Sleuth Kit Java Bindings (JNI)  4.11.1
Java bindings for using The Sleuth Kit
BlackboardArtifact.java
Go to the documentation of this file.
1 /*
2  * Sleuth Kit Data Model
3  *
4  * Copyright 2011-2021 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import com.google.common.annotations.Beta;
22 import java.io.Serializable;
23 import java.io.UnsupportedEncodingException;
24 import java.sql.SQLException;
25 import java.text.MessageFormat;
26 import java.util.ArrayList;
27 import java.util.Collection;
28 import java.util.Collections;
29 import java.util.HashMap;
30 import java.util.HashSet;
31 import java.util.List;
32 import java.util.Map;
33 import java.util.Objects;
34 import java.util.ResourceBundle;
35 import java.util.Set;
36 import java.util.stream.Collectors;
37 import java.util.stream.Stream;
42 
54 public abstract class BlackboardArtifact implements Content {
55 
56  private static final ResourceBundle bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle");
57  private final long artifactId;
58  private final long sourceObjId; // refers to objID of parent/source object
59  private final long artifactObjId; // objId of the artifact in tsk_objects. TBD: replace artifactID with this
60  private final Long dataSourceObjId; // objId of the data source in tsk_objects.
61  private final int artifactTypeId;
62  private final String artifactTypeName;
63  private final String displayName;
64  private ReviewStatus reviewStatus;
65  private final SleuthkitCase sleuthkitCase;
66  private final List<BlackboardAttribute> attrsCache = new ArrayList<BlackboardAttribute>();
67  private boolean loadedCacheFromDb = false;
68  private volatile Content parent;
69  private volatile String uniquePath;
70 
71  private byte[] contentBytes = null;
72 
73  private volatile boolean checkedHasChildren;
74  private volatile boolean hasChildren;
75  private volatile int childrenCount;
76 
97  BlackboardArtifact(SleuthkitCase sleuthkitCase, long artifactID, long sourceObjId, long artifactObjId, Long dataSourceObjId, int artifactTypeID, String artifactTypeName, String displayName, ReviewStatus reviewStatus) {
98 
99  this.sleuthkitCase = sleuthkitCase;
100  this.artifactId = artifactID;
101  this.sourceObjId = sourceObjId;
102  this.artifactObjId = artifactObjId;
103  this.artifactTypeId = artifactTypeID;
104  this.dataSourceObjId = dataSourceObjId;
105  this.artifactTypeName = artifactTypeName;
106  this.displayName = displayName;
107  this.reviewStatus = reviewStatus;
108 
109  this.checkedHasChildren = false;
110  this.hasChildren = false;
111  this.childrenCount = -1;
112 
113  }
114 
135  BlackboardArtifact(SleuthkitCase sleuthkitCase, long artifactID, long sourceObjId, long artifactObjID, Long dataSourceObjID, int artifactTypeID, String artifactTypeName, String displayName, ReviewStatus reviewStatus, boolean isNew) {
136  this(sleuthkitCase, artifactID, sourceObjId, artifactObjID, dataSourceObjID, artifactTypeID, artifactTypeName, displayName, reviewStatus);
137  if (isNew) {
138  /*
139  * If this object represents a newly created artifact, then its
140  * collection of attributes has already been populated and there is
141  * no need to fetch them form the case database.
142  */
143  this.loadedCacheFromDb = true;
144  }
145  }
146 
154  return sleuthkitCase;
155  }
156 
162  public long getArtifactID() {
163  return this.artifactId;
164  }
165 
172  public long getObjectID() {
173  return this.sourceObjId;
174  }
175 
181  @Beta
182  public Long getDataSourceObjectID() {
183  return this.dataSourceObjId;
184  }
185 
191  public int getArtifactTypeID() {
192  return this.artifactTypeId;
193  }
194 
203  BlackboardArtifact.Type standardTypesValue = BlackboardArtifact.Type.STANDARD_TYPES.get(getArtifactTypeID());
204  if (standardTypesValue != null) {
205  return standardTypesValue;
206  } else {
208  }
209  }
210 
216  public String getArtifactTypeName() {
217  return this.artifactTypeName;
218  }
219 
225  public String getDisplayName() {
226  return this.displayName;
227  }
228 
236  public String getShortDescription() throws TskCoreException {
237  BlackboardAttribute attr = null;
238  StringBuilder shortDescription = new StringBuilder("");
239  if (BlackboardArtifact.Type.STANDARD_TYPES.get(artifactTypeId) != null) {
240  switch (ARTIFACT_TYPE.fromID(artifactTypeId)) {
241  case TSK_WIFI_NETWORK_ADAPTER:
243  break;
244  case TSK_WIFI_NETWORK:
246  break;
247  case TSK_REMOTE_DRIVE:
249  break;
250  case TSK_SERVICE_ACCOUNT:
251  case TSK_SCREEN_SHOTS:
252  case TSK_DELETED_PROG:
253  case TSK_METADATA:
254  case TSK_OS_INFO:
255  case TSK_PROG_NOTIFICATIONS:
256  case TSK_PROG_RUN:
257  case TSK_RECENT_OBJECT:
258  case TSK_USER_DEVICE_EVENT:
259  case TSK_WEB_SEARCH_QUERY:
261  break;
262  case TSK_BLUETOOTH_PAIRING:
264  break;
265  case TSK_ACCOUNT:
267  if (attr == null) {
269  }
270  break;
271  case TSK_WEB_CATEGORIZATION:
272  case TSK_BLUETOOTH_ADAPTER:
273  case TSK_GPS_AREA:
274  case TSK_GPS_BOOKMARK:
275  case TSK_GPS_LAST_KNOWN_LOCATION:
276  case TSK_GPS_ROUTE:
277  case TSK_GPS_SEARCH:
278  case TSK_GPS_TRACK:
279  case TSK_WEB_FORM_AUTOFILL:
281  break;
282  case TSK_WEB_ACCOUNT_TYPE:
284  break;
285  case TSK_HASHSET_HIT:
286  case TSK_INTERESTING_ARTIFACT_HIT:
287  case TSK_INTERESTING_FILE_HIT:
288  case TSK_INTERESTING_ITEM:
289  case TSK_YARA_HIT:
291  break;
292  case TSK_ENCRYPTION_DETECTED:
293  case TSK_ENCRYPTION_SUSPECTED:
294  case TSK_OBJECT_DETECTED:
295  case TSK_USER_CONTENT_SUSPECTED:
296  case TSK_VERIFICATION_FAILED:
298  break;
299  case TSK_DATA_SOURCE_USAGE:
300  case TSK_CALENDAR_ENTRY:
302  break;
303  case TSK_WEB_BOOKMARK: //web_bookmark, web_cookie, web_download, and web_history are the same attribute for now
304  case TSK_WEB_COOKIE:
305  case TSK_WEB_DOWNLOAD:
306  case TSK_WEB_HISTORY:
307  case TSK_WEB_CACHE:
309  break;
310  case TSK_KEYWORD_HIT:
312  break;
313  case TSK_DEVICE_ATTACHED:
315  break;
316  case TSK_CONTACT: //contact, message, and calllog are the same attributes for now
317  case TSK_MESSAGE:
318  case TSK_CALLLOG:
319  case TSK_SPEED_DIAL_ENTRY:
320  case TSK_WEB_FORM_ADDRESS:
321  //get the first of these attributes which exists and is non null
322  final ATTRIBUTE_TYPE[] typesThatCanHaveName = {ATTRIBUTE_TYPE.TSK_NAME,
334  ATTRIBUTE_TYPE.TSK_LOCATION}; //in the order we want to use them
335  for (ATTRIBUTE_TYPE t : typesThatCanHaveName) {
336  attr = getAttribute(new BlackboardAttribute.Type(t));
337  if (attr != null && !attr.getDisplayString().isEmpty()) {
338  break;
339  }
340  }
341  break;
342  default:
343  break;
344  }
345  }
346  if (attr != null) {
347  shortDescription.append(attr.getAttributeType().getDisplayName()).append(": ").append(attr.getDisplayString());
348  } else {
349  shortDescription.append(getDisplayName());
350  }
351  //get the first of these date attributes which exists and is non null
352  final ATTRIBUTE_TYPE[] typesThatCanHaveDate = {ATTRIBUTE_TYPE.TSK_DATETIME,
359  ATTRIBUTE_TYPE.TSK_DATETIME_END}; //in the order we want to use them
360  BlackboardAttribute date;
361  for (ATTRIBUTE_TYPE t : typesThatCanHaveDate) {
362  date = getAttribute(new BlackboardAttribute.Type(t));
363  if (date != null && !date.getDisplayString().isEmpty()) {
364  shortDescription.append(" ");
365  shortDescription.append(MessageFormat.format(bundle.getString("BlackboardArtifact.shortDescriptionDate.text"), date.getDisplayString())); //NON-NLS
366  break;
367  }
368  }
369  return shortDescription.toString();
370  }
371 
379  return reviewStatus;
380  }
381 
390  public void setReviewStatus(ReviewStatus newStatus) throws TskCoreException {
391  getSleuthkitCase().setReviewStatus(this, newStatus);
392  reviewStatus = newStatus;
393  }
394 
406  public void addAttribute(BlackboardAttribute attribute) throws TskCoreException {
407  attribute.setArtifactId(artifactId);
408  attribute.setCaseDatabase(getSleuthkitCase());
409  getSleuthkitCase().addBlackboardAttribute(attribute, this.artifactTypeId);
410  attrsCache.add(attribute);
411  }
412 
421  public List<BlackboardAttribute> getAttributes() throws TskCoreException {
422  ArrayList<BlackboardAttribute> attributes;
423  if (false == loadedCacheFromDb) {
425  attrsCache.clear();
426  attrsCache.addAll(attributes);
427  loadedCacheFromDb = true;
428  } else {
429  attributes = new ArrayList<>(attrsCache);
430  }
431  return attributes;
432  }
433 
440  void setAttributes(List<BlackboardAttribute> attributes) {
441  attrsCache.clear();
442  attrsCache.addAll(attributes);
443  loadedCacheFromDb = true;
444  }
445 
461  List<BlackboardAttribute> attributes = this.getAttributes();
462  for (BlackboardAttribute attribute : attributes) {
463  if (attribute.getAttributeType().equals(attributeType)) {
464  return attribute;
465  }
466  }
467  return null;
468  }
469 
479  public void addAttributes(Collection<BlackboardAttribute> attributes) throws TskCoreException {
480  if (attributes.isEmpty()) {
481  return;
482  }
483  for (BlackboardAttribute attribute : attributes) {
484  attribute.setArtifactId(artifactId);
485  attribute.setCaseDatabase(getSleuthkitCase());
486  }
487  getSleuthkitCase().addBlackboardAttributes(attributes, artifactTypeId);
488  attrsCache.addAll(attributes);
489  }
490 
506  public void addAttributes(Collection<BlackboardAttribute> attributes, final SleuthkitCase.CaseDbTransaction caseDbTransaction) throws TskCoreException {
507 
508  if (Objects.isNull(attributes) || attributes.isEmpty()) {
509  throw new TskCoreException("Illegal argument passed to addAttributes: null or empty attributes passed to addAttributes");
510  }
511  if (Objects.isNull(caseDbTransaction)) {
512  throw new TskCoreException("Illegal argument passed to addAttributes: null caseDbTransaction passed to addAttributes");
513  }
514  try {
515  for (final BlackboardAttribute attribute : attributes) {
516  attribute.setArtifactId(artifactId);
517  attribute.setCaseDatabase(getSleuthkitCase());
518  getSleuthkitCase().addBlackBoardAttribute(attribute, artifactTypeId, caseDbTransaction.getConnection());
519  }
520  attrsCache.addAll(attributes);
521  } catch (SQLException ex) {
522  throw new TskCoreException("Error adding blackboard attributes", ex);
523  }
524  }
525 
532  @Override
533  public String getUniquePath() throws TskCoreException {
534  // Return the path of the parent file
535  // It is possible that multiple threads could be doing this calculation
536  // simultaneously, but it's worth the potential extra processing to prevent deadlocks.
537  if (uniquePath == null) {
538  String tempUniquePath = "";
539  Content myParent = getParent();
540  if (myParent != null) {
541  tempUniquePath = myParent.getUniquePath();
542  }
543 
544  // Don't update uniquePath until it is complete.
545  uniquePath = tempUniquePath;
546  }
547  return uniquePath;
548  }
549 
550  @Override
552  if (parent == null) {
553  parent = getSleuthkitCase().getContentById(sourceObjId);
554  }
555  return parent;
556  }
557 
565  @Override
566  public ArrayList<BlackboardArtifact> getAllArtifacts() throws TskCoreException {
567  // Currently we don't have any artifacts derived from an artifact.
568  return new ArrayList<BlackboardArtifact>();
569  }
570 
571  @Override
572  public List<AnalysisResult> getAllAnalysisResults() throws TskCoreException {
573  return sleuthkitCase.getBlackboard().getAnalysisResults(artifactObjId);
574  }
575 
576  @Override
577  public List<DataArtifact> getAllDataArtifacts() throws TskCoreException {
578  return sleuthkitCase.getBlackboard().getDataArtifactsBySource(artifactObjId);
579  }
580 
581  @Override
583  return sleuthkitCase.getScoringManager().getAggregateScore(artifactObjId);
584 
585  }
586 
587  @Override
588  public List<AnalysisResult> getAnalysisResults(BlackboardArtifact.Type artifactType) throws TskCoreException {
589  return sleuthkitCase.getBlackboard().getAnalysisResults(artifactObjId, artifactType.getTypeID()); //NON-NLS
590  }
591 
602  @Override
603  public ArrayList<BlackboardArtifact> getArtifacts(String artifactTypeName) throws TskCoreException {
604  // Currently we don't have any artifacts derived from an artifact.
605  return new ArrayList<BlackboardArtifact>();
606  }
607 
618  @Override
619  public ArrayList<BlackboardArtifact> getArtifacts(int artifactTypeID) throws TskCoreException {
620  // Currently we don't have any artifacts derived from an artifact.
621  return new ArrayList<BlackboardArtifact>();
622  }
623 
633  @Override
634  public ArrayList<BlackboardArtifact> getArtifacts(BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException {
635  // Currently we don't have any artifacts derived from an artifact.
636  return new ArrayList<BlackboardArtifact>();
637  }
638 
646  @Override
647  public long getAllArtifactsCount() throws TskCoreException {
648  // Currently we don't have any artifacts derived from an artifact.
649  return 0;
650  }
651 
662  @Override
663  public long getArtifactsCount(String artifactTypeName) throws TskCoreException {
664  // Currently we don't have any artifacts derived from an artifact.
665  return 0;
666  }
667 
678  @Override
679  public long getArtifactsCount(int artifactTypeID) throws TskCoreException {
680  // Currently we don't have any artifacts derived from an artifact.
681  return 0;
682  }
683 
694  @Override
696  // Currently we don't have any artifacts derived from an artifact.
697  return 0;
698  }
699 
708  @Override
710  // Currently we don't have any artifacts derived from an artifact.
711  return null;
712  }
713 
727  @Override
729  // Currently we don't have any artifacts derived from an artifact.
730  if (create) {
731  throw new TskCoreException("Artifacts of artifacts are not supported.");
732  }
733 
734  return null;
735  }
736 
747  @Override
748  public ArrayList<BlackboardAttribute> getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException {
749  // Currently we don't have any artifacts derived from an artifact.
750  return new ArrayList<>();
751  }
752 
760  @Override
761  public Set<String> getHashSetNames() throws TskCoreException {
762  // Currently we don't have any artifacts derived from an artifact.
763  return new HashSet<String>();
764  }
765 
779  @Deprecated
780  @Override
781  public BlackboardArtifact newArtifact(int artifactTypeID) throws TskCoreException {
782  throw new TskCoreException("Cannot create artifact of an artifact. Not supported.");
783  }
784 
785  @Override
786  public AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection<BlackboardAttribute> attributesList) throws TskCoreException {
787  // Get the ID before starting the transaction
788  long dataSourceId = this.getDataSource().getId();
789 
790  CaseDbTransaction trans = sleuthkitCase.beginTransaction();
791  try {
792  AnalysisResultAdded resultAdded = sleuthkitCase.getBlackboard().newAnalysisResult(artifactType, this.getId(), dataSourceId, score, conclusion, configuration, justification, attributesList, trans);
793 
794  trans.commit();
795  return resultAdded;
796  } catch (BlackboardException ex) {
797  trans.rollback();
798  throw new TskCoreException("Error adding analysis result.", ex);
799  }
800  }
801 
802  @Override
803  public AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection<BlackboardAttribute> attributesList, long dataSourceId) throws TskCoreException {
804  CaseDbTransaction trans = sleuthkitCase.beginTransaction();
805  try {
806  AnalysisResultAdded resultAdded = sleuthkitCase.getBlackboard().newAnalysisResult(artifactType, this.getId(), dataSourceId, score, conclusion, configuration, justification, attributesList, trans);
807 
808  trans.commit();
809  return resultAdded;
810  } catch (BlackboardException ex) {
811  trans.rollback();
812  throw new TskCoreException("Error adding analysis result.", ex);
813  }
814  }
815 
816  @Override
817  public DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection<BlackboardAttribute> attributesList, Long osAccountId) throws TskCoreException {
818  throw new TskCoreException("Cannot create data artifact of an artifact. Not supported.");
819  }
820 
821  @Override
822  public DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection<BlackboardAttribute> attributesList, Long osAccountId, long dataSourceId) throws TskCoreException {
823  throw new TskCoreException("Cannot create data artifact of an artifact. Not supported.");
824  }
825 
826  @Override
827  public DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection<BlackboardAttribute> attributesList) throws TskCoreException {
828  return newDataArtifact(artifactType, attributesList, null);
829  }
830 
843  @Deprecated
844  @Override
846  throw new TskCoreException("Cannot create artifact of an artifact. Not supported.");
847  }
848 
857  @Override
858  public <T> T accept(ContentVisitor<T> visitor) {
859  return visitor.visit(this);
860  }
861 
869  @Override
870  public boolean equals(Object object) {
871  if (object == null) {
872  return false;
873  }
874  if (getClass() != object.getClass()) {
875  return false;
876  }
877  final BlackboardArtifact other = (BlackboardArtifact) object;
878  return artifactId == other.getArtifactID();
879  }
880 
886  @Override
887  public int hashCode() {
888  int hash = 7;
889  hash = 41 * hash + (int) (this.artifactId ^ (this.artifactId >>> 32));
890  return hash;
891  }
892 
898  @Override
899  public String toString() {
900  return "BlackboardArtifact{" + "artifactID=" + artifactId + ", objID=" + getObjectID() + ", artifactObjID=" + artifactObjId + ", artifactTypeID=" + artifactTypeId + ", artifactTypeName=" + artifactTypeName + ", displayName=" + displayName + ", Case=" + getSleuthkitCase() + '}'; //NON-NLS
901  }
902 
913  @Override
914  public <T> T accept(SleuthkitItemVisitor<T> visitor) {
915  return visitor.visit(this);
916  }
917 
924  @Override
925  public long getSize() {
926 
927  if (contentBytes == null) {
928  try {
929  loadArtifactContent();
930  } catch (TskCoreException ex) {
931  return 0;
932  }
933  }
934 
935  return contentBytes.length;
936  }
937 
941  @Override
942  public void close() {
943  contentBytes = null;
944  }
945 
959  @Override
960  public final int read(byte[] buf, long offset, long len) throws TskCoreException {
961 
962  if (contentBytes == null) {
963  loadArtifactContent();
964  }
965 
966  if (0 == contentBytes.length) {
967  return 0;
968  }
969 
970  // Copy bytes
971  long readLen = Math.min(contentBytes.length - offset, len);
972  System.arraycopy(contentBytes, 0, buf, 0, (int) readLen);
973 
974  return (int) readLen;
975  }
976 
977  @Override
978  public String getName() {
979  return this.displayName + getArtifactID();
980  }
981 
982  @Override
984  return dataSourceObjId != null ? getSleuthkitCase().getContentById(dataSourceObjId) : null;
985  }
986 
993  private void loadArtifactContent() throws TskCoreException {
994  StringBuilder artifactContents = new StringBuilder();
995 
996  Content dataSource = null;
997  try {
998  dataSource = getDataSource();
999  } catch (TskCoreException ex) {
1000  throw new TskCoreException("Unable to get datasource for artifact: " + this.toString(), ex);
1001  }
1002  if (dataSource == null) {
1003  throw new TskCoreException("Datasource was null for artifact: " + this.toString());
1004  }
1005 
1006  try {
1007  for (BlackboardAttribute attribute : getAttributes()) {
1008  artifactContents.append(attribute.getAttributeType().getDisplayName());
1009  artifactContents.append(" : ");
1010  artifactContents.append(attribute.getDisplayString());
1011  artifactContents.append(System.lineSeparator());
1012  }
1013  } catch (TskCoreException ex) {
1014  throw new TskCoreException("Unable to get attributes for artifact: " + this.toString(), ex);
1015  }
1016 
1017  try {
1018  contentBytes = artifactContents.toString().getBytes("UTF-8");
1019  } catch (UnsupportedEncodingException ex) {
1020  throw new TskCoreException("Failed to convert artifact string to bytes for artifact: " + this.toString(), ex);
1021  }
1022 
1023  }
1024 
1028  public static final class Type implements Serializable {
1029 
1030  private static final long serialVersionUID = 1L;
1031 
1035  public static final Type TSK_GEN_INFO = new BlackboardArtifact.Type(1, "TSK_GEN_INFO", bundle.getString("BlackboardArtifact.tskGenInfo.text"), Category.DATA_ARTIFACT);
1036 
1042  public static final Type TSK_WEB_BOOKMARK = new BlackboardArtifact.Type(2, "TSK_WEB_BOOKMARK", bundle.getString("BlackboardArtifact.tskWebBookmark.text"), Category.DATA_ARTIFACT);
1043 
1049  public static final Type TSK_WEB_COOKIE = new BlackboardArtifact.Type(3, "TSK_WEB_COOKIE", bundle.getString("BlackboardArtifact.tskWebCookie.text"), Category.DATA_ARTIFACT);
1050 
1056  public static final Type TSK_WEB_HISTORY = new BlackboardArtifact.Type(4, "TSK_WEB_HISTORY", bundle.getString("BlackboardArtifact.tskWebHistory.text"), Category.DATA_ARTIFACT);
1057 
1063  public static final Type TSK_WEB_DOWNLOAD = new BlackboardArtifact.Type(5, "TSK_WEB_DOWNLOAD", bundle.getString("BlackboardArtifact.tskWebDownload.text"), Category.DATA_ARTIFACT);
1064 
1068  public static final Type TSK_RECENT_OBJECT = new BlackboardArtifact.Type(6, "TSK_RECENT_OBJ", bundle.getString("BlackboardArtifact.tsk.recentObject.text"), Category.DATA_ARTIFACT);
1069 
1070  // 7 was used for deprecated TSK_GPS_TRACKPOINT.
1074  public static final Type TSK_INSTALLED_PROG = new BlackboardArtifact.Type(8, "TSK_INSTALLED_PROG", bundle.getString("BlackboardArtifact.tskInstalledProg.text"), Category.DATA_ARTIFACT);
1075 
1079  public static final Type TSK_KEYWORD_HIT = new BlackboardArtifact.Type(9, "TSK_KEYWORD_HIT", bundle.getString("BlackboardArtifact.tskKeywordHits.text"), Category.ANALYSIS_RESULT);
1080 
1084  public static final Type TSK_HASHSET_HIT = new BlackboardArtifact.Type(10, "TSK_HASHSET_HIT", bundle.getString("BlackboardArtifact.tskHashsetHit.text"), Category.ANALYSIS_RESULT);
1085 
1089  public static final Type TSK_DEVICE_ATTACHED = new BlackboardArtifact.Type(11, "TSK_DEVICE_ATTACHED", bundle.getString("BlackboardArtifact.tskDeviceAttached.text"), Category.DATA_ARTIFACT);
1090 
1097  @Deprecated
1098  public static final Type TSK_INTERESTING_FILE_HIT = new BlackboardArtifact.Type(12, "TSK_INTERESTING_FILE_HIT", bundle.getString("BlackboardArtifact.tskInterestingFileHit.text"), Category.ANALYSIS_RESULT);
1099 
1103  public static final Type TSK_EMAIL_MSG = new BlackboardArtifact.Type(13, "TSK_EMAIL_MSG", bundle.getString("BlackboardArtifact.tskEmailMsg.text"), Category.DATA_ARTIFACT);
1104 
1108  public static final Type TSK_EXTRACTED_TEXT = new BlackboardArtifact.Type(14, "TSK_EXTRACTED_TEXT", bundle.getString("BlackboardArtifact.tskExtractedText.text"), Category.DATA_ARTIFACT);
1109 
1113  public static final Type TSK_WEB_SEARCH_QUERY = new BlackboardArtifact.Type(15, "TSK_WEB_SEARCH_QUERY", bundle.getString("BlackboardArtifact.tskWebSearchQuery.text"), Category.DATA_ARTIFACT);
1114 
1118  public static final Type TSK_METADATA_EXIF = new BlackboardArtifact.Type(16, "TSK_METADATA_EXIF", bundle.getString("BlackboardArtifact.tskMetadataExif.text"), Category.ANALYSIS_RESULT);
1119 
1120  // 17 was used for deprecated TSK_TAG_FILE.
1121  // 18 was used for deprecated TSK_TAG_ARTIFACT.
1125  public static final Type TSK_OS_INFO = new BlackboardArtifact.Type(19, "TSK_OS_INFO", bundle.getString("BlackboardArtifact.tskOsInfo.text"), Category.DATA_ARTIFACT);
1126 
1127  // 20 was used for deprecated TSK_OS_ACCOUNT.
1131  public static final Type TSK_SERVICE_ACCOUNT = new BlackboardArtifact.Type(21, "TSK_SERVICE_ACCOUNT", bundle.getString("BlackboardArtifact.tskServiceAccount.text"), Category.DATA_ARTIFACT);
1132 
1133  // 22 was used for deprecated TSK_TOOL_OUTPUT.
1140  public static final Type TSK_CONTACT = new BlackboardArtifact.Type(23, "TSK_CONTACT", bundle.getString("BlackboardArtifact.tskContact.text"), Category.DATA_ARTIFACT);
1141 
1148  public static final Type TSK_MESSAGE = new BlackboardArtifact.Type(24, "TSK_MESSAGE", bundle.getString("BlackboardArtifact.tskMessage.text"), Category.DATA_ARTIFACT);
1149 
1156  public static final Type TSK_CALLLOG = new BlackboardArtifact.Type(25, "TSK_CALLLOG", bundle.getString("BlackboardArtifact.tskCalllog.text"), Category.DATA_ARTIFACT);
1157 
1161  public static final Type TSK_CALENDAR_ENTRY = new BlackboardArtifact.Type(26, "TSK_CALENDAR_ENTRY", bundle.getString("BlackboardArtifact.tskCalendarEntry.text"), Category.DATA_ARTIFACT);
1162 
1166  public static final Type TSK_SPEED_DIAL_ENTRY = new BlackboardArtifact.Type(27, "TSK_SPEED_DIAL_ENTRY", bundle.getString("BlackboardArtifact.tskSpeedDialEntry.text"), Category.DATA_ARTIFACT);
1167 
1171  public static final Type TSK_BLUETOOTH_PAIRING = new BlackboardArtifact.Type(28, "TSK_BLUETOOTH_PAIRING", bundle.getString("BlackboardArtifact.tskBluetoothPairing.text"), Category.DATA_ARTIFACT);
1172 
1176  public static final Type TSK_GPS_BOOKMARK = new BlackboardArtifact.Type(29, "TSK_GPS_BOOKMARK", bundle.getString("BlackboardArtifact.tskGpsBookmark.text"), Category.DATA_ARTIFACT);
1177 
1181  public static final Type TSK_GPS_LAST_KNOWN_LOCATION = new BlackboardArtifact.Type(30, "TSK_GPS_LAST_KNOWN_LOCATION", bundle.getString("BlackboardArtifact.tskGpsLastKnownLocation.text"), Category.DATA_ARTIFACT);
1182 
1186  public static final Type TSK_GPS_SEARCH = new BlackboardArtifact.Type(31, "TSK_GPS_SEARCH", bundle.getString("BlackboardArtifact.tskGpsSearch.text"), Category.DATA_ARTIFACT);
1187 
1191  public static final Type TSK_PROG_RUN = new BlackboardArtifact.Type(32, "TSK_PROG_RUN", bundle.getString("BlackboardArtifact.tskProgRun.text"), Category.DATA_ARTIFACT);
1192 
1196  public static final Type TSK_ENCRYPTION_DETECTED = new BlackboardArtifact.Type(33, "TSK_ENCRYPTION_DETECTED", bundle.getString("BlackboardArtifact.tskEncryptionDetected.text"), Category.ANALYSIS_RESULT);
1197 
1201  public static final Type TSK_EXT_MISMATCH_DETECTED = new BlackboardArtifact.Type(34, "TSK_EXT_MISMATCH_DETECTED", bundle.getString("BlackboardArtifact.tskExtMismatchDetected.text"), Category.ANALYSIS_RESULT);
1202 
1209  @Deprecated
1210  public static final Type TSK_INTERESTING_ARTIFACT_HIT = new BlackboardArtifact.Type(35, "TSK_INTERESTING_ARTIFACT_HIT", bundle.getString("BlackboardArtifact.tskInterestingArtifactHit.text"), Category.ANALYSIS_RESULT);
1211 
1217  public static final Type TSK_GPS_ROUTE = new BlackboardArtifact.Type(36, "TSK_GPS_ROUTE", bundle.getString("BlackboardArtifact.tskGpsRoute.text"), Category.DATA_ARTIFACT);
1218 
1222  public static final Type TSK_REMOTE_DRIVE = new BlackboardArtifact.Type(37, "TSK_REMOTE_DRIVE", bundle.getString("BlackboardArtifact.tskRemoteDrive.text"), Category.DATA_ARTIFACT);
1223 
1227  public static final Type TSK_FACE_DETECTED = new BlackboardArtifact.Type(38, "TSK_FACE_DETECTED", bundle.getString("BlackboardArtifact.tskFaceDetected.text"), Category.ANALYSIS_RESULT);
1228 
1232  public static final Type TSK_ACCOUNT = new BlackboardArtifact.Type(39, "TSK_ACCOUNT", bundle.getString("BlackboardArtifact.tskAccount.text"), Category.DATA_ARTIFACT);
1233 
1237  public static final Type TSK_ENCRYPTION_SUSPECTED = new BlackboardArtifact.Type(40, "TSK_ENCRYPTION_SUSPECTED", bundle.getString("BlackboardArtifact.tskEncryptionSuspected.text"), Category.ANALYSIS_RESULT);
1238 
1239  /*
1240  * A classifier detected an object in a media file.
1241  */
1242  public static final Type TSK_OBJECT_DETECTED = new BlackboardArtifact.Type(41, "TSK_OBJECT_DETECTED", bundle.getString("BlackboardArtifact.tskObjectDetected.text"), Category.ANALYSIS_RESULT);
1243 
1247  public static final Type TSK_WIFI_NETWORK = new BlackboardArtifact.Type(42, "TSK_WIFI_NETWORK", bundle.getString("BlackboardArtifact.tskWIFINetwork.text"), Category.DATA_ARTIFACT);
1248 
1252  public static final Type TSK_DEVICE_INFO = new BlackboardArtifact.Type(43, "TSK_DEVICE_INFO", bundle.getString("BlackboardArtifact.tskDeviceInfo.text"), Category.DATA_ARTIFACT);
1253 
1257  public static final Type TSK_SIM_ATTACHED = new BlackboardArtifact.Type(44, "TSK_SIM_ATTACHED", bundle.getString("BlackboardArtifact.tskSimAttached.text"), Category.DATA_ARTIFACT);
1258 
1262  public static final Type TSK_BLUETOOTH_ADAPTER = new BlackboardArtifact.Type(45, "TSK_BLUETOOTH_ADAPTER", bundle.getString("BlackboardArtifact.tskBluetoothAdapter.text"), Category.DATA_ARTIFACT);
1263 
1267  public static final Type TSK_WIFI_NETWORK_ADAPTER = new BlackboardArtifact.Type(46, "TSK_WIFI_NETWORK_ADAPTER", bundle.getString("BlackboardArtifact.tskWIFINetworkAdapter.text"), Category.DATA_ARTIFACT);
1268 
1272  public static final Type TSK_VERIFICATION_FAILED = new BlackboardArtifact.Type(47, "TSK_VERIFICATION_FAILED", bundle.getString("BlackboardArtifact.tskVerificationFailed.text"), Category.ANALYSIS_RESULT);
1273 
1277  public static final Type TSK_DATA_SOURCE_USAGE = new BlackboardArtifact.Type(48, "TSK_DATA_SOURCE_USAGE", bundle.getString("BlackboardArtifact.tskDataSourceUsage.text"), Category.ANALYSIS_RESULT);
1278 
1284  public static final Type TSK_WEB_FORM_AUTOFILL = new BlackboardArtifact.Type(49, "TSK_WEB_FORM_AUTOFILL", bundle.getString("BlackboardArtifact.tskWebFormAutofill.text"), Category.DATA_ARTIFACT);
1285 
1291  public static final Type TSK_WEB_FORM_ADDRESS = new BlackboardArtifact.Type(50, "TSK_WEB_FORM_ADDRESSES ", bundle.getString("BlackboardArtifact.tskWebFormAddresses.text"), Category.DATA_ARTIFACT);
1292 
1293  // 51 was used for deprecated TSK_DOWNLOAD_SOURCE
1297  public static final Type TSK_WEB_CACHE = new BlackboardArtifact.Type(52, "TSK_WEB_CACHE", bundle.getString("BlackboardArtifact.tskWebCache.text"), Category.DATA_ARTIFACT);
1298 
1302  public static final Type TSK_TL_EVENT = new BlackboardArtifact.Type(53, "TSK_TL_EVENT", bundle.getString("BlackboardArtifact.tskTLEvent.text"), Category.DATA_ARTIFACT);
1303 
1307  public static final Type TSK_CLIPBOARD_CONTENT = new BlackboardArtifact.Type(54, "TSK_CLIPBOARD_CONTENT", bundle.getString("BlackboardArtifact.tskClipboardContent.text"), Category.DATA_ARTIFACT);
1308 
1312  public static final Type TSK_ASSOCIATED_OBJECT = new BlackboardArtifact.Type(55, "TSK_ASSOCIATED_OBJECT", bundle.getString("BlackboardArtifact.tskAssociatedObject.text"), Category.DATA_ARTIFACT);
1313 
1317  public static final Type TSK_USER_CONTENT_SUSPECTED = new BlackboardArtifact.Type(56, "TSK_USER_CONTENT_SUSPECTED", bundle.getString("BlackboardArtifact.tskUserContentSuspected.text"), Category.ANALYSIS_RESULT);
1318 
1322  public static final Type TSK_METADATA = new BlackboardArtifact.Type(57, "TSK_METADATA", bundle.getString("BlackboardArtifact.tskMetadata.text"), Category.DATA_ARTIFACT);
1323 
1329  public static final Type TSK_GPS_TRACK = new BlackboardArtifact.Type(58, "TSK_GPS_TRACK", bundle.getString("BlackboardArtifact.tskTrack.text"), Category.DATA_ARTIFACT);
1330 
1334  public static final Type TSK_WEB_ACCOUNT_TYPE = new BlackboardArtifact.Type(59, "TSK_WEB_ACCOUNT_TYPE", bundle.getString("BlackboardArtifact.tskWebAccountType.text"), Category.ANALYSIS_RESULT);
1335 
1339  public static final Type TSK_SCREEN_SHOTS = new BlackboardArtifact.Type(60, "TSK_SCREEN_SHOTS", bundle.getString("BlackboardArtifact.tskScreenShots.text"), Category.DATA_ARTIFACT);
1340 
1344  public static final Type TSK_PROG_NOTIFICATIONS = new BlackboardArtifact.Type(62, "TSK_PROG_NOTIFICATIONS", bundle.getString("BlackboardArtifact.tskProgNotifications.text"), Category.DATA_ARTIFACT);
1345 
1349  public static final Type TSK_BACKUP_EVENT = new BlackboardArtifact.Type(63, "TSK_BACKUP_EVENT", bundle.getString("BlackboardArtifact.tskBackupEvent.text"), Category.DATA_ARTIFACT);
1350 
1354  public static final Type TSK_DELETED_PROG = new BlackboardArtifact.Type(64, "TSK_DELETED_PROG", bundle.getString("BlackboardArtifact.tskDeletedProg.text"), Category.DATA_ARTIFACT);
1355 
1359  public static final Type TSK_USER_DEVICE_EVENT = new BlackboardArtifact.Type(65, "TSK_USER_DEVICE_EVENT", bundle.getString("BlackboardArtifact.tskUserDeviceEvent.text"), Category.DATA_ARTIFACT);
1360 
1364  public static final Type TSK_YARA_HIT = new BlackboardArtifact.Type(66, "TSK_YARA_HIT", bundle.getString("BlackboardArtifact.tskYaraHit.text"), Category.ANALYSIS_RESULT);
1365 
1369  public static final Type TSK_GPS_AREA = new BlackboardArtifact.Type(67, "TSK_GPS_AREA", bundle.getString("BlackboardArtifact.tskGPSArea.text"), Category.DATA_ARTIFACT);
1370 
1374  public static final Type TSK_WEB_CATEGORIZATION = new BlackboardArtifact.Type(68, "TSK_WEB_CATEGORIZATION", bundle.getString("BlackboardArtifact.tskWebCategorization.text"), Category.ANALYSIS_RESULT);
1375 
1380  public static final Type TSK_PREVIOUSLY_SEEN = new BlackboardArtifact.Type(69, "TSK_PREVIOUSLY_SEEN", bundle.getString("BlackboardArtifact.tskPreviouslySeen.text"), Category.ANALYSIS_RESULT);
1381 
1386  public static final Type TSK_PREVIOUSLY_UNSEEN = new BlackboardArtifact.Type(70, "TSK_PREVIOUSLY_UNSEEN", bundle.getString("BlackboardArtifact.tskPreviouslyUnseen.text"), Category.ANALYSIS_RESULT);
1387 
1392  public static final Type TSK_PREVIOUSLY_NOTABLE = new BlackboardArtifact.Type(71, "TSK_PREVIOUSLY_NOTABLE", bundle.getString("BlackboardArtifact.tskPreviouslyNotable.text"), Category.ANALYSIS_RESULT);
1393 
1398  public static final Type TSK_INTERESTING_ITEM = new BlackboardArtifact.Type(72, "TSK_INTERESTING_ITEM", bundle.getString("BlackboardArtifact.tskInterestingItem.text"), Category.ANALYSIS_RESULT);
1399  /*
1400  * IMPORTANT!
1401  *
1402  * Until BlackboardArtifact.ARTIFACT_TYPE is deprecated and/or removed,
1403  * new standard artifact types need to be added to both
1404  * BlackboardArtifact.ARTIFACT_TYPE and
1405  * BlackboardArtifact.Type.STANDARD_TYPES.
1406  *
1407  * Also, ensure that new types have a one line JavaDoc description and
1408  * are added to the standard artifacts catalog (artifact_catalog.dox).
1409  *
1410  */
1411 
1415  static final Map<Integer, Type> STANDARD_TYPES = Collections.unmodifiableMap(Stream.of(
1416  TSK_GEN_INFO,
1417  TSK_WEB_BOOKMARK,
1418  TSK_WEB_COOKIE,
1419  TSK_WEB_HISTORY,
1420  TSK_WEB_DOWNLOAD,
1421  TSK_RECENT_OBJECT,
1422  TSK_INSTALLED_PROG,
1423  TSK_KEYWORD_HIT,
1424  TSK_HASHSET_HIT,
1425  TSK_DEVICE_ATTACHED,
1426  TSK_EMAIL_MSG,
1427  TSK_EXTRACTED_TEXT,
1428  TSK_WEB_SEARCH_QUERY,
1429  TSK_METADATA_EXIF,
1430  TSK_OS_INFO,
1431  TSK_SERVICE_ACCOUNT,
1432  TSK_CONTACT,
1433  TSK_MESSAGE,
1434  TSK_CALLLOG,
1435  TSK_CALENDAR_ENTRY,
1436  TSK_SPEED_DIAL_ENTRY,
1437  TSK_BLUETOOTH_PAIRING,
1438  TSK_GPS_BOOKMARK,
1439  TSK_GPS_LAST_KNOWN_LOCATION,
1440  TSK_GPS_SEARCH,
1441  TSK_PROG_RUN,
1442  TSK_ENCRYPTION_DETECTED,
1443  TSK_EXT_MISMATCH_DETECTED,
1444  TSK_GPS_ROUTE,
1445  TSK_REMOTE_DRIVE,
1446  TSK_FACE_DETECTED,
1447  TSK_ACCOUNT,
1448  TSK_ENCRYPTION_SUSPECTED,
1449  TSK_OBJECT_DETECTED,
1450  TSK_WIFI_NETWORK,
1451  TSK_DEVICE_INFO,
1452  TSK_SIM_ATTACHED,
1453  TSK_BLUETOOTH_ADAPTER,
1454  TSK_WIFI_NETWORK_ADAPTER,
1455  TSK_VERIFICATION_FAILED,
1456  TSK_DATA_SOURCE_USAGE,
1457  TSK_WEB_FORM_AUTOFILL,
1458  TSK_WEB_FORM_ADDRESS,
1459  TSK_WEB_CACHE,
1460  TSK_TL_EVENT,
1461  TSK_CLIPBOARD_CONTENT,
1462  TSK_ASSOCIATED_OBJECT,
1463  TSK_USER_CONTENT_SUSPECTED,
1464  TSK_METADATA,
1465  TSK_GPS_TRACK,
1466  TSK_WEB_ACCOUNT_TYPE,
1467  TSK_SCREEN_SHOTS,
1468  TSK_PROG_NOTIFICATIONS,
1469  TSK_BACKUP_EVENT,
1470  TSK_DELETED_PROG,
1471  TSK_USER_DEVICE_EVENT,
1472  TSK_YARA_HIT,
1473  TSK_GPS_AREA,
1474  TSK_WEB_CATEGORIZATION,
1475  TSK_PREVIOUSLY_SEEN,
1476  TSK_PREVIOUSLY_UNSEEN,
1477  TSK_PREVIOUSLY_NOTABLE,
1478  TSK_INTERESTING_ITEM
1479  ).collect(Collectors.toMap(type -> type.getTypeID(), type -> type)));
1480 
1481  private final String typeName;
1482  private final int typeID;
1483  private final String displayName;
1484  private final Category category;
1485 
1494  Type(int typeID, String typeName, String displayName, Category category) {
1495  this.typeID = typeID;
1496  this.typeName = typeName;
1497  this.displayName = displayName;
1498  this.category = category;
1499  }
1500 
1506  public Type(ARTIFACT_TYPE type) {
1507  this(type.getTypeID(), type.getLabel(), type.getDisplayName(), type.getCategory());
1508  }
1509 
1515  public String getTypeName() {
1516  return this.typeName;
1517  }
1518 
1524  public int getTypeID() {
1525  return this.typeID;
1526  }
1527 
1533  public String getDisplayName() {
1534  return this.displayName;
1535  }
1536 
1543  return category;
1544  }
1545 
1553  @Override
1554  public boolean equals(Object that) {
1555  if (this == that) {
1556  return true;
1557  } else if (!(that instanceof Type)) {
1558  return false;
1559  } else {
1560  return ((Type) that).sameType(this);
1561  }
1562  }
1563 
1571  private boolean sameType(Type that) {
1572  return this.typeName.equals(that.getTypeName())
1573  && this.displayName.equals(that.getDisplayName())
1574  && this.typeID == that.getTypeID();
1575  }
1576 
1582  @Override
1583  public int hashCode() {
1584  int hash = 11;
1585  hash = 83 * hash + Objects.hashCode(this.typeID);
1586  hash = 83 * hash + Objects.hashCode(this.displayName);
1587  hash = 83 * hash + Objects.hashCode(this.typeName);
1588  return hash;
1589  }
1590  }
1591 
1597  public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
1598 
1602  TSK_GEN_INFO(1, "TSK_GEN_INFO", //NON-NLS
1603  bundle.getString("BlackboardArtifact.tskGenInfo.text"), Category.DATA_ARTIFACT),
1609  TSK_WEB_BOOKMARK(2, "TSK_WEB_BOOKMARK", //NON-NLS
1610  bundle.getString("BlackboardArtifact.tskWebBookmark.text"), Category.DATA_ARTIFACT),
1616  TSK_WEB_COOKIE(3, "TSK_WEB_COOKIE",
1617  bundle.getString("BlackboardArtifact.tskWebCookie.text"), Category.DATA_ARTIFACT), //NON-NLS
1623  TSK_WEB_HISTORY(4, "TSK_WEB_HISTORY", //NON-NLS
1624  bundle.getString("BlackboardArtifact.tskWebHistory.text"), Category.DATA_ARTIFACT),
1630  TSK_WEB_DOWNLOAD(5, "TSK_WEB_DOWNLOAD", //NON-NLS
1631  bundle.getString("BlackboardArtifact.tskWebDownload.text"), Category.DATA_ARTIFACT),
1635  TSK_RECENT_OBJECT(6, "TSK_RECENT_OBJ", //NON-NLS
1636  bundle.getString("BlackboardArtifact.tsk.recentObject.text"), Category.DATA_ARTIFACT),
1642  @Deprecated
1643  TSK_GPS_TRACKPOINT(7, "TSK_GPS_TRACKPOINT", //NON-NLS
1644  bundle.getString("BlackboardArtifact.tskGpsTrackpoint.text"), Category.DATA_ARTIFACT),
1648  TSK_INSTALLED_PROG(8, "TSK_INSTALLED_PROG", //NON-NLS
1649  bundle.getString("BlackboardArtifact.tskInstalledProg.text"), Category.DATA_ARTIFACT),
1653  TSK_KEYWORD_HIT(9, "TSK_KEYWORD_HIT",
1654  bundle.getString("BlackboardArtifact.tskKeywordHits.text"), Category.ANALYSIS_RESULT),
1658  TSK_HASHSET_HIT(10, "TSK_HASHSET_HIT", //NON-NLS
1659  bundle.getString("BlackboardArtifact.tskHashsetHit.text"), Category.ANALYSIS_RESULT),
1663  TSK_DEVICE_ATTACHED(11, "TSK_DEVICE_ATTACHED", //NON-NLS
1664  bundle.getString("BlackboardArtifact.tskDeviceAttached.text"), Category.DATA_ARTIFACT),
1671  @Deprecated
1672  TSK_INTERESTING_FILE_HIT(12, "TSK_INTERESTING_FILE_HIT", //NON-NLS
1673  bundle.getString("BlackboardArtifact.tskInterestingFileHit.text"), Category.ANALYSIS_RESULT),
1674 
1677  TSK_EMAIL_MSG(13, "TSK_EMAIL_MSG", //NON-NLS
1678  bundle.getString("BlackboardArtifact.tskEmailMsg.text"), Category.DATA_ARTIFACT),
1682  TSK_EXTRACTED_TEXT(14, "TSK_EXTRACTED_TEXT", //NON-NLS
1683  bundle.getString("BlackboardArtifact.tskExtractedText.text"), Category.DATA_ARTIFACT),
1687  TSK_WEB_SEARCH_QUERY(15, "TSK_WEB_SEARCH_QUERY", //NON-NLS
1688  bundle.getString("BlackboardArtifact.tskWebSearchQuery.text"), Category.DATA_ARTIFACT),
1692  TSK_METADATA_EXIF(16, "TSK_METADATA_EXIF", //NON-NLS
1693  bundle.getString("BlackboardArtifact.tskMetadataExif.text"), Category.ANALYSIS_RESULT),
1699  @Deprecated
1700  TSK_TAG_FILE(17, "TSK_TAG_FILE", //NON-NLS
1701  bundle.getString("BlackboardArtifact.tagFile.text"), Category.ANALYSIS_RESULT),
1707  @Deprecated
1708  TSK_TAG_ARTIFACT(18, "TSK_TAG_ARTIFACT", //NON-NLS
1709  bundle.getString("BlackboardArtifact.tskTagArtifact.text"), Category.ANALYSIS_RESULT),
1713  TSK_OS_INFO(19, "TSK_OS_INFO", //NON-NLS
1714  bundle.getString("BlackboardArtifact.tskOsInfo.text"), Category.DATA_ARTIFACT),
1718  @Deprecated
1719  TSK_OS_ACCOUNT(20, "TSK_OS_ACCOUNT", //NON-NLS
1720  bundle.getString("BlackboardArtifact.tskOsAccount.text"), Category.DATA_ARTIFACT),
1724  TSK_SERVICE_ACCOUNT(21, "TSK_SERVICE_ACCOUNT", //NON-NLS
1725  bundle.getString("BlackboardArtifact.tskServiceAccount.text"), Category.DATA_ARTIFACT),
1731  @Deprecated
1732  TSK_TOOL_OUTPUT(22, "TSK_TOOL_OUTPUT", //NON-NLS
1733  bundle.getString("BlackboardArtifact.tskToolOutput.text"), Category.DATA_ARTIFACT),
1740  TSK_CONTACT(23, "TSK_CONTACT", //NON-NLS
1741  bundle.getString("BlackboardArtifact.tskContact.text"), Category.DATA_ARTIFACT),
1748  TSK_MESSAGE(24, "TSK_MESSAGE", //NON-NLS
1749  bundle.getString("BlackboardArtifact.tskMessage.text"), Category.DATA_ARTIFACT),
1756  TSK_CALLLOG(25, "TSK_CALLLOG", //NON-NLS
1757  bundle.getString("BlackboardArtifact.tskCalllog.text"), Category.DATA_ARTIFACT),
1761  TSK_CALENDAR_ENTRY(26, "TSK_CALENDAR_ENTRY", //NON-NLS
1762  bundle.getString("BlackboardArtifact.tskCalendarEntry.text"), Category.DATA_ARTIFACT),
1766  TSK_SPEED_DIAL_ENTRY(27, "TSK_SPEED_DIAL_ENTRY", //NON-NLS
1767  bundle.getString("BlackboardArtifact.tskSpeedDialEntry.text"), Category.DATA_ARTIFACT),
1771  TSK_BLUETOOTH_PAIRING(28, "TSK_BLUETOOTH_PAIRING", //NON-NLS
1772  bundle.getString("BlackboardArtifact.tskBluetoothPairing.text"), Category.DATA_ARTIFACT),
1776  TSK_GPS_BOOKMARK(29, "TSK_GPS_BOOKMARK", //NON-NLS
1777  bundle.getString("BlackboardArtifact.tskGpsBookmark.text"), Category.DATA_ARTIFACT),
1781  TSK_GPS_LAST_KNOWN_LOCATION(30, "TSK_GPS_LAST_KNOWN_LOCATION", //NON-NLS
1782  bundle.getString("BlackboardArtifact.tskGpsLastKnownLocation.text"), Category.DATA_ARTIFACT),
1786  TSK_GPS_SEARCH(31, "TSK_GPS_SEARCH", //NON-NLS
1787  bundle.getString("BlackboardArtifact.tskGpsSearch.text"), Category.DATA_ARTIFACT),
1791  TSK_PROG_RUN(32, "TSK_PROG_RUN", //NON-NLS
1792  bundle.getString("BlackboardArtifact.tskProgRun.text"), Category.DATA_ARTIFACT),
1796  TSK_ENCRYPTION_DETECTED(33, "TSK_ENCRYPTION_DETECTED", //NON-NLS
1797  bundle.getString("BlackboardArtifact.tskEncryptionDetected.text"), Category.ANALYSIS_RESULT),
1801  TSK_EXT_MISMATCH_DETECTED(34, "TSK_EXT_MISMATCH_DETECTED", //NON-NLS
1802  bundle.getString("BlackboardArtifact.tskExtMismatchDetected.text"), Category.ANALYSIS_RESULT),
1809  @Deprecated
1810  TSK_INTERESTING_ARTIFACT_HIT(35, "TSK_INTERESTING_ARTIFACT_HIT", //NON-NLS
1811  bundle.getString("BlackboardArtifact.tskInterestingArtifactHit.text"), Category.ANALYSIS_RESULT),
1817  TSK_GPS_ROUTE(36, "TSK_GPS_ROUTE", //NON-NLS
1818  bundle.getString("BlackboardArtifact.tskGpsRoute.text"), Category.DATA_ARTIFACT),
1822  TSK_REMOTE_DRIVE(37, "TSK_REMOTE_DRIVE", //NON-NLS
1823  bundle.getString("BlackboardArtifact.tskRemoteDrive.text"), Category.DATA_ARTIFACT),
1827  TSK_FACE_DETECTED(38, "TSK_FACE_DETECTED", //NON-NLS
1828  bundle.getString("BlackboardArtifact.tskFaceDetected.text"), Category.ANALYSIS_RESULT),
1832  TSK_ACCOUNT(39, "TSK_ACCOUNT", //NON-NLS
1833  bundle.getString("BlackboardArtifact.tskAccount.text"), Category.DATA_ARTIFACT),
1837  TSK_ENCRYPTION_SUSPECTED(40, "TSK_ENCRYPTION_SUSPECTED", //NON-NLS
1838  bundle.getString("BlackboardArtifact.tskEncryptionSuspected.text"), Category.ANALYSIS_RESULT),
1839  /*
1840  * A classifier detected an object in a media file.
1841  */
1842  TSK_OBJECT_DETECTED(41, "TSK_OBJECT_DETECTED", //NON-NLS
1843  bundle.getString("BlackboardArtifact.tskObjectDetected.text"), Category.ANALYSIS_RESULT),
1847  TSK_WIFI_NETWORK(42, "TSK_WIFI_NETWORK", //NON-NLS
1848  bundle.getString("BlackboardArtifact.tskWIFINetwork.text"), Category.DATA_ARTIFACT),
1852  TSK_DEVICE_INFO(43, "TSK_DEVICE_INFO", //NON-NLS
1853  bundle.getString("BlackboardArtifact.tskDeviceInfo.text"), Category.DATA_ARTIFACT),
1857  TSK_SIM_ATTACHED(44, "TSK_SIM_ATTACHED", //NON-NLS
1858  bundle.getString("BlackboardArtifact.tskSimAttached.text"), Category.DATA_ARTIFACT),
1862  TSK_BLUETOOTH_ADAPTER(45, "TSK_BLUETOOTH_ADAPTER", //NON-NLS
1863  bundle.getString("BlackboardArtifact.tskBluetoothAdapter.text"), Category.DATA_ARTIFACT),
1867  TSK_WIFI_NETWORK_ADAPTER(46, "TSK_WIFI_NETWORK_ADAPTER", //NON-NLS
1868  bundle.getString("BlackboardArtifact.tskWIFINetworkAdapter.text"), Category.DATA_ARTIFACT),
1872  TSK_VERIFICATION_FAILED(47, "TSK_VERIFICATION_FAILED", //NON-NLS
1873  bundle.getString("BlackboardArtifact.tskVerificationFailed.text"), Category.ANALYSIS_RESULT),
1877  TSK_DATA_SOURCE_USAGE(48, "TSK_DATA_SOURCE_USAGE", //NON-NLS
1878  bundle.getString("BlackboardArtifact.tskDataSourceUsage.text"), Category.ANALYSIS_RESULT),
1884  TSK_WEB_FORM_AUTOFILL(49, "TSK_WEB_FORM_AUTOFILL", //NON-NLS
1885  bundle.getString("BlackboardArtifact.tskWebFormAutofill.text"), Category.DATA_ARTIFACT),
1891  TSK_WEB_FORM_ADDRESS(50, "TSK_WEB_FORM_ADDRESSES ", //NON-NLS
1892  bundle.getString("BlackboardArtifact.tskWebFormAddresses.text"), Category.DATA_ARTIFACT),
1899  @Deprecated
1900  TSK_DOWNLOAD_SOURCE(51, "TSK_DOWNLOAD_SOURCE", //NON-NLS
1901  bundle.getString("BlackboardArtifact.tskDownloadSource.text"), Category.DATA_ARTIFACT),
1905  TSK_WEB_CACHE(52, "TSK_WEB_CACHE", //NON-NLS
1906  bundle.getString("BlackboardArtifact.tskWebCache.text"), Category.DATA_ARTIFACT),
1910  TSK_TL_EVENT(53, "TSK_TL_EVENT", //NON-NLS
1911  bundle.getString("BlackboardArtifact.tskTLEvent.text"), Category.DATA_ARTIFACT),
1915  TSK_CLIPBOARD_CONTENT(54, "TSK_CLIPBOARD_CONTENT", //NON-NLS
1916  bundle.getString("BlackboardArtifact.tskClipboardContent.text"), Category.DATA_ARTIFACT),
1920  TSK_ASSOCIATED_OBJECT(55, "TSK_ASSOCIATED_OBJECT", //NON-NLS
1921  bundle.getString("BlackboardArtifact.tskAssociatedObject.text"), Category.DATA_ARTIFACT),
1925  TSK_USER_CONTENT_SUSPECTED(56, "TSK_USER_CONTENT_SUSPECTED", //NON-NLS
1926  bundle.getString("BlackboardArtifact.tskUserContentSuspected.text"), Category.ANALYSIS_RESULT),
1930  TSK_METADATA(57, "TSK_METADATA", //NON-NLS
1931  bundle.getString("BlackboardArtifact.tskMetadata.text"), Category.DATA_ARTIFACT),
1937  TSK_GPS_TRACK(58, "TSK_GPS_TRACK",
1938  bundle.getString("BlackboardArtifact.tskTrack.text"), Category.DATA_ARTIFACT),
1942  TSK_WEB_ACCOUNT_TYPE(59, "TSK_WEB_ACCOUNT_TYPE",
1943  bundle.getString("BlackboardArtifact.tskWebAccountType.text"), Category.ANALYSIS_RESULT),
1947  TSK_SCREEN_SHOTS(60, "TSK_SCREEN_SHOTS",
1948  bundle.getString("BlackboardArtifact.tskScreenShots.text"), Category.DATA_ARTIFACT),
1952  TSK_PROG_NOTIFICATIONS(62, "TSK_PROG_NOTIFICATIONS",
1953  bundle.getString("BlackboardArtifact.tskProgNotifications.text"), Category.DATA_ARTIFACT),
1957  TSK_BACKUP_EVENT(63, "TSK_BACKUP_EVENT",
1958  bundle.getString("BlackboardArtifact.tskBackupEvent.text"), Category.DATA_ARTIFACT),
1962  TSK_DELETED_PROG(64, "TSK_DELETED_PROG",
1963  bundle.getString("BlackboardArtifact.tskDeletedProg.text"), Category.DATA_ARTIFACT),
1967  TSK_USER_DEVICE_EVENT(65, "TSK_USER_DEVICE_EVENT",
1968  bundle.getString("BlackboardArtifact.tskUserDeviceEvent.text"), Category.DATA_ARTIFACT),
1972  TSK_YARA_HIT(66, "TSK_YARA_HIT",
1973  bundle.getString("BlackboardArtifact.tskYaraHit.text"), Category.ANALYSIS_RESULT),
1977  TSK_GPS_AREA(67, "TSK_GPS_AREA",
1978  bundle.getString("BlackboardArtifact.tskGPSArea.text"), Category.DATA_ARTIFACT),
1979  TSK_WEB_CATEGORIZATION(68, "TSK_WEB_CATEGORIZATION",
1980  bundle.getString("BlackboardArtifact.tskWebCategorization.text"), Category.ANALYSIS_RESULT),
1985  TSK_PREVIOUSLY_SEEN(69, "TSK_PREVIOUSLY_SEEN",
1986  bundle.getString("BlackboardArtifact.tskPreviouslySeen.text"), Category.ANALYSIS_RESULT),
1991  TSK_PREVIOUSLY_UNSEEN(70, "TSK_PREVIOUSLY_UNSEEN",
1992  bundle.getString("BlackboardArtifact.tskPreviouslyUnseen.text"), Category.ANALYSIS_RESULT),
1997  TSK_PREVIOUSLY_NOTABLE(71, "TSK_PREVIOUSLY_NOTABLE",
1998  bundle.getString("BlackboardArtifact.tskPreviouslyNotable.text"), Category.ANALYSIS_RESULT),
2003  TSK_INTERESTING_ITEM(72, "TSK_INTERESTING_ITEM", //NON-NLS
2004  bundle.getString("BlackboardArtifact.tskInterestingItem.text"), Category.ANALYSIS_RESULT);
2005  /*
2006  * IMPORTANT!
2007  *
2008  * Until BlackboardArtifact.ARTIFACT_TYPE is deprecated and/or removed,
2009  * new standard artifact types need to be added to both
2010  * BlackboardArtifact.ARTIFACT_TYPE and
2011  * BlackboardArtifact.Type.STANDARD_TYPES.
2012  *
2013  * Also, ensure that new types have a one line JavaDoc description and
2014  * are added to the standard artifacts catalog (artifact_catalog.dox).
2015  */
2016 
2017  private final String label;
2018  private final int typeId;
2019  private final String displayName;
2020  private final Category category;
2021 
2029  private ARTIFACT_TYPE(int typeId, String label, String displayName) {
2030  this(typeId, label, displayName, Category.DATA_ARTIFACT);
2031  }
2032 
2041  private ARTIFACT_TYPE(int typeId, String label, String displayName, Category category) {
2042  this.typeId = typeId;
2043  this.label = label;
2044  this.displayName = displayName;
2045  this.category = category;
2046  }
2047 
2053  public int getTypeID() {
2054  return this.typeId;
2055  }
2056 
2062  public String getLabel() {
2063  return this.label;
2064  }
2065 
2072  return this.category;
2073  }
2074 
2083  static public ARTIFACT_TYPE fromLabel(String label) {
2084  for (ARTIFACT_TYPE value : ARTIFACT_TYPE.values()) {
2085  if (value.getLabel().equals(label)) {
2086  return value;
2087  }
2088  }
2089  throw new IllegalArgumentException("No ARTIFACT_TYPE matching type: " + label);
2090  }
2091 
2102  static public ARTIFACT_TYPE fromID(int id) {
2103  for (ARTIFACT_TYPE value : ARTIFACT_TYPE.values()) {
2104  if (value.getTypeID() == id) {
2105  return value;
2106  }
2107  }
2108  throw new IllegalArgumentException("No ARTIFACT_TYPE matching type: " + id);
2109  }
2110 
2116  public String getDisplayName() {
2117  return displayName;
2118  }
2119 
2131  @Override
2132  public <T> T accept(SleuthkitItemVisitor<T> visitor) {
2133  return visitor.visit(this);
2134  }
2135 
2136  }
2137 
2145  public enum Category {
2146  // NOTE: The schema code defaults to '0', so that code must be updated too if DATA_ARTIFACT changes from being 0
2147  DATA_ARTIFACT(0, "DATA_ARTIFACT", ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle").getString("CategoryType.DataArtifact")), // artifact is data that is directly/indirectly extracted from a data source.
2148  ANALYSIS_RESULT(1, "ANALYSIS_RESULT", ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle").getString("CategoryType.AnalysisResult")); // artifacts represents outcome of analysis of data.
2149 
2150  private final Integer id;
2151  private final String name;
2152  private final String displayName;
2153 
2154  private final static Map<Integer, Category> idToCategory = new HashMap<Integer, Category>();
2155 
2156  static {
2157  for (Category status : values()) {
2158  idToCategory.put(status.getID(), status);
2159  }
2160  }
2161 
2169  private Category(Integer id, String name, String displayName) {
2170  this.id = id;
2171  this.name = name;
2172  this.displayName = displayName;
2173  }
2174 
2182  public static Category fromID(int id) {
2183  return idToCategory.get(id);
2184  }
2185 
2191  public Integer getID() {
2192  return id;
2193  }
2194 
2200  String getName() {
2201  return name;
2202  }
2203 
2209  public String getDisplayName() {
2210  return displayName;
2211  }
2212  }
2213 
2217  public enum ReviewStatus {
2218 
2219  APPROVED(1, "APPROVED", "ReviewStatus.Approved"), //approved by human user
2220  REJECTED(2, "REJECTED", "ReviewStatus.Rejected"), //rejected by humna user
2221  UNDECIDED(3, "UNDECIDED", "ReviewStatus.Undecided"); // not yet reviewed by human user
2222 
2223  private final Integer id;
2224  private final String name;
2225  private final String displayName;
2226  private final static Map<Integer, ReviewStatus> idToStatus = new HashMap<Integer, ReviewStatus>();
2227 
2228  static {
2229  for (ReviewStatus status : values()) {
2230  idToStatus.put(status.getID(), status);
2231  }
2232  }
2233 
2242  private ReviewStatus(Integer id, String name, String displayNameKey) {
2243  this.id = id;
2244  this.name = name;
2245  this.displayName = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle").getString(displayNameKey);
2246  }
2247 
2255  public static ReviewStatus withID(int id) {
2256  return idToStatus.get(id);
2257  }
2258 
2264  public Integer getID() {
2265  return id;
2266  }
2267 
2273  String getName() {
2274  return name;
2275  }
2276 
2282  public String getDisplayName() {
2283  return displayName;
2284  }
2285  }
2286 
2308  @Deprecated
2309  protected BlackboardArtifact(SleuthkitCase sleuthkitCase, long artifactID, long objID, long artifactObjID, long dataSourceObjId, int artifactTypeID, String artifactTypeName, String displayName) {
2310  this(sleuthkitCase, artifactID, objID, artifactObjID, dataSourceObjId, artifactTypeID, artifactTypeName, displayName, ReviewStatus.UNDECIDED);
2311  }
2312 
2327  @Deprecated
2328  public List<BlackboardAttribute> getAttributes(final BlackboardAttribute.ATTRIBUTE_TYPE attributeType) throws TskCoreException {
2329  if (loadedCacheFromDb == false) {
2330  List<BlackboardAttribute> attrs = getSleuthkitCase().getBlackboardAttributes(this);
2331  attrsCache.clear();
2332  attrsCache.addAll(attrs);
2333  loadedCacheFromDb = true;
2334  }
2335  ArrayList<BlackboardAttribute> filteredAttributes = new ArrayList<BlackboardAttribute>();
2336  for (BlackboardAttribute attr : attrsCache) {
2337  if (attr.getAttributeType().getTypeID() == attributeType.getTypeID()) {
2338  filteredAttributes.add(attr);
2339  }
2340  }
2341  return filteredAttributes;
2342  }
2343 
2344  @Override
2345  public long getId() {
2346  return this.artifactObjId;
2347  }
2348 
2357  @Override
2358  public List<Long> getChildrenIds() throws TskCoreException {
2359  List<Long> childrenIDs = new ArrayList<Long>();
2360  childrenIDs.addAll(getSleuthkitCase().getAbstractFileChildrenIds(this));
2361  childrenIDs.addAll(getSleuthkitCase().getBlackboardArtifactChildrenIds(this));
2362 
2363  return childrenIDs;
2364  }
2365 
2366  @Override
2367  public int getChildrenCount() throws TskCoreException {
2368  if (childrenCount != -1) {
2369  return childrenCount;
2370  }
2371 
2372  childrenCount = this.getSleuthkitCase().getContentChildrenCount(this);
2373 
2374  hasChildren = childrenCount > 0;
2375  checkedHasChildren = true;
2376 
2377  return childrenCount;
2378  }
2379 
2380  @Override
2381  public boolean hasChildren() throws TskCoreException {
2382  if (checkedHasChildren == true) {
2383  return hasChildren;
2384  }
2385 
2386  childrenCount = this.getSleuthkitCase().getContentChildrenCount(this);
2387 
2388  hasChildren = childrenCount > 0;
2389  checkedHasChildren = true;
2390 
2391  return hasChildren;
2392  }
2393 
2402  @Override
2403  public List<Content> getChildren() throws TskCoreException {
2404  List<Content> children = new ArrayList<>();
2405  children.addAll(getSleuthkitCase().getAbstractFileChildren(this));
2406  children.addAll(getSleuthkitCase().getBlackboardArtifactChildren(this));
2407 
2408  return children;
2409  }
2410 }
ArrayList< BlackboardArtifact > getArtifacts(int artifactTypeID)
ArrayList< BlackboardAttribute > getBlackboardAttributes(final BlackboardArtifact artifact)
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId)
void addBlackboardAttributes(Collection< BlackboardAttribute > attributes, int artifactTypeId)
void addAttributes(Collection< BlackboardAttribute > attributes)
void addBlackboardAttribute(BlackboardAttribute attr, int artifactTypeId)
ArrayList< BlackboardAttribute > getBlackboardAttributes(final BlackboardArtifact artifact)
List< BlackboardAttribute > getAttributes(final BlackboardAttribute.ATTRIBUTE_TYPE attributeType)
final int read(byte[] buf, long offset, long len)
void addAttribute(BlackboardAttribute attribute)
ArrayList< BlackboardArtifact > getArtifacts(BlackboardArtifact.ARTIFACT_TYPE type)
AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList)
List< AnalysisResult > getAnalysisResults(long dataSourceObjId, Integer artifactTypeID)
public< T > T accept(SleuthkitItemVisitor< T > visitor)
void addAttributes(Collection< BlackboardAttribute > attributes, final SleuthkitCase.CaseDbTransaction caseDbTransaction)
BlackboardArtifact newArtifact(int artifactTypeID)
BlackboardAttribute getAttribute(BlackboardAttribute.Type attributeType)
long getArtifactsCount(String artifactTypeName)
BlackboardArtifact.Type getArtifactType(String artTypeName)
List< AnalysisResult > getAnalysisResults(BlackboardArtifact.Type artifactType)
BlackboardArtifact getGenInfoArtifact(boolean create)
AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId)
ArrayList< BlackboardArtifact > getArtifacts(String artifactTypeName)
BlackboardArtifact(SleuthkitCase sleuthkitCase, long artifactID, long objID, long artifactObjID, long dataSourceObjId, int artifactTypeID, String artifactTypeName, String displayName)
AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, long objId, Long dataSourceObjId, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList)
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId)
ArrayList< BlackboardArtifact > getAllArtifacts()
long getArtifactsCount(BlackboardArtifact.ARTIFACT_TYPE type)
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList)
ArrayList< BlackboardAttribute > getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE attr_type)
BlackboardArtifact newArtifact(BlackboardArtifact.ARTIFACT_TYPE type)
void setReviewStatus(BlackboardArtifact artifact, BlackboardArtifact.ReviewStatus newStatus)

Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.