org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities Class Reference

Classes
class	AttributeComparator
interface	ResultSetHandler
enum	SortOrder

Static Public Member Functions
static List< BlackboardArtifact >	getArtifacts (SleuthkitCase skCase, BlackboardArtifact.Type artifactType, DataSource dataSource, BlackboardAttribute.Type attributeType, SortOrder sortOrder) throws TskCoreException
static List< BlackboardArtifact >	getArtifacts (SleuthkitCase skCase, BlackboardArtifact.Type artifactType, DataSource dataSource, BlackboardAttribute.Type attributeType, SortOrder sortOrder, int maxCount) throws TskCoreException
static Long	getCountOfRegNonSlackFiles (SleuthkitCase skCase, DataSource currentDataSource, String additionalWhere) throws TskCoreException, SQLException
static Date	getDateOrNull (BlackboardArtifact artifact, Type attributeType)
static Integer	getIntOrNull (BlackboardArtifact artifact, Type attributeType)
static Long	getLongOrNull (BlackboardArtifact artifact, Type attributeType)
static long	getLongOrZero (Long longVal)
static String	getMetaFlagsContainsStatement (TSK_FS_META_FLAG_ENUM flag)
static String	getStringOrNull (BlackboardArtifact artifact, Type attributeType)
static String	getStringOrZero (Long longVal)

Static Public Attributes
static final String	COMMA_FORMAT_STR = "#,###"
static final DecimalFormat	COMMA_FORMATTER = new DecimalFormat(COMMA_FORMAT_STR)

Private Member Functions
	DataSourceInfoUtilities ()

Static Private Member Functions
static List< BlackboardArtifact >	createListFromMap (SortedMap< BlackboardAttribute, List< BlackboardArtifact >> sortedMap, int maxCount)
static SortedMap< BlackboardAttribute, List< BlackboardArtifact > >	getArtifactMap (SleuthkitCase skCase, BlackboardArtifact.Type artifactType, DataSource dataSource, BlackboardAttribute.Type attributeType, SortOrder sortOrder) throws TskCoreException
static BlackboardAttribute	getAttributeOrNull (BlackboardArtifact artifact, Type attributeType)

Detailed Description

Utilities for getting information about a data source or all data sources from the case database.

Definition at line 45 of file DataSourceInfoUtilities.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.DataSourceInfoUtilities ( )

private

Empty private constructor

Definition at line 225 of file DataSourceInfoUtilities.java.

Member Function Documentation

static List<BlackboardArtifact> org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.createListFromMap ( SortedMap< BlackboardAttribute, List< BlackboardArtifact >>  sortedMap, int  maxCount  )

staticprivate

Creates the list of artifacts from the sorted map and the given count.

Parameters

sortedMap	Sorted map of artifact lists.
maxCount	Maximum number of artifacts to return.

Returns

List of artifacts, list will be empty if none were found.

Definition at line 274 of file DataSourceInfoUtilities.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getArtifacts().

static SortedMap<BlackboardAttribute, List<BlackboardArtifact> > org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getArtifactMap ( SleuthkitCase  skCase, BlackboardArtifact.Type  artifactType, DataSource  dataSource, BlackboardAttribute.Type  attributeType, SortOrder  sortOrder  ) throws TskCoreException

staticprivate

Create a Map of lists of artifacts sorted by the given attribute.

Parameters

skCase	SleuthkitCase instance.
artifactType	Type of artifacts to sort.
dataSource	Data Source that the artifact belongs to.
attributeType	Attribute type to sort by.
sortOrder	Sort order of the attributes, either ascending or descending.

Returns

A Map of lists of artifacts sorted by the value of attribute given type. Artifacts that do not have an attribute of the given type will not be included.

Exceptions

TskCoreException

Definition at line 244 of file DataSourceInfoUtilities.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getArtifacts().

static List<BlackboardArtifact> org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getArtifacts ( SleuthkitCase  skCase, BlackboardArtifact.Type  artifactType, DataSource  dataSource, BlackboardAttribute.Type  attributeType, SortOrder  sortOrder  ) throws TskCoreException

static

Returns a list of all artifacts of the given type that have an attribute of the given type sorted by given attribute type value. Artifacts that do not have the given attribute will not be included in the list.

Sorting on attributes of type byte[] and JSON is not currently supported.

Parameters

skCase	SleuthkitCase instance.
artifactType	Type of artifacts to sort.
dataSource	Data Source that the artifact belongs to.
attributeType	Attribute type to sort by.
sortOrder	Sort order of the attributes, either ascending or descending.

Returns

A list of artifacts of type artifactType sorted by the attribute of attributeType in the given sortOrder. If no artifacts are found an empty list will be returned.

Exceptions

TskCoreException

Definition at line 188 of file DataSourceInfoUtilities.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices().

static List<BlackboardArtifact> org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getArtifacts ( SleuthkitCase  skCase, BlackboardArtifact.Type  artifactType, DataSource  dataSource, BlackboardAttribute.Type  attributeType, SortOrder  sortOrder, int  maxCount  ) throws TskCoreException

static

Return a list of artifacts that have been sorted by their attribute of attributeType. If an artifact of the given type does not have the given attribute it will not be included in the returned list.

Sorting on attributes of type byte[] and JSON is not currently supported.

Parameters

skCase	SleuthkitCase instance.
artifactType	Type of artifacts to sort.
dataSource	Data Source that the artifact belongs to.
attributeType	Attribute type to sort by.
sortOrder	Sort order of the attributes, either ascending or descending.
maxCount	Maximum number of results to return. To return all values maxCount should be 0.

Returns

A list of artifacts of type artifactType sorted by the attribute of attributeType in the given sortOrder. If no artifacts are found an empty list will be returned.

Exceptions

TskCoreException

Definition at line 214 of file DataSourceInfoUtilities.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.createListFromMap(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getArtifactMap().

static BlackboardAttribute org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getAttributeOrNull ( BlackboardArtifact  artifact, Type  attributeType  )

staticprivate

Retrieves attribute from artifact if exists. Returns null if attribute is null or underlying call throws exception.

Parameters

artifact	The artifact.
attributeType	The attribute type to retrieve from the artifact.

Returns

The attribute or null if could not be received.

Definition at line 370 of file DataSourceInfoUtilities.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getIntOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getLongOrNull(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull().

static Long org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getCountOfRegNonSlackFiles ( SleuthkitCase  skCase, DataSource  currentDataSource, String  additionalWhere  ) throws TskCoreException, SQLException

static

Gets a count of regular non-slack files for a particular datasource.

Parameters

skCase	The current SleuthkitCase.
currentDataSource	The datasource.
additionalWhere	Additional sql where clauses.

Returns

The count of files or null on error.

Exceptions

TskCoreException
SQLException

Definition at line 107 of file DataSourceInfoUtilities.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.TypesSummary.getCountOfAllocatedFiles(), org.sleuthkit.autopsy.datasourcesummary.datamodel.MimeTypeSummary.getCountOfAllRegularFiles(), org.sleuthkit.autopsy.datasourcesummary.datamodel.MimeTypeSummary.getCountOfFilesForMimeTypes(), org.sleuthkit.autopsy.datasourcesummary.datamodel.MimeTypeSummary.getCountOfFilesNotInMimeTypes(), org.sleuthkit.autopsy.datasourcesummary.datamodel.MimeTypeSummary.getCountOfFilesWithNoMimeType(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.TypesSummary.getCountOfUnallocatedFiles().

static Date org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getDateOrNull ( BlackboardArtifact  artifact, Type  attributeType  )

static

Retrieves the long value of a certain attribute type from an artifact and converts to date (seconds since epoch).

Parameters

artifact	The artifact.
attributeType	The attribute type.

Returns

The date determined from the 'getValueLong()' as seconds from epoch or null if the attribute could not be retrieved or is 0.

Definition at line 430 of file DataSourceInfoUtilities.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getLongOrNull().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getAccountResult(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMessageAccountResult(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getWebSearchResult().

static Integer org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getIntOrNull ( BlackboardArtifact  artifact, Type  attributeType  )

static

Retrieves the int value of a certain attribute type from an artifact.

Parameters

artifact	The artifact.
attributeType	The attribute type.

Returns

The 'getValueInt()' value or null if the attribute could not be retrieved.

Definition at line 415 of file DataSourceInfoUtilities.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getAttributeOrNull().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult().

static Long org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getLongOrNull ( BlackboardArtifact  artifact, Type  attributeType  )

static

Retrieves the long value of a certain attribute type from an artifact.

Parameters

artifact	The artifact.
attributeType	The attribute type.

Returns

The 'getValueLong()' value or null if the attribute could not be retrieved.

Definition at line 401 of file DataSourceInfoUtilities.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getAttributeOrNull().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getDateOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachment(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownload(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocument().

static long org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getLongOrZero ( Long  longVal )

static

Returns the long value or zero if longVal is null.

Parameters

longVal

The long value.

Returns

The long value or 0 if provided value is null.

Definition at line 442 of file DataSourceInfoUtilities.java.

static String org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getMetaFlagsContainsStatement ( TSK_FS_META_FLAG_ENUM  flag )

static

Creates sql where clause that does a bitwise check to see if flag is present.

Parameters

flag	The flag for which to check.

Returns

The clause.

Definition at line 156 of file DataSourceInfoUtilities.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.TypesSummary.getCountOfAllocatedFiles(), org.sleuthkit.autopsy.datasourcesummary.datamodel.TypesSummary.getCountOfUnallocatedFiles(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.ContainerSummary.getSizeOfUnallocatedFiles().

static String org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull ( BlackboardArtifact  artifact, Type  attributeType  )

static

Retrieves the string value of a certain attribute type from an artifact.

Parameters

artifact	The artifact.
attributeType	The attribute type.

Returns

The 'getValueString()' value or null if the attribute or String could not be retrieved.

Definition at line 387 of file DataSourceInfoUtilities.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getAttributeOrNull().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.AnalysisSummary.getCountsData(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMessageAccountResult(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachment(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownload(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocument(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getWebSearchResult().

static String org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrZero ( Long  longVal )

static

Returns string value of long with comma separators. If null returns a string of '0'.

Parameters

longVal

The long value.

Returns

The string value of the long.

Definition at line 454 of file DataSourceInfoUtilities.java.

Member Data Documentation

final String org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.COMMA_FORMAT_STR = "#,###"

static

Definition at line 47 of file DataSourceInfoUtilities.java.

final DecimalFormat org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.COMMA_FORMATTER = new DecimalFormat(COMMA_FORMAT_STR)

static

Definition at line 48 of file DataSourceInfoUtilities.java.

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/DataSourceInfoUtilities.java