19 package org.sleuthkit.autopsy.report.infrastructure;
22 import com.google.common.collect.ListMultimap;
23 import com.google.common.collect.Lists;
24 import com.google.common.collect.Multimaps;
25 import java.sql.ResultSet;
26 import java.sql.SQLException;
27 import java.util.ArrayList;
28 import java.util.Arrays;
29 import java.util.Collection;
30 import java.util.Collections;
31 import java.util.Comparator;
32 import java.util.HashMap;
33 import java.util.HashSet;
34 import java.util.Iterator;
35 import java.util.List;
37 import java.util.Objects;
39 import java.util.TreeSet;
40 import java.util.logging.Level;
41 import java.util.stream.Collectors;
42 import org.openide.util.NbBundle;
43 import org.openide.util.NbBundle.Messages;
66 class TableReportGenerator {
68 private List<BlackboardArtifact.Type> artifactTypes =
new ArrayList<>();
69 private HashSet<String> tagNamesFilter =
new HashSet<>();
71 private final Set<Content> images =
new HashSet<>();
72 private final ReportProgressPanel progressPanel;
73 private final TableReportModule tableReport;
74 private final TableReportSettings settings;
75 private final Map<Integer, List<Column>> columnHeaderMap;
76 private static final Logger logger = Logger.getLogger(TableReportGenerator.class.getName());
78 private final List<String> errorList;
80 TableReportGenerator(TableReportSettings settings, ReportProgressPanel progressPanel, TableReportModule tableReport) {
82 this.progressPanel = progressPanel;
83 this.tableReport = tableReport;
84 this.columnHeaderMap =
new HashMap<>();
85 errorList =
new ArrayList<>();
86 this.settings = settings;
89 private void getAllExistingTags() throws NoCurrentCaseException, TskCoreException {
90 List<String> tagNames =
new ArrayList<>();
93 List<TagName> tagNamesInUse = Case.getCurrentCaseThrows().getServices().getTagsManager().getTagNamesInUse();
95 String notableString =
"";
96 for (TagName tagName : tagNamesInUse) {
97 notableString = tagName.getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() :
"";
98 tagNames.add(tagName.getDisplayName() + notableString);
100 tagNamesFilter =
new HashSet<>(tagNames);
103 @SuppressWarnings(
"deprecation")
104 private
void getAllExistingArtiactTypes() throws NoCurrentCaseException, TskCoreException {
106 ArrayList<BlackboardArtifact.Type> doNotReport =
new ArrayList<>();
107 doNotReport.add(
new BlackboardArtifact.Type(BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO));
108 doNotReport.add(
new BlackboardArtifact.Type(BlackboardArtifact.ARTIFACT_TYPE.TSK_TOOL_OUTPUT));
109 doNotReport.add(
new BlackboardArtifact.Type(BlackboardArtifact.ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT));
110 doNotReport.add(
new BlackboardArtifact.Type(BlackboardArtifact.ARTIFACT_TYPE.TSK_TL_EVENT));
112 Case.getCurrentCaseThrows().getSleuthkitCase().getArtifactTypes().forEach(artifactTypes::add);
113 artifactTypes.removeAll(doNotReport);
116 protected void execute() {
118 progressPanel.start();
119 progressPanel.updateStatusLabel(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.readingTagsArtifacts.text"));
121 if (settings.useStoredTagsAndArtifactsLists()) {
123 artifactTypes = settings.getArtifactSelections();
126 tagNamesFilter =
new HashSet<>(settings.getTagSelections());
131 if (settings.getSelectedReportOption() == TableReportSettings.TableReportOption.ALL_TAGGED_RESULTS) {
132 getAllExistingTags();
136 getAllExistingArtiactTypes();
137 }
catch (NoCurrentCaseException | TskCoreException ex) {
138 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAllTagsArtifacts"));
139 logger.log(Level.SEVERE,
"Failed get all possible tag names and artifact types", ex);
145 progressPanel.setIndeterminate(
false);
146 progressPanel.setMaximumProgress(this.artifactTypes.size() + 2);
149 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
150 makeBlackboardArtifactTables();
154 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
155 makeContentTagsTables();
158 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
159 makeBlackboardArtifactTagsTables();
162 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
164 makeThumbnailTable();
171 private void makeBlackboardArtifactTables() {
174 if (!tagNamesFilter.isEmpty()) {
175 comment += NbBundle.getMessage(this.getClass(),
"ReportGenerator.artifactTable.taggedResults.text");
176 comment += makeCommaSeparatedList(tagNamesFilter);
180 for (BlackboardArtifact.Type type : artifactTypes) {
183 if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
187 progressPanel.updateStatusLabel(
188 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
189 type.getDisplayName()));
192 if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
193 writeKeywordHits(tableReport, comment, tagNamesFilter);
195 }
else if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
196 writeHashsetHits(tableReport, comment, tagNamesFilter);
200 List<ArtifactData> artifactList = getFilteredArtifacts(type, tagNamesFilter);
202 if (artifactList.isEmpty()) {
211 if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
213 ListMultimap<String, ArtifactData> groupedArtifacts = Multimaps.index(artifactList,
216 return artifactData.getArtifact().getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE)).getValueString();
217 }
catch (TskCoreException ex) {
218 logger.log(Level.SEVERE,
"Unable to get value of TSK_ACCOUNT_TYPE attribute. Defaulting to \"unknown\"", ex);
222 for (String accountTypeStr : groupedArtifacts.keySet()) {
229 String accountDisplayname = accountTypeStr;
230 if (accountTypeStr != null) {
232 Account.Type acctType = Case.getCurrentCaseThrows().getSleuthkitCase().getCommunicationsManager().getAccountType(accountTypeStr);
233 if (acctType != null) {
234 accountDisplayname = acctType.getDisplayName();
236 }
catch (TskCoreException | NoCurrentCaseException ex) {
237 logger.log(Level.SEVERE,
"Unable to get display name for account type " + accountTypeStr, ex);
241 final String compundDataTypeName = BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getDisplayName() +
": " + accountDisplayname;
242 writeTableForDataType(
new ArrayList<>(groupedArtifacts.get(accountTypeStr)), type, compundDataTypeName, comment);
246 writeTableForDataType(artifactList, type, type.getDisplayName(), comment);
261 private void writeTableForDataType(List<ArtifactData> artifactList, BlackboardArtifact.Type type, String tableName, String comment) {
266 Set<BlackboardAttribute.Type> attrTypeSet =
new TreeSet<>(Comparator.comparing(BlackboardAttribute.Type::getDisplayName));
267 for (ArtifactData data : artifactList) {
268 List<BlackboardAttribute> attributes = data.getAttributes();
269 for (BlackboardAttribute attribute : attributes) {
270 attrTypeSet.add(attribute.getAttributeType());
278 List<Column> columns = getArtifactTableColumns(type.getTypeID(), attrTypeSet);
279 if (columns.isEmpty()) {
282 columnHeaderMap.put(type.getTypeID(), columns);
288 Collections.sort(artifactList);
290 tableReport.startDataType(tableName, comment);
293 for (ArtifactData artifactData : artifactList) {
296 List<String> rowData = artifactData.getRow();
297 if (rowData.isEmpty()) {
301 tableReport.addRow(rowData);
304 progressPanel.increment();
305 tableReport.endTable();
306 tableReport.endDataType();
312 @Messages({
"ReportGenerator.tagTable.header.userName=User Name"})
313 @SuppressWarnings(
"deprecation")
314 private
void makeContentTagsTables() {
317 List<ContentTag> tags;
319 tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getAllContentTags();
320 }
catch (TskCoreException | NoCurrentCaseException ex) {
321 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetContentTags"));
322 logger.log(Level.SEVERE,
"failed to get content tags", ex);
329 progressPanel.updateStatusLabel(
330 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
331 BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName()));
332 ArrayList<String> columnHeaders =
new ArrayList<>(Arrays.asList(
333 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.tag"),
334 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.file"),
335 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.comment"),
336 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.userName"),
337 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeModified"),
338 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeChanged"),
339 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeAccessed"),
340 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeCreated"),
341 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.size"),
342 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.hash")));
344 StringBuilder comment =
new StringBuilder();
345 if (!tagNamesFilter.isEmpty()) {
347 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.makeContTagTab.taggedFiles.msg"));
348 comment.append(makeCommaSeparatedList(tagNamesFilter));
350 if (tableReport instanceof HTMLReport) {
351 HTMLReport htmlReportModule = (HTMLReport) tableReport;
352 htmlReportModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
353 htmlReportModule.startContentTagsTable(columnHeaders);
355 tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
356 tableReport.startTable(columnHeaders);
360 for (ContentTag tag : tags) {
362 if (shouldFilterFromReport(tag.getContent())) {
365 }
catch (TskCoreException ex) {
366 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetContentTags"));
367 logger.log(Level.SEVERE,
"Failed to access content data from the case database.", ex);
372 String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() :
"";
373 if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) ==
false) {
379 fileName = tag.getContent().getUniquePath();
380 }
catch (TskCoreException ex) {
381 fileName = tag.getContent().getName();
384 ArrayList<String> rowData =
new ArrayList<>(Arrays.asList(tag.getName().getDisplayName() + notableString, fileName, tag.getComment(), tag.getUserName()));
385 Content content = tag.getContent();
386 if (content instanceof AbstractFile) {
387 AbstractFile file = (AbstractFile) content;
390 rowData.add(file.getMtimeAsDate());
391 rowData.add(file.getCtimeAsDate());
392 rowData.add(file.getAtimeAsDate());
393 rowData.add(file.getCrtimeAsDate());
394 rowData.add(Long.toString(file.getSize()));
395 rowData.add(file.getMd5Hash());
398 if (tableReport instanceof HTMLReport) {
399 HTMLReport htmlReportModule = (HTMLReport) tableReport;
400 htmlReportModule.addRowWithTaggedContentHyperlink(rowData, tag);
402 tableReport.addRow(rowData);
406 checkIfTagHasImage(tag);
410 progressPanel.increment();
411 tableReport.endTable();
412 tableReport.endDataType();
418 @SuppressWarnings(
"deprecation")
420 "ReportGenerator.errList.failedGetBBArtifactTags=Failed to get result tags."
422 private void makeBlackboardArtifactTagsTables() {
424 List<BlackboardArtifactTag> tags;
426 tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getAllBlackboardArtifactTags();
427 }
catch (TskCoreException | NoCurrentCaseException ex) {
428 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBArtifactTags"));
429 logger.log(Level.SEVERE,
"failed to get blackboard artifact tags", ex);
435 progressPanel.updateStatusLabel(
436 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
437 BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName()));
438 StringBuilder comment =
new StringBuilder();
439 if (!tagNamesFilter.isEmpty()) {
441 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.makeBbArtTagTab.taggedRes.msg"));
442 comment.append(makeCommaSeparatedList(tagNamesFilter));
444 tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName(), comment.toString());
445 tableReport.startTable(
new ArrayList<>(Arrays.asList(
446 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.resultType"),
447 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.tag"),
448 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.comment"),
449 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.srcFile"),
450 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.userName"))));
453 for (BlackboardArtifactTag tag : tags) {
455 if (shouldFilterFromReport(tag.getContent())) {
458 }
catch (TskCoreException ex) {
459 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBArtifactTags"));
460 logger.log(Level.SEVERE,
"Failed to access content data from the case database.", ex);
464 String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() :
"";
465 if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) ==
false) {
470 row =
new ArrayList<>(Arrays.asList(tag.getArtifact().getArtifactTypeName(), tag.getName().getDisplayName() + notableString,
471 tag.getComment(), tag.getContent().getName(), tag.getUserName()));
472 tableReport.addRow(row);
475 checkIfTagHasImage(tag);
479 progressPanel.increment();
480 tableReport.endTable();
481 tableReport.endDataType();
491 private boolean passesTagNamesFilter(String tagName) {
492 return tagNamesFilter.isEmpty() || tagNamesFilter.contains(tagName);
498 private void makeThumbnailTable() {
499 progressPanel.updateStatusLabel(
500 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.createdThumb.text"));
502 if (tableReport instanceof HTMLReport) {
503 HTMLReport htmlModule = (HTMLReport) tableReport;
504 htmlModule.startDataType(
505 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.thumbnailTable.name"),
506 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.thumbnailTable.desc"));
507 List<String> emptyHeaders =
new ArrayList<>();
508 for (
int i = 0; i < HTMLReport.THUMBNAIL_COLUMNS; i++) {
509 emptyHeaders.add(
"");
511 htmlModule.startTable(emptyHeaders);
513 htmlModule.addThumbnailRows(images);
515 htmlModule.endTable();
516 htmlModule.endDataType();
527 private void checkIfTagHasImage(BlackboardArtifactTag artifactTag) {
530 file = Case.getCurrentCaseThrows().getSleuthkitCase().getAbstractFileById(artifactTag.getArtifact().getObjectID());
531 }
catch (TskCoreException | NoCurrentCaseException ex) {
533 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.errGetContentFromBBArtifact"));
534 logger.log(Level.WARNING,
"Error while getting content from a blackboard artifact to report on.", ex);
539 checkIfFileIsImage(file);
550 private void checkIfTagHasImage(ContentTag contentTag) {
551 Content c = contentTag.getContent();
552 if (c instanceof AbstractFile ==
false) {
555 checkIfFileIsImage((AbstractFile) c);
563 private void checkIfFileIsImage(AbstractFile file) {
566 || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS
567 || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS) {
571 if (ImageUtils.thumbnailSupported(file)) {
584 private String makeCommaSeparatedList(Collection<String> items) {
586 for (Iterator<String> iterator = items.iterator(); iterator.hasNext();) {
587 list += iterator.next() + (iterator.hasNext() ?
", " :
"");
597 @SuppressWarnings(
"deprecation")
598 @NbBundle.Messages({
"ReportGenerator.errList.noOpenCase=No open case available."})
599 private void writeKeywordHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
606 String orderByClause;
609 openCase = Case.getCurrentCaseThrows();
610 }
catch (NoCurrentCaseException ex) {
611 errorList.add(Bundle.ReportGenerator_errList_noOpenCase());
612 logger.log(Level.SEVERE,
"Exception while getting open case: ", ex);
617 String tagIDList =
"";
618 if (!tagNamesFilter.isEmpty()) {
620 Map<String, TagName> tagNamesMap = Case.getCurrentCaseThrows().getServices().getTagsManager().getDisplayNamesToTagNamesMap();
621 for (String tagDisplayName : tagNamesFilter) {
622 if (tagNamesMap.containsKey(tagDisplayName)) {
623 if (!tagIDList.isEmpty()) {
626 tagIDList += tagNamesMap.get(tagDisplayName).getId();
629 if (tagDisplayName.endsWith(getNotableTagLabel())) {
630 String editedDisplayName = tagDisplayName.substring(0, tagDisplayName.length() - getNotableTagLabel().length());
631 if (tagNamesMap.containsKey(editedDisplayName)) {
632 if (!tagIDList.isEmpty()) {
635 tagIDList += tagNamesMap.get(editedDisplayName).getId();
640 }
catch (NoCurrentCaseException | TskCoreException ex) {
641 logger.log(Level.SEVERE,
"Exception while getting tag info - proceeding without tag filter: ", ex);
647 String adHocCountQuery =
"SELECT COUNT(*) FROM "
649 "(SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 ";
650 if (!tagIDList.isEmpty()) {
651 adHocCountQuery +=
", blackboard_artifact_tags as tag ";
653 adHocCountQuery +=
"WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") ";
654 if (!tagIDList.isEmpty()) {
655 adHocCountQuery +=
" AND (art.artifact_id = tag.artifact_id) AND (tag.tag_name_id IN (" + tagIDList +
")) ";
657 adHocCountQuery +=
"EXCEPT "
659 "SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
")) AS adHocHits";
662 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(adHocCountQuery)) {
663 ResultSet adHocCountResultSet = dbQuery.getResultSet();
664 if (adHocCountResultSet.next()) {
665 adHocCount = adHocCountResultSet.getInt(1);
667 throw new TskCoreException(
"Error counting ad hoc keywords");
669 }
catch (TskCoreException | SQLException ex) {
670 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryKWLists"));
671 logger.log(Level.SEVERE,
"Failed to count ad hoc searches with query " + adHocCountQuery, ex);
676 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
677 orderByClause =
"ORDER BY convert_to(list, 'SQL_ASCII') ASC NULLS FIRST";
679 orderByClause =
"ORDER BY list ASC";
681 String keywordListQuery
682 =
"SELECT att.value_text AS list "
684 "FROM blackboard_attributes AS att, blackboard_artifacts AS art ";
685 if (!tagIDList.isEmpty()) {
686 keywordListQuery +=
", blackboard_artifact_tags as tag ";
688 keywordListQuery +=
"WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
" "
690 "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
" "
692 "AND att.artifact_id = art.artifact_id ";
693 if (!tagIDList.isEmpty()) {
694 keywordListQuery +=
"AND (art.artifact_id = tag.artifact_id) "
696 "AND (tag.tag_name_id IN (" + tagIDList +
")) ";
698 if (adHocCount > 0) {
699 keywordListQuery +=
" UNION SELECT \'\' AS list ";
701 keywordListQuery =
"SELECT * FROM ( " + keywordListQuery +
" ) kwListNames ";
702 keywordListQuery +=
"GROUP BY list " + orderByClause;
705 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(keywordListQuery)) {
706 ResultSet listsRs = dbQuery.getResultSet();
707 List<String> lists =
new ArrayList<>();
708 while (listsRs.next()) {
709 String list = listsRs.getString(
"list");
710 if (list.isEmpty()) {
711 list = NbBundle.getMessage(this.getClass(),
"ReportGenerator.writeKwHits.userSrchs");
717 tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), comment);
718 tableModule.addSetIndex(lists);
719 progressPanel.updateStatusLabel(
720 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
721 BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName()));
722 }
catch (TskCoreException | SQLException ex) {
723 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryKWLists"));
724 logger.log(Level.SEVERE,
"Failed to query keyword lists with query " + keywordListQuery, ex);
729 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
730 orderByClause =
"ORDER BY convert_to(list, 'SQL_ASCII') ASC NULLS FIRST, "
731 +
"convert_to(keyword, 'SQL_ASCII') ASC NULLS FIRST, "
732 +
"convert_to(parent_path, 'SQL_ASCII') ASC NULLS FIRST, "
733 +
"convert_to(name, 'SQL_ASCII') ASC NULLS FIRST, "
734 +
"convert_to(preview, 'SQL_ASCII') ASC NULLS FIRST";
736 orderByClause =
"ORDER BY list ASC, keyword ASC, parent_path ASC, name ASC, preview ASC";
740 String keywordListsQuery
741 =
"SELECT art.artifact_id AS artifact_id, art.obj_id AS obj_id, att1.value_text AS keyword, att2.value_text AS preview, att3.value_text AS list, f.name AS name, f.parent_path AS parent_path "
743 "FROM blackboard_artifacts AS art, blackboard_attributes AS att1, blackboard_attributes AS att2, blackboard_attributes AS att3, tsk_files AS f "
745 "WHERE (att1.artifact_id = art.artifact_id) "
747 "AND (att2.artifact_id = art.artifact_id) "
749 "AND (att3.artifact_id = art.artifact_id) "
751 "AND (f.obj_id = art.obj_id) "
753 "AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID() +
") "
755 "AND (att2.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID() +
") "
757 "AND (att3.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
") "
759 "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") ";
762 String keywordAdHocQuery
763 =
"SELECT art.artifact_id AS artifact_id, art.obj_id AS obj_id, att1.value_text AS keyword, att2.value_text AS preview, \'\' AS list, f.name AS name, f.parent_path AS parent_path "
765 "FROM blackboard_artifacts AS art, blackboard_attributes AS att1, blackboard_attributes AS att2, tsk_files AS f "
769 " (art.artifact_id IN (SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") "
773 "SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
"))) "
775 "AND (att1.artifact_id = art.artifact_id) "
777 "AND (att2.artifact_id = art.artifact_id) "
779 "AND (f.obj_id = art.obj_id) "
781 "AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID() +
") "
783 "AND (att2.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID() +
") "
785 "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") ";
787 String keywordsQuery =
"SELECT * FROM ( " + keywordListsQuery +
" UNION " + keywordAdHocQuery +
" ) kwHits " + orderByClause;
789 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(keywordsQuery)) {
790 ResultSet resultSet = dbQuery.getResultSet();
792 String currentKeyword =
"";
793 String currentList =
"";
794 while (resultSet.next()) {
796 if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
801 HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong(
"artifact_id"));
802 if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
805 String tagsList = makeCommaSeparatedList(uniqueTagNames);
807 Long objId = resultSet.getLong(
"obj_id");
808 String keyword = resultSet.getString(
"keyword");
809 String preview = resultSet.getString(
"preview");
810 String list = resultSet.getString(
"list");
811 String uniquePath =
"";
814 AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
816 uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
817 if (shouldFilterFromReport(f)) {
821 }
catch (TskCoreException ex) {
823 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAbstractFileByID"));
824 logger.log(Level.WARNING,
"Failed to get Abstract File by ID.", ex);
828 if ((!list.equals(currentList) && !list.isEmpty()) || (list.isEmpty() && !currentList.equals(
829 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.writeKwHits.userSrchs")))) {
830 if (!currentList.isEmpty()) {
831 tableModule.endTable();
832 tableModule.endSet();
834 currentList = list.isEmpty() ? NbBundle
835 .getMessage(this.getClass(),
"ReportGenerator.writeKwHits.userSrchs") : list;
837 tableModule.startSet(currentList);
838 progressPanel.updateStatusLabel(
839 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processingList",
840 BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), currentList));
842 if (!keyword.equals(currentKeyword)) {
844 if (!currentKeyword.equals(
"")) {
845 tableModule.endTable();
849 currentKeyword = keyword;
850 tableModule.addSetElement(currentKeyword);
851 List<String> columnHeaderNames =
new ArrayList<>();
852 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.preview"));
853 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.srcFile"));
854 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags"));
855 tableModule.startTable(columnHeaderNames);
858 tableModule.addRow(Arrays.asList(
new String[]{preview, uniquePath, tagsList}));
862 if (!currentKeyword.isEmpty()) {
863 tableModule.endTable();
867 progressPanel.increment();
868 tableModule.endDataType();
869 }
catch (TskCoreException | SQLException ex) {
870 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryKWs"));
871 logger.log(Level.SEVERE,
"Failed to query keywords with query " + keywordsQuery, ex);
880 @SuppressWarnings(
"deprecation")
881 private
void writeHashsetHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
882 String orderByClause;
885 openCase = Case.getCurrentCaseThrows();
886 }
catch (NoCurrentCaseException ex) {
887 errorList.add(Bundle.ReportGenerator_errList_noOpenCase());
888 logger.log(Level.SEVERE,
"Exception while getting open case: ", ex);
891 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
892 orderByClause =
"ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST";
894 orderByClause =
"ORDER BY att.value_text ASC";
897 =
"SELECT att.value_text AS list "
899 "FROM blackboard_attributes AS att, blackboard_artifacts AS art "
901 "WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
" "
903 "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() +
" "
905 "AND att.artifact_id = art.artifact_id "
907 "GROUP BY list " + orderByClause;
909 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(hashsetsQuery)) {
911 ResultSet listsRs = dbQuery.getResultSet();
912 List<String> lists =
new ArrayList<>();
913 while (listsRs.next()) {
914 lists.add(listsRs.getString(
"list"));
917 tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), comment);
918 tableModule.addSetIndex(lists);
919 progressPanel.updateStatusLabel(
920 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
921 BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName()));
922 }
catch (TskCoreException | SQLException ex) {
923 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryHashsetLists"));
924 logger.log(Level.SEVERE,
"Failed to query hashset lists: ", ex);
928 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
929 orderByClause =
"ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST, "
930 +
"convert_to(f.parent_path, 'SQL_ASCII') ASC NULLS FIRST, "
931 +
"convert_to(f.name, 'SQL_ASCII') ASC NULLS FIRST, "
932 +
"size ASC NULLS FIRST";
934 orderByClause =
"ORDER BY att.value_text ASC, f.parent_path ASC, f.name ASC, size ASC";
936 String hashsetHitsQuery
937 =
"SELECT art.artifact_id, art.obj_id, att.value_text AS setname, f.name AS name, f.size AS size, f.parent_path AS parent_path "
939 "FROM blackboard_artifacts AS art, blackboard_attributes AS att, tsk_files AS f "
941 "WHERE (att.artifact_id = art.artifact_id) "
943 "AND (f.obj_id = art.obj_id) "
945 "AND (att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
") "
947 "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() +
") "
951 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(hashsetHitsQuery)) {
953 ResultSet resultSet = dbQuery.getResultSet();
954 String currentSet =
"";
955 while (resultSet.next()) {
957 if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
962 HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong(
"artifact_id"));
963 if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
966 String tagsList = makeCommaSeparatedList(uniqueTagNames);
968 Long objId = resultSet.getLong(
"obj_id");
969 String set = resultSet.getString(
"setname");
970 String size = resultSet.getString(
"size");
971 String uniquePath =
"";
974 AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
976 uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
977 if (shouldFilterFromReport(f)) {
981 }
catch (TskCoreException ex) {
983 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAbstractFileFromID"));
984 logger.log(Level.WARNING,
"Failed to get Abstract File from ID.", ex);
989 if (!set.equals(currentSet)) {
990 if (!currentSet.isEmpty()) {
991 tableModule.endTable();
992 tableModule.endSet();
995 tableModule.startSet(currentSet);
996 List<String> columnHeaderNames =
new ArrayList<>();
997 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.file"));
998 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.size"));
999 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags"));
1000 tableModule.startTable(columnHeaderNames);
1001 progressPanel.updateStatusLabel(
1002 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processingList",
1003 BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), currentSet));
1007 tableModule.addRow(Arrays.asList(
new String[]{uniquePath, size, tagsList}));
1011 progressPanel.increment();
1012 tableModule.endDataType();
1013 }
catch (TskCoreException | SQLException ex) {
1014 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryHashsetHits"));
1015 logger.log(Level.SEVERE,
"Failed to query hashsets hits: ", ex);
1022 List<String> getErrorList() {
1035 private List<String> rowData = null;
1038 ArtifactData(BlackboardArtifact artifact, List<BlackboardAttribute> attrs, HashSet<String> tags) {
1040 this.attributes = attrs;
1044 }
catch (TskCoreException | NoCurrentCaseException ex) {
1045 logger.log(Level.SEVERE,
"Could not get content from database", ex);
1062 return artifact.getArtifactID();
1066 return artifact.getObjectID();
1087 List<String> thisRow =
getRow();
1088 List<String> otherRow = otherArtifactData.
getRow();
1089 for (
int i = 0; i < thisRow.size(); i++) {
1090 int compare = thisRow.get(i).compareTo(otherRow.get(i));
1106 if (rowData == null) {
1111 if (rowData.size() > 0) {
1113 for (
int i = 0; i < rowData.size(); i++) {
1114 if (rowData.get(i) == null) {
1120 return new ArrayList<>();
1122 }
catch (TskCoreException ex) {
1124 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.coreExceptionWhileGenRptRow"));
1125 logger.log(Level.WARNING,
"Core exception while generating row data for artifact report.", ex);
1126 rowData = Collections.<String>emptyList();
1144 @SuppressWarnings(
"deprecation")
1147 List<String> orderedRowData =
new ArrayList<>();
1148 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() ==
getArtifact().getArtifactTypeID()) {
1149 if (content != null && content instanceof AbstractFile) {
1150 AbstractFile file = (AbstractFile) content;
1151 orderedRowData.add(file.getName());
1152 orderedRowData.add(file.getNameExtension());
1153 String mimeType = file.getMIMEType();
1154 if (mimeType == null) {
1155 orderedRowData.add(
"");
1157 orderedRowData.add(mimeType);
1159 orderedRowData.add(file.getUniquePath());
1162 orderedRowData.add(null);
1163 orderedRowData.add(null);
1164 orderedRowData.add(null);
1165 orderedRowData.add(null);
1167 orderedRowData.add(makeCommaSeparatedList(
getTags()));
1169 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() ==
getArtifact().getArtifactTypeID()
1170 || BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID() ==
getArtifact().getArtifactTypeID()) {
1171 String[] attributeDataArray =
new String[7];
1173 for (BlackboardAttribute attr : attributes) {
1174 if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME))) {
1175 attributeDataArray[0] = attr.getDisplayString();
1176 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY))) {
1177 attributeDataArray[1] = attr.getDisplayString();
1178 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT))) {
1179 attributeDataArray[3] = attr.getDisplayString();
1180 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION))) {
1181 attributeDataArray[4] = attr.getDisplayString();
1182 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT))) {
1183 attributeDataArray[5] = attr.getDisplayString();
1184 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME))) {
1185 attributeDataArray[6] = attr.getDisplayString();
1189 attributeDataArray[2] = content.getUniquePath();
1190 orderedRowData.addAll(Arrays.asList(attributeDataArray));
1192 HashSet<String> allTags =
getTags();
1195 for (ContentTag ct : contentTags) {
1197 allTags.add(ct.getName().getDisplayName() + notableString);
1199 }
catch (TskCoreException | NoCurrentCaseException ex) {
1200 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetContentTags"));
1201 logger.log(Level.SEVERE,
"Failed to get content tags", ex);
1203 orderedRowData.add(makeCommaSeparatedList(allTags));
1205 }
else if (columnHeaderMap.containsKey(
this.artifact.getArtifactTypeID())) {
1207 for (
Column currColumn : columnHeaderMap.get(
this.artifact.getArtifactTypeID())) {
1208 String cellData = currColumn.getCellData(
this);
1209 orderedRowData.add(cellData);
1213 return orderedRowData;
1227 private List<ArtifactData> getFilteredArtifacts(BlackboardArtifact.Type type, HashSet<String> tagNamesFilter) {
1228 List<ArtifactData> artifacts =
new ArrayList<>();
1230 List<Long> dsIds = settings.getSelectedDataSources() != null
1231 ? settings.getSelectedDataSources()
1235 if (shouldFilterFromReport(artifact)) {
1239 List<BlackboardArtifactTag> tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getBlackboardArtifactTagsByArtifact(artifact);
1240 HashSet<String> uniqueTagNames =
new HashSet<>();
1241 for (BlackboardArtifactTag tag : tags) {
1242 String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() :
"";
1243 uniqueTagNames.add(tag.getName().getDisplayName() + notableString);
1245 if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
1249 artifacts.add(
new ArtifactData(artifact, Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboard().getBlackboardAttributes(artifact), uniqueTagNames));
1250 }
catch (TskCoreException ex) {
1251 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBAttribs"));
1252 logger.log(Level.SEVERE,
"Failed to get Blackboard Attributes when generating report.", ex);
1255 }
catch (TskCoreException | NoCurrentCaseException ex) {
1256 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBArtifacts"));
1257 logger.log(Level.SEVERE,
"Failed to get Blackboard Artifacts when generating report.", ex);
1262 private Boolean failsTagFilter(HashSet<String> tagNames, HashSet<String> tagsNamesFilter) {
1263 if (null == tagsNamesFilter || tagsNamesFilter.isEmpty()) {
1267 HashSet<String> filteredTagNames =
new HashSet<>(tagNames);
1268 filteredTagNames.retainAll(tagsNamesFilter);
1269 return filteredTagNames.isEmpty();
1282 @Messages({
"ReportGenerator.artTableColHdr.comment=Comment"})
1283 @SuppressWarnings(
"deprecation")
1284 private List<Column> getArtifactTableColumns(
int artifactTypeId, Set<BlackboardAttribute.Type> attributeTypeSet) {
1285 ArrayList<Column> columns =
new ArrayList<>();
1289 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID() == artifactTypeId) {
1290 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1291 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1293 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.title"),
1294 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1296 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateCreated"),
1297 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1299 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1300 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1302 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID() == artifactTypeId) {
1303 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1304 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1306 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1307 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1309 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1310 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1312 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.value"),
1313 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE)));
1315 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1316 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1318 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID() == artifactTypeId) {
1319 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1320 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1322 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateAccessed"),
1323 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1325 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.referrer"),
1326 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REFERRER)));
1328 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.title"),
1329 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1331 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1332 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1334 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.urlDomainDecoded"),
1335 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL_DECODED)));
1337 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifactTypeId) {
1338 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dest"),
1339 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1341 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.sourceUrl"),
1342 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1344 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateAccessed"),
1345 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1347 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1348 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1350 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
1351 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == artifactTypeId) {
1352 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.path"),
1353 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1355 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1356 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1358 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
1359 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID() == artifactTypeId) {
1360 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.progName"),
1361 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1363 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.instDateTime"),
1364 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1366 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() == artifactTypeId) {
1367 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.preview")));
1369 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() == artifactTypeId) {
1370 columns.add(
new SourceFileColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.file")));
1372 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.size")));
1374 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID() == artifactTypeId) {
1375 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devMake"),
1376 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1378 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devModel"),
1379 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1381 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.deviceId"),
1382 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1384 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1385 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1387 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID() == artifactTypeId) {
1388 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.text"),
1389 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1391 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.domain"),
1392 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)));
1394 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateAccessed"),
1395 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1397 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.progName"),
1398 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1400 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID() == artifactTypeId) {
1401 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTaken"),
1402 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1404 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devManufacturer"),
1405 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1407 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devModel"),
1408 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1410 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1411 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1413 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1414 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1416 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1417 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1419 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID() == artifactTypeId) {
1420 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1421 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1423 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumber"),
1424 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1426 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumHome"),
1427 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_HOME)));
1429 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumOffice"),
1430 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_OFFICE)));
1432 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumMobile"),
1433 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_MOBILE)));
1435 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.email"),
1436 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL)));
1438 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() == artifactTypeId) {
1439 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.msgType"),
1440 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)));
1442 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.direction"),
1443 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1445 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.readStatus"),
1446 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_READ_STATUS)));
1448 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1449 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1451 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.fromPhoneNum"),
1452 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1454 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.fromEmail"),
1455 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1457 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.toPhoneNum"),
1458 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1460 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.toEmail"),
1461 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1463 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.subject"),
1464 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1466 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.text"),
1467 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1469 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID() == artifactTypeId) {
1470 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1471 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1473 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.fromPhoneNum"),
1474 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1476 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.toPhoneNum"),
1477 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1479 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1480 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1482 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.direction"),
1483 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1485 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID() == artifactTypeId) {
1486 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.calendarEntryType"),
1487 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CALENDAR_ENTRY_TYPE)));
1489 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1490 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1492 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.startDateTime"),
1493 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1495 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.endDateTime"),
1496 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_END)));
1498 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.location"),
1499 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1501 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID() == artifactTypeId) {
1502 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.shortCut"),
1503 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SHORTCUT)));
1505 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1506 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME_PERSON)));
1508 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumber"),
1509 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1511 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID() == artifactTypeId) {
1512 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.deviceName"),
1513 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_NAME)));
1515 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.deviceAddress"),
1516 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1518 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1519 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1521 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID() == artifactTypeId) {
1522 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1523 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1525 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1526 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1528 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1529 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1531 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID() == artifactTypeId) {
1532 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1533 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1535 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1536 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1538 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1539 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1541 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1542 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1544 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.locationAddress"),
1545 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1547 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1548 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1550 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID() == artifactTypeId) {
1551 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1552 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1554 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1555 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1557 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1558 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1560 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1561 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1563 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.locationAddress"),
1564 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1566 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1567 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1569 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID() == artifactTypeId) {
1570 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1571 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1573 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1574 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1576 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1577 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1579 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1580 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1582 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.locationAddress"),
1583 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1585 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1586 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1588 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID() == artifactTypeId) {
1589 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.category"),
1590 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1592 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.userId"),
1593 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1595 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.password"),
1596 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PASSWORD)));
1598 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1599 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1601 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.appName"),
1602 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1604 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1605 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1607 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.appPath"),
1608 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1610 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1611 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1613 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.replytoAddress"),
1614 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_REPLYTO)));
1616 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.mailServer"),
1617 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SERVER_NAME)));
1619 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID() == artifactTypeId
1620 || BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID() == artifactTypeId) {
1621 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1622 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1624 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() == artifactTypeId) {
1625 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.file")));
1627 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.extension.text")));
1629 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.mimeType.text")));
1631 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.path")));
1633 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID() == artifactTypeId) {
1634 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.processorArchitecture.text"),
1635 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROCESSOR_ARCHITECTURE)));
1637 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.osName.text"),
1638 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1640 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.osInstallDate.text"),
1641 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1643 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == artifactTypeId) {
1644 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailTo"),
1645 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1647 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailFrom"),
1648 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1650 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSubject"),
1651 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1653 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskDateTimeSent"),
1654 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)));
1656 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskDateTimeRcvd"),
1657 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_RCVD)));
1659 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskPath"),
1660 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1662 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailCc"),
1663 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_CC)));
1665 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailBcc"),
1666 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_BCC)));
1668 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskMsgId"),
1669 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MSG_ID)));
1671 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == artifactTypeId) {
1672 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSetName"),
1673 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1675 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskInterestingFilesCategory"),
1676 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1678 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskPath"),
1679 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1681 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.comment"),
1682 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT)));
1684 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1685 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1687 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_ROUTE.getTypeID() == artifactTypeId) {
1688 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskGpsRouteCategory"),
1689 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1691 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1692 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1694 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitudeEnd"),
1695 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END)));
1697 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitudeEnd"),
1698 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END)));
1700 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitudeStart"),
1701 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START)));
1703 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitudeStart"),
1704 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START)));
1706 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1707 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1709 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.location"),
1710 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1712 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1713 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1715 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == artifactTypeId) {
1716 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSetName"),
1717 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1719 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.associatedArtifact"),
1720 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1722 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1723 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1725 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ITEM.getTypeID() == artifactTypeId) {
1726 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSetName"),
1727 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1729 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.associatedArtifact"),
1730 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1732 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1733 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1735 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskInterestingFilesCategory"),
1736 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1738 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskPath"),
1739 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1741 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.comment"),
1742 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT)));
1744 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1745 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1747 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == artifactTypeId) {
1748 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1749 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1751 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.associatedArtifact"),
1752 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1754 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1755 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1757 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.count"),
1758 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COUNT)));
1760 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_ACCOUNT.getTypeID() == artifactTypeId) {
1761 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.userName"),
1762 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME)));
1764 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.userId"),
1765 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1767 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_REMOTE_DRIVE.getTypeID() == artifactTypeId) {
1768 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.localPath"),
1769 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCAL_PATH)));
1771 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.remotePath"),
1772 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REMOTE_PATH)));
1773 }
else if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
1774 columns.add(
new StatusColumn());
1775 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE));
1776 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
1777 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME));
1778 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_SEARCH_DOCUMENT_ID));
1779 }
else if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID()) {
1780 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
1784 for (BlackboardAttribute.Type type : attributeTypeSet) {
1785 columns.add(
new AttributeColumn(type.getDisplayName(), type));
1787 columns.add(
new SourceFileColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.srcFile")));
1788 columns.add(
new TaggedResultsColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags")));
1796 for (Column column : columns) {
1797 attributeTypeSet = column.removeTypeFromSet(attributeTypeSet);
1800 for (BlackboardAttribute.Type type : attributeTypeSet) {
1801 columns.add(
new AttributeColumn(type.getDisplayName(), type));
1804 if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()
1805 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()
1806 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()
1807 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()
1808 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()
1809 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()
1810 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()
1811 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID()
1812 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID()
1813 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID()
1814 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()
1815 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID()
1816 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID()
1817 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID()
1818 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID()
1819 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID()
1820 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID()
1821 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID()
1822 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID()
1823 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_AREA.getTypeID()
1824 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID()
1825 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID()
1826 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID()
1827 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID()) {
1828 columns.add(
new SourceFileColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.srcFile")));
1830 columns.add(
new TaggedResultsColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags")));
1842 private String getFileUniquePath(Content content) {
1844 if (content != null) {
1845 return content.getUniquePath();
1849 }
catch (TskCoreException ex) {
1850 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAbstractFileByID"));
1851 logger.log(Level.WARNING,
"Failed to get Abstract File by ID.", ex);
1860 private boolean shouldFilterFromReport(Content content)
throws TskCoreException {
1861 if (this.settings.getSelectedDataSources() == null) {
1865 if (content.getDataSource() == null) {
1869 long dataSourceId = content.getDataSource().getId();
1870 return !this.settings.getSelectedDataSources().contains(dataSourceId);
1882 @SuppressWarnings(
"deprecation")
1883 private HashSet<String> getUniqueTagNames(
long artifactId) throws TskCoreException {
1884 HashSet<String> uniqueTagNames =
new HashSet<>();
1886 String query =
"SELECT display_name, artifact_id, knownStatus FROM tag_names AS tn, blackboard_artifact_tags AS bat "
1888 "WHERE tn.tag_name_id = bat.tag_name_id AND bat.artifact_id = " + artifactId;
1890 try (SleuthkitCase.CaseDbQuery dbQuery = Case.getCurrentCaseThrows().getSleuthkitCase().executeQuery(query)) {
1891 ResultSet tagNameRows = dbQuery.getResultSet();
1892 while (tagNameRows.next()) {
1893 String notableString = tagNameRows.getInt(
"knownStatus") == TskData.FileKnown.BAD.ordinal() ? getNotableTagLabel() :
"";
1894 uniqueTagNames.add(tagNameRows.getString(
"display_name") + notableString);
1896 }
catch (TskCoreException | SQLException | NoCurrentCaseException ex) {
1897 throw new TskCoreException(
"Error getting tag names for artifact: ", ex);
1900 return uniqueTagNames;
1910 Set<BlackboardAttribute.Type>
removeTypeFromSet(Set<BlackboardAttribute.Type> types);
1915 @NbBundle.Messages(
"TableReportGenerator.StatusColumn.Header=Review Status")
1918 return Bundle.TableReportGenerator_StatusColumn_Header();
1923 return artData.
getArtifact().getReviewStatus().getDisplayName();
1946 this.columnHeader = Objects.requireNonNull(columnHeader);
1957 List<BlackboardAttribute> attributes = artData.
getAttributes();
1958 for (BlackboardAttribute attribute : attributes) {
1959 if (attribute.getAttributeType().equals(this.
attributeType)) {
1960 if (attribute.getAttributeType().getValueType() != BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
1961 return attribute.getDisplayString();
1992 return getFileUniquePath(artData.
getContent());
2017 return makeCommaSeparatedList(artData.
getTags());
2042 throw new UnsupportedOperationException(
"Cannot get cell data of unspecified column");
BlackboardArtifact getArtifact()
final String columnHeader
String getCellData(ArtifactData artData)
List< String > getOrderedRowDataAsStrings()
List< BlackboardAttribute > attributes
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
String getCellData(ArtifactData artData)
int compareTo(ArtifactData otherArtifactData)
final BlackboardAttribute.Type attributeType
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
static String getFormattedTime(long epochTime)
String getCellData(ArtifactData artData)
HashSet< String > getTags()
List< BlackboardAttribute > getAttributes()
String getCellData(ArtifactData artData)
String getCellData(ArtifactData artData)
final String columnHeader
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
BlackboardArtifact artifact
final String columnHeader
TagsManager getTagsManager()
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
SleuthkitCase getSleuthkitCase()
String getCellData(ArtifactData artData)
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
static Case getCurrentCaseThrows()
final String columnHeader