Sleuth Kit Java Bindings (JNI)  4.11.0
Java bindings for using The Sleuth Kit
org.sleuthkit.datamodel.CommunicationsManager Class Reference

Public Member Functions

org.sleuthkit.datamodel.Account.Type addAccountType (String accountTypeName, String displayName) throws TskCoreException
 
void addRelationships (AccountFileInstance sender, List< AccountFileInstance > recipients, BlackboardArtifact sourceArtifact, org.sleuthkit.datamodel.Relationship.Type relationshipType, long dateTime) throws TskCoreException, TskDataException
 
AccountFileInstance createAccountFileInstance (org.sleuthkit.datamodel.Account.Type accountType, String accountUniqueID, String moduleName, Content sourceFile) throws TskCoreException, InvalidAccountIDException
 
Account getAccount (org.sleuthkit.datamodel.Account.Type accountType, String accountUniqueID) throws TskCoreException, InvalidAccountIDException
 
List< AccountDeviceInstancegetAccountDeviceInstancesWithRelationships (CommunicationsFilter filter) throws TskCoreException
 
List< AccountFileInstancegetAccountFileInstances (Account account) throws TskCoreException
 
List< AccountgetAccountsRelatedToArtifact (BlackboardArtifact artifact) throws TskCoreException
 
org.sleuthkit.datamodel.Account.Type getAccountType (String accountTypeName) throws TskCoreException
 
List< Account.Type > getAccountTypesInUse () throws TskCoreException
 
List< AccountDeviceInstancegetRelatedAccountDeviceInstances (AccountDeviceInstance accountDeviceInstance, CommunicationsFilter filter) throws TskCoreException
 
Map< AccountPair, Long > getRelationshipCountsPairwise (Set< AccountDeviceInstance > accounts, CommunicationsFilter filter) throws TskCoreException
 
Set< ContentgetRelationshipSources (Set< AccountDeviceInstance > accountDeviceInstanceList, CommunicationsFilter filter) throws TskCoreException
 
List< ContentgetRelationshipSources (AccountDeviceInstance account1, AccountDeviceInstance account2, CommunicationsFilter filter) throws TskCoreException
 
long getRelationshipSourcesCount (AccountDeviceInstance accountDeviceInstance, CommunicationsFilter filter) throws TskCoreException
 

Detailed Description

Provides an API to create Accounts and communications/relationships between accounts.

Definition at line 47 of file CommunicationsManager.java.

Member Function Documentation

org.sleuthkit.datamodel.Account.Type org.sleuthkit.datamodel.CommunicationsManager.addAccountType ( String  accountTypeName,
String  displayName 
) throws TskCoreException

Add a custom account type that is not already defined in Account.Type. Will not allow duplicates and will return existing type if the name is already defined.

Parameters
accountTypeNameaccount type that must be unique
displayNameaccount type display name
Returns
Account.Type
Exceptions
TskCoreExceptionif a critical error occurs within TSK core

Definition at line 191 of file CommunicationsManager.java.

References org.sleuthkit.datamodel.SleuthkitCase.beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

void org.sleuthkit.datamodel.CommunicationsManager.addRelationships ( AccountFileInstance  sender,
List< AccountFileInstance recipients,
BlackboardArtifact  sourceArtifact,
org.sleuthkit.datamodel.Relationship.Type  relationshipType,
long  dateTime 
) throws TskCoreException, TskDataException

Adds relationships between the sender and each of the recipient account instances and between all recipient account instances. All account instances must be from the same data source.

Parameters
senderSender account, may be null.
recipientsList of recipients, may be empty.
sourceArtifactArtifact that relationships were derived from.
relationshipTypeThe type of relationships to be created.
dateTimeDate of communications/relationship, as epoch seconds.
Exceptions
org.sleuthkit.datamodel.TskCoreException
org.sleuthkit.datamodel.TskDataExceptionIf the all the accounts and the relationship are not from the same data source, or if the sourceArtifact and relationshipType are not compatible.

Definition at line 339 of file CommunicationsManager.java.

References org.sleuthkit.datamodel.SleuthkitCase.beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), org.sleuthkit.datamodel.SleuthkitCase.getDatabaseType(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

AccountFileInstance org.sleuthkit.datamodel.CommunicationsManager.createAccountFileInstance ( org.sleuthkit.datamodel.Account.Type  accountType,
String  accountUniqueID,
String  moduleName,
Content  sourceFile 
) throws TskCoreException, InvalidAccountIDException

Records that an account was used in a specific file. Behind the scenes, it will create a case-specific Account object if it does not already exist and create the needed database entries (which currently include making a BlackboardArtifact).

Parameters
accountTypeaccount type
accountUniqueIDunique account identifier (such as email address)
moduleNamemodule creating the account
sourceFilesource file the account was found in (for the blackboard)
Returns
AccountFileInstance
Exceptions
TskCoreExceptionIf a critical error occurs within TSK core
InvalidAccountIDExceptionIf the account identifier is not valid.

Definition at line 259 of file CommunicationsManager.java.

Referenced by org.sleuthkit.datamodel.blackboardutils.WebBrowserArtifactsHelper.addWebFormAddress().

Account org.sleuthkit.datamodel.CommunicationsManager.getAccount ( org.sleuthkit.datamodel.Account.Type  accountType,
String  accountUniqueID 
) throws TskCoreException, InvalidAccountIDException

Get the Account with the given account type and account ID.

Parameters
accountTypeaccount type
accountUniqueIDunique account identifier (such as an email address)
Returns
Account, returns NULL is no matching account found
Exceptions
TskCoreExceptionIf a critical error occurs within TSK core.
InvalidAccountIDExceptionIf the account identifier is not valid.

Definition at line 295 of file CommunicationsManager.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

List<AccountDeviceInstance> org.sleuthkit.datamodel.CommunicationsManager.getAccountDeviceInstancesWithRelationships ( CommunicationsFilter  filter) throws TskCoreException

Returns a list of AccountDeviceInstances that have at least one relationship that meets the criteria listed in the filters.

Applicable filters: DeviceFilter, AccountTypeFilter, DateRangeFilter, RelationshipTypeFilter, MostRecentFilter

Parameters
filterfilters to apply
Returns
list of AccountDeviceInstances
Exceptions
TskCoreExceptionexception thrown if a critical error occurs within TSK core

Definition at line 618 of file CommunicationsManager.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.getDatabaseType(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

List<AccountFileInstance> org.sleuthkit.datamodel.CommunicationsManager.getAccountFileInstances ( Account  account) throws TskCoreException

Get a list AccountFileInstance for the given accounts.

Parameters
accountList of accounts
Returns
A lit of AccountFileInstances for the given accounts or null if none are found.
Exceptions
org.sleuthkit.datamodel.TskCoreException

Definition at line 1154 of file CommunicationsManager.java.

References org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts(), org.sleuthkit.datamodel.Account.getTypeSpecificID(), org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT, and org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ID.

List<Account> org.sleuthkit.datamodel.CommunicationsManager.getAccountsRelatedToArtifact ( BlackboardArtifact  artifact) throws TskCoreException

Gets a list of accounts that are related to the given artifact.

Parameters
artifact
Returns
A list of distinct accounts or an empty list if none where found.
Exceptions
TskCoreException

Definition at line 1218 of file CommunicationsManager.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

org.sleuthkit.datamodel.Account.Type org.sleuthkit.datamodel.CommunicationsManager.getAccountType ( String  accountTypeName) throws TskCoreException

Get the Account.Type for the give type name.

Parameters
accountTypeNameAn account type name.
Returns
An Account.Type or null if the account type does not exist.
Exceptions
TskCoreExceptionIf an error occurs accessing the case database.

Definition at line 581 of file CommunicationsManager.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

List<Account.Type> org.sleuthkit.datamodel.CommunicationsManager.getAccountTypesInUse ( ) throws TskCoreException

Gets a list of the distinct account types that can currently be found in the case db.

Returns
A list of distinct accounts or an empty list.
Exceptions
TskCoreException

Definition at line 1180 of file CommunicationsManager.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

List<AccountDeviceInstance> org.sleuthkit.datamodel.CommunicationsManager.getRelatedAccountDeviceInstances ( AccountDeviceInstance  accountDeviceInstance,
CommunicationsFilter  filter 
) throws TskCoreException

Get a set of AccountDeviceInstances that have relationships with the given AccountDeviceInstance and meet the criteria of the given filter.

Applicable filters: DeviceFilter, DateRangeFilter, RelationshipTypeFilter

Parameters
accountDeviceInstanceThe account device instance.
filterThe filters to apply.
Returns
A set of AccountDeviceInstances that have relationships with the given AccountDeviceInstance and meet the criteria of the given filter.
Exceptions
TskCoreExceptionif there is a serious error executing he query.

Definition at line 990 of file CommunicationsManager.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.SleuthkitCase.getDatabaseType(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

Map<AccountPair, Long> org.sleuthkit.datamodel.CommunicationsManager.getRelationshipCountsPairwise ( Set< AccountDeviceInstance accounts,
CommunicationsFilter  filter 
) throws TskCoreException

Get the number of relationships between all pairs of accounts in the given set. For each pair of accounts <a2,a1> == <a1,a2>, find the number of relationships between those two accounts that pass the given filter,.

Applicable filters: DeviceFilter, DateRangeFilter, RelationshipTypeFilter

Parameters
accountsThe set of accounts to count the relationships (pairwise) between.
filterThe filter that relationships must pass to be included in the count.
Returns
The number of relationships (that pass the filter) between each pair of accounts, organized in a map where the key is an unordered pair of account ids, and the value is the number of relationships.
Exceptions
TskCoreExceptionif there is a problem querying the DB.

Definition at line 728 of file CommunicationsManager.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

Set<Content> org.sleuthkit.datamodel.CommunicationsManager.getRelationshipSources ( Set< AccountDeviceInstance accountDeviceInstanceList,
CommunicationsFilter  filter 
) throws TskCoreException

Get the unique relationship sources (such as EMAIL artifacts) associated with accounts on specific devices (AccountDeviceInstance) that meet the filter criteria.

Applicable filters: RelationshipTypeFilter, DateRangeFilter, MostRecentFilter

Parameters
accountDeviceInstanceListset of account device instances for which to get the relationship sources.
filterFilters to apply.
Returns
relationship sources found for given account(s).
Exceptions
org.sleuthkit.datamodel.TskCoreException

Definition at line 897 of file CommunicationsManager.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.Account.getAccountID(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

List<Content> org.sleuthkit.datamodel.CommunicationsManager.getRelationshipSources ( AccountDeviceInstance  account1,
AccountDeviceInstance  account2,
CommunicationsFilter  filter 
) throws TskCoreException

Get the sources (artifacts, content) of relationships between the given account device instances.

Applicable filters: DeviceFilter, DateRangeFilter, RelationshipTypeFilter, MostRecentFilter

Parameters
account1First AccountDeviceInstance
account2Second AccountDeviceInstance
filterFilters to apply.
Returns
relationship sources for relationships between account1 and account2.
Exceptions
org.sleuthkit.datamodel.TskCoreException

Definition at line 1095 of file CommunicationsManager.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

long org.sleuthkit.datamodel.CommunicationsManager.getRelationshipSourcesCount ( AccountDeviceInstance  accountDeviceInstance,
CommunicationsFilter  filter 
) throws TskCoreException

Get the number of unique relationship sources (such as EMAIL artifacts) associated with an account on a given device (AccountDeviceInstance) that meet the filter criteria.

Applicable filters: RelationshipTypeFilter, DateRangeFilter

Parameters
accountDeviceInstanceAccount of interest
filterFilters to apply.
Returns
number of account relationships found for this account.
Exceptions
org.sleuthkit.datamodel.TskCoreException

Definition at line 838 of file CommunicationsManager.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.Account.getAccountID(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().


The documentation for this class was generated from the following file:

Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.