Autopsy  4.19.3
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Static Public Member Functions | Static Public Attributes | Private Member Functions | Static Private Member Functions | List of all members
org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities Class Reference

Classes

class  AttributeComparator
 
interface  ResultSetHandler
 
enum  SortOrder
 

Static Public Member Functions

static List< BlackboardArtifact > getArtifacts (SleuthkitCase skCase, BlackboardArtifact.Type artifactType, DataSource dataSource, BlackboardAttribute.Type attributeType, SortOrder sortOrder) throws TskCoreException
 
static List< BlackboardArtifact > getArtifacts (SleuthkitCase skCase, BlackboardArtifact.Type artifactType, DataSource dataSource, BlackboardAttribute.Type attributeType, SortOrder sortOrder, int maxCount) throws TskCoreException
 
static Long getCountOfRegNonSlackFiles (SleuthkitCase skCase, DataSource currentDataSource, String additionalWhere) throws TskCoreException, SQLException
 
static Date getDateOrNull (BlackboardArtifact artifact, Type attributeType)
 
static Integer getIntOrNull (BlackboardArtifact artifact, Type attributeType)
 
static Long getLongOrNull (BlackboardArtifact artifact, Type attributeType)
 
static long getLongOrZero (Long longVal)
 
static String getMetaFlagsContainsStatement (TSK_FS_META_FLAG_ENUM flag)
 
static String getStringOrNull (BlackboardArtifact artifact, Type attributeType)
 
static String getStringOrZero (Long longVal)
 

Static Public Attributes

static final String COMMA_FORMAT_STR = "#,###"
 
static final DecimalFormat COMMA_FORMATTER = new DecimalFormat(COMMA_FORMAT_STR)
 

Private Member Functions

 DataSourceInfoUtilities ()
 

Static Private Member Functions

static List< BlackboardArtifact > createListFromMap (SortedMap< BlackboardAttribute, List< BlackboardArtifact >> sortedMap, int maxCount)
 
static SortedMap< BlackboardAttribute, List< BlackboardArtifact > > getArtifactMap (SleuthkitCase skCase, BlackboardArtifact.Type artifactType, DataSource dataSource, BlackboardAttribute.Type attributeType, SortOrder sortOrder) throws TskCoreException
 
static BlackboardAttribute getAttributeOrNull (BlackboardArtifact artifact, Type attributeType)
 

Detailed Description

Utilities for getting information about a data source or all data sources from the case database.

Definition at line 45 of file DataSourceInfoUtilities.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.DataSourceInfoUtilities ( )
private

Empty private constructor

Definition at line 225 of file DataSourceInfoUtilities.java.

Member Function Documentation

static List<BlackboardArtifact> org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.createListFromMap ( SortedMap< BlackboardAttribute, List< BlackboardArtifact >>  sortedMap,
int  maxCount 
)
staticprivate

Creates the list of artifacts from the sorted map and the given count.

Parameters
sortedMapSorted map of artifact lists.
maxCountMaximum number of artifacts to return.
Returns
List of artifacts, list will be empty if none were found.

Definition at line 274 of file DataSourceInfoUtilities.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getArtifacts().

static SortedMap<BlackboardAttribute, List<BlackboardArtifact> > org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getArtifactMap ( SleuthkitCase  skCase,
BlackboardArtifact.Type  artifactType,
DataSource  dataSource,
BlackboardAttribute.Type  attributeType,
SortOrder  sortOrder 
) throws TskCoreException
staticprivate

Create a Map of lists of artifacts sorted by the given attribute.

Parameters
skCaseSleuthkitCase instance.
artifactTypeType of artifacts to sort.
dataSourceData Source that the artifact belongs to.
attributeTypeAttribute type to sort by.
sortOrderSort order of the attributes, either ascending or descending.
Returns
A Map of lists of artifacts sorted by the value of attribute given type. Artifacts that do not have an attribute of the given type will not be included.
Exceptions
TskCoreException

Definition at line 244 of file DataSourceInfoUtilities.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getArtifacts().

static List<BlackboardArtifact> org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getArtifacts ( SleuthkitCase  skCase,
BlackboardArtifact.Type  artifactType,
DataSource  dataSource,
BlackboardAttribute.Type  attributeType,
SortOrder  sortOrder 
) throws TskCoreException
static

Returns a list of all artifacts of the given type that have an attribute of the given type sorted by given attribute type value. Artifacts that do not have the given attribute will not be included in the list.

Sorting on attributes of type byte[] and JSON is not currently supported.

Parameters
skCaseSleuthkitCase instance.
artifactTypeType of artifacts to sort.
dataSourceData Source that the artifact belongs to.
attributeTypeAttribute type to sort by.
sortOrderSort order of the attributes, either ascending or descending.
Returns
A list of artifacts of type artifactType sorted by the attribute of attributeType in the given sortOrder. If no artifacts are found an empty list will be returned.
Exceptions
TskCoreException

Definition at line 188 of file DataSourceInfoUtilities.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices().

static List<BlackboardArtifact> org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getArtifacts ( SleuthkitCase  skCase,
BlackboardArtifact.Type  artifactType,
DataSource  dataSource,
BlackboardAttribute.Type  attributeType,
SortOrder  sortOrder,
int  maxCount 
) throws TskCoreException
static

Return a list of artifacts that have been sorted by their attribute of attributeType. If an artifact of the given type does not have the given attribute it will not be included in the returned list.

Sorting on attributes of type byte[] and JSON is not currently supported.

Parameters
skCaseSleuthkitCase instance.
artifactTypeType of artifacts to sort.
dataSourceData Source that the artifact belongs to.
attributeTypeAttribute type to sort by.
sortOrderSort order of the attributes, either ascending or descending.
maxCountMaximum number of results to return. To return all values maxCount should be 0.
Returns
A list of artifacts of type artifactType sorted by the attribute of attributeType in the given sortOrder. If no artifacts are found an empty list will be returned.
Exceptions
TskCoreException

Definition at line 214 of file DataSourceInfoUtilities.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.createListFromMap(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getArtifactMap().

static BlackboardAttribute org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getAttributeOrNull ( BlackboardArtifact  artifact,
Type  attributeType 
)
staticprivate

Retrieves attribute from artifact if exists. Returns null if attribute is null or underlying call throws exception.

Parameters
artifactThe artifact.
attributeTypeThe attribute type to retrieve from the artifact.
Returns
The attribute or null if could not be received.

Definition at line 370 of file DataSourceInfoUtilities.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getIntOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getLongOrNull(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull().

static Long org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getCountOfRegNonSlackFiles ( SleuthkitCase  skCase,
DataSource  currentDataSource,
String  additionalWhere 
) throws TskCoreException, SQLException
static
static Date org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getDateOrNull ( BlackboardArtifact  artifact,
Type  attributeType 
)
static

Retrieves the long value of a certain attribute type from an artifact and converts to date (seconds since epoch).

Parameters
artifactThe artifact.
attributeTypeThe attribute type.
Returns
The date determined from the 'getValueLong()' as seconds from epoch or null if the attribute could not be retrieved or is 0.

Definition at line 430 of file DataSourceInfoUtilities.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getLongOrNull().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getAccountResult(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMessageAccountResult(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getWebSearchResult().

static Integer org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getIntOrNull ( BlackboardArtifact  artifact,
Type  attributeType 
)
static

Retrieves the int value of a certain attribute type from an artifact.

Parameters
artifactThe artifact.
attributeTypeThe attribute type.
Returns
The 'getValueInt()' value or null if the attribute could not be retrieved.

Definition at line 415 of file DataSourceInfoUtilities.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getAttributeOrNull().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult().

static Long org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getLongOrNull ( BlackboardArtifact  artifact,
Type  attributeType 
)
static
static long org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getLongOrZero ( Long  longVal)
static

Returns the long value or zero if longVal is null.

Parameters
longValThe long value.
Returns
The long value or 0 if provided value is null.

Definition at line 442 of file DataSourceInfoUtilities.java.

static String org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getMetaFlagsContainsStatement ( TSK_FS_META_FLAG_ENUM  flag)
static
static String org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull ( BlackboardArtifact  artifact,
Type  attributeType 
)
static
static String org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrZero ( Long  longVal)
static

Returns string value of long with comma separators. If null returns a string of '0'.

Parameters
longValThe long value.
Returns
The string value of the long.

Definition at line 454 of file DataSourceInfoUtilities.java.

Member Data Documentation

final String org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.COMMA_FORMAT_STR = "#,###"
static

Definition at line 47 of file DataSourceInfoUtilities.java.

final DecimalFormat org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.COMMA_FORMATTER = new DecimalFormat(COMMA_FORMAT_STR)
static

Definition at line 48 of file DataSourceInfoUtilities.java.


The documentation for this class was generated from the following file:

Copyright © 2012-2022 Basis Technology. Generated on: Tue Oct 4 2022
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.