Sleuth Kit Java Bindings (JNI)
4.10.2
Java bindings for using The Sleuth Kit
|
Classes | |
class | ArtifactsPostedEvent |
class | BlackboardException |
Public Member Functions | |
boolean | artifactExists (Content content, BlackboardArtifact.ARTIFACT_TYPE artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException |
Score | deleteAnalysisResult (AnalysisResult analysisResult) throws TskCoreException |
Score | deleteAnalysisResult (long artifactObjId, CaseDbTransaction transaction) throws TskCoreException |
AnalysisResult | getAnalysisResultById (long artifactObjId) throws TskCoreException |
List< AnalysisResult > | getAnalysisResults (long sourceObjId) throws TskCoreException |
List< AnalysisResult > | getAnalysisResults (long sourceObjId, int artifactTypeId) throws TskCoreException |
List< AnalysisResult > | getAnalysisResultsByType (int artifactTypeId) throws TskCoreException |
List< AnalysisResult > | getAnalysisResultsByType (int artifactTypeId, long dataSourceObjId) throws TskCoreException |
List< AnalysisResult > | getAnalysisResultsWhere (String whereClause) throws TskCoreException |
List< BlackboardArtifact > | getArtifacts (int artifactTypeID, long dataSourceObjId) throws TskCoreException |
List< BlackboardArtifact > | getArtifacts (Collection< BlackboardArtifact.Type > artifactTypes, Collection< Long > dataSourceObjIds) throws TskCoreException |
long | getArtifactsCount (int artifactTypeID, long dataSourceObjId) throws TskCoreException |
BlackboardArtifact.Type | getArtifactType (int artTypeId) throws TskCoreException |
List< BlackboardArtifact.Type > | getArtifactTypesInUse (long dataSourceObjId) throws TskCoreException |
DataArtifact | getDataArtifactById (long artifactObjId) throws TskCoreException |
List< DataArtifact > | getDataArtifacts (int artifactTypeID, long dataSourceObjId) throws TskCoreException |
List< DataArtifact > | getDataArtifacts (int artifactTypeID) throws TskCoreException |
BlackboardArtifact.Type | getOrAddArtifactType (String typeName, String displayName) throws BlackboardException |
BlackboardArtifact.Type | getOrAddArtifactType (String typeName, String displayName, BlackboardArtifact.Category category) throws BlackboardException |
BlackboardAttribute.Type | getOrAddAttributeType (String typeName, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName) throws BlackboardException |
boolean | hasAnalysisResults (long sourceObjId) throws TskCoreException |
boolean | hasDataArtifacts (long sourceObjId) throws TskCoreException |
AnalysisResultAdded | newAnalysisResult (BlackboardArtifact.Type artifactType, long objId, Long dataSourceObjId, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws BlackboardException, TskCoreException |
AnalysisResultAdded | newAnalysisResult (BlackboardArtifact.Type artifactType, long objId, Long dataSourceObjId, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, CaseDbTransaction transaction) throws BlackboardException |
DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, long sourceObjId, Long dataSourceObjId, Collection< BlackboardAttribute > attributes, Long osAccountId) throws TskCoreException |
DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, long sourceObjId, Long dataSourceObjId, Collection< BlackboardAttribute > attributes, Long osAccountObjId, final CaseDbTransaction transaction) throws TskCoreException |
void | postArtifact (BlackboardArtifact artifact, String moduleName) throws BlackboardException |
void | postArtifacts (Collection< BlackboardArtifact > artifacts, String moduleName) throws BlackboardException |
A representation of the blackboard, a place where artifacts and their attributes are posted.
Definition at line 44 of file Blackboard.java.
boolean org.sleuthkit.datamodel.Blackboard.artifactExists | ( | Content | content, |
BlackboardArtifact.ARTIFACT_TYPE | artifactType, | ||
Collection< BlackboardAttribute > | attributesList | ||
) | throws TskCoreException |
Definition at line 988 of file Blackboard.java.
Score org.sleuthkit.datamodel.Blackboard.deleteAnalysisResult | ( | AnalysisResult | analysisResult | ) | throws TskCoreException |
Delete the specified analysis result.
Deletes the result from blackboard_artifacts and tsk_analysis_results, and recalculates and updates the aggregate score of the content. Fires an event to indicate that the analysis result has been deleted and that the score of the item has changed.
analysisResult | AnalysisResult to delete. |
TskCoreException |
Definition at line 268 of file Blackboard.java.
References org.sleuthkit.datamodel.SleuthkitCase.beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().
Referenced by org.sleuthkit.datamodel.Blackboard.deleteAnalysisResult().
Score org.sleuthkit.datamodel.Blackboard.deleteAnalysisResult | ( | long | artifactObjId, |
CaseDbTransaction | transaction | ||
) | throws TskCoreException |
Delete the specified analysis result.
Deletes the result from blackboard_artifacts and tsk_analysis_results, and recalculates and updates the aggregate score of the content.
artifactObjId | Artifact Obj Id to be deleted |
transaction |
TskCoreException |
Definition at line 297 of file Blackboard.java.
References org.sleuthkit.datamodel.Blackboard.deleteAnalysisResult(), and org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere().
AnalysisResult org.sleuthkit.datamodel.Blackboard.getAnalysisResultById | ( | long | artifactObjId | ) | throws TskCoreException |
Get the analysis results by its artifact_obj_id.
artifactObjId | Artifact object id of the analysis result. |
TskCoreException | If a critical error occurred within TSK core. |
Definition at line 574 of file Blackboard.java.
References org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere().
Referenced by org.sleuthkit.datamodel.SleuthkitCase.getArtifactById().
List<AnalysisResult> org.sleuthkit.datamodel.Blackboard.getAnalysisResults | ( | long | sourceObjId | ) | throws TskCoreException |
Get all analysis results for a given object.
sourceObjId | Object id. |
TskCoreException | exception thrown if a critical error occurs within TSK core. |
Definition at line 400 of file Blackboard.java.
References org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere().
Referenced by org.sleuthkit.datamodel.Report.getAllAnalysisResults(), org.sleuthkit.datamodel.AbstractContent.getAllAnalysisResults(), org.sleuthkit.datamodel.BlackboardArtifact.getAllAnalysisResults(), org.sleuthkit.datamodel.Report.getAnalysisResults(), org.sleuthkit.datamodel.AbstractContent.getAnalysisResults(), and org.sleuthkit.datamodel.BlackboardArtifact.getAnalysisResults().
List<AnalysisResult> org.sleuthkit.datamodel.Blackboard.getAnalysisResults | ( | long | sourceObjId, |
int | artifactTypeId | ||
) | throws TskCoreException |
Get analysis results of the given type, for the given object.
sourceObjId | Object id. |
artifactTypeId | Result type to get. |
TskCoreException | exception thrown if a critical error occurs within TSK core. |
Definition at line 506 of file Blackboard.java.
References org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere(), and org.sleuthkit.datamodel.SleuthkitCase.getArtifactType().
List<AnalysisResult> org.sleuthkit.datamodel.Blackboard.getAnalysisResultsByType | ( | int | artifactTypeId | ) | throws TskCoreException |
Get all analysis results of given artifact type.
artifactTypeId | The artifact type id for which to search. |
TskCoreException | Exception thrown if a critical error occurs within TSK core. |
Definition at line 370 of file Blackboard.java.
References org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere().
List<AnalysisResult> org.sleuthkit.datamodel.Blackboard.getAnalysisResultsByType | ( | int | artifactTypeId, |
long | dataSourceObjId | ||
) | throws TskCoreException |
Get all analysis results of given artifact type.
artifactTypeId | The artifact type id for which to search. |
dataSourceObjId | Object Id of the data source to look under. |
TskCoreException | Exception thrown if a critical error occurs within TSK core. |
Definition at line 385 of file Blackboard.java.
References org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere().
List<AnalysisResult> org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere | ( | String | whereClause | ) | throws TskCoreException |
Get all analysis results matching the given where sub-clause.
whereClause | Where sub clause, specifies conditions to match. |
TskCoreException | exception thrown if a critical error occurs within TSK core. |
Definition at line 529 of file Blackboard.java.
References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().
Referenced by org.sleuthkit.datamodel.Blackboard.deleteAnalysisResult(), org.sleuthkit.datamodel.Blackboard.getAnalysisResultById(), org.sleuthkit.datamodel.Blackboard.getAnalysisResults(), and org.sleuthkit.datamodel.Blackboard.getAnalysisResultsByType().
List<BlackboardArtifact> org.sleuthkit.datamodel.Blackboard.getArtifacts | ( | int | artifactTypeID, |
long | dataSourceObjId | ||
) | throws TskCoreException |
Get all blackboard artifacts of a given type. Does not included rejected artifacts.
artifactTypeID | artifact type to get |
dataSourceObjId | data source to look under |
TskCoreException | exception thrown if a critical error occurs within TSK core |
Definition at line 895 of file Blackboard.java.
List<BlackboardArtifact> org.sleuthkit.datamodel.Blackboard.getArtifacts | ( | Collection< BlackboardArtifact.Type > | artifactTypes, |
Collection< Long > | dataSourceObjIds | ||
) | throws TskCoreException |
Get all blackboard artifacts of the given type(s) for the given data source(s). Does not included rejected artifacts.
artifactTypes | list of artifact types to get |
dataSourceObjIds | data sources to look under |
TskCoreException | exception thrown if a critical error occurs within TSK core |
Definition at line 912 of file Blackboard.java.
long org.sleuthkit.datamodel.Blackboard.getArtifactsCount | ( | int | artifactTypeID, |
long | dataSourceObjId | ||
) | throws TskCoreException |
Get count of all blackboard artifacts of a given type for the given data source. Does not include rejected artifacts.
artifactTypeID | artifact type id (must exist in database) |
dataSourceObjId | data source object id |
TskCoreException | exception thrown if a critical error occurs within TSK core |
Definition at line 878 of file Blackboard.java.
BlackboardArtifact.Type org.sleuthkit.datamodel.Blackboard.getArtifactType | ( | int | artTypeId | ) | throws TskCoreException |
Get the artifact type associated with an artifact type id.
artTypeId | An artifact type id. |
TskCoreException | If an error occurs accessing the case database or no value is found. |
Definition at line 793 of file Blackboard.java.
References org.sleuthkit.datamodel.SleuthkitCase.getArtifactType().
List<BlackboardArtifact.Type> org.sleuthkit.datamodel.Blackboard.getArtifactTypesInUse | ( | long | dataSourceObjId | ) | throws TskCoreException |
Gets the list of all artifact types in use for the given data source. Gets both standard and custom types.
dataSourceObjId | data source object id |
TskCoreException | exception thrown if a critical error occurred within tsk core |
Definition at line 836 of file Blackboard.java.
References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.fromID(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().
DataArtifact org.sleuthkit.datamodel.Blackboard.getDataArtifactById | ( | long | artifactObjId | ) | throws TskCoreException |
Get the data artifact with the given artifact obj id.
artifactObjId | Object id of the data artifact to get. |
TskCoreException | exception thrown if a critical error occurs within TSK core. |
Definition at line 700 of file Blackboard.java.
References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().
Referenced by org.sleuthkit.datamodel.SleuthkitCase.getArtifactById().
List<DataArtifact> org.sleuthkit.datamodel.Blackboard.getDataArtifacts | ( | int | artifactTypeID, |
long | dataSourceObjId | ||
) | throws TskCoreException |
Get all data artifacts of a given type for a given data source.
artifactTypeID | Artifact type to get. |
dataSourceObjId | Data source to look under. |
TskCoreException | exception thrown if a critical error occurs within TSK core. |
Definition at line 644 of file Blackboard.java.
References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, org.sleuthkit.datamodel.SleuthkitCase.getArtifactType(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().
List<DataArtifact> org.sleuthkit.datamodel.Blackboard.getDataArtifacts | ( | int | artifactTypeID | ) | throws TskCoreException |
Get all data artifacts of a given type.
artifactTypeID | Artifact type to get. |
TskCoreException | exception thrown if a critical error occurs within TSK core. |
Definition at line 673 of file Blackboard.java.
References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, org.sleuthkit.datamodel.SleuthkitCase.getArtifactType(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().
BlackboardArtifact.Type org.sleuthkit.datamodel.Blackboard.getOrAddArtifactType | ( | String | typeName, |
String | displayName | ||
) | throws BlackboardException |
Gets an artifact type, creating it if it does not already exist. Use this method to define custom artifact types.
This assumes that the artifact type is of category DATA_ARTIFACT.
typeName | The type name of the artifact type. |
displayName | The display name of the artifact type. |
BlackboardException | If there is a problem getting or adding the artifact type. |
Definition at line 120 of file Blackboard.java.
References org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT.
BlackboardArtifact.Type org.sleuthkit.datamodel.Blackboard.getOrAddArtifactType | ( | String | typeName, |
String | displayName, | ||
BlackboardArtifact.Category | category | ||
) | throws BlackboardException |
Gets an artifact type, creating it if it does not already exist. Use this method to define custom artifact types.
typeName | The type name of the artifact type. |
displayName | The display name of the artifact type. |
category | The artifact type category. |
BlackboardException | If there is a problem getting or adding the artifact type. |
Definition at line 138 of file Blackboard.java.
References org.sleuthkit.datamodel.SleuthkitCase.addBlackboardArtifactType(), and org.sleuthkit.datamodel.SleuthkitCase.getArtifactType().
BlackboardAttribute.Type org.sleuthkit.datamodel.Blackboard.getOrAddAttributeType | ( | String | typeName, |
BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE | valueType, | ||
String | displayName | ||
) | throws BlackboardException |
Gets an attribute type, creating it if it does not already exist. Use this method to define custom attribute types.
typeName | The type name of the attribute type. |
valueType | The value type of the attribute type. |
displayName | The display name of the attribute type. |
BlackboardException | If there is a problem getting or adding the attribute type. |
Definition at line 810 of file Blackboard.java.
References org.sleuthkit.datamodel.SleuthkitCase.addArtifactAttributeType(), and org.sleuthkit.datamodel.SleuthkitCase.getAttributeType().
boolean org.sleuthkit.datamodel.Blackboard.hasAnalysisResults | ( | long | sourceObjId | ) | throws TskCoreException |
Returns true if there are analysis results belonging to the sourceObjId.
sourceObjId | The source content object id. |
TskCoreException |
Definition at line 441 of file Blackboard.java.
References org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT.
boolean org.sleuthkit.datamodel.Blackboard.hasDataArtifacts | ( | long | sourceObjId | ) | throws TskCoreException |
Returns true if there are data artifacts belonging to the sourceObjId.
sourceObjId | The source content object id. |
TskCoreException |
Definition at line 431 of file Blackboard.java.
References org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT.
AnalysisResultAdded org.sleuthkit.datamodel.Blackboard.newAnalysisResult | ( | BlackboardArtifact.Type | artifactType, |
long | objId, | ||
Long | dataSourceObjId, | ||
Score | score, | ||
String | conclusion, | ||
String | configuration, | ||
String | justification, | ||
Collection< BlackboardAttribute > | attributesList | ||
) | throws BlackboardException, TskCoreException |
Adds new analysis result artifact.
artifactType | Type of analysis result artifact to create. |
objId | Object id of parent. |
dataSourceObjId | Data source object id, may be null. |
score | Score associated with this analysis result. |
conclusion | Conclusion of the analysis, may be null or an empty string. |
configuration | Configuration associated with this analysis, may be null or an empty string. |
justification | Justification, may be null or an empty string. |
attributesList | Attributes to be attached to this analysis result artifact. |
TskCoreException | |
BlackboardException | exception thrown if a critical error occurs within TSK core |
Definition at line 178 of file Blackboard.java.
References org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.SleuthkitCase.beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().
Referenced by org.sleuthkit.datamodel.Report.newAnalysisResult(), org.sleuthkit.datamodel.AbstractContent.newAnalysisResult(), org.sleuthkit.datamodel.BlackboardArtifact.newAnalysisResult(), and org.sleuthkit.datamodel.Report.newArtifact().
AnalysisResultAdded org.sleuthkit.datamodel.Blackboard.newAnalysisResult | ( | BlackboardArtifact.Type | artifactType, |
long | objId, | ||
Long | dataSourceObjId, | ||
Score | score, | ||
String | conclusion, | ||
String | configuration, | ||
String | justification, | ||
Collection< BlackboardAttribute > | attributesList, | ||
CaseDbTransaction | transaction | ||
) | throws BlackboardException |
Adds new analysis result artifact.
artifactType | Type of analysis result artifact to create. |
objId | Object id of parent. |
dataSourceObjId | Data source object id, may be null. |
score | Score associated with this analysis result. |
conclusion | Conclusion of the analysis, may be null or an empty string. |
configuration | Configuration associated with this analysis, may be null or an empty string. |
justification | Justification, may be null or an empty string. |
attributesList | Attributes to be attached to this analysis result artifact. |
transaction | DB transaction to use. |
BlackboardException | exception thrown if a critical error occurs within TSK core |
Definition at line 227 of file Blackboard.java.
References org.sleuthkit.datamodel.BlackboardArtifact.addAttributes(), org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.AnalysisResult.getScore(), and org.sleuthkit.datamodel.SleuthkitCase.getScoringManager().
DataArtifact org.sleuthkit.datamodel.Blackboard.newDataArtifact | ( | BlackboardArtifact.Type | artifactType, |
long | sourceObjId, | ||
Long | dataSourceObjId, | ||
Collection< BlackboardAttribute > | attributes, | ||
Long | osAccountId | ||
) | throws TskCoreException |
Add a new data artifact with the given type.
artifactType | The type of the data artifact. |
sourceObjId | The content that is the source of this artifact. |
dataSourceObjId | The data source the artifact source content belongs to, may be the same as the sourceObjId. May be null. |
attributes | The attributes. May be empty or null. |
osAccountId | The OS account id associated with the artifact. May be null. |
TskCoreException | If a critical error occurs within tsk core. |
Definition at line 1146 of file Blackboard.java.
References org.sleuthkit.datamodel.SleuthkitCase.beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().
Referenced by org.sleuthkit.datamodel.Report.newDataArtifact(), and org.sleuthkit.datamodel.AbstractContent.newDataArtifact().
DataArtifact org.sleuthkit.datamodel.Blackboard.newDataArtifact | ( | BlackboardArtifact.Type | artifactType, |
long | sourceObjId, | ||
Long | dataSourceObjId, | ||
Collection< BlackboardAttribute > | attributes, | ||
Long | osAccountObjId, | ||
final CaseDbTransaction | transaction | ||
) | throws TskCoreException |
Add a new data artifact with the given type.
This api executes in the context of the given transaction.
artifactType | The type of the data artifact. |
sourceObjId | The content that is the source of this artifact. |
dataSourceObjId | The data source the artifact source content belongs to, may be the same as the sourceObjId. May be null. |
attributes | The attributes. May be empty or null. |
osAccountObjId | The OS account associated with the artifact. May be null. |
transaction | The transaction in the scope of which the operation is to be performed. |
TskCoreException | If a critical error occurs within tsk core. |
Definition at line 1190 of file Blackboard.java.
References org.sleuthkit.datamodel.BlackboardArtifact.addAttributes(), org.sleuthkit.datamodel.TskData.ObjectType.ARTIFACT, org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, and org.sleuthkit.datamodel.BlackboardArtifact.ReviewStatus.UNDECIDED.
void org.sleuthkit.datamodel.Blackboard.postArtifact | ( | BlackboardArtifact | artifact, |
String | moduleName | ||
) | throws BlackboardException |
Posts the artifact. The artifact should be complete (all attributes have been added) before being posted. Posting the artifact includes making any timeline events that may be derived from it, and broadcasting a notification that the artifact is ready for further analysis.
artifact | The artifact to be posted. |
moduleName | The name of the module that is posting the artifacts. |
BlackboardException | If there is a problem posting the artifact. |
Definition at line 71 of file Blackboard.java.
References org.sleuthkit.datamodel.Blackboard.postArtifacts().
void org.sleuthkit.datamodel.Blackboard.postArtifacts | ( | Collection< BlackboardArtifact > | artifacts, |
String | moduleName | ||
) | throws BlackboardException |
Posts a Collection of artifacts. The artifacts should be complete (all attributes have been added) before being posted. Posting the artifacts includes making any events that may be derived from them, and broadcasting notifications that the artifacts are ready for further analysis.
artifacts | The artifacts to be posted . |
moduleName | The name of the module that is posting the artifacts. |
BlackboardException | If there is a problem posting the artifacts. |
Definition at line 90 of file Blackboard.java.
References org.sleuthkit.datamodel.SleuthkitCase.getTimelineManager().
Referenced by org.sleuthkit.datamodel.Blackboard.postArtifact().
Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.