org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary Class Reference

Classes
class	LastAccessedArtifact
class	TopAccountResult
class	TopDeviceAttachedResult
class	TopDomainsResult
class	TopProgramsResult
class	TopWebSearchResult

Public Member Functions
	UserActivitySummary ()
	UserActivitySummary (SleuthkitCaseProvider provider, TextTranslationService translationService, java.util.logging.Logger logger)
List< TopWebSearchResult >	getMostRecentWebSearches (DataSource dataSource, int count) throws SleuthkitCaseProviderException, TskCoreException
List< TopAccountResult >	getRecentAccounts (DataSource dataSource, int count) throws SleuthkitCaseProviderException, TskCoreException
List< TopDeviceAttachedResult >	getRecentDevices (DataSource dataSource, int count) throws SleuthkitCaseProviderException, TskCoreException
List< TopDomainsResult >	getRecentDomains (DataSource dataSource, int count) throws TskCoreException, SleuthkitCaseProviderException
List< TopProgramsResult >	getTopPrograms (DataSource dataSource, int count) throws SleuthkitCaseProviderException, TskCoreException

Static Public Member Functions
static String	getShortFolderName (String strPath, String applicationName)

Private Member Functions
Pair< Long, Map< String, List< Pair< BlackboardArtifact, Long > > > >	getDomainGroupsAndMostRecent (DataSource dataSource) throws TskCoreException, SleuthkitCaseProviderException
TopDomainsResult	getDomainsResult (String domain, List< Pair< BlackboardArtifact, Long >> visits, long mostRecentMs)
TopDeviceAttachedResult	getMostRecentDevice (TopDeviceAttachedResult r1, TopDeviceAttachedResult r2)
TopProgramsResult	getTopProgramsResult (BlackboardArtifact artifact)
String	getTranslationOrNull (String original)

Static Private Member Functions
static void	assertValidCount (int count)
static TopAccountResult	getAccountResult (BlackboardArtifact artifact, String messageType, BlackboardAttribute.Type...dateAttrs)
static Long	getMax (Long num1, Long num2)
static Date	getMax (Date date1, Date date2)
static TopAccountResult	getMessageAccountResult (BlackboardArtifact artifact)
static TopWebSearchResult	getWebSearchResult (BlackboardArtifact artifact)
static boolean	isPositiveNum (Long longNum)
static int	nullableCompare (Long long1, Long long2)

Private Attributes
final SleuthkitCaseProvider	caseProvider
final java.util.logging.Logger	logger
final TextTranslationService	translationService

Static Private Attributes
static final Set< String >	DEVICE_EXCLUDE_LIST = new HashSet<>(Arrays.asList("ROOT_HUB", "ROOT_HUB20"))
static final Set< String >	DOMAIN_EXCLUDE_LIST = new HashSet<>(Arrays.asList("127.0.0.1", "LOCALHOST"))
static final long	DOMAIN_WINDOW_DAYS = 30
static final long	DOMAIN_WINDOW_MS = DOMAIN_WINDOW_DAYS * MS_PER_DAY
static final long	MS_PER_DAY = 1000 * 60 * 60 * 24
static final String	NTOS_BOOT_IDENTIFIER = "NTOSBOOT"
static final List< Function< List< String >, String > >	SHORT_FOLDER_MATCHERS
static final Comparator< TopAccountResult >	TOP_ACCOUNT_RESULT_DATE_COMPARE = (a, b) -> a.getLastAccessed().compareTo(b.getLastAccessed())
static final Comparator< TopProgramsResult >	TOP_PROGRAMS_RESULT_COMPARE
static final Comparator< TopWebSearchResult >	TOP_WEBSEARCH_RESULT_DATE_COMPARE = (a, b) -> a.getLastAccessed().compareTo(b.getLastAccessed())
static final BlackboardAttribute.Type	TYPE_COUNT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_COUNT)
static final BlackboardAttribute.Type	TYPE_DATETIME = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME)
static final BlackboardAttribute.Type	TYPE_DATETIME_ACCESSED = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)
static final BlackboardAttribute.Type	TYPE_DATETIME_END = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_END)
static final BlackboardAttribute.Type	TYPE_DATETIME_RCVD = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_RCVD)
static final BlackboardAttribute.Type	TYPE_DATETIME_SENT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_SENT)
static final BlackboardAttribute.Type	TYPE_DATETIME_START = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_START)
static final BlackboardArtifact.Type	TYPE_DEVICE_ATTACHED = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_DEVICE_ATTACHED)
static final BlackboardAttribute.Type	TYPE_DEVICE_ID = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_ID)
static final BlackboardAttribute.Type	TYPE_DEVICE_MAKE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)
static final BlackboardAttribute.Type	TYPE_DEVICE_MODEL = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)
static final BlackboardAttribute.Type	TYPE_DOMAIN = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DOMAIN)
static final BlackboardAttribute.Type	TYPE_MESSAGE_TYPE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)
static final BlackboardAttribute.Type	TYPE_PATH = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH)
static final BlackboardAttribute.Type	TYPE_PROG_NAME = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)
static final BlackboardAttribute.Type	TYPE_TEXT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_TEXT)
static final BlackboardArtifact.Type	TYPE_WEB_HISTORY = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_WEB_HISTORY)
static final String	WINDOWS_PREFIX = "/WINDOWS"

Detailed Description

Provides summary information about user activity in a datasource. At this time, the data being provided for domains is fictitious and is done as a placeholder.

Definition at line 56 of file UserActivitySummary.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.UserActivitySummary

(

)

Main constructor.

Definition at line 154 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.DEFAULT, org.sleuthkit.autopsy.texttranslation.TextTranslationService.getInstance(), and org.sleuthkit.autopsy.coreutils.Logger.getLogger().

org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.UserActivitySummary	(	SleuthkitCaseProvider	provider,
		TextTranslationService	translationService,
		java.util.logging.Logger	logger
	)

Main constructor with external dependencies specified. This constructor is designed with unit testing in mind since mocked dependencies can be utilized.

Parameters

provider	The object providing the current SleuthkitCase.
translationService	The translation service.
logger	The logger to use.

Definition at line 168 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.logger, and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.translationService.

Member Function Documentation

static void org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.assertValidCount ( int  count )

staticprivate

Throws an IllegalArgumentException if count <= 0.

Parameters

count

The count being checked.

Definition at line 183 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMostRecentWebSearches(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDomains(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopPrograms().

static TopAccountResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getAccountResult ( BlackboardArtifact  artifact, String  messageType, BlackboardAttribute.Type...  dateAttrs  )

staticprivate

Obtains a TopAccountResult from a blackboard artifact. The date is maximum of any found dates for attribute types provided.

Parameters

artifact	The artifact.
messageType	The type of message this is.
dateAttrs	The date attribute types.

Returns

The TopAccountResult or null if the account type or max date are not provided.

Definition at line 572 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getDateOrNull().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts().

Pair<Long, Map<String, List<Pair<BlackboardArtifact, Long> > > > org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent ( DataSource  dataSource ) throws TskCoreException, SleuthkitCaseProviderException

private

Queries TSK_WEB_HISTORY artifacts and returning the latest web history date accessed and a mapping of domains to all of their visits.

Parameters

dataSource

The datasource.

Returns

A tuple where the first value is the latest web history accessed date in milliseconds and the second value maps normalized (lowercase; trimmed) domain names to when those domains were visited and the relevant artifact.

Exceptions

TskCoreException
SleuthkitCaseProviderException

Definition at line 315 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.SortOrder.DESCENDING, org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getArtifacts(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getLongOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMax(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_ACCESSED, org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DOMAIN, and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_WEB_HISTORY.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDomains().

TopDomainsResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainsResult ( String  domain, List< Pair< BlackboardArtifact, Long >>  visits, long  mostRecentMs  )

private

Creates a TopDomainsResult from data or null if no visit date exists within DOMAIN_WINDOW_MS of mostRecentMs.

Parameters

domain	The domain.
visits	The list of the artifact and its associated time in milliseconds.
mostRecentMs	The most recent visit of any domain.

Returns

The TopDomainsResult or null if no visits to this domain within 30 days of mostRecentMs.

Definition at line 270 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMax().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDomains().

static Long org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMax ( Long  num1, Long  num2  )

staticprivate

Returns the maximum value given two longs handling possible null values.

Parameters

num1	The first number.
num2	The second number.

Returns

The maximum non-null number or null if both numbers are null.

Definition at line 361 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainsResult(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopPrograms().

static Date org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMax ( Date  date1, Date  date2  )

staticprivate

Retrieves the maximum date given two (possibly null) dates.

Parameters

date1	First date.
date2	Second date.

Returns

The maximum non-null date or null if both items are null.

Definition at line 703 of file UserActivitySummary.java.

static TopAccountResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMessageAccountResult ( BlackboardArtifact  artifact )

staticprivate

Obtains a TopAccountResult from a TSK_MESSAGE blackboard artifact.

Parameters

artifact

The artifact.

Returns

The TopAccountResult or null if the account type or message date cannot be determined.

Definition at line 553 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getDateOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME, and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_MESSAGE_TYPE.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts().

TopDeviceAttachedResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMostRecentDevice ( TopDeviceAttachedResult  r1, TopDeviceAttachedResult  r2  )

private

Gives the most recent TopDeviceAttachedResult. If one is null, the other is returned.

Parameters

r1	A result.
r2	Another result.

Returns

The most recent one with a non-null date.

Definition at line 486 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.LastAccessedArtifact.getLastAccessed().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices().

List<TopWebSearchResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMostRecentWebSearches	(	DataSource	dataSource,
		int	count
	)		throws SleuthkitCaseProviderException, TskCoreException

Retrieves most recent web searches by most recent date grouped by search term.

Parameters

dataSource	The data source.
count	The maximum number of records to be shown (must be > 0).

Returns

The list of most recent web searches where most recent search appears first.

Exceptions

org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.SleuthkitCaseProviderException
TskCoreException

Definition at line 402 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.assertValidCount(), org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTranslationOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getWebSearchResult(), and org.sleuthkit.autopsy.texttranslation.TextTranslationService.hasProvider().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivitySummaryGetter.getMostRecentWebSearches().

List<TopAccountResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts	(	DataSource	dataSource,
		int	count
	)		throws SleuthkitCaseProviderException, TskCoreException

Retrieves most recent account used by most recent date for a message sent.

Parameters

dataSource	The data source.
count	The maximum number of records to be shown (must be > 0).

Returns

The list of most recent accounts used where the most recent account by last message sent occurs first.

Exceptions

org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.SleuthkitCaseProviderException
TskCoreException

Definition at line 606 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.assertValidCount(), org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getAccountResult(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMessageAccountResult(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_END, org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_RCVD, org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_SENT, and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_START.

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivitySummaryGetter.getRecentAccounts().

List<TopDeviceAttachedResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices	(	DataSource	dataSource,
		int	count
	)		throws SleuthkitCaseProviderException, TskCoreException

Retrieves most recent devices used by most recent date attached.

Parameters

dataSource	The data source.
count	The maximum number of records to be shown (must be > 0).

Returns

The list of most recent devices attached where most recent device attached appears first.

Exceptions

org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.SleuthkitCaseProviderException
TskCoreException

Definition at line 512 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.assertValidCount(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.SortOrder.DESCENDING, org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getArtifacts(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getDateOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMostRecentDevice(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME, org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_ATTACHED, org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_ID, org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_MAKE, and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_MODEL.

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivitySummaryGetter.getRecentDevices().

List<TopDomainsResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDomains	(	DataSource	dataSource,
		int	count
	)		throws TskCoreException, SleuthkitCaseProviderException

Gets a list of recent domains based on the datasource.

Parameters

dataSource	The datasource to query for recent domains.
count	The max count of items to return.

Returns

The list of items retrieved from the database.

Exceptions

InterruptedException

Definition at line 232 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.assertValidCount(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainsResult().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivitySummaryGetter.getRecentDomains().

static String org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getShortFolderName ( String  strPath, String  applicationName  )

static

Determines a short folder name if any. Otherwise, returns empty string.

Parameters

strPath	The string path.
applicationName	The application name.

Returns

The short folder name or empty string if not found.

Definition at line 197 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivityPanel.getShortFolderName().

List<TopProgramsResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopPrograms	(	DataSource	dataSource,
		int	count
	)		throws SleuthkitCaseProviderException, TskCoreException

Retrieves the top programs results for the given data source limited to the count provided as a parameter. The highest run times are at the top of the list. If that information isn't available the last run date is used. If both, the last run date and the number of run times are unavailable, the programs will be sorted alphabetically, the count will be ignored and all items will be returned.

Parameters

dataSource	The datasource. If the datasource is null, an empty list will be returned.
count	The number of results to return. This value must be > 0 or an IllegalArgumentException will be thrown.

Returns

The sorted list and limited to the count if last run or run count information is available on any item.

Exceptions

SleuthkitCaseProviderException
TskCoreException

Definition at line 764 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.assertValidCount(), org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.LastAccessedArtifact.getLastAccessed(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMax(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TopProgramsResult.getRunTimes(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.isPositiveNum().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivitySummaryGetter.getTopPrograms().

TopProgramsResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult ( BlackboardArtifact  artifact )

private

Creates a TopProgramsResult from a TSK_PROG_RUN blackboard artifact.

Parameters

artifact

The TSK_PROG_RUN blackboard artifact.

Returns

The generated TopProgramsResult.

Definition at line 668 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getDateOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getIntOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_COUNT, org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME, org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_PATH, and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_PROG_NAME.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopPrograms().

String org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTranslationOrNull ( String  original )

private

Return the translation of the original text if possible and differs from the original. Otherwise, return null.

Parameters

original

The original text.

Returns

The translated text or null if no translation can be determined or exists.

Definition at line 455 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.texttranslation.TextTranslationService.hasProvider(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.logger, and org.sleuthkit.autopsy.texttranslation.TextTranslationService.translate().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMostRecentWebSearches().

static TopWebSearchResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getWebSearchResult ( BlackboardArtifact  artifact )

staticprivate

Attempts to obtain a web search result record from a blackboard artifact.

Parameters

artifact

The artifact.

Returns

The TopWebSearchResult or null if the search string or date accessed cannot be determined.

Definition at line 379 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getDateOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_ACCESSED, and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_TEXT.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMostRecentWebSearches().

static boolean org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.isPositiveNum ( Long  longNum )

staticprivate

Returns true if number is non-null and higher than 0.

Parameters

longNum

The number.

Returns

True if non-null and higher than 0.

Definition at line 741 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopPrograms().

static int org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.nullableCompare ( Long  long1, Long  long2  )

staticprivate

Returns the compare value favoring the higher non-null number.

Parameters

long1	First possibly null long.
long2	Second possibly null long.

Returns

Returns the compare value: 1,0,-1 favoring the higher non-null value.

Definition at line 722 of file UserActivitySummary.java.

Member Data Documentation

final SleuthkitCaseProvider org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.caseProvider

private

Definition at line 147 of file UserActivitySummary.java.

final Set<String> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.DEVICE_EXCLUDE_LIST = new HashSet<>(Arrays.asList("ROOT_HUB", "ROOT_HUB20"))

staticprivate

Definition at line 140 of file UserActivitySummary.java.

final Set<String> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.DOMAIN_EXCLUDE_LIST = new HashSet<>(Arrays.asList("127.0.0.1", "LOCALHOST"))

staticprivate

Definition at line 141 of file UserActivitySummary.java.

final long org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.DOMAIN_WINDOW_DAYS = 30

staticprivate

Definition at line 144 of file UserActivitySummary.java.

final long org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.DOMAIN_WINDOW_MS = DOMAIN_WINDOW_DAYS * MS_PER_DAY

staticprivate

Definition at line 145 of file UserActivitySummary.java.

final java.util.logging.Logger org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.logger

private

Definition at line 149 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTranslationOrNull(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.UserActivitySummary().

final long org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.MS_PER_DAY = 1000 * 60 * 60 * 24

staticprivate

Definition at line 143 of file UserActivitySummary.java.

final String org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.NTOS_BOOT_IDENTIFIER = "NTOSBOOT"

staticprivate

Definition at line 107 of file UserActivitySummary.java.

final List<Function<List<String>, String> > org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.SHORT_FOLDER_MATCHERS

staticprivate

Initial value:

= Arrays.asList(
            
            (pathList) -> {
                if (pathList.size() < 2) {
                    return null;
                }

                String rootParent = pathList.get(0).toUpperCase();
                if ("PROGRAM FILES".equals(rootParent) || "PROGRAM FILES (X86)".equals(rootParent)) {
                    return pathList.get(1);
                } else {
                    return null;
                }
            },
            
            (pathList) -> {
                for (String pathEl : pathList) {
                    String uppered = pathEl.toUpperCase();
                    if ("APPLICATION DATA".equals(uppered) || "APPDATA".equals(uppered)) {
                        return "AppData";
                    }
                }
                return null;
            }
    )

Functions that determine the folder name of a list of path elements. If not matched, function returns null.

Definition at line 62 of file UserActivitySummary.java.

final Comparator<TopAccountResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TOP_ACCOUNT_RESULT_DATE_COMPARE = (a, b) -> a.getLastAccessed().compareTo(b.getLastAccessed())

staticprivate

Definition at line 110 of file UserActivitySummary.java.

final Comparator<TopProgramsResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TOP_PROGRAMS_RESULT_COMPARE

staticprivate

Initial value:

= (a, b) -> {
        
        
        int runTimesCompare = nullableCompare(a.getRunTimes(), b.getRunTimes());
        if (runTimesCompare != 0) {
            return -runTimesCompare;
        }

        
        
        int lastRunCompare = nullableCompare(
                a.getLastAccessed() == null ? null : a.getLastAccessed().getTime(),
                b.getLastAccessed() == null ? null : b.getLastAccessed().getTime());

        if (lastRunCompare != 0) {
            return -lastRunCompare;
        }

        
        return (a.getProgramName() == null ? "" : a.getProgramName())
                .compareToIgnoreCase((b.getProgramName() == null ? "" : b.getProgramName()));
    }

Sorts TopProgramsResults pushing highest run time count then most recent run and then the program name that comes earliest in the alphabet.

Definition at line 117 of file UserActivitySummary.java.

final Comparator<TopWebSearchResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TOP_WEBSEARCH_RESULT_DATE_COMPARE = (a, b) -> a.getLastAccessed().compareTo(b.getLastAccessed())

staticprivate

Definition at line 111 of file UserActivitySummary.java.

final TextTranslationService org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.translationService

private

Definition at line 148 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.UserActivitySummary().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_COUNT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_COUNT)

staticprivate

Definition at line 105 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME)

staticprivate

Definition at line 91 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMessageAccountResult(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_ACCESSED = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)

staticprivate

Definition at line 92 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getWebSearchResult().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_END = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_END)

staticprivate

Definition at line 101 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_RCVD = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_RCVD)

staticprivate

Definition at line 98 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_SENT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_SENT)

staticprivate

Definition at line 99 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_START = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_START)

staticprivate

Definition at line 100 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts().

final BlackboardArtifact.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_ATTACHED = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_DEVICE_ATTACHED)

staticprivate

Definition at line 88 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_ID = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_ID)

staticprivate

Definition at line 93 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_MAKE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)

staticprivate

Definition at line 94 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_MODEL = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)

staticprivate

Definition at line 95 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DOMAIN = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DOMAIN)

staticprivate

Definition at line 102 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_MESSAGE_TYPE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)

staticprivate

Definition at line 96 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMessageAccountResult().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_PATH = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH)

staticprivate

Definition at line 104 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_PROG_NAME = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)

staticprivate

Definition at line 103 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_TEXT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_TEXT)

staticprivate

Definition at line 97 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getWebSearchResult().

final BlackboardArtifact.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_WEB_HISTORY = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_WEB_HISTORY)

staticprivate

Definition at line 89 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent().

final String org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.WINDOWS_PREFIX = "/WINDOWS"

staticprivate

Definition at line 108 of file UserActivitySummary.java.

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/UserActivitySummary.java