Autopsy  4.21.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
DomainSearchArtifactsLoader.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2020 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.discovery.search;
20 
21 import com.google.common.cache.CacheLoader;
22 import java.util.ArrayList;
23 import java.util.HashMap;
24 import java.util.List;
25 import java.util.Map;
26 import org.sleuthkit.datamodel.TskCoreException;
27 import org.sleuthkit.datamodel.SleuthkitCase;
28 import org.sleuthkit.datamodel.BlackboardArtifact;
29 import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
30 import org.sleuthkit.datamodel.BlackboardAttribute;
31 
36 public class DomainSearchArtifactsLoader extends CacheLoader<DomainSearchArtifactsCache.ArtifactCacheKey, Map<String, List<BlackboardArtifact>>> {
37 
38  private static final BlackboardAttribute.Type TSK_DOMAIN = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN);
39 
40  @Override
41  public Map<String, List<BlackboardArtifact>> load(DomainSearchArtifactsCache.ArtifactCacheKey artifactKey) throws TskCoreException, InterruptedException {
42  final SleuthkitCase caseDb = artifactKey.getSleuthkitCase();
43  final ARTIFACT_TYPE type = artifactKey.getType();
44  List<BlackboardArtifact> artifacts = caseDb.getBlackboardArtifacts(type);
45 
46  Map<String, List<BlackboardArtifact>> artifactsByDomain = new HashMap<>();
47 
48  // Grab artifacts with matching domain names.
49  for (BlackboardArtifact artifact : artifacts) {
50  if(Thread.currentThread().isInterrupted()) {
51  throw new InterruptedException();
52  }
53  final BlackboardAttribute tskDomain = artifact.getAttribute(TSK_DOMAIN);
54  if (tskDomain != null) {
55  final String normalizedDomain = tskDomain.getValueString().trim().toLowerCase();
56  List<BlackboardArtifact> artifactsWithDomain = artifactsByDomain.getOrDefault(normalizedDomain, new ArrayList<>());
57  artifactsWithDomain.add(artifact);
58  artifactsByDomain.put(normalizedDomain, artifactsWithDomain);
59  }
60  }
61 
62  return artifactsByDomain;
63  }
64 }
Type(int value, String displayName, Collection< String > mediaTypes, Collection< BlackboardArtifact.ARTIFACT_TYPE > artifactTypes)
Map< String, List< BlackboardArtifact > > load(DomainSearchArtifactsCache.ArtifactCacheKey artifactKey)

Copyright © 2012-2022 Basis Technology. Generated on: Tue Feb 6 2024
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.