Autopsy  4.21.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
ArtifactTextExtractor.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2021 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.textextractors;
20 
21 import java.io.InputStreamReader;
22 import java.io.Reader;
23 import java.nio.charset.StandardCharsets;
24 import org.apache.commons.io.IOUtils;
26 import org.sleuthkit.datamodel.BlackboardArtifact;
27 import org.sleuthkit.datamodel.BlackboardAttribute;
28 import org.sleuthkit.datamodel.TskCoreException;
29 
34 class ArtifactTextExtractor implements TextExtractor {
35 
36  private final BlackboardArtifact artifact;
37 
38  public ArtifactTextExtractor(BlackboardArtifact artifact) {
39  this.artifact = artifact;
40  }
41 
42  @Override
43  public Reader getReader() throws InitReaderException {
44  // Concatenate the string values of all attributes into a single
45  // "content" string to be indexed.
46  StringBuilder artifactContents = new StringBuilder();
47 
48  try {
49  for (BlackboardAttribute attribute : artifact.getAttributes()) {
50  artifactContents.append(attribute.getAttributeType().getDisplayName());
51  artifactContents.append(" : ");
52  // We have also discussed modifying BlackboardAttribute.getDisplayString()
53  // to magically format datetime attributes but that is complicated by
54  // the fact that BlackboardAttribute exists in Sleuthkit data model
55  // while the utility to determine the timezone to use is in ContentUtils
56  // in the Autopsy datamodel.
57  switch (attribute.getValueType()) {
58  case DATETIME:
59  artifactContents.append(TimeZoneUtils.getFormattedTime(attribute.getValueLong()));
60  break;
61  default:
62  artifactContents.append(attribute.getDisplayString());
63  }
64  artifactContents.append(System.lineSeparator());
65  }
66  } catch (TskCoreException tskCoreException) {
67  throw new InitReaderException("Unable to get attributes for artifact: " + artifact.toString(), tskCoreException);
68  }
69 
70  return new InputStreamReader(IOUtils.toInputStream(artifactContents,
71  StandardCharsets.UTF_8), StandardCharsets.UTF_8);
72  }
73 
74  @Override
75  public boolean isSupported() {
76  return true;
77  }
78 }
static String getFormattedTime(long epochTime)

Copyright © 2012-2022 Basis Technology. Generated on: Tue Feb 6 2024
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.