Autopsy  4.8.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
TableReportGenerator.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2013-2018 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.report;
20 
21 import com.google.common.collect.ListMultimap;
22 import com.google.common.collect.Lists;
23 import com.google.common.collect.Multimaps;
24 import java.sql.ResultSet;
25 import java.sql.SQLException;
26 import java.util.ArrayList;
27 import java.util.Arrays;
28 import java.util.Collection;
29 import java.util.Collections;
30 import java.util.Comparator;
31 import java.util.HashMap;
32 import java.util.HashSet;
33 import java.util.Iterator;
34 import java.util.List;
35 import java.util.Map;
36 import java.util.Objects;
37 import java.util.Set;
38 import java.util.TreeSet;
39 import java.util.logging.Level;
40 import org.openide.util.NbBundle;
41 import org.openide.util.NbBundle.Messages;
42 import org.sleuthkit.autopsy.casemodule.Case;
43 import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
44 import org.sleuthkit.autopsy.casemodule.services.TagsManager;
45 import org.sleuthkit.autopsy.coreutils.ImageUtils;
46 import org.sleuthkit.autopsy.coreutils.Logger;
47 import org.sleuthkit.autopsy.datamodel.ContentUtils;
48 import static org.sleuthkit.autopsy.casemodule.services.TagsManager.getNotableTagLabel;
49 import org.sleuthkit.datamodel.AbstractFile;
50 import org.sleuthkit.datamodel.Account;
51 import org.sleuthkit.datamodel.BlackboardArtifact;
52 import org.sleuthkit.datamodel.BlackboardArtifactTag;
53 import org.sleuthkit.datamodel.BlackboardAttribute;
54 import org.sleuthkit.datamodel.BlackboardAttribute.Type;
55 import org.sleuthkit.datamodel.Content;
56 import org.sleuthkit.datamodel.ContentTag;
57 import org.sleuthkit.datamodel.SleuthkitCase;
58 import org.sleuthkit.datamodel.TagName;
59 import org.sleuthkit.datamodel.TskCoreException;
60 import org.sleuthkit.datamodel.TskData;
61 
62 class TableReportGenerator {
63 
64  private final List<BlackboardArtifact.Type> artifactTypes = new ArrayList<>();
65  private final HashSet<String> tagNamesFilter = new HashSet<>();
66 
67  private final Set<Content> images = new HashSet<>();
68  private final ReportProgressPanel progressPanel;
69  private final TableReportModule tableReport;
70  private final Map<Integer, List<Column>> columnHeaderMap;
71  private static final Logger logger = Logger.getLogger(TableReportGenerator.class.getName());
72 
73  private final List<String> errorList;
74 
75  TableReportGenerator(Map<BlackboardArtifact.Type, Boolean> artifactTypeSelections, Map<String, Boolean> tagNameSelections, ReportProgressPanel progressPanel, TableReportModule tableReport) {
76 
77  this.progressPanel = progressPanel;
78  this.tableReport = tableReport;
79  this.columnHeaderMap = new HashMap<>();
80  errorList = new ArrayList<>();
81  // Get the artifact types selected by the user.
82  for (Map.Entry<BlackboardArtifact.Type, Boolean> entry : artifactTypeSelections.entrySet()) {
83  if (entry.getValue()) {
84  artifactTypes.add(entry.getKey());
85  }
86  }
87 
88  // Get the tag names selected by the user and make a tag names filter.
89  if (null != tagNameSelections) {
90  for (Map.Entry<String, Boolean> entry : tagNameSelections.entrySet()) {
91  if (entry.getValue() == true) {
92  tagNamesFilter.add(entry.getKey());
93  }
94  }
95  }
96  }
97 
98  protected void execute() {
99  // Start the progress indicators for each active TableReportModule.
100 
101  progressPanel.start();
102  progressPanel.setIndeterminate(false);
103  progressPanel.setMaximumProgress(this.artifactTypes.size() + 2); // +2 for content and blackboard artifact tags
104  // report on the blackboard results
105  if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
106  makeBlackboardArtifactTables();
107  }
108 
109  // report on the tagged files and artifacts
110  if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
111  makeContentTagsTables();
112  }
113 
114  if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
115  makeBlackboardArtifactTagsTables();
116  }
117 
118  if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
119  // report on the tagged images
120  makeThumbnailTable();
121  }
122  }
123 
127  private void makeBlackboardArtifactTables() {
128  // Make a comment string describing the tag names filter in effect.
129  String comment = "";
130  if (!tagNamesFilter.isEmpty()) {
131  comment += NbBundle.getMessage(this.getClass(), "ReportGenerator.artifactTable.taggedResults.text");
132  comment += makeCommaSeparatedList(tagNamesFilter);
133  }
134 
135  // Add a table to the report for every enabled blackboard artifact type.
136  for (BlackboardArtifact.Type type : artifactTypes) {
137  // Check for cancellaton.
138 
139  if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
140  return;
141  }
142 
143  progressPanel.updateStatusLabel(
144  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
145  type.getDisplayName()));
146 
147  // Keyword hits and hashset hit artifacts get special handling.
148  if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
149  writeKeywordHits(tableReport, comment, tagNamesFilter);
150  continue;
151  } else if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
152  writeHashsetHits(tableReport, comment, tagNamesFilter);
153  continue;
154  }
155 
156  List<ArtifactData> artifactList = getFilteredArtifacts(type, tagNamesFilter);
157 
158  if (artifactList.isEmpty()) {
159  continue;
160  }
161 
162  /*
163  * TSK_ACCOUNT artifacts get grouped by their TSK_ACCOUNT_TYPE
164  * attribute, and then handed off to the standard method for writing
165  * tables.
166  */
167  if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
168  //Group account artifacts by their account type
169  ListMultimap<String, ArtifactData> groupedArtifacts = Multimaps.index(artifactList,
170  artifactData -> {
171  try {
172  return artifactData.getArtifact().getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE)).getValueString();
173  } catch (TskCoreException ex) {
174  logger.log(Level.SEVERE, "Unable to get value of TSK_ACCOUNT_TYPE attribute. Defaulting to \"unknown\"", ex);
175  return "unknown";
176  }
177  });
178  for (String accountTypeStr : groupedArtifacts.keySet()) {
179  /*
180  * If the report is a ReportHTML, the data type name
181  * eventualy makes it to useDataTypeIcon which expects but
182  * does not require a artifact name, so we make a synthetic
183  * compund name by appending a ":" and the account type.
184  */
185  String accountDisplayname = accountTypeStr;
186  if (accountTypeStr != null) {
187  try {
188  Account.Type acctType = Case.getCurrentCaseThrows().getSleuthkitCase().getCommunicationsManager().getAccountType(accountTypeStr);
189  if (acctType != null) {
190  accountDisplayname = acctType.getDisplayName();
191  }
192  } catch (TskCoreException | NoCurrentCaseException ex) {
193  logger.log(Level.SEVERE, "Unable to get display name for account type " + accountTypeStr, ex);
194  }
195  }
196 
197  final String compundDataTypeName = BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getDisplayName() + ": " + accountDisplayname;
198  writeTableForDataType(new ArrayList<>(groupedArtifacts.get(accountTypeStr)), type, compundDataTypeName, comment);
199  }
200  } else {
201  //all other artifact types are sent to writeTableForDataType directly
202  writeTableForDataType(artifactList, type, type.getDisplayName(), comment);
203  }
204  }
205  }
206 
217  private void writeTableForDataType(List<ArtifactData> artifactList, BlackboardArtifact.Type type, String tableName, String comment) {
218  /*
219  * Make a sorted set of all of the attribute types that are on any of
220  * the given artifacts.
221  */
222  Set<BlackboardAttribute.Type> attrTypeSet = new TreeSet<>(Comparator.comparing(BlackboardAttribute.Type::getDisplayName));
223  for (ArtifactData data : artifactList) {
224  List<BlackboardAttribute> attributes = data.getAttributes();
225  for (BlackboardAttribute attribute : attributes) {
226  attrTypeSet.add(attribute.getAttributeType());
227  }
228  }
229  /*
230  * Get the columns appropriate for the artifact type. This is used to
231  * get the data that will be in the cells below based on type, and
232  * display the column headers.
233  */
234  List<Column> columns = getArtifactTableColumns(type.getTypeID(), attrTypeSet);
235  if (columns.isEmpty()) {
236  return;
237  }
238  columnHeaderMap.put(type.getTypeID(), columns);
239 
240  /*
241  * The artifact list is sorted now, as getting the row data is dependent
242  * on having the columns, which is necessary for sorting.
243  */
244  Collections.sort(artifactList);
245 
246  tableReport.startDataType(tableName, comment);
247  tableReport.startTable(Lists.transform(columns, Column::getColumnHeader));
248 
249  for (ArtifactData artifactData : artifactList) {
250  // Get the row data for this artifact, and has the
251  // module add it.
252  List<String> rowData = artifactData.getRow();
253  if (rowData.isEmpty()) {
254  return;
255  }
256 
257  tableReport.addRow(rowData);
258  }
259  // Finish up this data type
260  progressPanel.increment();
261  tableReport.endTable();
262  tableReport.endDataType();
263  }
264 
268  @Messages({"ReportGenerator.tagTable.header.userName=User Name"})
269  @SuppressWarnings("deprecation")
270  private void makeContentTagsTables() {
271 
272  // Get the content tags.
273  List<ContentTag> tags;
274  try {
275  tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getAllContentTags();
276  } catch (TskCoreException | NoCurrentCaseException ex) {
277  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetContentTags"));
278  logger.log(Level.SEVERE, "failed to get content tags", ex); //NON-NLS
279  return;
280  }
281 
282  // Tell the modules reporting on content tags is beginning.
283  // @@@ This casting is a tricky little workaround to allow the HTML report module to slip in a content hyperlink.
284  // @@@ Alos Using the obsolete ARTIFACT_TYPE.TSK_TAG_FILE is also an expedient hack.
285  progressPanel.updateStatusLabel(
286  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
287  BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName()));
288  ArrayList<String> columnHeaders = new ArrayList<>(Arrays.asList(
289  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.tag"),
290  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.file"),
291  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.comment"),
292  NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.userName"),
293  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.timeModified"),
294  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.timeChanged"),
295  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.timeAccessed"),
296  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.timeCreated"),
297  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.size"),
298  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.hash")));
299 
300  StringBuilder comment = new StringBuilder();
301  if (!tagNamesFilter.isEmpty()) {
302  comment.append(
303  NbBundle.getMessage(this.getClass(), "ReportGenerator.makeContTagTab.taggedFiles.msg"));
304  comment.append(makeCommaSeparatedList(tagNamesFilter));
305  }
306  if (tableReport instanceof ReportHTML) {
307  ReportHTML htmlReportModule = (ReportHTML) tableReport;
308  htmlReportModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
309  htmlReportModule.startContentTagsTable(columnHeaders);
310  } else {
311  tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
312  tableReport.startTable(columnHeaders);
313  }
314 
315  // Give the modules the rows for the content tags.
316  for (ContentTag tag : tags) {
317  // skip tags that we are not reporting on
318  String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : "";
319  if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) == false) {
320  continue;
321  }
322 
323  String fileName;
324  try {
325  fileName = tag.getContent().getUniquePath();
326  } catch (TskCoreException ex) {
327  fileName = tag.getContent().getName();
328  }
329 
330  ArrayList<String> rowData = new ArrayList<>(Arrays.asList(tag.getName().getDisplayName() + notableString, fileName, tag.getComment(), tag.getUserName()));
331  Content content = tag.getContent();
332  if (content instanceof AbstractFile) {
333  AbstractFile file = (AbstractFile) content;
334 
335  // Add metadata about the file to HTML output
336  rowData.add(file.getMtimeAsDate());
337  rowData.add(file.getCtimeAsDate());
338  rowData.add(file.getAtimeAsDate());
339  rowData.add(file.getCrtimeAsDate());
340  rowData.add(Long.toString(file.getSize()));
341  rowData.add(file.getMd5Hash());
342  }
343  // @@@ This casting is a tricky little workaround to allow the HTML report module to slip in a content hyperlink.
344  if (tableReport instanceof ReportHTML) {
345  ReportHTML htmlReportModule = (ReportHTML) tableReport;
346  htmlReportModule.addRowWithTaggedContentHyperlink(rowData, tag);
347  } else {
348  tableReport.addRow(rowData);
349  }
350 
351  // see if it is for an image so that we later report on it
352  checkIfTagHasImage(tag);
353  }
354 
355  // The the modules content tags reporting is ended.
356  progressPanel.increment();
357  tableReport.endTable();
358  tableReport.endDataType();
359  }
360 
364  @SuppressWarnings("deprecation")
365  private void makeBlackboardArtifactTagsTables() {
366 
367  List<BlackboardArtifactTag> tags;
368  try {
369  tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getAllBlackboardArtifactTags();
370  } catch (TskCoreException | NoCurrentCaseException ex) {
371  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetBBArtifactTags"));
372  logger.log(Level.SEVERE, "failed to get blackboard artifact tags", ex); //NON-NLS
373  return;
374  }
375 
376  // Tell the modules reporting on blackboard artifact tags data type is beginning.
377  // @@@ Using the obsolete ARTIFACT_TYPE.TSK_TAG_ARTIFACT is an expedient hack.
378  progressPanel.updateStatusLabel(
379  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
380  BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName()));
381  StringBuilder comment = new StringBuilder();
382  if (!tagNamesFilter.isEmpty()) {
383  comment.append(
384  NbBundle.getMessage(this.getClass(), "ReportGenerator.makeBbArtTagTab.taggedRes.msg"));
385  comment.append(makeCommaSeparatedList(tagNamesFilter));
386  }
387  tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName(), comment.toString());
388  tableReport.startTable(new ArrayList<>(Arrays.asList(
389  NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.resultType"),
390  NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.tag"),
391  NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.comment"),
392  NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.srcFile"),
393  NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.userName"))));
394 
395  // Give the modules the rows for the content tags.
396  for (BlackboardArtifactTag tag : tags) {
397  String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : "";
398  if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) == false) {
399  continue;
400  }
401 
402  List<String> row;
403  row = new ArrayList<>(Arrays.asList(tag.getArtifact().getArtifactTypeName(), tag.getName().getDisplayName() + notableString,
404  tag.getComment(), tag.getContent().getName(), tag.getUserName()));
405  tableReport.addRow(row);
406 
407  // check if the tag is an image that we should later make a thumbnail for
408  checkIfTagHasImage(tag);
409  }
410 
411  // The the modules blackboard artifact tags reporting is ended.
412  progressPanel.increment();
413  tableReport.endTable();
414  tableReport.endDataType();
415  }
416 
424  private boolean passesTagNamesFilter(String tagName) {
425  return tagNamesFilter.isEmpty() || tagNamesFilter.contains(tagName);
426  }
427 
431  private void makeThumbnailTable() {
432  progressPanel.updateStatusLabel(
433  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.createdThumb.text"));
434 
435  if (tableReport instanceof ReportHTML) {
436  ReportHTML htmlModule = (ReportHTML) tableReport;
437  htmlModule.startDataType(
438  NbBundle.getMessage(this.getClass(), "ReportGenerator.thumbnailTable.name"),
439  NbBundle.getMessage(this.getClass(), "ReportGenerator.thumbnailTable.desc"));
440  List<String> emptyHeaders = new ArrayList<>();
441  for (int i = 0; i < ReportHTML.THUMBNAIL_COLUMNS; i++) {
442  emptyHeaders.add("");
443  }
444  htmlModule.startTable(emptyHeaders);
445 
446  htmlModule.addThumbnailRows(images);
447 
448  htmlModule.endTable();
449  htmlModule.endDataType();
450  }
451 
452  }
453 
460  private void checkIfTagHasImage(BlackboardArtifactTag artifactTag) {
461  AbstractFile file;
462  try {
463  file = Case.getCurrentCaseThrows().getSleuthkitCase().getAbstractFileById(artifactTag.getArtifact().getObjectID());
464  } catch (TskCoreException | NoCurrentCaseException ex) {
465  errorList.add(
466  NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.errGetContentFromBBArtifact"));
467  logger.log(Level.WARNING, "Error while getting content from a blackboard artifact to report on.", ex); //NON-NLS
468  return;
469  }
470 
471  if (file != null) {
472  checkIfFileIsImage(file);
473  }
474  }
475 
483  private void checkIfTagHasImage(ContentTag contentTag) {
484  Content c = contentTag.getContent();
485  if (c instanceof AbstractFile == false) {
486  return;
487  }
488  checkIfFileIsImage((AbstractFile) c);
489  }
490 
496  private void checkIfFileIsImage(AbstractFile file) {
497 
498  if (file.isDir()
499  || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS
500  || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS) {
501  return;
502  }
503 
504  if (ImageUtils.thumbnailSupported(file)) {
505  images.add(file);
506  }
507  }
508 
517  private String makeCommaSeparatedList(Collection<String> items) {
518  String list = "";
519  for (Iterator<String> iterator = items.iterator(); iterator.hasNext();) {
520  list += iterator.next() + (iterator.hasNext() ? ", " : "");
521  }
522  return list;
523  }
524 
530  @SuppressWarnings("deprecation")
531  @NbBundle.Messages ({"ReportGenerator.errList.noOpenCase=No open case available."})
532  private void writeKeywordHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
533 
534  // Query for keyword lists-only so that we can tell modules what lists
535  // will exist for their index.
536  // @@@ There is a bug in here. We should use the tags in the below code
537  // so that we only report the lists that we will later provide with real
538  // hits. If no keyord hits are tagged, then we make the page for nothing.
539  String orderByClause;
540  Case openCase;
541  try {
542  openCase = Case.getCurrentCaseThrows();
543  } catch (NoCurrentCaseException ex) {
544  errorList.add(Bundle.ReportGenerator_errList_noOpenCase());
545  logger.log(Level.SEVERE, "Exception while getting open case: ", ex); //NON-NLS
546  return;
547  }
548 
549  // Get a list of all selected tag IDs
550  String tagIDList = "";
551  if( ! tagNamesFilter.isEmpty()) {
552  try {
553  Map<String, TagName> tagNamesMap = Case.getCurrentCaseThrows().getServices().getTagsManager().getDisplayNamesToTagNamesMap();
554  for(String tagDisplayName : tagNamesFilter) {
555  if(tagNamesMap.containsKey(tagDisplayName)) {
556  if (! tagIDList.isEmpty()) {
557  tagIDList += ",";
558  }
559  tagIDList += tagNamesMap.get(tagDisplayName).getId();
560  } else {
561  // If the tag name ends with "(Notable)", try stripping that off
562  if(tagDisplayName.endsWith(getNotableTagLabel())) {
563  String editedDisplayName = tagDisplayName.substring(0, tagDisplayName.length() - getNotableTagLabel().length());
564  if(tagNamesMap.containsKey(editedDisplayName)) {
565  if (! tagIDList.isEmpty()) {
566  tagIDList += ",";
567  }
568  tagIDList += tagNamesMap.get(editedDisplayName).getId();
569  }
570  }
571  }
572  }
573  } catch (NoCurrentCaseException | TskCoreException ex) {
574  logger.log(Level.SEVERE, "Exception while getting tag info - proceeding without tag filter: ", ex); //NON-NLS
575  tagIDList = "";
576  }
577  }
578 
579  // Check if there are any ad-hoc results
580  String adHocCountQuery = "SELECT COUNT(*) FROM " + //NON-NLS
581  "(SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 ";//NON-NLS
582  if (!tagIDList.isEmpty()) {
583  adHocCountQuery += ", blackboard_artifact_tags as tag "; //NON-NLS
584  }
585  adHocCountQuery += "WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() + ") "; // NON-NLS
586  if (!tagIDList.isEmpty()) {
587  adHocCountQuery += " AND (art.artifact_id = tag.artifact_id) AND (tag.tag_name_id IN (" + tagIDList + ")) "; //NON-NLS
588  }
589  adHocCountQuery += "EXCEPT " + // NON-NLS
590  "SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() + ") AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + ")) AS adHocHits"; //NON-NLS
591 
592  int adHocCount = 0;
593  try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(adHocCountQuery)) {
594  ResultSet adHocCountResultSet = dbQuery.getResultSet();
595  if (adHocCountResultSet.next()) {
596  adHocCount = adHocCountResultSet.getInt(1); //NON-NLS
597  } else {
598  throw new TskCoreException("Error counting ad hoc keywords");
599  }
600  } catch (TskCoreException | SQLException ex) {
601  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryKWLists"));
602  logger.log(Level.SEVERE, "Failed to count ad hoc searches with query " + adHocCountQuery, ex); //NON-NLS
603  return;
604  }
605 
606  // Create the query to get the keyword list names
607  if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
608  orderByClause = "ORDER BY convert_to(list, 'SQL_ASCII') ASC NULLS FIRST"; //NON-NLS
609  } else {
610  orderByClause = "ORDER BY list ASC"; //NON-NLS
611  }
612  String keywordListQuery
613  = "SELECT att.value_text AS list "
614  + //NON-NLS
615  "FROM blackboard_attributes AS att, blackboard_artifacts AS art "; // NON-NLS
616  if(! tagIDList.isEmpty()) {
617  keywordListQuery += ", blackboard_artifact_tags as tag "; //NON-NLS
618  }
619  keywordListQuery += "WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + " "
620  + //NON-NLS
621  "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() + " "
622  + //NON-NLS
623  "AND att.artifact_id = art.artifact_id ";
624  if (! tagIDList.isEmpty()) {
625  keywordListQuery += "AND (art.artifact_id = tag.artifact_id) " + //NON-NLS
626  "AND (tag.tag_name_id IN (" + tagIDList + ")) "; //NON-NLS
627  }
628  if (adHocCount > 0) {
629  keywordListQuery += " UNION SELECT \'\' AS list ";
630  }
631  keywordListQuery = "SELECT * FROM ( " + keywordListQuery + " ) kwListNames ";
632  keywordListQuery += "GROUP BY list " + orderByClause; //NON-NLS
633 
634  // Make the table of contents links for each list type
635  try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(keywordListQuery)) {
636  ResultSet listsRs = dbQuery.getResultSet();
637  List<String> lists = new ArrayList<>();
638  while (listsRs.next()) {
639  String list = listsRs.getString("list"); //NON-NLS
640  if (list.isEmpty()) {
641  list = NbBundle.getMessage(this.getClass(), "ReportGenerator.writeKwHits.userSrchs");
642  }
643  lists.add(list);
644  }
645 
646  // Make keyword data type and give them set index
647  tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), comment);
648  tableModule.addSetIndex(lists);
649  progressPanel.updateStatusLabel(
650  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
651  BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName()));
652  } catch (TskCoreException | SQLException ex) {
653  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryKWLists"));
654  logger.log(Level.SEVERE, "Failed to query keyword lists with query " + keywordListQuery, ex); //NON-NLS
655  return;
656  }
657 
658  // Query for keywords, grouped by list
659  if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
660  orderByClause = "ORDER BY convert_to(list, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
661  + "convert_to(keyword, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
662  + "convert_to(parent_path, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
663  + "convert_to(name, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
664  + "convert_to(preview, 'SQL_ASCII') ASC NULLS FIRST"; //NON-NLS
665  } else {
666  orderByClause = "ORDER BY list ASC, keyword ASC, parent_path ASC, name ASC, preview ASC"; //NON-NLS
667  }
668 
669  // Query for keywords that are part of a list
670  String keywordListsQuery
671  = "SELECT art.artifact_id AS artifact_id, art.obj_id AS obj_id, att1.value_text AS keyword, att2.value_text AS preview, att3.value_text AS list, f.name AS name, f.parent_path AS parent_path "
672  + //NON-NLS
673  "FROM blackboard_artifacts AS art, blackboard_attributes AS att1, blackboard_attributes AS att2, blackboard_attributes AS att3, tsk_files AS f "
674  + //NON-NLS
675  "WHERE (att1.artifact_id = art.artifact_id) "
676  + //NON-NLS
677  "AND (att2.artifact_id = art.artifact_id) "
678  + //NON-NLS
679  "AND (att3.artifact_id = art.artifact_id) "
680  + //NON-NLS
681  "AND (f.obj_id = art.obj_id) "
682  + //NON-NLS
683  "AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID() + ") "
684  + //NON-NLS
685  "AND (att2.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID() + ") "
686  + //NON-NLS
687  "AND (att3.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + ") "
688  + //NON-NLS
689  "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() + ") ";
690 
691  // Query for keywords that are not part of a list
692  String keywordAdHocQuery =
693  "SELECT art.artifact_id AS artifact_id, art.obj_id AS obj_id, att1.value_text AS keyword, att2.value_text AS preview, \'\' AS list, f.name AS name, f.parent_path AS parent_path " + // NON-NLS
694  "FROM blackboard_artifacts AS art, blackboard_attributes AS att1, blackboard_attributes AS att2, tsk_files AS f " + // NON-NLS
695  "WHERE " + // NON-NLS
696  " (art.artifact_id IN (SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() + ") " + // NON-NLS
697  "EXCEPT " + // NON-NLS
698  "SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() + ") AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + "))) " + //NON-NLS
699  "AND (att1.artifact_id = art.artifact_id) " + //NON-NLS
700  "AND (att2.artifact_id = art.artifact_id) " + //NON-NLS
701  "AND (f.obj_id = art.obj_id) " + //NON-NLS
702  "AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID() + ") " + // NON-NLS
703  "AND (att2.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID() + ") " + // NON-NLS
704  "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() + ") "; // NON-NLS
705 
706  String keywordsQuery = "SELECT * FROM ( " + keywordListsQuery + " UNION " + keywordAdHocQuery + " ) kwHits " + orderByClause;
707 
708  try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(keywordsQuery)) {
709  ResultSet resultSet = dbQuery.getResultSet();
710 
711  String currentKeyword = "";
712  String currentList = "";
713  while (resultSet.next()) {
714  // Check to see if all the TableReportModules have been canceled
715  if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
716  break;
717  }
718 
719  // Get any tags that associated with this artifact and apply the tag filter.
720  HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong("artifact_id")); //NON-NLS
721  if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
722  continue;
723  }
724  String tagsList = makeCommaSeparatedList(uniqueTagNames);
725 
726  Long objId = resultSet.getLong("obj_id"); //NON-NLS
727  String keyword = resultSet.getString("keyword"); //NON-NLS
728  String preview = resultSet.getString("preview"); //NON-NLS
729  String list = resultSet.getString("list"); //NON-NLS
730  String uniquePath = "";
731 
732  try {
733  AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
734  if (f != null) {
735  uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
736  }
737  } catch (TskCoreException ex) {
738  errorList.add(
739  NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileByID"));
740  logger.log(Level.WARNING, "Failed to get Abstract File by ID.", ex); //NON-NLS
741  }
742 
743  // If the lists aren't the same, we've started a new list
744  if ((!list.equals(currentList) && !list.isEmpty()) || (list.isEmpty() && !currentList.equals(
745  NbBundle.getMessage(this.getClass(), "ReportGenerator.writeKwHits.userSrchs")))) {
746  if (!currentList.isEmpty()) {
747  tableModule.endTable();
748  tableModule.endSet();
749  }
750  currentList = list.isEmpty() ? NbBundle
751  .getMessage(this.getClass(), "ReportGenerator.writeKwHits.userSrchs") : list;
752  currentKeyword = ""; // reset the current keyword because it's a new list
753  tableModule.startSet(currentList);
754  progressPanel.updateStatusLabel(
755  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processingList",
756  BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), currentList));
757  }
758  if (!keyword.equals(currentKeyword)) {
759  if (!currentKeyword.equals("")) {
760  tableModule.endTable();
761  }
762  currentKeyword = keyword;
763  tableModule.addSetElement(currentKeyword);
764  List<String> columnHeaderNames = new ArrayList<>();
765  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.preview"));
766  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.srcFile"));
767  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags"));
768  tableModule.startTable(columnHeaderNames);
769  }
770 
771  tableModule.addRow(Arrays.asList(new String[]{preview, uniquePath, tagsList}));
772  }
773 
774  // Finish the current data type
775  progressPanel.increment();
776  tableModule.endDataType();
777  } catch (TskCoreException | SQLException ex) {
778  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryKWs"));
779  logger.log(Level.SEVERE, "Failed to query keywords with query " + keywordsQuery, ex); //NON-NLS
780  }
781  }
782 
788  @SuppressWarnings("deprecation")
789  private void writeHashsetHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
790  String orderByClause;
791  Case openCase;
792  try {
793  openCase = Case.getCurrentCaseThrows();
794  } catch (NoCurrentCaseException ex) {
795  errorList.add(Bundle.ReportGenerator_errList_noOpenCase());
796  logger.log(Level.SEVERE, "Exception while getting open case: ", ex); //NON-NLS
797  return;
798  }
799  if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
800  orderByClause = "ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST"; //NON-NLS
801  } else {
802  orderByClause = "ORDER BY att.value_text ASC"; //NON-NLS
803  }
804  String hashsetsQuery
805  = "SELECT att.value_text AS list "
806  + //NON-NLS
807  "FROM blackboard_attributes AS att, blackboard_artifacts AS art "
808  + //NON-NLS
809  "WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + " "
810  + //NON-NLS
811  "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() + " "
812  + //NON-NLS
813  "AND att.artifact_id = art.artifact_id "
814  + //NON-NLS
815  "GROUP BY list " + orderByClause; //NON-NLS
816 
817  try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(hashsetsQuery)) {
818  // Query for hashsets
819  ResultSet listsRs = dbQuery.getResultSet();
820  List<String> lists = new ArrayList<>();
821  while (listsRs.next()) {
822  lists.add(listsRs.getString("list")); //NON-NLS
823  }
824 
825  tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), comment);
826  tableModule.addSetIndex(lists);
827  progressPanel.updateStatusLabel(
828  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
829  BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName()));
830  } catch (TskCoreException | SQLException ex) {
831  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryHashsetLists"));
832  logger.log(Level.SEVERE, "Failed to query hashset lists: ", ex); //NON-NLS
833  return;
834  }
835 
836  if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
837  orderByClause = "ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
838  + "convert_to(f.parent_path, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
839  + "convert_to(f.name, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
840  + "size ASC NULLS FIRST"; //NON-NLS
841  } else {
842  orderByClause = "ORDER BY att.value_text ASC, f.parent_path ASC, f.name ASC, size ASC"; //NON-NLS
843  }
844  String hashsetHitsQuery
845  = "SELECT art.artifact_id, art.obj_id, att.value_text AS setname, f.name AS name, f.size AS size, f.parent_path AS parent_path "
846  + //NON-NLS
847  "FROM blackboard_artifacts AS art, blackboard_attributes AS att, tsk_files AS f "
848  + //NON-NLS
849  "WHERE (att.artifact_id = art.artifact_id) "
850  + //NON-NLS
851  "AND (f.obj_id = art.obj_id) "
852  + //NON-NLS
853  "AND (att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + ") "
854  + //NON-NLS
855  "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() + ") "
856  + //NON-NLS
857  orderByClause; //NON-NLS
858 
859  try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(hashsetHitsQuery)) {
860  // Query for hashset hits
861  ResultSet resultSet = dbQuery.getResultSet();
862  String currentSet = "";
863  while (resultSet.next()) {
864  // Check to see if all the TableReportModules have been canceled
865  if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
866  break;
867  }
868 
869  // Get any tags that associated with this artifact and apply the tag filter.
870  HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong("artifact_id")); //NON-NLS
871  if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
872  continue;
873  }
874  String tagsList = makeCommaSeparatedList(uniqueTagNames);
875 
876  Long objId = resultSet.getLong("obj_id"); //NON-NLS
877  String set = resultSet.getString("setname"); //NON-NLS
878  String size = resultSet.getString("size"); //NON-NLS
879  String uniquePath = "";
880 
881  try {
882  AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
883  if (f != null) {
884  uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
885  }
886  } catch (TskCoreException ex) {
887  errorList.add(
888  NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileFromID"));
889  logger.log(Level.WARNING, "Failed to get Abstract File from ID.", ex); //NON-NLS
890  return;
891  }
892 
893  // If the sets aren't the same, we've started a new set
894  if (!set.equals(currentSet)) {
895  if (!currentSet.isEmpty()) {
896  tableModule.endTable();
897  tableModule.endSet();
898  }
899  currentSet = set;
900  tableModule.startSet(currentSet);
901  List<String> columnHeaderNames = new ArrayList<>();
902  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.file"));
903  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.size"));
904  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags"));
905  tableModule.startTable(columnHeaderNames);
906  progressPanel.updateStatusLabel(
907  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processingList",
908  BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), currentSet));
909  }
910 
911  // Add a row for this hit to every module
912  tableModule.addRow(Arrays.asList(new String[]{uniquePath, size, tagsList}));
913  }
914 
915  // Finish the current data type
916  progressPanel.increment();
917  tableModule.endDataType();
918  } catch (TskCoreException | SQLException ex) {
919  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryHashsetHits"));
920  logger.log(Level.SEVERE, "Failed to query hashsets hits: ", ex); //NON-NLS
921  }
922  }
923 
927  List<String> getErrorList() {
928  return errorList;
929  }
930 
935  private class ArtifactData implements Comparable<ArtifactData> {
936 
937  private BlackboardArtifact artifact;
938  private List<BlackboardAttribute> attributes;
939  private HashSet<String> tags;
940  private List<String> rowData = null;
941  private Content content;
942 
943  ArtifactData(BlackboardArtifact artifact, List<BlackboardAttribute> attrs, HashSet<String> tags) {
944  this.artifact = artifact;
945  this.attributes = attrs;
946  this.tags = tags;
947  try {
948  this.content = Case.getCurrentCaseThrows().getSleuthkitCase().getContentById(artifact.getObjectID());
949  } catch (TskCoreException | NoCurrentCaseException ex) {
950  logger.log(Level.SEVERE, "Could not get content from database", ex);
951  }
952  }
953 
954  public BlackboardArtifact getArtifact() {
955  return artifact;
956  }
957 
958  public List<BlackboardAttribute> getAttributes() {
959  return attributes;
960  }
961 
962  public HashSet<String> getTags() {
963  return tags;
964  }
965 
966  public long getArtifactID() {
967  return artifact.getArtifactID();
968  }
969 
970  public long getObjectID() {
971  return artifact.getObjectID();
972  }
973 
977  public Content getContent() {
978  return content;
979  }
980 
990  @Override
991  public int compareTo(ArtifactData otherArtifactData) {
992  List<String> thisRow = getRow();
993  List<String> otherRow = otherArtifactData.getRow();
994  for (int i = 0; i < thisRow.size(); i++) {
995  int compare = thisRow.get(i).compareTo(otherRow.get(i));
996  if (compare != 0) {
997  return compare;
998  }
999  }
1000  return ((Long) this.getArtifactID()).compareTo(otherArtifactData.getArtifactID());
1001  }
1002 
1010  public List<String> getRow() {
1011  if (rowData == null) {
1012  try {
1013  rowData = getOrderedRowDataAsStrings();
1014  // If else is done so that row data is not set before
1015  // columns are added to the hash map.
1016  if (rowData.size() > 0) {
1017  // replace null values if attribute was not defined
1018  for (int i = 0; i < rowData.size(); i++) {
1019  if (rowData.get(i) == null) {
1020  rowData.set(i, "");
1021  }
1022  }
1023  } else {
1024  rowData = null;
1025  return new ArrayList<>();
1026  }
1027  } catch (TskCoreException ex) {
1028  errorList.add(
1029  NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.coreExceptionWhileGenRptRow"));
1030  logger.log(Level.WARNING, "Core exception while generating row data for artifact report.", ex); //NON-NLS
1031  rowData = Collections.<String>emptyList();
1032  }
1033  }
1034  return rowData;
1035  }
1036 
1046  private List<String> getOrderedRowDataAsStrings() throws TskCoreException {
1047 
1048  List<String> orderedRowData = new ArrayList<>();
1049  if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() == getArtifact().getArtifactTypeID()) {
1050  if (content != null && content instanceof AbstractFile) {
1051  AbstractFile file = (AbstractFile) content;
1052  orderedRowData.add(file.getName());
1053  orderedRowData.add(file.getNameExtension());
1054  String mimeType = file.getMIMEType();
1055  if (mimeType == null) {
1056  orderedRowData.add("");
1057  } else {
1058  orderedRowData.add(mimeType);
1059  }
1060  orderedRowData.add(file.getUniquePath());
1061  } else {
1062  // Make empty rows to make sure the formatting is correct
1063  orderedRowData.add(null);
1064  orderedRowData.add(null);
1065  orderedRowData.add(null);
1066  orderedRowData.add(null);
1067  }
1068  orderedRowData.add(makeCommaSeparatedList(getTags()));
1069 
1070  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == getArtifact().getArtifactTypeID()) {
1071  String[] attributeDataArray = new String[5];
1072  // Array is used so that order of the attributes is maintained.
1073  for (BlackboardAttribute attr : attributes) {
1074  if (attr.getAttributeType().equals(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME))) {
1075  attributeDataArray[0] = attr.getDisplayString();
1076  } else if (attr.getAttributeType().equals(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY))) {
1077  attributeDataArray[1] = attr.getDisplayString();
1078  } else if (attr.getAttributeType().equals(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT))) {
1079  attributeDataArray[3] = attr.getDisplayString();
1080  } else if (attr.getAttributeType().equals(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION))) {
1081  attributeDataArray[4] = attr.getDisplayString();
1082  }
1083  }
1084 
1085  attributeDataArray[2] = content.getUniquePath();
1086  orderedRowData.addAll(Arrays.asList(attributeDataArray));
1087 
1088  HashSet<String> allTags = getTags();
1089  try {
1090  List<ContentTag> contentTags = Case.getCurrentCaseThrows().getServices().getTagsManager().getContentTagsByContent(content);
1091  for (ContentTag ct : contentTags) {
1092  String notableString = ct.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : "";
1093  allTags.add(ct.getName().getDisplayName() + notableString);
1094  }
1095  } catch (TskCoreException | NoCurrentCaseException ex) {
1096  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetContentTags"));
1097  logger.log(Level.SEVERE, "Failed to get content tags", ex); //NON-NLS
1098  }
1099  orderedRowData.add(makeCommaSeparatedList(allTags));
1100 
1101  } else if (columnHeaderMap.containsKey(this.artifact.getArtifactTypeID())) {
1102 
1103  for (Column currColumn : columnHeaderMap.get(this.artifact.getArtifactTypeID())) {
1104  String cellData = currColumn.getCellData(this);
1105  orderedRowData.add(cellData);
1106  }
1107  }
1108 
1109  return orderedRowData;
1110  }
1111 
1112  }
1113 
1123  private List<ArtifactData> getFilteredArtifacts(BlackboardArtifact.Type type, HashSet<String> tagNamesFilter) {
1124  List<ArtifactData> artifacts = new ArrayList<>();
1125  try {
1126  for (BlackboardArtifact artifact : Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboardArtifacts(type.getTypeID())) {
1127  List<BlackboardArtifactTag> tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getBlackboardArtifactTagsByArtifact(artifact);
1128  HashSet<String> uniqueTagNames = new HashSet<>();
1129  for (BlackboardArtifactTag tag : tags) {
1130  String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : "";
1131  uniqueTagNames.add(tag.getName().getDisplayName() + notableString);
1132  }
1133  if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
1134  continue;
1135  }
1136  try {
1137  artifacts.add(new ArtifactData(artifact, Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboardAttributes(artifact), uniqueTagNames));
1138  } catch (TskCoreException ex) {
1139  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetBBAttribs"));
1140  logger.log(Level.SEVERE, "Failed to get Blackboard Attributes when generating report.", ex); //NON-NLS
1141  }
1142  }
1143  } catch (TskCoreException | NoCurrentCaseException ex) {
1144  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetBBArtifacts"));
1145  logger.log(Level.SEVERE, "Failed to get Blackboard Artifacts when generating report.", ex); //NON-NLS
1146  }
1147  return artifacts;
1148  }
1149 
1150  private Boolean failsTagFilter(HashSet<String> tagNames, HashSet<String> tagsNamesFilter) {
1151  if (null == tagsNamesFilter || tagsNamesFilter.isEmpty()) {
1152  return false;
1153  }
1154 
1155  HashSet<String> filteredTagNames = new HashSet<>(tagNames);
1156  filteredTagNames.retainAll(tagsNamesFilter);
1157  return filteredTagNames.isEmpty();
1158  }
1159 
1170  @Messages({"ReportGenerator.artTableColHdr.comment=Comment"})
1171  private List<Column> getArtifactTableColumns(int artifactTypeId, Set<BlackboardAttribute.Type> attributeTypeSet) {
1172  ArrayList<Column> columns = new ArrayList<>();
1173 
1174  // Long switch statement to retain ordering of attribute types that are
1175  // attached to pre-defined artifact types.
1176  if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID() == artifactTypeId) {
1177  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.url"),
1178  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1179 
1180  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.title"),
1181  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1182 
1183  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateCreated"),
1184  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1185 
1186  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1187  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1188 
1189  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID() == artifactTypeId) {
1190  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.url"),
1191  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1192 
1193  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1194  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1195 
1196  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1197  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1198 
1199  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.value"),
1200  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE)));
1201 
1202  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1203  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1204 
1205  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID() == artifactTypeId) {
1206  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.url"),
1207  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1208 
1209  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateAccessed"),
1210  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1211 
1212  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.referrer"),
1213  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REFERRER)));
1214 
1215  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.title"),
1216  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1217 
1218  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1219  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1220 
1221  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.urlDomainDecoded"),
1222  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL_DECODED)));
1223 
1224  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifactTypeId) {
1225  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dest"),
1226  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1227 
1228  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.sourceUrl"),
1229  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1230 
1231  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateAccessed"),
1232  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1233 
1234  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1235  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1236 
1237  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == artifactTypeId) {
1238  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.path"),
1239  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1240 
1241  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1242  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1243 
1244  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID() == artifactTypeId) {
1245  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.progName"),
1246  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1247 
1248  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.instDateTime"),
1249  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1250 
1251  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() == artifactTypeId) {
1252  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.preview")));
1253 
1254  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() == artifactTypeId) {
1255  columns.add(new SourceFileColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.file")));
1256 
1257  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.size")));
1258 
1259  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID() == artifactTypeId) {
1260  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.devMake"),
1261  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1262 
1263  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.devModel"),
1264  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1265 
1266  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.deviceId"),
1267  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1268 
1269  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1270  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1271 
1272  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID() == artifactTypeId) {
1273  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.text"),
1274  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1275 
1276  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.domain"),
1277  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)));
1278 
1279  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateAccessed"),
1280  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1281 
1282  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.progName"),
1283  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1284 
1285  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID() == artifactTypeId) {
1286  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTaken"),
1287  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1288 
1289  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.devManufacturer"),
1290  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1291 
1292  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.devModel"),
1293  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1294 
1295  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitude"),
1296  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1297 
1298  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitude"),
1299  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1300 
1301  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.altitude"),
1302  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1303 
1304  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID() == artifactTypeId) {
1305  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.personName"),
1306  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1307 
1308  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.phoneNumber"),
1309  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1310 
1311  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.phoneNumHome"),
1312  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_HOME)));
1313 
1314  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.phoneNumOffice"),
1315  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_OFFICE)));
1316 
1317  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.phoneNumMobile"),
1318  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_MOBILE)));
1319 
1320  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.email"),
1321  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL)));
1322 
1323  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() == artifactTypeId) {
1324  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.msgType"),
1325  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)));
1326 
1327  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.direction"),
1328  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1329 
1330  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.readStatus"),
1331  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_READ_STATUS)));
1332 
1333  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1334  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1335 
1336  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.fromPhoneNum"),
1337  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1338 
1339  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.fromEmail"),
1340  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1341 
1342  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.toPhoneNum"),
1343  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1344 
1345  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.toEmail"),
1346  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1347 
1348  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.subject"),
1349  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1350 
1351  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.text"),
1352  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1353 
1354  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID() == artifactTypeId) {
1355  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.personName"),
1356  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1357 
1358  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.fromPhoneNum"),
1359  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1360 
1361  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.toPhoneNum"),
1362  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1363 
1364  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1365  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1366 
1367  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.direction"),
1368  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1369 
1370  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID() == artifactTypeId) {
1371  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.calendarEntryType"),
1372  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CALENDAR_ENTRY_TYPE)));
1373 
1374  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.description"),
1375  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1376 
1377  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.startDateTime"),
1378  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1379 
1380  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.endDateTime"),
1381  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_END)));
1382 
1383  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.location"),
1384  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1385 
1386  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID() == artifactTypeId) {
1387  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.shortCut"),
1388  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SHORTCUT)));
1389 
1390  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.personName"),
1391  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME_PERSON)));
1392 
1393  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.phoneNumber"),
1394  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1395 
1396  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID() == artifactTypeId) {
1397  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.deviceName"),
1398  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_NAME)));
1399 
1400  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.deviceAddress"),
1401  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1402 
1403  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1404  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1405 
1406  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID() == artifactTypeId) {
1407  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitude"),
1408  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1409 
1410  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitude"),
1411  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1412 
1413  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1414  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1415 
1416  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID() == artifactTypeId) {
1417  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitude"),
1418  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1419 
1420  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitude"),
1421  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1422 
1423  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.altitude"),
1424  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1425 
1426  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1427  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1428 
1429  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.locationAddress"),
1430  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1431 
1432  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1433  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1434 
1435  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID() == artifactTypeId) {
1436  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitude"),
1437  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1438 
1439  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitude"),
1440  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1441 
1442  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.altitude"),
1443  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1444 
1445  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1446  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1447 
1448  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.locationAddress"),
1449  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1450 
1451  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1452  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1453 
1454  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID() == artifactTypeId) {
1455  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitude"),
1456  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1457 
1458  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitude"),
1459  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1460 
1461  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.altitude"),
1462  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1463 
1464  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1465  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1466 
1467  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.locationAddress"),
1468  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1469 
1470  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1471  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1472 
1473  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID() == artifactTypeId) {
1474  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.category"),
1475  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1476 
1477  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.userId"),
1478  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1479 
1480  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.password"),
1481  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PASSWORD)));
1482 
1483  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.personName"),
1484  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1485 
1486  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.appName"),
1487  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1488 
1489  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.url"),
1490  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1491 
1492  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.appPath"),
1493  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1494 
1495  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.description"),
1496  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1497 
1498  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.replytoAddress"),
1499  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_REPLYTO)));
1500 
1501  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.mailServer"),
1502  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SERVER_NAME)));
1503 
1504  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID() == artifactTypeId ||
1505  BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID() == artifactTypeId) {
1506  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1507  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1508 
1509  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() == artifactTypeId) {
1510  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.file")));
1511 
1512  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.extension.text")));
1513 
1514  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.mimeType.text")));
1515 
1516  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.path")));
1517 
1518  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID() == artifactTypeId) {
1519  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.processorArchitecture.text"),
1520  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROCESSOR_ARCHITECTURE)));
1521 
1522  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.osName.text"),
1523  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1524 
1525  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.osInstallDate.text"),
1526  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1527 
1528  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == artifactTypeId) {
1529  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskEmailTo"),
1530  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1531 
1532  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskEmailFrom"),
1533  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1534 
1535  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskSubject"),
1536  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1537 
1538  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskDateTimeSent"),
1539  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)));
1540 
1541  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskDateTimeRcvd"),
1542  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_RCVD)));
1543 
1544  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskPath"),
1545  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1546 
1547  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskEmailCc"),
1548  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_CC)));
1549 
1550  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskEmailBcc"),
1551  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_BCC)));
1552 
1553  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskMsgId"),
1554  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MSG_ID)));
1555 
1556  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == artifactTypeId) {
1557  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskSetName"),
1558  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1559 
1560  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskInterestingFilesCategory"),
1561  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1562 
1563  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskPath"),
1564  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1565 
1566  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.comment"),
1567  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT)));
1568 
1569  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.description"),
1570  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1571 
1572  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_ROUTE.getTypeID() == artifactTypeId) {
1573  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskGpsRouteCategory"),
1574  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1575 
1576  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1577  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1578 
1579  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitudeEnd"),
1580  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END)));
1581 
1582  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitudeEnd"),
1583  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END)));
1584 
1585  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitudeStart"),
1586  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START)));
1587 
1588  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitudeStart"),
1589  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START)));
1590 
1591  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1592  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1593 
1594  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.location"),
1595  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1596 
1597  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1598  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1599 
1600  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == artifactTypeId) {
1601  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskSetName"),
1602  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1603 
1604  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.associatedArtifact"),
1605  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1606 
1607  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1608  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1609 
1610  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == artifactTypeId) {
1611  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1612  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1613 
1614  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.associatedArtifact"),
1615  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1616 
1617  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1618  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1619 
1620  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.count"),
1621  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COUNT)));
1622 
1623  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_ACCOUNT.getTypeID() == artifactTypeId) {
1624  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.userName"),
1625  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME)));
1626 
1627  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.userId"),
1628  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1629 
1630  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_REMOTE_DRIVE.getTypeID() == artifactTypeId) {
1631  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.localPath"),
1632  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCAL_PATH)));
1633 
1634  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.remotePath"),
1635  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REMOTE_PATH)));
1636  } else if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
1637  columns.add(new StatusColumn());
1638  attributeTypeSet.remove(new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE));
1639  attributeTypeSet.remove(new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
1640  attributeTypeSet.remove(new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME));
1641  attributeTypeSet.remove(new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_SEARCH_DOCUMENT_ID));
1642  } else {
1643  // This is the case that it is a custom type. The reason an else is
1644  // necessary is to make sure that the source file column is added
1645  for (BlackboardAttribute.Type type : attributeTypeSet) {
1646  columns.add(new AttributeColumn(type.getDisplayName(), type));
1647  }
1648  columns.add(new SourceFileColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.srcFile")));
1649  columns.add(new TaggedResultsColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags")));
1650 
1651  // Short circuits to guarantee that the attribute types aren't added
1652  // twice.
1653  return columns;
1654  }
1655  // If it is an attribute column, it removes the attribute type of that
1656  // column from the set, so types are not reported more than once.
1657  for (Column column : columns) {
1658  attributeTypeSet = column.removeTypeFromSet(attributeTypeSet);
1659  }
1660  // Now uses the remaining types in the set to construct columns
1661  for (BlackboardAttribute.Type type : attributeTypeSet) {
1662  columns.add(new AttributeColumn(type.getDisplayName(), type));
1663  }
1664  // Source file column is added here for ordering purposes.
1665  if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()
1666  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()
1667  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()
1668  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()
1669  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()
1670  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()
1671  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()
1672  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID()
1673  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID()
1674  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID()
1675  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()
1676  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID()
1677  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID()
1678  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID()
1679  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID()
1680  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID()
1681  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID()
1682  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID()
1683  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID()
1684  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID()
1685  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID()
1686  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID()
1687  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID()) {
1688  columns.add(new SourceFileColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.srcFile")));
1689  }
1690  columns.add(new TaggedResultsColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags")));
1691 
1692  return columns;
1693  }
1694 
1702  private String getFileUniquePath(Content content) {
1703  try {
1704  if (content != null) {
1705  return content.getUniquePath();
1706  } else {
1707  return "";
1708  }
1709  } catch (TskCoreException ex) {
1710  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileByID"));
1711  logger.log(Level.WARNING, "Failed to get Abstract File by ID.", ex); //NON-NLS
1712  }
1713  return "";
1714 
1715  }
1716 
1726  @SuppressWarnings("deprecation")
1727  private HashSet<String> getUniqueTagNames(long artifactId) throws TskCoreException {
1728  HashSet<String> uniqueTagNames = new HashSet<>();
1729 
1730  String query = "SELECT display_name, artifact_id, knownStatus FROM tag_names AS tn, blackboard_artifact_tags AS bat "
1731  + //NON-NLS
1732  "WHERE tn.tag_name_id = bat.tag_name_id AND bat.artifact_id = " + artifactId; //NON-NLS
1733 
1734  try (SleuthkitCase.CaseDbQuery dbQuery = Case.getCurrentCaseThrows().getSleuthkitCase().executeQuery(query)) {
1735  ResultSet tagNameRows = dbQuery.getResultSet();
1736  while (tagNameRows.next()) {
1737  String notableString = tagNameRows.getInt("knownStatus") == TskData.FileKnown.BAD.ordinal() ? getNotableTagLabel() : "";
1738  uniqueTagNames.add(tagNameRows.getString("display_name") + notableString); //NON-NLS
1739  }
1740  } catch (TskCoreException | SQLException | NoCurrentCaseException ex) {
1741  throw new TskCoreException("Error getting tag names for artifact: ", ex);
1742  }
1743 
1744  return uniqueTagNames;
1745 
1746  }
1747 
1748  private interface Column {
1749 
1750  String getColumnHeader();
1751 
1752  String getCellData(ArtifactData artData);
1753 
1754  Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types);
1755  }
1756 
1757  private class StatusColumn implements Column {
1758 
1759  @NbBundle.Messages("TableReportGenerator.StatusColumn.Header=Review Status")
1760  @Override
1761  public String getColumnHeader() {
1762  return Bundle.TableReportGenerator_StatusColumn_Header();
1763  }
1764 
1765  @Override
1766  public String getCellData(ArtifactData artData) {
1767  return artData.getArtifact().getReviewStatus().getDisplayName();
1768  }
1769 
1770  @Override
1771  public Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types) {
1772  // This column doesn't have a type, so nothing to remove
1773  return types;
1774  }
1775 
1776  }
1777 
1778  private class AttributeColumn implements Column {
1779 
1780  private final String columnHeader;
1781  private final BlackboardAttribute.Type attributeType;
1782 
1789  AttributeColumn(String columnHeader, BlackboardAttribute.Type attributeType) {
1790  this.columnHeader = Objects.requireNonNull(columnHeader);
1791  this.attributeType = attributeType;
1792  }
1793 
1794  @Override
1795  public String getColumnHeader() {
1796  return this.columnHeader;
1797  }
1798 
1799  @Override
1800  public String getCellData(ArtifactData artData) {
1801  List<BlackboardAttribute> attributes = artData.getAttributes();
1802  for (BlackboardAttribute attribute : attributes) {
1803  if (attribute.getAttributeType().equals(this.attributeType)) {
1804  if (attribute.getAttributeType().getValueType() != BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
1805  return attribute.getDisplayString();
1806  } else {
1807  return ContentUtils.getStringTime(attribute.getValueLong(), artData.getContent());
1808  }
1809  }
1810  }
1811  return "";
1812  }
1813 
1814  @Override
1815  public Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types) {
1816  types.remove(this.attributeType);
1817  return types;
1818  }
1819  }
1820 
1821  private class SourceFileColumn implements Column {
1822 
1823  private final String columnHeader;
1824 
1825  SourceFileColumn(String columnHeader) {
1826  this.columnHeader = columnHeader;
1827  }
1828 
1829  @Override
1830  public String getColumnHeader() {
1831  return this.columnHeader;
1832  }
1833 
1834  @Override
1835  public String getCellData(ArtifactData artData) {
1836  return getFileUniquePath(artData.getContent());
1837  }
1838 
1839  @Override
1840  public Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types) {
1841  // This column doesn't have a type, so nothing to remove
1842  return types;
1843  }
1844  }
1845 
1846  private class TaggedResultsColumn implements Column {
1847 
1848  private final String columnHeader;
1849 
1850  TaggedResultsColumn(String columnHeader) {
1851  this.columnHeader = columnHeader;
1852  }
1853 
1854  @Override
1855  public String getColumnHeader() {
1856  return this.columnHeader;
1857  }
1858 
1859  @Override
1860  public String getCellData(ArtifactData artData) {
1861  return makeCommaSeparatedList(artData.getTags());
1862  }
1863 
1864  @Override
1865  public Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types) {
1866  // This column doesn't have a type, so nothing to remove
1867  return types;
1868  }
1869  }
1870 
1871  private class HeaderOnlyColumn implements Column {
1872 
1873  private final String columnHeader;
1874 
1875  HeaderOnlyColumn(String columnHeader) {
1876  this.columnHeader = columnHeader;
1877  }
1878 
1879  @Override
1880  public String getColumnHeader() {
1881  return columnHeader;
1882  }
1883 
1884  @Override
1885  public String getCellData(ArtifactData artData) {
1886  throw new UnsupportedOperationException("Cannot get cell data of unspecified column");
1887  }
1888 
1889  @Override
1890  public Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types) {
1891  // This column doesn't have a type, so nothing to remove
1892  return types;
1893  }
1894  }
1895 }
org.sleuthkit.autopsy.report.TableReportGenerator.SourceFileColumn.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Definition: TableReportGenerator.java:1840
org.sleuthkit.autopsy.datamodel.ContentUtils.getStringTime
static String getStringTime(long epochSeconds, TimeZone tzone)
Definition: ContentUtils.java:88
org.sleuthkit.autopsy.datamodel.ContentUtils
Definition: ContentUtils.java:55
org.sleuthkit.autopsy.casemodule.services.TagsManager.getContentTagsByContent
List< ContentTag > getContentTagsByContent(Content content)
Definition: TagsManager.java:605
org.sleuthkit.autopsy.report.TableReportGenerator.Column.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
org.sleuthkit.autopsy.report.TableReportGenerator.StatusColumn.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Definition: TableReportGenerator.java:1771
org.sleuthkit.autopsy.report.TableReportGenerator.AttributeColumn.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Definition: TableReportGenerator.java:1815
org.sleuthkit.autopsy.report.TableReportGenerator.HeaderOnlyColumn.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Definition: TableReportGenerator.java:1890
org.sleuthkit.autopsy.casemodule.services.TagsManager.getBlackboardArtifactTagsByArtifact
List< BlackboardArtifactTag > getBlackboardArtifactTagsByArtifact(BlackboardArtifact artifact)
Definition: TagsManager.java:825
org.sleuthkit.autopsy.report.TableReportGenerator.TaggedResultsColumn.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Definition: TableReportGenerator.java:1865

Copyright © 2012-2018 Basis Technology. Generated on: Thu Oct 4 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.