19 package org.sleuthkit.datamodel;
21 import com.google.common.net.InternetDomainName;
22 import java.text.MessageFormat;
23 import java.util.Optional;
24 import java.util.logging.Level;
25 import java.util.logging.Logger;
26 import org.apache.commons.lang3.StringUtils;
32 class TimelineEventArtifactTypeImpl
extends TimelineEventTypeImpl {
34 private static final Logger logger = Logger.getLogger(TimelineEventArtifactTypeImpl.class.getName());
36 static final int EMAIL_FULL_DESCRIPTION_LENGTH_MAX = 150;
37 static final int EMAIL_TO_FROM_LENGTH_MAX = 75;
39 private final BlackboardArtifact.Type artifactType;
40 private final BlackboardAttribute.Type dateTimeAttributeType;
41 private final TSKCoreCheckedFunction<BlackboardArtifact, String> fullExtractor;
42 private final TSKCoreCheckedFunction<BlackboardArtifact, String> medExtractor;
43 private final TSKCoreCheckedFunction<BlackboardArtifact, String> shortExtractor;
44 private final TSKCoreCheckedFunction<BlackboardArtifact, TimelineEventDescriptionWithTime> artifactParsingFunction;
46 protected static final int MAX_SHORT_DESCRIPTION_LENGTH = 500;
47 protected static final int MAX_MED_DESCRIPTION_LENGTH = 500;
48 protected static final int MAX_FULL_DESCRIPTION_LENGTH = 1024;
50 TimelineEventArtifactTypeImpl(
int typeID, String displayName,
51 TimelineEventType superType,
52 BlackboardArtifact.Type artifactType,
53 BlackboardAttribute.Type dateTimeAttributeType,
54 TSKCoreCheckedFunction<BlackboardArtifact, String> shortExtractor,
55 TSKCoreCheckedFunction<BlackboardArtifact, String> medExtractor,
56 TSKCoreCheckedFunction<BlackboardArtifact, String> fullExtractor) {
57 this(typeID, displayName, superType, artifactType, dateTimeAttributeType, shortExtractor, medExtractor, fullExtractor, null);
60 TimelineEventArtifactTypeImpl(
int typeID, String displayName,
61 TimelineEventType superType,
62 BlackboardArtifact.Type artifactType,
63 BlackboardAttribute.Type dateTimeAttributeType,
64 TSKCoreCheckedFunction<BlackboardArtifact, String> shortExtractor,
65 TSKCoreCheckedFunction<BlackboardArtifact, String> medExtractor,
66 TSKCoreCheckedFunction<BlackboardArtifact, String> fullExtractor,
67 TSKCoreCheckedFunction<BlackboardArtifact, TimelineEventDescriptionWithTime> eventPayloadFunction) {
69 super(typeID, displayName, TimelineEventType.HierarchyLevel.EVENT, superType);
70 this.artifactType = artifactType;
71 this.dateTimeAttributeType = dateTimeAttributeType;
72 this.shortExtractor = shortExtractor;
73 this.medExtractor = medExtractor;
74 this.fullExtractor = fullExtractor;
75 this.artifactParsingFunction = eventPayloadFunction;
78 int getArtifactTypeID() {
79 return getArtifactType().getTypeID();
87 BlackboardAttribute.Type getDateTimeAttributeType() {
88 return dateTimeAttributeType;
91 String extractFullDescription(BlackboardArtifact artf)
throws TskCoreException {
92 return fullExtractor.apply(artf);
95 String extractMedDescription(BlackboardArtifact artf)
throws TskCoreException {
96 return medExtractor.apply(artf);
99 String extractShortDescription(BlackboardArtifact artf)
throws TskCoreException {
100 return shortExtractor.apply(artf);
108 BlackboardArtifact.Type getArtifactType() {
121 TimelineEventDescriptionWithTime makeEventDescription(BlackboardArtifact artifact)
throws TskCoreException {
124 if (this.getArtifactTypeID() != artifact.getArtifactTypeID()) {
125 throw new IllegalArgumentException();
127 BlackboardAttribute timeAttribute = artifact.getAttribute(getDateTimeAttributeType());
128 if (timeAttribute == null) {
139 if (this.artifactParsingFunction != null) {
141 return this.artifactParsingFunction.apply(artifact);
145 String shortDescription = extractShortDescription(artifact);
146 if (shortDescription.length() > MAX_SHORT_DESCRIPTION_LENGTH) {
147 shortDescription = shortDescription.substring(0, MAX_SHORT_DESCRIPTION_LENGTH);
150 String medDescription = shortDescription +
" : " + extractMedDescription(artifact);
151 if (medDescription.length() > MAX_MED_DESCRIPTION_LENGTH) {
152 medDescription = medDescription.substring(0, MAX_MED_DESCRIPTION_LENGTH);
155 String fullDescription = medDescription +
" : " + extractFullDescription(artifact);
156 if (fullDescription.length() > MAX_FULL_DESCRIPTION_LENGTH) {
157 fullDescription = fullDescription.substring(0, MAX_FULL_DESCRIPTION_LENGTH);
160 return new TimelineEventDescriptionWithTime(timeAttribute.getValueLong(), shortDescription, medDescription, fullDescription);
163 static BlackboardAttribute getAttributeSafe(BlackboardArtifact artf, BlackboardAttribute.Type attrType) {
165 return artf.getAttribute(attrType);
166 }
catch (TskCoreException ex) {
167 logger.log(Level.SEVERE, MessageFormat.format(
"Error getting attribute from artifact {0}.", artf.getArtifactID()), ex);
176 static class AttributeExtractor
implements TSKCoreCheckedFunction<BlackboardArtifact, String> {
178 private final BlackboardAttribute.Type attributeType;
180 AttributeExtractor(BlackboardAttribute.Type attribute) {
181 this.attributeType = attribute;
185 public String apply(BlackboardArtifact artf)
throws TskCoreException {
186 return Optional.ofNullable(getAttributeSafe(artf, attributeType))
197 final static class TopPrivateDomainExtractor
extends AttributeExtractor {
199 final private static TopPrivateDomainExtractor instance =
new TopPrivateDomainExtractor();
201 static TopPrivateDomainExtractor getInstance() {
205 TopPrivateDomainExtractor() {
206 super(
new BlackboardAttribute.Type(TSK_DOMAIN));
210 public String apply(BlackboardArtifact artf)
throws TskCoreException {
211 String domainString = StringUtils.substringBefore(super.apply(artf),
"/");
212 if (InternetDomainName.isValid(domainString)) {
213 InternetDomainName domain = InternetDomainName.from(domainString);
214 return (domain.isUnderPublicSuffix())
215 ? domain.topPrivateDomain().toString()
231 interface TSKCoreCheckedFunction<I, O> {
233 O apply(I input)
throws TskCoreException;
String getDisplayString()