumberThe number of columns to append.
contentThe content in content.get(row).get(column) format.
columnHeadersThe column headers or null if no column headers should be created.
Returns
The created table.

Definition at line 581 of file AnnotationUtils.java.

References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendRow().

Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendVerticalEntryTables().

static <T> Element org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendVerticalEntryTables ( Element  parent,
List<?extends T >  items,
List< ItemEntry< T >>  rowHeaders 
)
staticprivate

Appends a table where items are displayed in rows of key-value pairs.

Parameters
parentThe parent to append the table.
itemsThe items to process into a series of tables.
rowHeadersThe keys and the means to process items in order to get key-value pairs.
Returns
The parent element provided as parameter.

Definition at line 546 of file AnnotationUtils.java.

References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendTable(), and org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getSpacedSectionClassName().

Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendEntries().

static Document org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.buildDocument ( Node  node)
static

Returns the formatted Annotation information for the given node. If no data was found the method will return null;

Parameters
nodeNode to get data for.
Returns
A formatted document of annotation information for the given node or null.

Definition at line 175 of file AnnotationUtils.java.

References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent().

Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationsContentViewer.AnnotationWorker.doInBackground().

static List<CorrelationAttributeInstance> org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getCentralRepositoryData ( BlackboardArtifact  artifact)
staticprivate

Gets the "Central Repository Comments" section with data for the blackboard artifact.

Parameters
artifactThe selected artifact.
Returns
The Correlation Attribute Instances associated with the artifact that have comments.

Definition at line 413 of file AnnotationUtils.java.

References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getCorrelationAttributeComments(), and org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch().

Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent().

static List<CorrelationAttributeInstance> org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getCentralRepositoryData ( AbstractFile  sourceFile)
staticprivate
static List<CorrelationAttributeInstance> org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getCorrelationAttributeComments ( List< Pair< CorrelationAttributeInstance.Type, String >>  lookupKeys)
staticprivate

Given a type and a value for that type, does a lookup in the Central Repository for matching values that have comments.

Parameters
lookupKeysThe type and value to lookup.
Returns
The found correlation attribute instances.

Definition at line 475 of file AnnotationUtils.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getArtifactInstancesByTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getInstance(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.logger.

Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getCentralRepositoryData().

static List<BlackboardArtifact> org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getFileSetHits ( AbstractFile  sourceFile,
BlackboardArtifact.ARTIFACT_TYPE  type 
)
staticprivate

Retrieves the blackboard artifacts for a source file matching a certain type that have a non-blank TSK_COMMENT.

Parameters
sourceFileThe source file for which to fetch artifacts.
typeThe type of blackboard artifact to fetch.
Returns
The artifacts found matching this type.

Definition at line 340 of file AnnotationUtils.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.hasTskComment(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.hasTskSet(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.logger.

Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent().

static List<ContentTag> org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getTags ( Content  sourceContent)
staticprivate
static List<BlackboardArtifactTag> org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getTags ( BlackboardArtifact  bba)
staticprivate

Retrieves tags for blackboard artifact tags.

Parameters
bbaThe blackboard artifact for which to retrieve tags.
Returns
The found tags.

Definition at line 319 of file AnnotationUtils.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.logger.

static boolean org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.hasTskComment ( BlackboardArtifact  artifact)
staticprivate

Returns true if the artifact contains a non-blank TSK_COMMENT attribute.

Parameters
artifactThe artifact to check.
Returns
True if it has a non-blank TSK_COMMENT.

Definition at line 361 of file AnnotationUtils.java.

References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.tryGetAttribute().

Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getFileSetHits(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact().

static boolean org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.hasTskSet ( BlackboardArtifact  artifact)
staticprivate

Returns true if the artifact contains a non-blank TSK_SET_NAME attribute.

Parameters
artifactThe artifact to check.
Returns
True if it has a non-blank TSK_SET_NAME.

Definition at line 372 of file AnnotationUtils.java.

References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.tryGetAttribute().

Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getFileSetHits().

static boolean org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.isSupported ( Node  node)
static

Returns whether or not the node is supported by the annotation viewer.

Parameters
nodeThe node to display.
Returns
True if the node is supported.

Definition at line 162 of file AnnotationUtils.java.

Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationsContentViewer.isSupported().

static boolean org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact ( Element  parent,
BlackboardArtifact  bba,
Content  sourceContent 
)
staticprivate

Renders annotations for an artifact.

Parameters
parentThe html element to render content int.
bbaThe blackboard artifact to render.
sourceContentThe content from which the blackboard artifact comes.
Returns
If any content was actually rendered.

("deprecation") - we need to support already existing interesting file and artifact hits.

Definition at line 211 of file AnnotationUtils.java.

References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendEntries(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendSection(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.ARTIFACT_COMMENT_CONFIG, org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.CR_COMMENTS_CONFIG, org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getCentralRepositoryData(), org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getIndentedClassName(), org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getSpacedSectionClassName(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getTags(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.hasTskComment(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.isEnabled(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.TAG_CONFIG.

Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.buildDocument().

static boolean org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent ( Element  parent,
Content  sourceContent,
boolean  isSubheader 
)
staticprivate
static String org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.tryGetAttribute ( BlackboardArtifact  artifact,
BlackboardAttribute.ATTRIBUTE_TYPE  attributeType 
)
staticprivate

Attempts to retrieve the attribute of a particular type from a blackboard artifact.

Parameters
artifactThe artifact from which to retrieve the information.
attributeTypeThe attribute type to retrieve from the artifact.
Returns
The string value of the attribute or null if not found.

Definition at line 385 of file AnnotationUtils.java.

References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.logger.

Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.hasTskComment(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.hasTskSet().

Member Data Documentation

final SectionConfig<BlackboardArtifact> org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.ARTIFACT_COMMENT_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_artifactCommentTitle(), ITEMSET_HIT_ENTRIES)
staticprivate
final SectionConfig<CorrelationAttributeInstance> org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.CR_COMMENTS_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_centralRepositoryEntry_title(), CR_COMMENTS_ENTRIES)
staticprivate
final List<ItemEntry<CorrelationAttributeInstance> > org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.CR_COMMENTS_ENTRIES
staticprivate
Initial value:
= Arrays.asList(
new ItemEntry<>(Bundle.AnnotationUtils_centralRepositoryEntryDataLabel_case(),
cai -> (cai.getCorrelationCase() != null) ? cai.getCorrelationCase().getDisplayName() : null),
new ItemEntry<>(Bundle.AnnotationUtils_centralRepositoryEntryDataLabel_comment(), cai -> cai.getComment()),
new ItemEntry<>(Bundle.AnnotationUtils_centralRepositoryEntryDataLabel_path(), cai -> cai.getFilePath())
)

Definition at line 119 of file AnnotationUtils.java.

final String org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.EMPTY_HTML = "<html><head></head><body></body></html>"
staticprivate

Definition at line 85 of file AnnotationUtils.java.

final SectionConfig<BlackboardArtifact> org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.HASHSET_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_hashSetHitTitle(), ITEMSET_HIT_ENTRIES)
staticprivate
final SectionConfig<BlackboardArtifact> org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.INTERESTING_FILE_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_interestingFileHitTitle(), ITEMSET_HIT_ENTRIES)
staticprivate
final SectionConfig<BlackboardArtifact> org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.INTERESTING_ITEM_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_interestingItemTitle(), ITEMSET_HIT_ENTRIES)
staticprivate
final List<ItemEntry<BlackboardArtifact> > org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.ITEMSET_HIT_ENTRIES
staticprivate
Initial value:
= Arrays.asList(
new ItemEntry<>(Bundle.AnnotationUtils_fileHitEntry_setName(),
(bba) -> tryGetAttribute(bba, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)),
new ItemEntry<>(Bundle.AnnotationUtils_fileHitEntry_comment(),
(bba) -> tryGetAttribute(bba, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT))
)

Definition at line 99 of file AnnotationUtils.java.

final Logger org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.logger = Logger.getLogger(AnnotationUtils.class.getName())
staticprivate
final SectionConfig<Tag> org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.TAG_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_tagEntry_title(), TAG_ENTRIES)
staticprivate
final List<ItemEntry<Tag> > org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.TAG_ENTRIES
staticprivate
Initial value:
= Arrays.asList(
new ItemEntry<>(Bundle.AnnotationUtils_tagEntryDataLabel_tag(),
(tag) -> (tag.getName() != null) ? tag.getName().getDisplayName() : null),
new ItemEntry<>(Bundle.AnnotationUtils_tagEntryDataLabel_tagUser(), (tag) -> tag.getUserName()),
new ItemEntry<>(Bundle.AnnotationUtils_tagEntryDataLabel_comment(), (tag) -> tag.getComment())
)

Definition at line 88 of file AnnotationUtils.java.


The documentation for this class was generated from the following file:

Copyright © 2012-2022 Basis Technology. Generated on: Thu Sep 29 2022
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.