19 package org.sleuthkit.autopsy.datamodel;
23 import com.google.common.annotations.Beta;
24 import com.google.common.cache.Cache;
25 import com.google.common.cache.CacheBuilder;
26 import java.beans.PropertyChangeEvent;
27 import java.beans.PropertyChangeListener;
28 import java.lang.ref.WeakReference;
29 import java.text.MessageFormat;
30 import java.util.ArrayList;
31 import java.util.Arrays;
32 import java.util.Collections;
33 import java.util.EnumSet;
34 import java.util.LinkedHashMap;
35 import java.util.List;
37 import java.util.MissingResourceException;
39 import java.util.concurrent.ExecutionException;
40 import java.util.concurrent.TimeUnit;
41 import java.util.logging.Level;
42 import java.util.stream.Collectors;
43 import java.util.stream.Stream;
44 import javax.swing.Action;
45 import javax.swing.SwingUtilities;
46 import org.apache.commons.lang3.StringUtils;
47 import org.apache.commons.lang3.tuple.Pair;
48 import org.openide.nodes.Node;
49 import org.openide.nodes.Sheet;
50 import org.openide.util.Lookup;
51 import org.openide.util.NbBundle;
52 import org.openide.util.NbBundle.Messages;
53 import org.openide.util.Utilities;
54 import org.openide.util.WeakListeners;
55 import org.openide.util.lookup.Lookups;
81 import org.
sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
83 import org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
102 import org.
sleuthkit.datamodel.BlackboardArtifact.Category;
135 private static final Cache<Long, Content>
contentCache = CacheBuilder.newBuilder().expireAfterWrite(1, TimeUnit.MINUTES).build();
156 @SuppressWarnings(
"deprecation")
158 BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID(),
159 BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID()
175 private final PropertyChangeListener
listener =
new PropertyChangeListener() {
177 public void propertyChange(PropertyChangeEvent evt) {
178 String eventType = evt.getPropertyName();
181 if (event.getAddedTag().getArtifact().equals(artifact)) {
186 if (event.getDeletedTagInfo().getArtifactID() == artifact.getArtifactID()) {
191 if (event.getAddedTag().getContent().equals(srcContent)) {
196 if (event.getDeletedTagInfo().getContentID() == srcContent.getId()) {
201 if (event.getContentID() == srcContent.getId()) {
205 if (evt.getNewValue() == null) {
210 contentCache.invalidateAll();
221 String originalName = evt.getOldValue().toString();
222 translatedSourceName = evt.getNewValue().toString();
223 setDisplayName(translatedSourceName);
224 setShortDescription(originalName);
226 Bundle.BlackboardArtifactNode_createSheet_srcFile_origName(),
227 Bundle.BlackboardArtifactNode_createSheet_srcFile_origDisplayName(),
241 private final PropertyChangeListener
weakListener = WeakListeners.propertyChange(listener, null);
260 if (srcContent == null) {
261 throw new IllegalArgumentException(MessageFormat.format(
"Artifact missing source content (artifact objID={0})", artifact));
271 srcContent.getUniquePath();
272 }
catch (TskCoreException ex) {
273 logger.log(Level.WARNING, MessageFormat.format(
"Error getting the unique path of the source content (artifact objID={0})", artifact.getId()), ex);
277 setName(Long.toString(artifact.getArtifactID()));
278 setIconBaseWithExtension(iconPath != null && iconPath.charAt(0) ==
'/' ? iconPath.substring(1) : iconPath);
295 super(artifact,
createLookup(artifact, useAssociatedFileInLookup));
300 srcContent = artifact.getParent();
301 }
catch (TskCoreException ex) {
302 logger.log(Level.WARNING, MessageFormat.format(
"Error getting the parent of the artifact for (artifact objID={0})", artifact.getId()), ex);
305 if (srcContent != null) {
313 srcContent.getUniquePath();
314 }
catch (TskCoreException ex) {
315 logger.log(Level.WARNING, MessageFormat.format(
"Error getting the unique path of the source content (artifact objID={0})", artifact.getId()), ex);
318 throw new IllegalArgumentException(MessageFormat.format(
"Artifact missing source content (artifact objID={0})", artifact));
321 setName(Long.toString(artifact.getArtifactID()));
324 setIconBaseWithExtension(iconPath != null && iconPath.charAt(0) ==
'/' ? iconPath.substring(1) : iconPath);
347 private static BlackboardArtifact.Type
getType(BlackboardArtifact artifact) {
349 return artifact.getType();
350 }
catch (TskCoreException ex) {
351 logger.log(Level.WARNING, MessageFormat.format(
"Error getting the artifact type for artifact (artifact objID={0})", artifact.getId()), ex);
367 private static Lookup
createLookup(BlackboardArtifact artifact,
boolean useAssociatedFile) {
373 if (useAssociatedFile) {
376 long srcObjectID = artifact.getObjectID();
377 content = contentCache.get(srcObjectID, () -> artifact.getSleuthkitCase().getContentById(srcObjectID));
379 }
catch (ExecutionException ex) {
380 logger.log(Level.SEVERE, MessageFormat.format(
"Error getting source/associated content (artifact object ID={0})", artifact.getId()), ex);
392 if (artifact instanceof AnalysisResult) {
405 if (content == null) {
406 return Lookups.fixed(artifact, artifactItem);
408 return Lookups.fixed(artifact, artifactItem, content);
421 for (Content lookupContent : this.getLookup().lookupAll(Content.class)) {
431 if ((lookupContent != null) && (lookupContent.getId() != artifact.getId())) {
432 return lookupContent;
451 private static Content
getPathIdFile(BlackboardArtifact artifact)
throws ExecutionException {
453 BlackboardAttribute attribute = artifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
454 if (attribute != null) {
455 return contentCache.get(attribute.getValueLong(), () -> artifact.getSleuthkitCase().getContentById(attribute.getValueLong()));
457 }
catch (TskCoreException ex) {
458 logger.log(Level.WARNING, MessageFormat.format(
"Error getting content for path id attrbiute for artifact: ", artifact.getId()), ex);
502 return Stream.of(items)
503 .filter(i -> i != null)
504 .collect(Collectors.toList());
510 List<List<Action>> actionsLists =
new ArrayList<>();
532 if (this.srcContent instanceof Report) {
537 int selectedFileCount = Utilities.actionsGlobalContext().lookupAll(AbstractFile.class).size();
538 int selectedArtifactCount = Utilities.actionsGlobalContext().lookupAll(
BlackboardArtifactItem.class).size();
544 if (parentFileNode != null) {
549 actionsLists.add(
getTagActions(parentFileNode != null, this.artifact, selectedFileCount, selectedArtifactCount));
555 actionsLists.add(Arrays.asList(super.getActions(context)));
557 return actionsLists.stream()
559 .filter((lst) -> lst != null && !lst.isEmpty())
561 .flatMap(lst -> Stream.concat(Stream.of((Action) null), lst.stream()))
564 .toArray(sz ->
new Action[sz]);
576 "BlackboardArtifactNode_getAssociatedTypeStr_webCache=Cached File",
577 "BlackboardArtifactNode_getAssociatedTypeStr_webDownload=Downloaded File",
578 "BlackboardArtifactNode_getAssociatedTypeStr_associated=Associated File",})
580 if (BlackboardArtifact.Type.TSK_WEB_CACHE.equals(
artifactType)) {
581 return Bundle.BlackboardArtifactNode_getAssociatedTypeStr_webCache();
582 }
else if (BlackboardArtifact.Type.TSK_WEB_DOWNLOAD.equals(
artifactType)) {
583 return Bundle.BlackboardArtifactNode_getAssociatedTypeStr_webDownload();
585 return Bundle.BlackboardArtifactNode_getAssociatedTypeStr_associated();
598 "BlackboardArtifactNode_getViewSrcContentAction_type_File=File",
599 "BlackboardArtifactNode_getViewSrcContentAction_type_DataArtifact=Data Artifact",
600 "BlackboardArtifactNode_getViewSrcContentAction_type_OSAccount=OS Account",
601 "BlackboardArtifactNode_getViewSrcContentAction_type_unknown=Item"
604 if (content instanceof AbstractFile) {
605 return Bundle.BlackboardArtifactNode_getViewSrcContentAction_type_File();
606 }
else if (content instanceof DataArtifact) {
607 return Bundle.BlackboardArtifactNode_getViewSrcContentAction_type_DataArtifact();
608 }
else if (content instanceof OsAccount) {
609 return Bundle.BlackboardArtifactNode_getViewSrcContentAction_type_OSAccount();
611 return Bundle.BlackboardArtifactNode_getViewSrcContentAction_type_unknown();
627 "BlackboardArtifactNode_getAssociatedFileActions_viewAssociatedFileAction=View {0} in Directory",
629 "BlackboardArtifactNode_getAssociatedFileActions_viewAssociatedFileInTimelineAction=View {0} in Timeline..."
633 AbstractFile associatedFile = findLinked(artifact);
634 if (associatedFile != null) {
635 return Arrays.asList(
637 Bundle.BlackboardArtifactNode_getAssociatedFileActions_viewAssociatedFileAction(
641 Bundle.BlackboardArtifactNode_getAssociatedFileActions_viewAssociatedFileInTimelineAction(
646 }
catch (TskCoreException ex) {
647 logger.log(Level.SEVERE, MessageFormat.format(
"Error getting linked file of artifact (artifact objID={0})", artifact.getId()), ex);
649 return Collections.emptyList();
661 "# {0} - contentType",
662 "BlackboardArtifactNode_getSrcContentAction_actionDisplayName=View Source {0} in Directory"
665 if (content instanceof DataArtifact) {
667 (BlackboardArtifact) content,
668 Bundle.BlackboardArtifactNode_getSrcContentAction_actionDisplayName(
670 }
else if (content instanceof OsAccount) {
673 Bundle.BlackboardArtifactNode_getSrcContentAction_actionDisplayName(
675 }
else if (content instanceof AbstractFile || artifact instanceof DataArtifact) {
677 Bundle.BlackboardArtifactNode_getSrcContentAction_actionDisplayName(
694 if (content instanceof File) {
695 return new FileNode((AbstractFile) content);
696 }
else if (content instanceof Directory) {
698 }
else if (content instanceof VirtualDirectory) {
700 }
else if (content instanceof LocalDirectory) {
702 }
else if (content instanceof LayoutFile) {
704 }
else if (content instanceof LocalFile || content instanceof DerivedFile) {
706 }
else if (content instanceof SlackFile) {
721 if ((srcContent instanceof AbstractFile)
723 .contains(
"." + ((AbstractFile) srcContent).getNameExtension().toLowerCase())) {
725 if (srcContent.getArtifacts(BlackboardArtifact.Type.TSK_ENCRYPTION_DETECTED.getTypeID()).size() > 0) {
728 }
catch (TskCoreException ex) {
729 logger.log(Level.WARNING,
"Unable to add unzip with password action to context menus", ex);
747 private List<Action>
getTagActions(
boolean hasSrcFile, BlackboardArtifact artifact,
int selectedFileCount,
int selectedArtifactCount) {
748 List<Action> actionsList =
new ArrayList<>();
751 if (hasSrcFile && !(artifact instanceof DataArtifact)) {
758 if (hasSrcFile && (!(artifact instanceof DataArtifact)) && (selectedFileCount == 1)) {
762 if (selectedArtifactCount == 1) {
778 "BlackboardArtifactNode_getSrcContentViewerActions_viewInNewWin=View Item in New Window",
779 "BlackboardArtifactNode_getSrcContentViewerActions_openInExtViewer=Open in External Viewer Ctrl+E"
782 List<Action> actionsList =
new ArrayList<>();
783 if (srcFileNode != null) {
784 actionsList.add(
new NewWindowViewAction(Bundle.BlackboardArtifactNode_getSrcContentViewerActions_viewInNewWin(), srcFileNode));
785 if (selectedFileCount == 1) {
786 actionsList.add(
new ExternalViewerAction(Bundle.BlackboardArtifactNode_getSrcContentViewerActions_openInExtViewer(), srcFileNode));
803 "# {0} - contentType",
804 "BlackboardArtifactNode_getTimelineSrcContentAction_actionDisplayName=View Source {0} in Timeline... "
807 if (srcContent instanceof AbstractFile) {
809 Bundle.BlackboardArtifactNode_getTimelineSrcContentAction_actionDisplayName(
811 }
else if (srcContent instanceof DataArtifact) {
815 Bundle.BlackboardArtifactNode_getTimelineSrcContentAction_actionDisplayName(
818 }
catch (TskCoreException ex) {
819 logger.log(Level.SEVERE, MessageFormat.format(
"Error getting source data artifact timestamp (artifact objID={0})", srcContent.getId()), ex);
835 "BlackboardArtifactNode_getTimelineArtifactAction_displayName=View Selected Item in Timeline... "
843 }
catch (TskCoreException ex) {
844 logger.log(Level.SEVERE, MessageFormat.format(
"Error getting artifact timestamp (artifact objID={0})", art.getId()), ex);
857 return srcContent.getName();
861 "BlackboardArtifactNode.createSheet.srcFile.name=Source Name",
862 "BlackboardArtifactNode.createSheet.srcFile.displayName=Source Name",
863 "BlackboardArtifactNode.createSheet.srcFile.origName=Original Name",
864 "BlackboardArtifactNode.createSheet.srcFile.origDisplayName=Original Name",
865 "BlackboardArtifactNode.createSheet.artifactType.displayName=Result Type",
866 "BlackboardArtifactNode.createSheet.artifactType.name=Result Type",
867 "BlackboardArtifactNode.createSheet.artifactDetails.displayName=Result Details",
868 "BlackboardArtifactNode.createSheet.artifactDetails.name=Result Details",
869 "BlackboardArtifactNode.createSheet.artifactMD5.displayName=MD5 Hash",
870 "BlackboardArtifactNode.createSheet.artifactMD5.name=MD5 Hash",
871 "BlackboardArtifactNode.createSheet.fileSize.name=Size",
872 "BlackboardArtifactNode.createSheet.fileSize.displayName=Size",
873 "BlackboardArtifactNode.createSheet.path.displayName=Path",
874 "BlackboardArtifactNode.createSheet.path.name=Path"
880 @SuppressWarnings(
"deprecation")
886 Sheet sheet = super.createSheet();
887 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
888 if (sheetSet == null) {
889 sheetSet = Sheet.createPropertiesSet();
900 Bundle.BlackboardArtifactNode_createSheet_srcFile_name(),
901 Bundle.BlackboardArtifactNode_createSheet_srcFile_displayName(),
906 if (artifact instanceof AnalysisResult
907 && !(
artifactType.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()
908 ||
artifactType.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID())) {
921 Bundle.BlackboardArtifactNode_createSheet_srcFile_origName(),
922 Bundle.BlackboardArtifactNode_createSheet_srcFile_origDisplayName(),
924 translatedSourceName != null ? srcContent.getName() :
""));
925 if (translatedSourceName == null) {
938 if (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() || artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID()) {
940 BlackboardAttribute attribute = artifact.getAttribute(
new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
941 if (attribute != null) {
945 "BlackboardArtifactNode.createSheet.artifactType.name"),
947 "BlackboardArtifactNode.createSheet.artifactType.displayName"),
949 associatedArtifact.getDisplayName()));
952 "BlackboardArtifactNode.createSheet.artifactDetails.name"),
954 "BlackboardArtifactNode.createSheet.artifactDetails.displayName"),
956 associatedArtifact.getShortDescription()));
959 logger.log(Level.SEVERE, MessageFormat.format(
"Error getting associated artifact with type " + artifact.getArtifactTypeName() +
" artifact (objID={0}))", artifact.getId()), ex);
967 Map<String, Object> map =
new LinkedHashMap<>();
969 for (Map.Entry<String, Object> entry : map.entrySet()) {
979 if (customProperties != null) {
990 final int artifactTypeId = artifact.getArtifactTypeID();
991 if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID()) {
993 String actualMimeType =
"";
994 if (srcContent instanceof AbstractFile) {
995 AbstractFile file = (AbstractFile) srcContent;
996 ext = file.getNameExtension();
997 actualMimeType = file.getMIMEType();
998 if (actualMimeType == null) {
1005 "BlackboardArtifactNode.createSheet.ext.name"),
1007 "BlackboardArtifactNode.createSheet.ext.displayName"),
1012 "BlackboardArtifactNode.createSheet.mimeType.name"),
1014 "BlackboardArtifactNode.createSheet.mimeType.displayName"),
1024 String sourcePath =
"";
1026 sourcePath = srcContent.getUniquePath();
1027 }
catch (TskCoreException ex) {
1028 logger.log(Level.SEVERE, MessageFormat.format(
"Error getting unique path of source content (artifact objID={0})", artifact.getId()), ex);
1032 if (sourcePath.isEmpty() ==
false) {
1035 "BlackboardArtifactNode.createSheet.filePath.name"),
1037 "BlackboardArtifactNode.createSheet.filePath.displayName"),
1048 AbstractFile file = srcContent instanceof AbstractFile ? (AbstractFile) srcContent : null;
1051 "ContentTagNode.createSheet.fileModifiedTime.name"),
1053 "ContentTagNode.createSheet.fileModifiedTime.displayName"),
1058 "ContentTagNode.createSheet.fileChangedTime.name"),
1060 "ContentTagNode.createSheet.fileChangedTime.displayName"),
1065 "ContentTagNode.createSheet.fileAccessedTime.name"),
1067 "ContentTagNode.createSheet.fileAccessedTime.displayName"),
1072 "ContentTagNode.createSheet.fileCreatedTime.name"),
1074 "ContentTagNode.createSheet.fileCreatedTime.displayName"),
1079 "ContentTagNode.createSheet.fileSize.name"),
1081 "ContentTagNode.createSheet.fileSize.displayName"),
1083 file == null ?
"" : file.getSize()));
1085 Bundle.BlackboardArtifactNode_createSheet_artifactMD5_name(),
1086 Bundle.BlackboardArtifactNode_createSheet_artifactMD5_displayName(),
1088 file == null ?
"" : StringUtils.defaultString(file.getMd5Hash())));
1091 String dataSourceStr =
"";
1093 Content dataSource = srcContent.getDataSource();
1094 if (dataSource != null) {
1095 dataSourceStr = dataSource.getName();
1099 }
catch (TskCoreException ex) {
1100 logger.log(Level.SEVERE, MessageFormat.format(
"Error getting source data source name (artifact objID={0})", artifact.getId()), ex);
1104 if (dataSourceStr.isEmpty() ==
false) {
1107 "BlackboardArtifactNode.createSheet.dataSrc.name"),
1109 "BlackboardArtifactNode.createSheet.dataSrc.displayName"),
1119 if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID()) {
1122 if (srcContent instanceof AbstractFile) {
1123 AbstractFile af = (AbstractFile) srcContent;
1124 size = af.getSize();
1126 path = af.getUniquePath();
1127 }
catch (TskCoreException ex) {
1128 path = af.getParentPath();
1134 "BlackboardArtifactNode.createSheet.fileSize.name"),
1136 "BlackboardArtifactNode.createSheet.fileSize.displayName"),
1142 "BlackboardArtifactNode.createSheet.path.name"),
1144 "BlackboardArtifactNode.createSheet.path.displayName"),
1149 if (scoTask != null) {
1150 backgroundTasksPool.submit(scoTask);
1164 List<Tag> tags =
new ArrayList<>();
1169 logger.log(Level.SEVERE, MessageFormat.format(
"Error getting tags for artifact and its source content (artifact objID={0})", artifact.getId()), ex);
1197 for (Tag tag : tags) {
1198 if (!StringUtils.isBlank(tag.getComment())) {
1216 logger.log(Level.SEVERE,
"Attempted to Query CR for presence of comments in a Blackboard Artifact node and was unable to perform query, comment column will only reflect caseDB", ex);
1224 String description = defaultDescription;
1229 }
else if (attribute != null) {
1230 description = Bundle.BlackboardArtifactNode_createSheet_count_noCorrelationValues_description();
1233 logger.log(Level.SEVERE, MessageFormat.format(
"Error querying central repository for other occurences count (artifact objID={0}, corrAttrType={1}, corrAttrValue={2})", artifact.getId(), attribute.
getCorrelationType(), attribute.
getCorrelationValue()), ex);
1235 logger.log(Level.WARNING, MessageFormat.format(
"Error normalizing correlation attribute for central repository query (artifact objID={0}, corrAttrType={2}, corrAttrValue={3})", artifact.getId(), attribute.
getCorrelationType(), attribute.
getCorrelationValue()), ex);
1237 return Pair.of(count, description);
1244 SwingUtilities.invokeLater(() -> {
1256 String parentName = srcContent.getName();
1259 while ((parent = parent.getParent()) != null) {
1260 parentName = parent.getName();
1262 }
catch (TskCoreException ex) {
1263 logger.log(Level.SEVERE, MessageFormat.format(
"Error getting root ancestor name for source content (artifact objID={0})", artifact.getId()), ex);
1276 if (customProperties == null) {
1277 customProperties =
new ArrayList<>();
1279 customProperties.add(property);
1290 @SuppressWarnings(
"deprecation")
1293 for (BlackboardAttribute attribute : artifact.getAttributes()) {
1294 final int attributeTypeID = attribute.getAttributeType().getTypeID();
1295 if (attributeTypeID == ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID()
1296 || attributeTypeID == ATTRIBUTE_TYPE.TSK_TAGGED_ARTIFACT.getTypeID()
1297 || attributeTypeID == ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID()
1298 || attributeTypeID == ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID()
1299 || attributeTypeID == ATTRIBUTE_TYPE.TSK_KEYWORD_SEARCH_TYPE.getTypeID()
1300 || attribute.getValueType() == BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.JSON) {
1304 }
else if (artifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID()) {
1306 }
else if (attribute.getAttributeType().getValueType() == BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
1308 }
else if (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_TOOL_OUTPUT.getTypeID()
1309 && attributeTypeID == ATTRIBUTE_TYPE.TSK_TEXT.getTypeID()) {
1318 String value = attribute.getDisplayString();
1319 if (value.length() > 512) {
1320 value = value.substring(0, 512);
1322 map.put(attribute.getAttributeType().getDisplayName(), value);
1324 switch (attribute.getAttributeType().getValueType()) {
1326 map.put(attribute.getAttributeType().getDisplayName(), attribute.getValueInt());
1329 map.put(attribute.getAttributeType().getDisplayName(), attribute.getValueDouble());
1332 map.put(attribute.getAttributeType().getDisplayName(), attribute.getValueLong());
1335 map.put(attribute.getAttributeType().getDisplayName(), attribute.getDisplayString());
1341 }
catch (TskCoreException ex) {
1342 logger.log(Level.SEVERE, MessageFormat.format(
"Error getting artifact attributes (artifact objID={0})", artifact.getId()), ex);
1356 final int attributeTypeID = attribute.getAttributeType().getTypeID();
1357 if (attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME_SENT.getTypeID()
1358 || attributeTypeID == ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_HTML.getTypeID()
1359 || attributeTypeID == ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_RTF.getTypeID()
1360 || attributeTypeID == ATTRIBUTE_TYPE.TSK_EMAIL_BCC.getTypeID()
1361 || attributeTypeID == ATTRIBUTE_TYPE.TSK_EMAIL_CC.getTypeID()
1362 || attributeTypeID == ATTRIBUTE_TYPE.TSK_HEADERS.getTypeID()) {
1366 }
else if (attributeTypeID == ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_PLAIN.getTypeID()) {
1367 String value = attribute.getDisplayString();
1368 if (value.length() > 160) {
1369 value = value.substring(0, 160) +
"...";
1371 map.put(attribute.getAttributeType().getDisplayName(), value);
1372 }
else if (attribute.getAttributeType().getValueType() == BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
1375 map.put(attribute.getAttributeType().getDisplayName(), attribute.getDisplayString());
1381 return visitor.
visit(
this);
1391 return getClass().getName();
1395 public <T> T accept(ContentNodeVisitor<T> visitor) {
1396 return visitor.visit(
this);
1400 "BlackboardArtifactNode_analysisSheet_sourceType_name=Source Type",
1401 "BlackboardArtifactNode_analysisSheet_soureName_name=Source Name",
1402 "BlackboardArtifactNode_analysisSheet_score_name=Score",
1403 "BlackboardArtifactNode_analysisSheet_conclusion_name=Conclusion",
1404 "BlackboardArtifactNode_analysisSheet_configuration_name=Configuration",
1405 "BlackboardArtifactNode_analysisSheet_justifaction_name=Justification"
1416 Bundle.BlackboardArtifactNode_analysisSheet_soureName_name(),
1417 Bundle.BlackboardArtifactNode_analysisSheet_soureName_name(),
1424 Bundle.BlackboardArtifactNode_analysisSheet_sourceType_name(),
1425 Bundle.BlackboardArtifactNode_analysisSheet_sourceType_name(),
1430 Bundle.BlackboardArtifactNode_analysisSheet_score_name(),
1431 Bundle.BlackboardArtifactNode_analysisSheet_score_name(),
1433 result.getScore().getSignificance().getDisplayName()));
1436 Bundle.BlackboardArtifactNode_analysisSheet_conclusion_name(),
1437 Bundle.BlackboardArtifactNode_analysisSheet_conclusion_name(),
1439 result.getConclusion()));
1442 Bundle.BlackboardArtifactNode_analysisSheet_configuration_name(),
1443 Bundle.BlackboardArtifactNode_analysisSheet_configuration_name(),
1445 result.getConfiguration()));
1448 Bundle.BlackboardArtifactNode_analysisSheet_justifaction_name(),
1449 Bundle.BlackboardArtifactNode_analysisSheet_justifaction_name(),
1451 result.getJustification()));
1466 Bundle.BlackboardArtifactNode_createSheet_score_name(),
1467 Bundle.BlackboardArtifactNode_createSheet_score_displayName(),
1471 Bundle.BlackboardArtifactNode_createSheet_comment_name(),
1472 Bundle.BlackboardArtifactNode_createSheet_comment_displayName(),
1477 Bundle.BlackboardArtifactNode_createSheet_count_name(),
1478 Bundle.BlackboardArtifactNode_createSheet_count_displayName(),
1482 return new GetSCOTask(
new WeakReference<>(
this), weakListener);
1498 if (source instanceof BlackboardArtifact) {
1499 BlackboardArtifact srcArtifact = (BlackboardArtifact) source;
1501 return srcArtifact.getType().getDisplayName();
1502 }
catch (TskCoreException ex) {
1503 logger.log(Level.SEVERE,
"Failed to get custom artifact type id=" + source.getId(), ex);
1505 }
else if (srcContent instanceof Volume) {
1506 return TskData.ObjectType.VOL.toString();
1507 }
else if (srcContent instanceof AbstractFile) {
1508 return TskData.ObjectType.ABSTRACTFILE.toString();
1509 }
else if (srcContent instanceof Image) {
1510 return TskData.ObjectType.IMG.toString();
1511 }
else if (srcContent instanceof VolumeSystem) {
1512 return TskData.ObjectType.VS.toString();
1513 }
else if (srcContent instanceof OsAccount) {
1514 return TskData.ObjectType.OS_ACCOUNT.toString();
1515 }
else if (srcContent instanceof HostAddress) {
1516 return TskData.ObjectType.HOST_ADDRESS.toString();
1517 }
else if (srcContent instanceof Pool) {
1518 return TskData.ObjectType.POOL.toString();
1530 SwingUtilities.invokeLater(
new Runnable() {
1533 if (scoData.getScoreAndDescription() != null) {
1535 Bundle.BlackboardArtifactNode_createSheet_score_name(),
1536 Bundle.BlackboardArtifactNode_createSheet_score_displayName(),
1537 scoData.getScoreAndDescription().getRight(),
1538 scoData.getScoreAndDescription().getLeft()));
1540 if (scoData.getComment() != null) {
1542 Bundle.BlackboardArtifactNode_createSheet_comment_name(),
1543 Bundle.BlackboardArtifactNode_createSheet_comment_displayName(),
1546 if (scoData.getCountAndDescription() != null) {
1548 Bundle.BlackboardArtifactNode_createSheet_count_name(),
1549 Bundle.BlackboardArtifactNode_createSheet_count_displayName(),
1550 scoData.getCountAndDescription().getRight(),
1551 scoData.getCountAndDescription().getLeft()));
1561 if (srcContent instanceof BlackboardArtifact) {
1563 setDisplayName(((BlackboardArtifact) srcContent).getShortDescription());
1564 }
catch (TskCoreException ex) {
1567 logger.log(Level.WARNING,
"Failed to get short description for artifact id = " + srcContent.getId(), ex);
1568 setDisplayName(srcContent.getName());
1570 }
else if (srcContent instanceof OsAccount) {
1571 setDisplayName(((OsAccount) srcContent).getAddr().orElse(srcContent.getName()));
1573 setDisplayName(srcContent.getName());
1576 setShortDescription(getDisplayName());
1591 @NbBundle.Messages({
"BlackboardArtifactNode.createSheet.score.name=S",
1592 "BlackboardArtifactNode.createSheet.score.displayName=S",
1593 "BlackboardArtifactNode.createSheet.notableFile.description=Associated file recognized as notable.",
1594 "BlackboardArtifactNode.createSheet.interestingResult.description=Result has an interesting result associated with it.",
1595 "BlackboardArtifactNode.createSheet.taggedItem.description=Result or associated file has been tagged.",
1596 "BlackboardArtifactNode.createSheet.notableTaggedItem.description=Result or associated file tagged with notable tag.",
1597 "BlackboardArtifactNode.createSheet.noScore.description=No score"})
1601 sheetSet.put(
new NodeProperty<>(Bundle.BlackboardArtifactNode_createSheet_score_name(), Bundle.BlackboardArtifactNode_createSheet_score_displayName(), scoreAndDescription.getRight(), scoreAndDescription.getLeft()));
1613 @NbBundle.Messages({
1614 "BlackboardArtifactNode.createSheet.tags.displayName=Tags"}
1618 List<Tag> tags =
new ArrayList<>();
1623 logger.log(Level.SEVERE, MessageFormat.format(
"Error getting tags for artifact and source content (artifact objID={0})", artifact.getId()), ex);
1625 sheetSet.put(
new NodeProperty<>(
"Tags", Bundle.BlackboardArtifactNode_createSheet_tags_displayName(),
NO_DESCR, tags.stream().map(t -> t.getName().getDisplayName()).collect(Collectors.joining(
", "))));
1641 sheetSet.put(
new NodeProperty<>(
"Tags", Bundle.BlackboardArtifactNode_createSheet_tags_displayName(),
NO_DESCR, tags.stream().map(t -> t.getName().getDisplayName()).collect(Collectors.joining(
", "))));
1656 @NbBundle.Messages({
"BlackboardArtifactNode.createSheet.count.name=O",
1657 "BlackboardArtifactNode.createSheet.count.displayName=O",
1658 "BlackboardArtifactNode.createSheet.count.noCorrelationAttributes.description=No correlation properties found",
1659 "BlackboardArtifactNode.createSheet.count.noCorrelationValues.description=Unable to find other occurrences because no value exists for the available correlation property",
1660 "# {0} - occurrenceCount",
1661 "# {1} - attributeType",
1662 "BlackboardArtifactNode.createSheet.count.description=There were {0} datasource(s) found with occurrences of the correlation value of type {1}"})
1665 Pair<Long, String> countAndDescription =
getCountPropertyAndDescription(attribute, Bundle.BlackboardArtifactNode_createSheet_count_noCorrelationAttributes_description());
1666 sheetSet.put(
new NodeProperty<>(Bundle.BlackboardArtifactNode_createSheet_count_name(), Bundle.BlackboardArtifactNode_createSheet_count_displayName(), countAndDescription.getRight(), countAndDescription.getLeft()));
1683 @NbBundle.Messages({
"BlackboardArtifactNode.createSheet.comment.name=C",
1684 "BlackboardArtifactNode.createSheet.comment.displayName=C"})
1687 List<CorrelationAttributeInstance> attributes =
new ArrayList<>();
1688 attributes.add(attribute);
1690 sheetSet.put(
new NodeProperty<>(Bundle.BlackboardArtifactNode_createSheet_comment_name(), Bundle.BlackboardArtifactNode_createSheet_comment_displayName(),
NO_DESCR, status));
static final String VALUE_LOADING
static BlackboardArtifact.Type getType(BlackboardArtifact artifact)
final void addTagProperty(Sheet.Set sheetSet, List< Tag > tags)
void addTagProperty(Sheet.Set sheetSet)
void fillPropertyMap(Map< String, Object > map, BlackboardArtifact artifact)
List< Action > getAssociatedFileActions(BlackboardArtifact artifact, BlackboardArtifact.Type artifactType)
static List< String > getArchiveExtensions()
List< Action > getTagActions(boolean hasSrcFile, BlackboardArtifact artifact, int selectedFileCount, int selectedArtifactCount)
static boolean hasSupportedTimeStamp(BlackboardArtifact artifact)
void setName(String name)
final String sourceObjTypeName
static List< Action > getActions(File file, boolean isArtifactSource)
Action getViewSrcContentAction(BlackboardArtifact artifact, Content content)
List< Action > getNonNull(Action...items)
static String getPropertyName()
static synchronized AddBlackboardArtifactTagAction getInstance()
static String getFormattedTime(long epochTime)
static synchronized DeleteFileBlackboardArtifactTagAction getInstance()
void setDisplayNameBySourceContent()
BlackboardArtifactNode(BlackboardArtifact artifact, String iconPath)
final PropertyChangeListener weakListener
String getSourceObjType(Content source)
static final Integer[] SHOW_FILE_METADATA
static final Cache< Long, Content > contentCache
volatile String translatedSourceName
void updateSCOColumns(final SCOData scoData)
String getCorrelationValue()
static synchronized ExportCSVAction getInstance()
Action[] getActions(boolean context)
Type getCorrelationType()
void addNodeProperty(NodeProperty<?> property)
static synchronized DeleteFileContentTagAction getInstance()
static final Set< Case.Events > CASE_EVENTS_OF_INTEREST
final void addScorePropertyAndDescription(Sheet.Set sheetSet, List< Tag > tags)
TagsManager getTagsManager()
Action getTimelineArtifactAction(BlackboardArtifact art)
static TextTranslationService getInstance()
GetSCOTask updateSheetForAnalysisResult(AnalysisResult result, Sheet.Set sheetSet)
static boolean displayTranslatedFileNames()
BlackboardArtifactNode(BlackboardArtifact artifact, boolean useAssociatedFileInLookup)
static Content getPathIdFile(BlackboardArtifact artifact)
List< NodeProperty<?extends Object > > customProperties
static boolean commentExistsOnAttributes(List< CorrelationAttributeInstance > attributes)
final List< Tag > getAllTagsFromDatabase()
static Lookup createLookup(BlackboardArtifact artifact, boolean useAssociatedFile)
final BlackboardArtifact artifact
void addEmailMsgProperty(Map< String, Object > map, BlackboardAttribute attribute)
static String getIconFilePath(int typeID)
static boolean getHideSCOColumns()
final void addCommentProperty(Sheet.Set sheetSet, List< Tag > tags, CorrelationAttributeInstance attribute)
Pair< Score, String > getScorePropertyAndDescription()
SleuthkitCase getSleuthkitCase()
Pair< Long, String > getCountPropertyAndDescription(CorrelationAttributeInstance attribute, String defaultDescription)
T visit(DataSourceFilesNode in)
String getContentTypeStr(Content content)
DataResultViewerTable.HasCommentStatus getCommentProperty(List< Tag > tags, List< CorrelationAttributeInstance > attributes)
synchronized boolean hasProvider()
final void addCountProperty(Sheet.Set sheetSet, CorrelationAttributeInstance attribute)
Long getCountCasesWithOtherInstances(CorrelationAttributeInstance instance)
List< Action > getSrcContentViewerActions(Node srcFileNode, int selectedFileCount)
BLACKBOARD_ARTIFACT_TAG_ADDED
static final Logger logger
Action getExtractWithPasswordAction(Content srcContent)
BlackboardArtifact getArtifact()
static synchronized ExternalViewerShortcutAction getInstance()
final BlackboardArtifact.Type artifactType
synchronized static Logger getLogger(String name)
GetSCOTask addSCOColumns(Sheet.Set sheetSet)
String getRootAncestorName()
static Case getCurrentCaseThrows()
Content getSourceContentFromLookup(BlackboardArtifact artifact)
Node getParentFileNode(Content content)
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
final PropertyChangeListener listener
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
Action getTimelineSrcContentAction(Content srcContent)
static CentralRepository getInstance()
String getAssociatedTypeStr(BlackboardArtifact.Type artifactType)
BlackboardArtifactNode(BlackboardArtifact artifact)
static synchronized AddContentTagAction getInstance()
BLACKBOARD_ARTIFACT_TAG_DELETED
void unregisterListener()
static boolean isEnabled()
static final String NO_DESCR