Sleuth Kit Java Bindings (JNI)  4.11.1
Java bindings for using The Sleuth Kit
TimelineEventArtifactTypeImpl.java
Go to the documentation of this file.
1 /*
2  * Sleuth Kit Data Model
3  *
4  * Copyright 2018 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import com.google.common.net.InternetDomainName;
22 import java.text.MessageFormat;
23 import java.util.Optional;
24 import java.util.logging.Level;
25 import java.util.logging.Logger;
26 import org.apache.commons.lang3.StringUtils;
28 
32 class TimelineEventArtifactTypeImpl extends TimelineEventTypeImpl {
33 
34  private static final Logger logger = Logger.getLogger(TimelineEventArtifactTypeImpl.class.getName());
35 
36  static final int EMAIL_FULL_DESCRIPTION_LENGTH_MAX = 150;
37  static final int EMAIL_TO_FROM_LENGTH_MAX = 75;
38 
39  private final BlackboardArtifact.Type artifactType;
40  private final BlackboardAttribute.Type dateTimeAttributeType;
41  private final TSKCoreCheckedFunction<BlackboardArtifact, String> fullExtractor;
42  private final TSKCoreCheckedFunction<BlackboardArtifact, String> medExtractor;
43  private final TSKCoreCheckedFunction<BlackboardArtifact, String> shortExtractor;
44  private final TSKCoreCheckedFunction<BlackboardArtifact, TimelineEventDescriptionWithTime> artifactParsingFunction;
45 
46  protected static final int MAX_SHORT_DESCRIPTION_LENGTH = 500;
47  protected static final int MAX_MED_DESCRIPTION_LENGTH = 500;
48  protected static final int MAX_FULL_DESCRIPTION_LENGTH = 1024;
49 
50  TimelineEventArtifactTypeImpl(int typeID, String displayName,
51  TimelineEventType superType,
52  BlackboardArtifact.Type artifactType,
53  BlackboardAttribute.Type dateTimeAttributeType,
54  TSKCoreCheckedFunction<BlackboardArtifact, String> shortExtractor,
55  TSKCoreCheckedFunction<BlackboardArtifact, String> medExtractor,
56  TSKCoreCheckedFunction<BlackboardArtifact, String> fullExtractor) {
57  this(typeID, displayName, superType, artifactType, dateTimeAttributeType, shortExtractor, medExtractor, fullExtractor, null);
58  }
59 
60  TimelineEventArtifactTypeImpl(int typeID, String displayName,
61  TimelineEventType superType,
62  BlackboardArtifact.Type artifactType,
63  BlackboardAttribute.Type dateTimeAttributeType,
64  TSKCoreCheckedFunction<BlackboardArtifact, String> shortExtractor,
65  TSKCoreCheckedFunction<BlackboardArtifact, String> medExtractor,
66  TSKCoreCheckedFunction<BlackboardArtifact, String> fullExtractor,
67  TSKCoreCheckedFunction<BlackboardArtifact, TimelineEventDescriptionWithTime> eventPayloadFunction) {
68 
69  super(typeID, displayName, TimelineEventType.HierarchyLevel.EVENT, superType);
70  this.artifactType = artifactType;
71  this.dateTimeAttributeType = dateTimeAttributeType;
72  this.shortExtractor = shortExtractor;
73  this.medExtractor = medExtractor;
74  this.fullExtractor = fullExtractor;
75  this.artifactParsingFunction = eventPayloadFunction;
76  }
77 
78  int getArtifactTypeID() {
79  return getArtifactType().getTypeID();
80  }
81 
87  BlackboardAttribute.Type getDateTimeAttributeType() {
88  return dateTimeAttributeType;
89  }
90 
91  String extractFullDescription(BlackboardArtifact artf) throws TskCoreException {
92  return fullExtractor.apply(artf);
93  }
94 
95  String extractMedDescription(BlackboardArtifact artf) throws TskCoreException {
96  return medExtractor.apply(artf);
97  }
98 
99  String extractShortDescription(BlackboardArtifact artf) throws TskCoreException {
100  return shortExtractor.apply(artf);
101  }
102 
108  BlackboardArtifact.Type getArtifactType() {
109  return artifactType;
110  }
111 
121  TimelineEventDescriptionWithTime makeEventDescription(BlackboardArtifact artifact) throws TskCoreException {
122  //if we got passed an artifact that doesn't correspond to this event type,
123  //something went very wrong. throw an exception.
124  if (this.getArtifactTypeID() != artifact.getArtifactTypeID()) {
125  throw new IllegalArgumentException();
126  }
127  BlackboardAttribute timeAttribute = artifact.getAttribute(getDateTimeAttributeType());
128  if (timeAttribute == null) {
129  /*
130  * This has the side effect of making sure that a TimelineEvent
131  * object is not created for this artifact.
132  */
133  return null;
134  }
135 
136  /*
137  * Use the type-specific method
138  */
139  if (this.artifactParsingFunction != null) {
140  //use the hook provided by this subtype implementation to build the descriptions.
141  return this.artifactParsingFunction.apply(artifact);
142  }
143 
144  //combine descriptions in standard way
145  String shortDescription = extractShortDescription(artifact);
146  if (shortDescription.length() > MAX_SHORT_DESCRIPTION_LENGTH) {
147  shortDescription = shortDescription.substring(0, MAX_SHORT_DESCRIPTION_LENGTH);
148  }
149 
150  String medDescription = shortDescription + " : " + extractMedDescription(artifact);
151  if (medDescription.length() > MAX_MED_DESCRIPTION_LENGTH) {
152  medDescription = medDescription.substring(0, MAX_MED_DESCRIPTION_LENGTH);
153  }
154 
155  String fullDescription = medDescription + " : " + extractFullDescription(artifact);
156  if (fullDescription.length() > MAX_FULL_DESCRIPTION_LENGTH) {
157  fullDescription = fullDescription.substring(0, MAX_FULL_DESCRIPTION_LENGTH);
158  }
159 
160  return new TimelineEventDescriptionWithTime(timeAttribute.getValueLong(), shortDescription, medDescription, fullDescription);
161  }
162 
163  static BlackboardAttribute getAttributeSafe(BlackboardArtifact artf, BlackboardAttribute.Type attrType) {
164  try {
165  return artf.getAttribute(attrType);
166  } catch (TskCoreException ex) {
167  logger.log(Level.SEVERE, MessageFormat.format("Error getting attribute from artifact {0}.", artf.getArtifactID()), ex); // NON-NLS
168  return null;
169  }
170  }
171 
176  static class AttributeExtractor implements TSKCoreCheckedFunction<BlackboardArtifact, String> {
177 
178  private final BlackboardAttribute.Type attributeType;
179 
180  AttributeExtractor(BlackboardAttribute.Type attribute) {
181  this.attributeType = attribute;
182  }
183 
184  @Override
185  public String apply(BlackboardArtifact artf) throws TskCoreException {
186  return Optional.ofNullable(getAttributeSafe(artf, attributeType))
188  .orElse("");
189  }
190  }
191 
197  final static class TopPrivateDomainExtractor extends AttributeExtractor {
198 
199  final private static TopPrivateDomainExtractor instance = new TopPrivateDomainExtractor();
200 
201  static TopPrivateDomainExtractor getInstance() {
202  return instance;
203  }
204 
205  TopPrivateDomainExtractor() {
206  super(new BlackboardAttribute.Type(TSK_DOMAIN));
207  }
208 
209  @Override
210  public String apply(BlackboardArtifact artf) throws TskCoreException {
211  String domainString = StringUtils.substringBefore(super.apply(artf), "/");
212  if (InternetDomainName.isValid(domainString)) {
213  InternetDomainName domain = InternetDomainName.from(domainString);
214  return (domain.isUnderPublicSuffix())
215  ? domain.topPrivateDomain().toString()
216  : domain.toString();
217  } else {
218  return domainString;
219  }
220  }
221  }
222 
230  @FunctionalInterface
231  interface TSKCoreCheckedFunction<I, O> {
232 
233  O apply(I input) throws TskCoreException;
234  }
235 }

Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.