Autopsy
4.19.3
Graphical digital forensics platform for The Sleuth Kit and other tools.
|
Classes | |
class | DisplayTskItems |
class | ItemEntry |
class | SectionConfig |
Static Public Member Functions | |
static Document | buildDocument (Node node) |
static boolean | isSupported (Node node) |
Private Member Functions | |
AnnotationUtils () | |
Static Private Member Functions | |
static< T > boolean | appendEntries (Element parent, AnnotationUtils.SectionConfig< T > config, List<?extends T > items, boolean isSubsection, boolean isFirstSection) |
static Element | appendRow (Element rowParent, List< String > data, int columnNumber, boolean isHeader) |
static Element | appendSection (Element parent, String headerText) |
static Element | appendSubsection (Element parent, String headerText) |
static Element | appendTable (Element parent, int columnNumber, List< List< String >> content, List< String > columnHeaders) |
static< T > Element | appendVerticalEntryTables (Element parent, List<?extends T > items, List< ItemEntry< T >> rowHeaders) |
static List< CorrelationAttributeInstance > | getCentralRepositoryData (BlackboardArtifact artifact) |
static List< CorrelationAttributeInstance > | getCentralRepositoryData (AbstractFile sourceFile) |
static List< CorrelationAttributeInstance > | getCorrelationAttributeComments (List< Pair< CorrelationAttributeInstance.Type, String >> lookupKeys) |
static List< BlackboardArtifact > | getFileSetHits (AbstractFile sourceFile, BlackboardArtifact.ARTIFACT_TYPE type) |
static List< ContentTag > | getTags (Content sourceContent) |
static List< BlackboardArtifactTag > | getTags (BlackboardArtifact bba) |
static boolean | hasTskComment (BlackboardArtifact artifact) |
static boolean | hasTskSet (BlackboardArtifact artifact) |
static boolean | renderArtifact (Element parent, BlackboardArtifact bba, Content sourceContent) |
static boolean | renderContent (Element parent, Content sourceContent, boolean isSubheader) |
static String | tryGetAttribute (BlackboardArtifact artifact, BlackboardAttribute.ATTRIBUTE_TYPE attributeType) |
Static Private Attributes | |
static final SectionConfig< BlackboardArtifact > | ARTIFACT_COMMENT_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_artifactCommentTitle(), ITEMSET_HIT_ENTRIES) |
static final SectionConfig< CorrelationAttributeInstance > | CR_COMMENTS_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_centralRepositoryEntry_title(), CR_COMMENTS_ENTRIES) |
static final List< ItemEntry< CorrelationAttributeInstance > > | CR_COMMENTS_ENTRIES |
static final String | EMPTY_HTML = "<html><head></head><body></body></html>" |
static final SectionConfig< BlackboardArtifact > | HASHSET_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_hashSetHitTitle(), ITEMSET_HIT_ENTRIES) |
static final SectionConfig< BlackboardArtifact > | INTERESTING_FILE_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_interestingFileHitTitle(), ITEMSET_HIT_ENTRIES) |
static final SectionConfig< BlackboardArtifact > | INTERESTING_ITEM_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_fileHitEntry_interestingItemTitle(), ITEMSET_HIT_ENTRIES) |
static final List< ItemEntry< BlackboardArtifact > > | ITEMSET_HIT_ENTRIES |
static final Logger | logger = Logger.getLogger(AnnotationUtils.class.getName()) |
static final SectionConfig< Tag > | TAG_CONFIG = new SectionConfig<>(Bundle.AnnotationUtils_tagEntry_title(), TAG_ENTRIES) |
static final List< ItemEntry< Tag > > | TAG_ENTRIES |
The business logic for the Annotations content panel.
Definition at line 59 of file AnnotationUtils.java.
|
private |
Definition at line 132 of file AnnotationUtils.java.
|
staticprivate |
Append entries to the parent element in the annotations viewer. Entries will be formatted as a table in the format specified in the SectionConfig.
parent | The parent element for which the entries will be attached. |
config | The display configuration for this entry type (i.e. table type, name, if data is not present). |
items | The items to display. |
isSubsection | Whether or not this should be displayed as a subsection. If not displayed as a top-level section. |
isFirstSection | Whether or not this is the first section appended. |
Definition at line 515 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendSection(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendSubsection(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendVerticalEntryTables(), org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getIndentedClassName(), and org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getSpacedSectionClassName().
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent().
|
staticprivate |
Appends a row to the parent element (should be thead or tbody).
rowParent | The parent table element. |
data | The data to place in columns within the table. |
columnNumber | The number of columns to append. |
isHeader | Whether or not this should have header cells ('th') instead of regular cells ('td'). |
Definition at line 607 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getKeyColumnClassName(), and org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getTextClassName().
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendTable().
|
staticprivate |
Appends a new section with a section header to the parent element.
parent | The element to append this section to. |
headerText | The text for the section. |
Definition at line 634 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getHeaderClassName().
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendEntries(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact().
|
staticprivate |
Appends a new subsection with a subsection header to the parent element.
parent | The element to append this subsection to. |
headerText | The text for the subsection. |
Definition at line 650 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getHeaderClassName().
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendEntries().
|
staticprivate |
Appends a generic table to the parent element.
parent | The parent element that will have a table appended to it. |
columnNumber | The number of columns to append. |
content | The content in content.get(row).get(column) format. |
columnHeaders | The column headers or null if no column headers should be created. |
Definition at line 581 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendRow().
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendVerticalEntryTables().
|
staticprivate |
Appends a table where items are displayed in rows of key-value pairs.
parent | The parent to append the table. |
items | The items to process into a series of tables. |
rowHeaders | The keys and the means to process items in order to get key-value pairs. |
Definition at line 546 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendTable(), and org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getSpacedSectionClassName().
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendEntries().
|
static |
Returns the formatted Annotation information for the given node. If no data was found the method will return null;
node | Node to get data for. |
Definition at line 175 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent().
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationsContentViewer.AnnotationWorker.doInBackground().
|
staticprivate |
Gets the "Central Repository Comments" section with data for the blackboard artifact.
artifact | The selected artifact. |
Definition at line 413 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getCorrelationAttributeComments(), and org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch().
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent().
|
staticprivate |
Gets the "Central Repository Comments" section with data.
sourceFile | A selected file, or a source file of the selected artifact. |
Definition at line 440 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.FILES_TYPE_ID, org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getCorrelationAttributeComments(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getDefinedCorrelationTypes(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getInstance(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.logger.
|
staticprivate |
Given a type and a value for that type, does a lookup in the Central Repository for matching values that have comments.
lookupKeys | The type and value to lookup. |
Definition at line 475 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getArtifactInstancesByTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getInstance(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.logger.
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getCentralRepositoryData().
|
staticprivate |
Retrieves the blackboard artifacts for a source file matching a certain type that have a non-blank TSK_COMMENT.
sourceFile | The source file for which to fetch artifacts. |
type | The type of blackboard artifact to fetch. |
Definition at line 340 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.hasTskComment(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.hasTskSet(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.logger.
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent().
|
staticprivate |
Retrieves tags associated with a content item.
sourceContent | The content for which to gather content. |
Definition at line 300 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.logger.
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent().
|
staticprivate |
Retrieves tags for blackboard artifact tags.
bba | The blackboard artifact for which to retrieve tags. |
Definition at line 319 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.logger.
|
staticprivate |
Returns true if the artifact contains a non-blank TSK_COMMENT attribute.
artifact | The artifact to check. |
Definition at line 361 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.tryGetAttribute().
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getFileSetHits(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact().
|
staticprivate |
Returns true if the artifact contains a non-blank TSK_SET_NAME attribute.
artifact | The artifact to check. |
Definition at line 372 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.tryGetAttribute().
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getFileSetHits().
|
static |
Returns whether or not the node is supported by the annotation viewer.
node | The node to display. |
Definition at line 162 of file AnnotationUtils.java.
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationsContentViewer.isSupported().
|
staticprivate |
Renders annotations for an artifact.
parent | The html element to render content int. |
bba | The blackboard artifact to render. |
sourceContent | The content from which the blackboard artifact comes. |
("deprecation") - we need to support already existing interesting file and artifact hits.
Definition at line 211 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendEntries(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendSection(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.ARTIFACT_COMMENT_CONFIG, org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.CR_COMMENTS_CONFIG, org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getCentralRepositoryData(), org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getIndentedClassName(), org.sleuthkit.autopsy.contentviewers.layout.ContentViewerHtmlStyles.getSpacedSectionClassName(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getTags(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.hasTskComment(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.isEnabled(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.TAG_CONFIG.
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.buildDocument().
|
staticprivate |
Renders annotations for a content item.
parent | The parent within which to render. |
sourceContent | The content for which annotations will be gathered. |
isSubheader | True if this section should be rendered as a subheader as opposed to a top-level header. |
("deprecation") - we need to support already existing interesting file and artifact hits.
Definition at line 260 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.appendEntries(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.CR_COMMENTS_CONFIG, org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getCentralRepositoryData(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getFileSetHits(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getTags(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.HASHSET_CONFIG, org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.INTERESTING_FILE_CONFIG, org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.INTERESTING_ITEM_CONFIG, org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.isEnabled(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.TAG_CONFIG.
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.buildDocument(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact().
|
staticprivate |
Attempts to retrieve the attribute of a particular type from a blackboard artifact.
artifact | The artifact from which to retrieve the information. |
attributeType | The attribute type to retrieve from the artifact. |
Definition at line 385 of file AnnotationUtils.java.
References org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.logger.
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.hasTskComment(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.hasTskSet().
|
staticprivate |
Definition at line 116 of file AnnotationUtils.java.
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact().
|
staticprivate |
Definition at line 127 of file AnnotationUtils.java.
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent().
|
staticprivate |
Definition at line 119 of file AnnotationUtils.java.
|
staticprivate |
Definition at line 85 of file AnnotationUtils.java.
|
staticprivate |
Definition at line 113 of file AnnotationUtils.java.
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent().
|
staticprivate |
Definition at line 107 of file AnnotationUtils.java.
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent().
|
staticprivate |
Definition at line 110 of file AnnotationUtils.java.
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent().
|
staticprivate |
Definition at line 99 of file AnnotationUtils.java.
|
staticprivate |
Definition at line 83 of file AnnotationUtils.java.
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getCentralRepositoryData(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getCorrelationAttributeComments(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getFileSetHits(), org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.getTags(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.tryGetAttribute().
|
staticprivate |
Definition at line 96 of file AnnotationUtils.java.
Referenced by org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderArtifact(), and org.sleuthkit.autopsy.contentviewers.annotations.AnnotationUtils.renderContent().
|
staticprivate |
Definition at line 88 of file AnnotationUtils.java.
Copyright © 2012-2022 Basis Technology. Generated on: Tue Mar 28 2023
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.