Classes
class	LastAccessedArtifact

class	TopAccountResult

class	TopDeviceAttachedResult

class	TopDomainsResult

class	TopProgramsResult

class	TopWebSearchResult

Public Member Functions
	UserActivitySummary ()

	UserActivitySummary (SleuthkitCaseProvider provider, TextTranslationService translationService, java.util.logging.Logger logger)

List< TopWebSearchResult >	getMostRecentWebSearches (DataSource dataSource, int count) throws SleuthkitCaseProviderException, TskCoreException

List< TopAccountResult >	getRecentAccounts (DataSource dataSource, int count) throws SleuthkitCaseProviderException, TskCoreException

List< TopDeviceAttachedResult >	getRecentDevices (DataSource dataSource, int count) throws SleuthkitCaseProviderException, TskCoreException

List< TopDomainsResult >	getRecentDomains (DataSource dataSource, int count) throws TskCoreException, SleuthkitCaseProviderException

List< TopProgramsResult >	getTopPrograms (DataSource dataSource, int count) throws SleuthkitCaseProviderException, TskCoreException

Static Public Member Functions
static String	getShortFolderName (String strPath, String applicationName)

Private Member Functions
Pair< Long, Map< String, List< Pair< BlackboardArtifact, Long > > > >	getDomainGroupsAndMostRecent (DataSource dataSource) throws TskCoreException, SleuthkitCaseProviderException

TopDomainsResult	getDomainsResult (String domain, List< Pair< BlackboardArtifact, Long >> visits, long mostRecentMs)

TopDeviceAttachedResult	getMostRecentDevice (TopDeviceAttachedResult r1, TopDeviceAttachedResult r2)

TopProgramsResult	getTopProgramsResult (BlackboardArtifact artifact)

String	getTranslationOrNull (String original)

Static Private Member Functions
static void	assertValidCount (int count)

static TopAccountResult	getAccountResult (BlackboardArtifact artifact, String messageType, BlackboardAttribute.Type...dateAttrs)

static Long	getMax (Long num1, Long num2)

static Date	getMax (Date date1, Date date2)

static TopAccountResult	getMessageAccountResult (BlackboardArtifact artifact)

static TopWebSearchResult	getWebSearchResult (BlackboardArtifact artifact)

static boolean	isPositiveNum (Long longNum)

static int	nullableCompare (Long long1, Long long2)

Private Attributes
final SleuthkitCaseProvider	caseProvider

final java.util.logging.Logger	logger

final TextTranslationService	translationService

Static Private Attributes
static final Set< String >	DEVICE_EXCLUDE_LIST = new HashSet<>(Arrays.asList("ROOT_HUB", "ROOT_HUB20"))

static final Set< String >	DOMAIN_EXCLUDE_LIST = new HashSet<>(Arrays.asList("127.0.0.1", "LOCALHOST"))

static final long	DOMAIN_WINDOW_DAYS = 30

static final long	DOMAIN_WINDOW_MS = DOMAIN_WINDOW_DAYS * MS_PER_DAY

static final long	MS_PER_DAY = 1000 * 60 * 60 * 24

static final String	NTOS_BOOT_IDENTIFIER = "NTOSBOOT"

static final List< Function< List< String >, String > >	SHORT_FOLDER_MATCHERS

static final Comparator< TopAccountResult >	TOP_ACCOUNT_RESULT_DATE_COMPARE = (a, b) -> a.getLastAccessed().compareTo(b.getLastAccessed())

static final Comparator< TopProgramsResult >	TOP_PROGRAMS_RESULT_COMPARE

static final Comparator< TopWebSearchResult >	TOP_WEBSEARCH_RESULT_DATE_COMPARE = (a, b) -> a.getLastAccessed().compareTo(b.getLastAccessed())

static final BlackboardAttribute.Type	TYPE_COUNT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_COUNT)

static final BlackboardAttribute.Type	TYPE_DATETIME = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME)

static final BlackboardAttribute.Type	TYPE_DATETIME_ACCESSED = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)

static final BlackboardAttribute.Type	TYPE_DATETIME_END = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_END)

static final BlackboardAttribute.Type	TYPE_DATETIME_RCVD = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_RCVD)

static final BlackboardAttribute.Type	TYPE_DATETIME_SENT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_SENT)

static final BlackboardAttribute.Type	TYPE_DATETIME_START = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_START)

static final BlackboardArtifact.Type	TYPE_DEVICE_ATTACHED = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_DEVICE_ATTACHED)

static final BlackboardAttribute.Type	TYPE_DEVICE_ID = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_ID)

static final BlackboardAttribute.Type	TYPE_DEVICE_MAKE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)

static final BlackboardAttribute.Type	TYPE_DEVICE_MODEL = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)

static final BlackboardAttribute.Type	TYPE_DOMAIN = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DOMAIN)

static final BlackboardAttribute.Type	TYPE_MESSAGE_TYPE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)

static final BlackboardAttribute.Type	TYPE_PATH = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH)

static final BlackboardAttribute.Type	TYPE_PROG_NAME = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)

static final BlackboardAttribute.Type	TYPE_TEXT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_TEXT)

static final BlackboardArtifact.Type	TYPE_WEB_HISTORY = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_WEB_HISTORY)

static final String	WINDOWS_PREFIX = "/WINDOWS"

Detailed Description

Provides summary information about user activity in a datasource. At this time, the data being provided for domains is fictitious and is done as a placeholder.

Definition at line 56 of file UserActivitySummary.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.UserActivitySummary ( )

Main constructor.

Definition at line 154 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.DEFAULT, org.sleuthkit.autopsy.texttranslation.TextTranslationService.getInstance(), and org.sleuthkit.autopsy.coreutils.Logger.getLogger().

org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.UserActivitySummary	(	SleuthkitCaseProvider	provider,
		TextTranslationService	translationService,
		java.util.logging.Logger	logger
	)

Main constructor with external dependencies specified. This constructor is designed with unit testing in mind since mocked dependencies can be utilized.

Parameters

provider	The object providing the current SleuthkitCase.
translationService	The translation service.
logger	The logger to use.

Definition at line 168 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.logger, and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.translationService.

Member Function Documentation

static void org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.assertValidCount ( int count )

staticprivate

Throws an IllegalArgumentException if count <= 0.

Parameters

count The count being checked.

Definition at line 183 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMostRecentWebSearches(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDomains(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopPrograms().

static TopAccountResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getAccountResult	(	BlackboardArtifact	artifact,
		String	messageType,
		BlackboardAttribute.Type...	dateAttrs
	)

staticprivate

Obtains a TopAccountResult from a blackboard artifact. The date is maximum of any found dates for attribute types provided.

Parameters

artifact	The artifact.
messageType	The type of message this is.
dateAttrs	The date attribute types.

Returns: The TopAccountResult or null if the account type or max date are not provided.

Definition at line 572 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getDateOrNull().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts().

Pair<Long, Map<String, List<Pair<BlackboardArtifact, Long> > > > org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent ( DataSource dataSource ) throws TskCoreException, SleuthkitCaseProviderException

private

Queries TSK_WEB_HISTORY artifacts and returning the latest web history date accessed and a mapping of domains to all of their visits.

Parameters

dataSource The datasource.

Returns: A tuple where the first value is the latest web history accessed date in milliseconds and the second value maps normalized (lowercase; trimmed) domain names to when those domains were visited and the relevant artifact.

Exceptions

TskCoreException
SleuthkitCaseProviderException

Definition at line 315 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDomains().

TopDomainsResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainsResult	(	String	domain,
		List< Pair< BlackboardArtifact, Long >>	visits,
		long	mostRecentMs
	)

private

Creates a TopDomainsResult from data or null if no visit date exists within DOMAIN_WINDOW_MS of mostRecentMs.

Parameters

domain	The domain.
visits	The list of the artifact and its associated time in milliseconds.
mostRecentMs	The most recent visit of any domain.

Returns: The TopDomainsResult or null if no visits to this domain within 30 days of mostRecentMs.

Definition at line 270 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMax().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDomains().

static Long org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMax	(	Long	num1,
		Long	num2
	)

staticprivate

Returns the maximum value given two longs handling possible null values.

Parameters

num1	The first number.
num2	The second number.

Returns: The maximum non-null number or null if both numbers are null.

Definition at line 361 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainsResult(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopPrograms().

static Date org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMax	(	Date	date1,
		Date	date2
	)

staticprivate

Retrieves the maximum date given two (possibly null) dates.

Parameters

date1	First date.
date2	Second date.

Returns: The maximum non-null date or null if both items are null.

Definition at line 703 of file UserActivitySummary.java.

static TopAccountResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMessageAccountResult ( BlackboardArtifact artifact )

staticprivate

Obtains a TopAccountResult from a TSK_MESSAGE blackboard artifact.

Parameters

artifact The artifact.

Returns: The TopAccountResult or null if the account type or message date cannot be determined.

Definition at line 553 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getDateOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME, and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_MESSAGE_TYPE.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts().

TopDeviceAttachedResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMostRecentDevice	(	TopDeviceAttachedResult	r1,
		TopDeviceAttachedResult	r2
	)

private

Gives the most recent TopDeviceAttachedResult. If one is null, the other is returned.

Parameters

r1	A result.
r2	Another result.

Returns: The most recent one with a non-null date.

Definition at line 486 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.LastAccessedArtifact.getLastAccessed().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices().

List<TopWebSearchResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMostRecentWebSearches	(	DataSource	dataSource,
		int	count
	)		throws SleuthkitCaseProviderException, TskCoreException

Retrieves most recent web searches by most recent date grouped by search term.

Parameters

dataSource	The data source.
count	The maximum number of records to be shown (must be > 0).

Returns: The list of most recent web searches where most recent search appears first.

Exceptions

org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.SleuthkitCaseProviderException
TskCoreException

Definition at line 402 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.assertValidCount(), org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTranslationOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getWebSearchResult(), and org.sleuthkit.autopsy.texttranslation.TextTranslationService.hasProvider().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivitySummaryGetter.getMostRecentWebSearches().

List<TopAccountResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts	(	DataSource	dataSource,
		int	count
	)		throws SleuthkitCaseProviderException, TskCoreException

Retrieves most recent account used by most recent date for a message sent.

Parameters

dataSource	The data source.
count	The maximum number of records to be shown (must be > 0).

Returns: The list of most recent accounts used where the most recent account by last message sent occurs first.

Exceptions

org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.SleuthkitCaseProviderException
TskCoreException

Definition at line 606 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivitySummaryGetter.getRecentAccounts().

List<TopDeviceAttachedResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices	(	DataSource	dataSource,
		int	count
	)		throws SleuthkitCaseProviderException, TskCoreException

Retrieves most recent devices used by most recent date attached.

Parameters

dataSource	The data source.
count	The maximum number of records to be shown (must be > 0).

Returns: The list of most recent devices attached where most recent device attached appears first.

Exceptions

org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.SleuthkitCaseProviderException
TskCoreException

Definition at line 512 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivitySummaryGetter.getRecentDevices().

List<TopDomainsResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDomains	(	DataSource	dataSource,
		int	count
	)		throws TskCoreException, SleuthkitCaseProviderException

Gets a list of recent domains based on the datasource.

Parameters

dataSource	The datasource to query for recent domains.
count	The max count of items to return.

Returns: The list of items retrieved from the database.

Exceptions

InterruptedException

Definition at line 232 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.assertValidCount(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainsResult().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivitySummaryGetter.getRecentDomains().

static String org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getShortFolderName	(	String	strPath,
		String	applicationName
	)

static

Determines a short folder name if any. Otherwise, returns empty string.

Parameters

strPath	The string path.
applicationName	The application name.

Returns: The short folder name or empty string if not found.

Definition at line 197 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivityPanel.getShortFolderName().

List<TopProgramsResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopPrograms	(	DataSource	dataSource,
		int	count
	)		throws SleuthkitCaseProviderException, TskCoreException

Retrieves the top programs results for the given data source limited to the count provided as a parameter. The highest run times are at the top of the list. If that information isn't available the last run date is used. If both, the last run date and the number of run times are unavailable, the programs will be sorted alphabetically, the count will be ignored and all items will be returned.

Parameters

dataSource	The datasource. If the datasource is null, an empty list will be returned.
count	The number of results to return. This value must be > 0 or an IllegalArgumentException will be thrown.

Returns: The sorted list and limited to the count if last run or run count information is available on any item.

Exceptions

SleuthkitCaseProviderException
TskCoreException

Definition at line 764 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.assertValidCount(), org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.LastAccessedArtifact.getLastAccessed(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMax(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TopProgramsResult.getRunTimes(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.isPositiveNum().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivitySummaryGetter.getTopPrograms().

TopProgramsResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult ( BlackboardArtifact artifact )

private

Creates a TopProgramsResult from a TSK_PROG_RUN blackboard artifact.

Parameters

artifact The TSK_PROG_RUN blackboard artifact.

Returns: The generated TopProgramsResult.

Definition at line 668 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getDateOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getIntOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_COUNT, org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME, org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_PATH, and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_PROG_NAME.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopPrograms().

String org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTranslationOrNull ( String original )

private

Return the translation of the original text if possible and differs from the original. Otherwise, return null.

Parameters

original The original text.

Returns: The translated text or null if no translation can be determined or exists.

Definition at line 455 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.texttranslation.TextTranslationService.hasProvider(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.logger, and org.sleuthkit.autopsy.texttranslation.TextTranslationService.translate().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMostRecentWebSearches().

static TopWebSearchResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getWebSearchResult ( BlackboardArtifact artifact )

staticprivate

Attempts to obtain a web search result record from a blackboard artifact.

Parameters

artifact The artifact.

Returns: The TopWebSearchResult or null if the search string or date accessed cannot be determined.

Definition at line 379 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getDateOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_ACCESSED, and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_TEXT.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMostRecentWebSearches().

static boolean org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.isPositiveNum ( Long longNum )

staticprivate

Returns true if number is non-null and higher than 0.

Parameters

longNum The number.

Returns: True if non-null and higher than 0.

Definition at line 741 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopPrograms().

static int org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.nullableCompare	(	Long	long1,
		Long	long2
	)

staticprivate

Returns the compare value favoring the higher non-null number.

Parameters

long1	First possibly null long.
long2	Second possibly null long.

Returns: Returns the compare value: 1,0,-1 favoring the higher non-null value.

Definition at line 722 of file UserActivitySummary.java.

Member Data Documentation

final SleuthkitCaseProvider org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.caseProvider

private

Definition at line 147 of file UserActivitySummary.java.

final Set<String> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.DEVICE_EXCLUDE_LIST = new HashSet<>(Arrays.asList("ROOT_HUB", "ROOT_HUB20"))

staticprivate

Definition at line 140 of file UserActivitySummary.java.

final Set<String> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.DOMAIN_EXCLUDE_LIST = new HashSet<>(Arrays.asList("127.0.0.1", "LOCALHOST"))

staticprivate

Definition at line 141 of file UserActivitySummary.java.

final long org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.DOMAIN_WINDOW_DAYS = 30

staticprivate

Definition at line 144 of file UserActivitySummary.java.

final long org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.DOMAIN_WINDOW_MS = DOMAIN_WINDOW_DAYS * MS_PER_DAY

staticprivate

Definition at line 145 of file UserActivitySummary.java.

final java.util.logging.Logger org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.logger

private

Definition at line 149 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTranslationOrNull(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.UserActivitySummary().

final long org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.MS_PER_DAY = 1000 * 60 * 60 * 24

staticprivate

Definition at line 143 of file UserActivitySummary.java.

final String org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.NTOS_BOOT_IDENTIFIER = "NTOSBOOT"

staticprivate

Definition at line 107 of file UserActivitySummary.java.

final List<Function<List<String>, String> > org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.SHORT_FOLDER_MATCHERS

staticprivate

Initial value:

= Arrays.asList(
            
            (pathList) -> {
                if (pathList.size() < 2) {
                    return null;
                }
                String rootParent = pathList.get(0).toUpperCase();
                if ("PROGRAM FILES".equals(rootParent) || "PROGRAM FILES (X86)".equals(rootParent)) {
                    return pathList.get(1);
                } else {
                    return null;
                }
            },
            
            (pathList) -> {
                for (String pathEl : pathList) {
                    String uppered = pathEl.toUpperCase();
                    if ("APPLICATION DATA".equals(uppered) || "APPDATA".equals(uppered)) {
                        return "AppData";
                    }
                }
                return null;
            }
    )

Functions that determine the folder name of a list of path elements. If not matched, function returns null.

Definition at line 62 of file UserActivitySummary.java.

final Comparator<TopAccountResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TOP_ACCOUNT_RESULT_DATE_COMPARE = (a, b) -> a.getLastAccessed().compareTo(b.getLastAccessed())

staticprivate

Definition at line 110 of file UserActivitySummary.java.

final Comparator<TopProgramsResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TOP_PROGRAMS_RESULT_COMPARE

staticprivate

Initial value:

= (a, b) -> {
        
        
        int runTimesCompare = nullableCompare(a.getRunTimes(), b.getRunTimes());
        if (runTimesCompare != 0) {
            return -runTimesCompare;
        }
        
        
        int lastRunCompare = nullableCompare(
                a.getLastAccessed() == null ? null : a.getLastAccessed().getTime(),
                b.getLastAccessed() == null ? null : b.getLastAccessed().getTime());
        if (lastRunCompare != 0) {
            return -lastRunCompare;
        }
        
        return (a.getProgramName() == null ? "" : a.getProgramName())
                .compareToIgnoreCase((b.getProgramName() == null ? "" : b.getProgramName()));
    }

Sorts TopProgramsResults pushing highest run time count then most recent run and then the program name that comes earliest in the alphabet.

Definition at line 117 of file UserActivitySummary.java.

final Comparator<TopWebSearchResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TOP_WEBSEARCH_RESULT_DATE_COMPARE = (a, b) -> a.getLastAccessed().compareTo(b.getLastAccessed())

staticprivate

Definition at line 111 of file UserActivitySummary.java.

final TextTranslationService org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.translationService

private

Definition at line 148 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.UserActivitySummary().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_COUNT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_COUNT)

staticprivate

Definition at line 105 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME)

staticprivate

Definition at line 91 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMessageAccountResult(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_ACCESSED = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)

staticprivate

Definition at line 92 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getWebSearchResult().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_END = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_END)

staticprivate

Definition at line 101 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_RCVD = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_RCVD)

staticprivate

Definition at line 98 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_SENT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_SENT)

staticprivate

Definition at line 99 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_START = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_START)

staticprivate

Definition at line 100 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts().

final BlackboardArtifact.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_ATTACHED = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_DEVICE_ATTACHED)

staticprivate

Definition at line 88 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_ID = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_ID)

staticprivate

Definition at line 93 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_MAKE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)

staticprivate

Definition at line 94 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_MODEL = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)

staticprivate

Definition at line 95 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DOMAIN = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DOMAIN)

staticprivate

Definition at line 102 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_MESSAGE_TYPE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)

staticprivate

Definition at line 96 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMessageAccountResult().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_PATH = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH)

staticprivate

Definition at line 104 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_PROG_NAME = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)

staticprivate

Definition at line 103 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_TEXT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_TEXT)

staticprivate

Definition at line 97 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getWebSearchResult().

final BlackboardArtifact.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_WEB_HISTORY = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_WEB_HISTORY)

staticprivate

Definition at line 89 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent().

final String org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.WINDOWS_PREFIX = "/WINDOWS"

staticprivate

Definition at line 108 of file UserActivitySummary.java.

The documentation for this class was generated from the following file:

/home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/UserActivitySummary.java

Classes

Public Member Functions

Static Public Member Functions

Private Member Functions

Static Private Member Functions

Private Attributes

Static Private Attributes

Detailed Description

Constructor & Destructor Documentation

Member Function Documentation

Member Data Documentation