Autopsy  4.19.3
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Static Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary Class Reference

Classes

class  RecentAttachmentDetails
 
class  RecentDownloadDetails
 
class  RecentFileDetails
 

Public Member Functions

 RecentFilesSummary ()
 
 RecentFilesSummary (SleuthkitCaseProvider provider)
 
List< RecentAttachmentDetailsgetRecentAttachments (DataSource dataSource, int maxCount) throws SleuthkitCaseProviderException, TskCoreException
 
List< RecentDownloadDetailsgetRecentDownloads (DataSource dataSource, int maxCount) throws TskCoreException, SleuthkitCaseProviderException
 
List< RecentFileDetailsgetRecentlyOpenedDocuments (DataSource dataSource, int maxCount) throws SleuthkitCaseProviderException, TskCoreException
 

Static Private Member Functions

static RecentAttachmentDetails getRecentAttachment (BlackboardArtifact artifact, SleuthkitCase skCase) throws TskCoreException
 
static RecentDownloadDetails getRecentDownload (BlackboardArtifact artifact)
 
static RecentFileDetails getRecentlyOpenedDocument (BlackboardArtifact artifact)
 
static< TextendsRecentFileDetails > List< T > getSortedLimited (List< T > fileDetails, int limit)
 
static boolean isMessageArtifact (BlackboardArtifact nodeArtifact)
 
static void throwOnNonPositiveCount (int count)
 

Private Attributes

final SleuthkitCaseProvider provider
 

Static Private Attributes

static final BlackboardAttribute.Type ASSOCATED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)
 
static final BlackboardArtifact.Type ASSOCATED_OBJ_ART = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT)
 
static final BlackboardAttribute.Type DATETIME_ACCESSED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)
 
static final DateFormat DATETIME_FORMAT = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss", Locale.getDefault())
 
static final BlackboardAttribute.Type DOMAIN_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)
 
static final BlackboardAttribute.Type EMAIL_FROM_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)
 
static final BlackboardAttribute.Type MSG_DATEIME_SENT_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)
 
static final BlackboardAttribute.Type PATH_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)
 

Detailed Description

Helper class for getting Recent Activity data.

Definition at line 45 of file RecentFilesSummary.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.RecentFilesSummary ( )
org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.RecentFilesSummary ( SleuthkitCaseProvider  provider)

Construct object with given SleuthkitCaseProvider

Parameters
providerSleuthkitCaseProvider provider, cannot be null.

Definition at line 71 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.provider.

Member Function Documentation

static RecentAttachmentDetails org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachment ( BlackboardArtifact  artifact,
SleuthkitCase  skCase 
) throws TskCoreException
staticprivate
List<RecentAttachmentDetails> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachments ( DataSource  dataSource,
int  maxCount 
) throws SleuthkitCaseProviderException, TskCoreException
static RecentDownloadDetails org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownload ( BlackboardArtifact  artifact)
staticprivate
List<RecentDownloadDetails> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownloads ( DataSource  dataSource,
int  maxCount 
) throws TskCoreException, SleuthkitCaseProviderException

Return a list of the most recent downloads based on the value of the the artifact TSK_DATETIME_ACCESSED attribute.

Parameters
dataSourceData source to query.
maxCountMaximum number of results to return, passing 0 will return all results.
Returns
A list of RecentFileDetails objects or empty list if none were found.
Exceptions
TskCoreException
SleuthkitCaseProviderException

Definition at line 193 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownload(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getSortedLimited(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.throwOnNonPositiveCount().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.RecentFilesGetter.getRecentDownloads().

static RecentFileDetails org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocument ( BlackboardArtifact  artifact)
staticprivate
List<RecentFileDetails> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocuments ( DataSource  dataSource,
int  maxCount 
) throws SleuthkitCaseProviderException, TskCoreException

Return a list of the most recently opened documents based on the TSK_RECENT_OBJECT artifact.

Parameters
dataSourceThe data source to query.
maxCountThe maximum number of results to return, pass 0 to get a list of all results.
Returns
A list RecentFileDetails representing the most recently opened documents or an empty list if none were found.
Exceptions
SleuthkitCaseProviderException
TskCoreException

Definition at line 133 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocument(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getSortedLimited(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.throwOnNonPositiveCount().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.RecentFilesGetter.getRecentlyOpenedDocuments().

static <TextendsRecentFileDetails> List<T> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getSortedLimited ( List< T >  fileDetails,
int  limit 
)
staticprivate

Removes fileDetails entries with redundant paths, sorts by date descending and limits to the limit provided.

Parameters
fileDetailsThe file details list.
limitThe maximum number of entries to return.
Returns
The sorted limited list with unique paths.

Definition at line 87 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachments(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownloads(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocuments().

static boolean org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.isMessageArtifact ( BlackboardArtifact  nodeArtifact)
staticprivate

Is the given artifact a message.

Parameters
nodeArtifactAn artifact that might be a message. Must not be null.
Returns
True if the given artifact is a message artifact

Definition at line 295 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachment().

static void org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.throwOnNonPositiveCount ( int  count)
staticprivate

Member Data Documentation

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ASSOCATED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)
staticprivate
final BlackboardArtifact.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ASSOCATED_OBJ_ART = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DATETIME_ACCESSED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)
staticprivate
final DateFormat org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DATETIME_FORMAT = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss", Locale.getDefault())
staticprivate

Definition at line 55 of file RecentFilesSummary.java.

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DOMAIN_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.EMAIL_FROM_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.MSG_DATEIME_SENT_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.PATH_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)
staticprivate
final SleuthkitCaseProvider org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.provider
private

The documentation for this class was generated from the following file:

Copyright © 2012-2022 Basis Technology. Generated on: Tue Oct 4 2022
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.