org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary Class Reference

Classes
class	RecentAttachmentDetails
class	RecentDownloadDetails
class	RecentFileDetails

Public Member Functions
	RecentFilesSummary ()
	RecentFilesSummary (SleuthkitCaseProvider provider)
List< RecentAttachmentDetails >	getRecentAttachments (DataSource dataSource, int maxCount) throws SleuthkitCaseProviderException, TskCoreException
List< RecentDownloadDetails >	getRecentDownloads (DataSource dataSource, int maxCount) throws TskCoreException, SleuthkitCaseProviderException
List< RecentFileDetails >	getRecentlyOpenedDocuments (DataSource dataSource, int maxCount) throws SleuthkitCaseProviderException, TskCoreException

Static Private Member Functions
static RecentAttachmentDetails	getRecentAttachment (BlackboardArtifact artifact, SleuthkitCase skCase) throws TskCoreException
static RecentDownloadDetails	getRecentDownload (BlackboardArtifact artifact)
static RecentFileDetails	getRecentlyOpenedDocument (BlackboardArtifact artifact)
static< TextendsRecentFileDetails > List< T >	getSortedLimited (List< T > fileDetails, int limit)
static boolean	isMessageArtifact (BlackboardArtifact nodeArtifact)
static void	throwOnNonPositiveCount (int count)

Private Attributes
final SleuthkitCaseProvider	provider

Static Private Attributes
static final BlackboardAttribute.Type	ASSOCATED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)
static final BlackboardArtifact.Type	ASSOCATED_OBJ_ART = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT)
static final BlackboardAttribute.Type	DATETIME_ACCESSED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)
static final DateFormat	DATETIME_FORMAT = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss", Locale.getDefault())
static final BlackboardAttribute.Type	DOMAIN_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)
static final BlackboardAttribute.Type	EMAIL_FROM_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)
static final BlackboardAttribute.Type	MSG_DATEIME_SENT_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)
static final BlackboardAttribute.Type	PATH_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)

Detailed Description

Helper class for getting Recent Activity data.

Definition at line 45 of file RecentFilesSummary.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.RecentFilesSummary

(

)

Default constructor.

Definition at line 62 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.DEFAULT.

org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.RecentFilesSummary

(

SleuthkitCaseProvider

provider

)

Construct object with given SleuthkitCaseProvider

Parameters

provider

SleuthkitCaseProvider provider, cannot be null.

Definition at line 71 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.provider.

Member Function Documentation

static RecentAttachmentDetails org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachment ( BlackboardArtifact  artifact, SleuthkitCase  skCase  ) throws TskCoreException

staticprivate

Creates a RecentAttachmentDetails object from the associated object artifact or null if no RecentAttachmentDetails object can be derived.

Parameters

artifact	The associated object artifact.
skCase	The current case.

Returns

The derived object or null.

Exceptions

TskCoreException

Definition at line 254 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ASSOCATED_ATT, org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.EMAIL_FROM_ATT, org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getLongOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.isMessageArtifact(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.MSG_DATEIME_SENT_ATT.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachments().

List<RecentAttachmentDetails> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachments	(	DataSource	dataSource,
		int	maxCount
	)		throws SleuthkitCaseProviderException, TskCoreException

Returns a list of the most recent message attachments.

Parameters

dataSource	Data source to query.
maxCount	Maximum number of results to return, passing 0 will return all results.

Returns

A list of RecentFileDetails of the most recent attachments.

Exceptions

SleuthkitCaseProviderException
TskCoreException

Definition at line 221 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ASSOCATED_OBJ_ART, org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachment(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getSortedLimited(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.throwOnNonPositiveCount().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.RecentFilesGetter.getRecentAttachments().

static RecentDownloadDetails org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownload ( BlackboardArtifact  artifact )

staticprivate

Returns a RecentDownloadDetails object as derived from the recent download artifact or null if no appropriate object can be made.

Parameters

artifact

The artifact.

Returns

The derived object or null if artifact is invalid.

Definition at line 156 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DATETIME_ACCESSED_ATT, org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DOMAIN_ATT, org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getLongOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.PATH_ATT.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownloads().

List<RecentDownloadDetails> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownloads	(	DataSource	dataSource,
		int	maxCount
	)		throws TskCoreException, SleuthkitCaseProviderException

Return a list of the most recent downloads based on the value of the the artifact TSK_DATETIME_ACCESSED attribute.

Parameters

dataSource	Data source to query.
maxCount	Maximum number of results to return, passing 0 will return all results.

Returns

A list of RecentFileDetails objects or empty list if none were found.

Exceptions

TskCoreException
SleuthkitCaseProviderException

Definition at line 193 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownload(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getSortedLimited(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.throwOnNonPositiveCount().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.RecentFilesGetter.getRecentDownloads().

static RecentFileDetails org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocument ( BlackboardArtifact  artifact )

staticprivate

Returns a RecentFileDetails object as derived from the recent document artifact or null if no appropriate object can be made.

Parameters

artifact

The artifact.

Returns

The derived object or null if artifact is invalid.

Definition at line 108 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DATETIME_ACCESSED_ATT, org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getLongOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.PATH_ATT.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocuments().

List<RecentFileDetails> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocuments	(	DataSource	dataSource,
		int	maxCount
	)		throws SleuthkitCaseProviderException, TskCoreException

Return a list of the most recently opened documents based on the TSK_RECENT_OBJECT artifact.

Parameters

dataSource	The data source to query.
maxCount	The maximum number of results to return, pass 0 to get a list of all results.

Returns

A list RecentFileDetails representing the most recently opened documents or an empty list if none were found.

Exceptions

SleuthkitCaseProviderException
TskCoreException

Definition at line 133 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocument(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getSortedLimited(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.throwOnNonPositiveCount().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.RecentFilesGetter.getRecentlyOpenedDocuments().

static <TextendsRecentFileDetails> List<T> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getSortedLimited ( List< T >  fileDetails, int  limit  )

staticprivate

Removes fileDetails entries with redundant paths, sorts by date descending and limits to the limit provided.

Parameters

fileDetails	The file details list.
limit	The maximum number of entries to return.

Returns

The sorted limited list with unique paths.

Definition at line 87 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachments(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownloads(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocuments().

static boolean org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.isMessageArtifact ( BlackboardArtifact  nodeArtifact )

staticprivate

Is the given artifact a message.

Parameters

nodeArtifact

An artifact that might be a message. Must not be null.

Returns

True if the given artifact is a message artifact

Definition at line 295 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachment().

static void org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.throwOnNonPositiveCount ( int  count )

staticprivate

Throws an IllegalArgumentException if count is less than 1.

Parameters

count

The count.

Definition at line 173 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachments(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownloads(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocuments().

Member Data Documentation

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ASSOCATED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)

staticprivate

Definition at line 50 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachment().

final BlackboardArtifact.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ASSOCATED_OBJ_ART = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT)

staticprivate

Definition at line 53 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachments().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DATETIME_ACCESSED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)

staticprivate

Definition at line 47 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownload(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocument().

final DateFormat org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DATETIME_FORMAT = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss", Locale.getDefault())

staticprivate

Definition at line 55 of file RecentFilesSummary.java.

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DOMAIN_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)

staticprivate

Definition at line 48 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownload().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.EMAIL_FROM_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)

staticprivate

Definition at line 51 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachment().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.MSG_DATEIME_SENT_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)

staticprivate

Definition at line 52 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachment().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.PATH_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)

staticprivate

Definition at line 49 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownload(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocument().

final SleuthkitCaseProvider org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.provider

private

Definition at line 57 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.RecentFilesSummary().

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/RecentFilesSummary.java