19 package org.sleuthkit.autopsy.datasourceprocessors.xry;
21 import java.util.ArrayList;
23 import java.util.HashMap;
24 import java.util.List;
25 import java.util.Optional;
27 import org.
sleuthkit.datamodel.Blackboard.BlackboardException;
37 final class XRYWebBookmarksFileParser
extends AbstractSingleEntityParser {
40 private static final Map<String, BlackboardAttribute.ATTRIBUTE_TYPE> XRY_KEYS
41 =
new HashMap<String, BlackboardAttribute.ATTRIBUTE_TYPE>() {
43 put(
"web address", BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL);
44 put(
"domain", BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN);
45 put(
"application", BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME);
50 boolean canProcess(XRYKeyValuePair pair) {
51 String normalizedKey = pair.getKey().toLowerCase();
52 return XRY_KEYS.containsKey(normalizedKey);
56 boolean isNamespace(String nameSpace) {
65 private Optional<BlackboardAttribute> getBlackboardAttribute(XRYKeyValuePair pair) {
66 String normalizedKey = pair.getKey().toLowerCase();
67 return Optional.of(
new BlackboardAttribute(
68 XRY_KEYS.get(normalizedKey),
69 PARSER_NAME, pair.getValue()));
73 void makeArtifact(List<XRYKeyValuePair> keyValuePairs, Content parent, SleuthkitCase currentCase)
throws TskCoreException, BlackboardException {
74 List<BlackboardAttribute> attributes =
new ArrayList<>();
75 for(XRYKeyValuePair pair : keyValuePairs) {
76 Optional<BlackboardAttribute> attribute = getBlackboardAttribute(pair);
77 if(attribute.isPresent()) {
78 attributes.add(attribute.get());
81 if(!attributes.isEmpty()) {
82 parent.newDataArtifact(BlackboardArtifact.Type.TSK_WEB_BOOKMARK, attributes);