Sleuth Kit Java Bindings (JNI)  4.11.0
Java bindings for using The Sleuth Kit
org.sleuthkit.datamodel.BlackboardArtifact Class Referenceabstract

Inherits org.sleuthkit.datamodel.Content.

Inherited by org.sleuthkit.datamodel.AnalysisResult, and org.sleuthkit.datamodel.DataArtifact.

Classes

enum  ARTIFACT_TYPE
 
enum  Category
 
enum  ReviewStatus
 
class  Type
 

Public Member Functions

void addAttribute (BlackboardAttribute attribute) throws TskCoreException
 
void addAttributes (Collection< BlackboardAttribute > attributes) throws TskCoreException
 
void addAttributes (Collection< BlackboardAttribute > attributes, final SleuthkitCase.CaseDbTransaction caseDbTransaction) throws TskCoreException
 
void close ()
 
boolean equals (Object object)
 
Score getAggregateScore () throws TskCoreException
 
List< AnalysisResultgetAllAnalysisResults () throws TskCoreException
 
ArrayList< BlackboardArtifactgetAllArtifacts () throws TskCoreException
 
long getAllArtifactsCount () throws TskCoreException
 
List< DataArtifactgetAllDataArtifacts () throws TskCoreException
 
List< AnalysisResultgetAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException
 
long getArtifactID ()
 
ArrayList< BlackboardArtifactgetArtifacts (String artifactTypeName) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (int artifactTypeID) throws TskCoreException
 
ArrayList< BlackboardArtifactgetArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
long getArtifactsCount (String artifactTypeName) throws TskCoreException
 
long getArtifactsCount (int artifactTypeID) throws TskCoreException
 
long getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
int getArtifactTypeID ()
 
String getArtifactTypeName ()
 
BlackboardAttribute getAttribute (BlackboardAttribute.Type attributeType) throws TskCoreException
 
List< BlackboardAttributegetAttributes () throws TskCoreException
 
List< BlackboardAttributegetAttributes (final BlackboardAttribute.ATTRIBUTE_TYPE attributeType) throws TskCoreException
 
List< ContentgetChildren () throws TskCoreException
 
int getChildrenCount () throws TskCoreException
 
List< Long > getChildrenIds () throws TskCoreException
 
Content getDataSource () throws TskCoreException
 
String getDisplayName ()
 
BlackboardArtifact getGenInfoArtifact () throws TskCoreException
 
BlackboardArtifact getGenInfoArtifact (boolean create) throws TskCoreException
 
ArrayList< BlackboardAttributegetGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException
 
Set< String > getHashSetNames () throws TskCoreException
 
long getId ()
 
String getName ()
 
long getObjectID ()
 
Content getParent () throws TskCoreException
 
ReviewStatus getReviewStatus ()
 
String getShortDescription () throws TskCoreException
 
long getSize ()
 
SleuthkitCase getSleuthkitCase ()
 
BlackboardArtifact.Type getType () throws TskCoreException
 
String getUniquePath () throws TskCoreException
 
boolean hasChildren () throws TskCoreException
 
int hashCode ()
 
AnalysisResultAdded newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException
 
AnalysisResultAdded newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException
 
BlackboardArtifact newArtifact (int artifactTypeID) throws TskCoreException
 
BlackboardArtifact newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException
 
final int read (byte[] buf, long offset, long len) throws TskCoreException
 
void setReviewStatus (ReviewStatus newStatus) throws TskCoreException
 
String toString ()
 
- Public Member Functions inherited from org.sleuthkit.datamodel.Content
List< AnalysisResultgetAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException
 
AnalysisResultAdded newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException
 
AnalysisResultAdded newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException
 

Protected Member Functions

 BlackboardArtifact (SleuthkitCase sleuthkitCase, long artifactID, long objID, long artifactObjID, long dataSourceObjId, int artifactTypeID, String artifactTypeName, String displayName)
 

Detailed Description

An artifact that has been posted to the blackboard. Artifacts store analysis results (such as hash set hits) and extracted data (such as a web bookmark). An artifact is a typed collection of name value pairs (attributes) that is associated with its source content (A data source, a file, or another artifact). Both standard artifact types and custom artifact types are supported.

IMPORTANT NOTE: No more than one attribute of a given type should be added to an artifact. It is undefined about which will be used.

Definition at line 53 of file BlackboardArtifact.java.

Constructor & Destructor Documentation

org.sleuthkit.datamodel.BlackboardArtifact.BlackboardArtifact ( SleuthkitCase  sleuthkitCase,
long  artifactID,
long  objID,
long  artifactObjID,
long  dataSourceObjId,
int  artifactTypeID,
String  artifactTypeName,
String  displayName 
)
protected

Constructs an artifact that has been posted to the blackboard. An artifact is a typed collection of name value pairs (attributes) that is associated with its source content (either a data source, or file within a data source). Both standard artifact types and custom artifact types are supported.

Parameters
sleuthkitCaseThe SleuthKit case (case database) that contains the artifact data.
artifactIDThe unique id for this artifact.
objIDThe unique id of the content with which this artifact is associated.
artifactObjIDThe unique id of the artifact, in tsk_objects
dataSourceObjIdThe id of the data source
artifactTypeIDThe type id of this artifact.
artifactTypeNameThe type name of this artifact.
displayNameThe display name of this artifact.
Deprecated:
Use new BlackboardArtifact(SleuthkitCase, long, long, int, String, String, ReviewStatus) instead.

Definition at line 2239 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.BlackboardArtifact.ReviewStatus.UNDECIDED.

Member Function Documentation

void org.sleuthkit.datamodel.BlackboardArtifact.addAttribute ( BlackboardAttribute  attribute) throws TskCoreException

Adds an attribute to this artifact.

IMPORTANT NOTE: No more than one attribute of a given type should be added to an artifact.

Parameters
attributeThe attribute to add
Exceptions
TskCoreExceptionIf an error occurs and the attribute was not added to the artifact.

Definition at line 398 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.SleuthkitCase.addBlackboardAttribute(), and org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.AccountFileInstance.addAttribute().

void org.sleuthkit.datamodel.BlackboardArtifact.addAttributes ( Collection< BlackboardAttribute attributes) throws TskCoreException

Adds a collection of attributes to this artifact in a single operation (faster than adding each attribute individually).

Parameters
attributesThe collection of attributes.
Exceptions
TskCoreExceptionIf an error occurs and the attributes were not added to the artifact.

Definition at line 459 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.SleuthkitCase.addBlackboardAttributes(), and org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.AccountFileInstance.addAttributes(), org.sleuthkit.datamodel.blackboardutils.CommunicationArtifactsHelper.addCalllog(), org.sleuthkit.datamodel.Blackboard.newAnalysisResult(), and org.sleuthkit.datamodel.Blackboard.newDataArtifact().

void org.sleuthkit.datamodel.BlackboardArtifact.addAttributes ( Collection< BlackboardAttribute attributes,
final SleuthkitCase.CaseDbTransaction  caseDbTransaction 
) throws TskCoreException

Adds a collection of attributes to this artifact in a single operation (faster than adding each attribute individually) within a transaction supplied by the caller.

Parameters
attributesThe collection of attributes.
caseDbTransactionThe transaction in the scope of which the operation is to be performed, managed by the caller. Null is not permitted.
Exceptions
TskCoreExceptionIf an error occurs and the attributes were not added to the artifact. If caseDbTransaction is null or if attributes is null or empty.

Definition at line 486 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().

void org.sleuthkit.datamodel.BlackboardArtifact.close ( )

Close the Content object.

Implements org.sleuthkit.datamodel.Content.

Definition at line 917 of file BlackboardArtifact.java.

boolean org.sleuthkit.datamodel.BlackboardArtifact.equals ( Object  object)

Tests this artifact for equality with another object.

Parameters
objectThe other object.
Returns
True or false.

Definition at line 845 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.BlackboardArtifact.getArtifactID().

Score org.sleuthkit.datamodel.BlackboardArtifact.getAggregateScore ( ) throws TskCoreException

Returns the final score for the content object.

Returns
Score.
Exceptions
TskCoreExceptionif critical error occurred within tsk core.

Implements org.sleuthkit.datamodel.Content.

Definition at line 562 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.ScoringManager.getAggregateScore(), and org.sleuthkit.datamodel.SleuthkitCase.getScoringManager().

List<AnalysisResult> org.sleuthkit.datamodel.BlackboardArtifact.getAllAnalysisResults ( ) throws TskCoreException

Get all analysis results associated with this content.

Returns
A list of analysis results.
Exceptions
TskCoreExceptionIf critical error occurred within tsk core.

Implements org.sleuthkit.datamodel.Content.

Definition at line 552 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.Blackboard.getAnalysisResults(), and org.sleuthkit.datamodel.SleuthkitCase.getBlackboard().

ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.BlackboardArtifact.getAllArtifacts ( ) throws TskCoreException

Get all artifacts associated with this content

Returns
a list of blackboard artifacts
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 546 of file BlackboardArtifact.java.

long org.sleuthkit.datamodel.BlackboardArtifact.getAllArtifactsCount ( ) throws TskCoreException

Get count of all artifacts associated with this content

Returns
count of all blackboard artifacts for this content
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 627 of file BlackboardArtifact.java.

List<DataArtifact> org.sleuthkit.datamodel.BlackboardArtifact.getAllDataArtifacts ( ) throws TskCoreException

Get all data artifacts associated with this content.

Returns
A list of data artifacts.
Exceptions
TskCoreExceptionIf critical error occurred within tsk core.

Implements org.sleuthkit.datamodel.Content.

Definition at line 557 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.SleuthkitCase.getBlackboard().

List<AnalysisResult> org.sleuthkit.datamodel.BlackboardArtifact.getAnalysisResults ( BlackboardArtifact.Type  artifactType) throws TskCoreException
long org.sleuthkit.datamodel.BlackboardArtifact.getArtifactID ( )
ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.BlackboardArtifact.getArtifacts ( String  artifactTypeName) throws TskCoreException

Get all artifacts associated with this content that have the given type name

Parameters
artifactTypeNamename of the type to look up
Returns
a list of blackboard artifacts matching the type
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 583 of file BlackboardArtifact.java.

ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.BlackboardArtifact.getArtifacts ( int  artifactTypeID) throws TskCoreException

Get all artifacts associated with this content that have the given type id

Parameters
artifactTypeIDtype id to look up
Returns
a list of blackboard artifacts matching the type
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 599 of file BlackboardArtifact.java.

ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.BlackboardArtifact.getArtifacts ( BlackboardArtifact.ARTIFACT_TYPE  type) throws TskCoreException

Get all artifacts associated with this content that have the given type

Parameters
typetype to look up
Returns
a list of blackboard artifacts matching the type
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 614 of file BlackboardArtifact.java.

long org.sleuthkit.datamodel.BlackboardArtifact.getArtifactsCount ( String  artifactTypeName) throws TskCoreException

Get count of all artifacts associated with this content that have the given type name

Parameters
artifactTypeNamename of the type to look up
Returns
count of blackboard artifacts matching the type
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 643 of file BlackboardArtifact.java.

long org.sleuthkit.datamodel.BlackboardArtifact.getArtifactsCount ( int  artifactTypeID) throws TskCoreException

Get count of all artifacts associated with this content that have the given type id

Parameters
artifactTypeIDtype id to look up
Returns
count of blackboard artifacts matching the type
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 659 of file BlackboardArtifact.java.

long org.sleuthkit.datamodel.BlackboardArtifact.getArtifactsCount ( BlackboardArtifact.ARTIFACT_TYPE  type) throws TskCoreException

Get count of all artifacts associated with this content that have the given type

Parameters
typetype to look up
Returns
count of blackboard artifacts matching the type
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 675 of file BlackboardArtifact.java.

int org.sleuthkit.datamodel.BlackboardArtifact.getArtifactTypeID ( )

Gets the artifact type id for this artifact.

Returns
The artifact type id.

Definition at line 189 of file BlackboardArtifact.java.

Referenced by org.sleuthkit.datamodel.BlackboardArtifact.getType().

String org.sleuthkit.datamodel.BlackboardArtifact.getArtifactTypeName ( )

Gets the artifact type name for this artifact.

Returns
The artifact type name.

Definition at line 212 of file BlackboardArtifact.java.

BlackboardAttribute org.sleuthkit.datamodel.BlackboardArtifact.getAttribute ( BlackboardAttribute.Type  attributeType) throws TskCoreException

Gets the attribute of this artifact that matches a given type.

IMPORTANT NOTE: No more than one attribute of a given type should be added to an artifact.

Parameters
attributeTypeThe attribute type.
Returns
The first attribute of the given type, or null if there are no attributes of that type.
Exceptions
TskCoreExceptionIf an error occurs and the attribute is not fetched.

Definition at line 440 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.BlackboardArtifact.getAttributes().

Referenced by org.sleuthkit.datamodel.AccountFileInstance.getAttribute(), and org.sleuthkit.datamodel.BlackboardArtifact.getShortDescription().

List<BlackboardAttribute> org.sleuthkit.datamodel.BlackboardArtifact.getAttributes ( ) throws TskCoreException

Gets the attributes of this artifact.

Returns
The attributes.
Exceptions
TskCoreExceptionIf an error occurs and the attributes cannot be fetched.

Definition at line 413 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.SleuthkitCase.getBlackboardAttributes(), and org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.BlackboardArtifact.getAttribute(), and org.sleuthkit.datamodel.AbstractContent.getGenInfoAttributes().

List<BlackboardAttribute> org.sleuthkit.datamodel.BlackboardArtifact.getAttributes ( final BlackboardAttribute.ATTRIBUTE_TYPE  attributeType) throws TskCoreException

Gets all attributes associated with this artifact that are of the given attribute type.

Parameters
attributeTypethe type of attributes to get
Returns
a list of attributes of the given type
Exceptions
TskCoreExceptionif a critical error occurs and the attributes are not fetched
Deprecated:
An artifact should not have multiple attributes of the same type. Use getAttribute(BlackboardAttribute.Type) instead.

Definition at line 2258 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.SleuthkitCase.getBlackboardAttributes(), and org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().

List<Content> org.sleuthkit.datamodel.BlackboardArtifact.getChildren ( ) throws TskCoreException

Get all children of this artifact, if any.

Returns
A list of the children.
Exceptions
TskCoreExceptionif there was an error querying the case database.

Implements org.sleuthkit.datamodel.Content.

Definition at line 2333 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().

int org.sleuthkit.datamodel.BlackboardArtifact.getChildrenCount ( ) throws TskCoreException

Returns count of children objects. Note, this should be more efficient than getting children and counting them.

Returns
children count
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 2297 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().

List<Long> org.sleuthkit.datamodel.BlackboardArtifact.getChildrenIds ( ) throws TskCoreException

Gets the object ids of children of this artifact, if any

Returns
A list of the object ids of children.
Exceptions
TskCoreExceptionif there was an error querying the case database.

Implements org.sleuthkit.datamodel.Content.

Definition at line 2288 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().

Content org.sleuthkit.datamodel.BlackboardArtifact.getDataSource ( ) throws TskCoreException

Gets the root data source (image, virtual directory, etc.) of this content.

Returns
Content associated with data source or null if one can't be found
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 958 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.SleuthkitCase.getContentById(), and org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.BlackboardArtifact.newAnalysisResult().

String org.sleuthkit.datamodel.BlackboardArtifact.getDisplayName ( )

Gets the artifact type display name for this artifact.

Returns
The artifact type display name.

Definition at line 221 of file BlackboardArtifact.java.

Referenced by org.sleuthkit.datamodel.BlackboardArtifact.getShortDescription().

BlackboardArtifact org.sleuthkit.datamodel.BlackboardArtifact.getGenInfoArtifact ( ) throws TskCoreException

Return the TSK_GEN_INFO artifact for the file so that individual attributes can be added to it. Creates one if it does not already exist.

Returns
Instance of the TSK_GEN_INFO artifact
Exceptions
TskCoreException

Implements org.sleuthkit.datamodel.Content.

Definition at line 689 of file BlackboardArtifact.java.

BlackboardArtifact org.sleuthkit.datamodel.BlackboardArtifact.getGenInfoArtifact ( boolean  create) throws TskCoreException

Return the TSK_GEN_INFO artifact for the file so that individual attributes can be added to it. If one does not create, behavior depends on the create argument.

Parameters
createIf true, an artifact will be created if it does not already exist.
Returns
Instance of the TSK_GEN_INFO artifact or null if artifact does not already exist and create was set to false
Exceptions
TskCoreException

Implements org.sleuthkit.datamodel.Content.

Definition at line 708 of file BlackboardArtifact.java.

ArrayList<BlackboardAttribute> org.sleuthkit.datamodel.BlackboardArtifact.getGenInfoAttributes ( BlackboardAttribute.ATTRIBUTE_TYPE  attr_type) throws TskCoreException

Return attributes of a given type from TSK_GEN_INFO.

Parameters
attr_typeAttribute type to find inside of the TSK_GEN_INFO artifact.
Returns
Attributes
Exceptions
org.sleuthkit.datamodel.TskCoreException

Implements org.sleuthkit.datamodel.Content.

Definition at line 728 of file BlackboardArtifact.java.

Set<String> org.sleuthkit.datamodel.BlackboardArtifact.getHashSetNames ( ) throws TskCoreException

Get the names of all the hashsets that this content is in.

Returns
the names of the hashsets that this content is in
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 741 of file BlackboardArtifact.java.

long org.sleuthkit.datamodel.BlackboardArtifact.getId ( )

Returns the unique object ID that was assigned to it in the database. This is a Sleuth Kit database-assigned number.

Returns
object id

Implements org.sleuthkit.datamodel.Content.

Definition at line 2275 of file BlackboardArtifact.java.

Referenced by org.sleuthkit.datamodel.BlackboardArtifact.newAnalysisResult().

String org.sleuthkit.datamodel.BlackboardArtifact.getName ( )

Get the name of this content object (does not include parent path)

Returns
the name

Implements org.sleuthkit.datamodel.Content.

Definition at line 953 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.BlackboardArtifact.getArtifactID().

long org.sleuthkit.datamodel.BlackboardArtifact.getObjectID ( )

Gets the object id of the source content (data source or file within a data source) of this artifact

Returns
The object id.

Definition at line 171 of file BlackboardArtifact.java.

Referenced by org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactTagsByTagName(), org.sleuthkit.datamodel.AccountFileInstance.getFile(), and org.sleuthkit.datamodel.BlackboardArtifact.toString().

Content org.sleuthkit.datamodel.BlackboardArtifact.getParent ( ) throws TskCoreException
Returns
returns the parent of this Content object or null if there isn't one as is the case for Image.
Exceptions
TskCoreException

Implements org.sleuthkit.datamodel.Content.

Definition at line 531 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.SleuthkitCase.getContentById(), and org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.BlackboardArtifact.getUniquePath().

ReviewStatus org.sleuthkit.datamodel.BlackboardArtifact.getReviewStatus ( )

Gets the review status of this artifact, i.e., whether it has been approved, rejected, or is still waiting for a decision from the user.

Returns
The review status.

Definition at line 370 of file BlackboardArtifact.java.

String org.sleuthkit.datamodel.BlackboardArtifact.getShortDescription ( ) throws TskCoreException

Gets a short description for this artifact.

Returns
The description, may be the empty string.
Exceptions
TskCoreExceptionif there is a problem creating the description.

Definition at line 232 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.fromID(), org.sleuthkit.datamodel.BlackboardArtifact.getAttribute(), org.sleuthkit.datamodel.AbstractAttribute.getAttributeType(), org.sleuthkit.datamodel.BlackboardArtifact.getDisplayName(), org.sleuthkit.datamodel.BlackboardAttribute.getDisplayString(), org.sleuthkit.datamodel.BlackboardAttribute.toString(), org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_END, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_MODIFIED, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_RCVD, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_NAME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_HOME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_OFFICE, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MAC_ADDRESS, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_HOME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_MOBILE, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_OFFICE, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REMOTE_PATH, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SSID, and org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT.

long org.sleuthkit.datamodel.BlackboardArtifact.getSize ( )

Get the (reported) size of the content object. Artifact content is a string dump of all its attributes.

Returns
size of the content in bytes

Implements org.sleuthkit.datamodel.Content.

Definition at line 900 of file BlackboardArtifact.java.

BlackboardArtifact.Type org.sleuthkit.datamodel.BlackboardArtifact.getType ( ) throws TskCoreException
String org.sleuthkit.datamodel.BlackboardArtifact.getUniquePath ( ) throws TskCoreException

This overiding implementation returns the unique path of the parent. It does not include the Artifact name in the unique path.

Exceptions
org.sleuthkit.datamodel.TskCoreException

Implements org.sleuthkit.datamodel.Content.

Definition at line 513 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.BlackboardArtifact.getParent(), and org.sleuthkit.datamodel.Content.getUniquePath().

boolean org.sleuthkit.datamodel.BlackboardArtifact.hasChildren ( ) throws TskCoreException

Returns true if the content object has children objects. Note, this should be more efficient than getting children and checking it empty.

Returns
true if has children, false otherwise.
Exceptions
TskCoreExceptionif critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 2311 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().

int org.sleuthkit.datamodel.BlackboardArtifact.hashCode ( )

Gets the hash code for this artifact.

Returns
The hash code.

Definition at line 862 of file BlackboardArtifact.java.

AnalysisResultAdded org.sleuthkit.datamodel.BlackboardArtifact.newAnalysisResult ( BlackboardArtifact.Type  artifactType,
Score  score,
String  conclusion,
String  configuration,
String  justification,
Collection< BlackboardAttribute attributesList,
long  dataSourceId 
) throws TskCoreException
BlackboardArtifact org.sleuthkit.datamodel.BlackboardArtifact.newArtifact ( int  artifactTypeID) throws TskCoreException

Create and add an artifact associated with this content to the blackboard

Parameters
artifactTypeIDid of the artifact type (if the id doesn't already exist an exception will be thrown)
Returns
the blackboard artifact created (the artifact type id can be looked up from this)
Exceptions
TskCoreExceptionif critical error occurred within tsk core
Deprecated:
Use the Blackboard to create Data Artifacts and Analysis Results.

Implements org.sleuthkit.datamodel.Content.

Definition at line 760 of file BlackboardArtifact.java.

Referenced by org.sleuthkit.datamodel.AbstractFile.newArtifact().

BlackboardArtifact org.sleuthkit.datamodel.BlackboardArtifact.newArtifact ( BlackboardArtifact.ARTIFACT_TYPE  type) throws TskCoreException

Create and add an artifact associated with this content to the blackboard

Parameters
typeartifact enum type
Returns
the blackboard artifact created (the artifact type id can be looked up from this)
Exceptions
TskCoreExceptionif critical error occurred within tsk core
Deprecated:
Use the Blackboard to create Data Artifacts and Analysis Results.

Implements org.sleuthkit.datamodel.Content.

Definition at line 820 of file BlackboardArtifact.java.

DataArtifact org.sleuthkit.datamodel.BlackboardArtifact.newDataArtifact ( BlackboardArtifact.Type  artifactType,
Collection< BlackboardAttribute attributesList,
Long  osAccountId 
) throws TskCoreException
DataArtifact org.sleuthkit.datamodel.BlackboardArtifact.newDataArtifact ( BlackboardArtifact.Type  artifactType,
Collection< BlackboardAttribute attributesList,
Long  osAccountId,
long  dataSourceId 
) throws TskCoreException

Definition at line 798 of file BlackboardArtifact.java.

DataArtifact org.sleuthkit.datamodel.BlackboardArtifact.newDataArtifact ( BlackboardArtifact.Type  artifactType,
Collection< BlackboardAttribute attributesList 
) throws TskCoreException
final int org.sleuthkit.datamodel.BlackboardArtifact.read ( byte[]  buf,
long  offset,
long  len 
) throws TskCoreException

Reads content data for this artifact Artifact content is a string dump of all its attributes.

Parameters
bufa character array of data (in bytes) to copy read data to
offsetbyte offset in the content to start reading from
lennumber of bytes to read into buf.
Returns
num of bytes read, or -1 on error
Exceptions
TskCoreExceptionif critical error occurred during read in the tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 935 of file BlackboardArtifact.java.

void org.sleuthkit.datamodel.BlackboardArtifact.setReviewStatus ( ReviewStatus  newStatus) throws TskCoreException

Sets the review status of this artifact, i.e., whether it has been approved, rejected, or is still waiting for a decision from the user.

Parameters
newStatusnew status of the artifact
Exceptions
TskCoreExceptionIf an error occurs

Definition at line 382 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase(), and org.sleuthkit.datamodel.SleuthkitCase.setReviewStatus().

String org.sleuthkit.datamodel.BlackboardArtifact.toString ( )

Gets a string representation of this artifact.

Returns
The string.

Definition at line 874 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.BlackboardArtifact.getObjectID(), and org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().


The documentation for this class was generated from the following file:

Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.