Sleuth Kit Java Bindings (JNI)
4.12.1
Java bindings for using The Sleuth Kit
|
Inherits org.sleuthkit.datamodel.Content.
Inherited by org.sleuthkit.datamodel.AnalysisResult, and org.sleuthkit.datamodel.DataArtifact.
Classes | |
enum | ARTIFACT_TYPE |
enum | Category |
enum | ReviewStatus |
class | Type |
Public Member Functions | |
void | addAttribute (BlackboardAttribute attribute) throws TskCoreException |
void | addAttributes (Collection< BlackboardAttribute > attributes) throws TskCoreException |
void | addAttributes (Collection< BlackboardAttribute > attributes, final SleuthkitCase.CaseDbTransaction caseDbTransaction) throws TskCoreException |
void | close () |
boolean | equals (Object object) |
Score | getAggregateScore () throws TskCoreException |
List< AnalysisResult > | getAllAnalysisResults () throws TskCoreException |
ArrayList< BlackboardArtifact > | getAllArtifacts () throws TskCoreException |
long | getAllArtifactsCount () throws TskCoreException |
List< DataArtifact > | getAllDataArtifacts () throws TskCoreException |
List< AnalysisResult > | getAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException |
long | getArtifactID () |
ArrayList< BlackboardArtifact > | getArtifacts (String artifactTypeName) throws TskCoreException |
ArrayList< BlackboardArtifact > | getArtifacts (int artifactTypeID) throws TskCoreException |
ArrayList< BlackboardArtifact > | getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
long | getArtifactsCount (String artifactTypeName) throws TskCoreException |
long | getArtifactsCount (int artifactTypeID) throws TskCoreException |
long | getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
int | getArtifactTypeID () |
String | getArtifactTypeName () |
BlackboardAttribute | getAttribute (BlackboardAttribute.Type attributeType) throws TskCoreException |
List< BlackboardAttribute > | getAttributes () throws TskCoreException |
List< BlackboardAttribute > | getAttributes (final BlackboardAttribute.ATTRIBUTE_TYPE attributeType) throws TskCoreException |
List< Content > | getChildren () throws TskCoreException |
int | getChildrenCount () throws TskCoreException |
List< Long > | getChildrenIds () throws TskCoreException |
Content | getDataSource () throws TskCoreException |
Long | getDataSourceObjectID () |
String | getDisplayName () |
BlackboardArtifact | getGenInfoArtifact () throws TskCoreException |
BlackboardArtifact | getGenInfoArtifact (boolean create) throws TskCoreException |
ArrayList< BlackboardAttribute > | getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException |
Set< String > | getHashSetNames () throws TskCoreException |
long | getId () |
String | getName () |
long | getObjectID () |
Content | getParent () throws TskCoreException |
ReviewStatus | getReviewStatus () |
String | getShortDescription () throws TskCoreException |
long | getSize () |
SleuthkitCase | getSleuthkitCase () |
BlackboardArtifact.Type | getType () throws TskCoreException |
String | getUniquePath () throws TskCoreException |
boolean | hasChildren () throws TskCoreException |
int | hashCode () |
AnalysisResultAdded | newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException |
AnalysisResultAdded | newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException |
BlackboardArtifact | newArtifact (int artifactTypeID) throws TskCoreException |
BlackboardArtifact | newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException |
DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException |
DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException |
DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException |
final int | read (byte[] buf, long offset, long len) throws TskCoreException |
void | setReviewStatus (ReviewStatus newStatus) throws TskCoreException |
String | toString () |
Public Member Functions inherited from org.sleuthkit.datamodel.Content | |
List< AnalysisResult > | getAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException |
AnalysisResultAdded | newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException |
AnalysisResultAdded | newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException |
DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException |
DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException |
DataArtifact | newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException |
Protected Member Functions | |
BlackboardArtifact (SleuthkitCase sleuthkitCase, long artifactID, long objID, long artifactObjID, long dataSourceObjId, int artifactTypeID, String artifactTypeName, String displayName) | |
An artifact that has been posted to the blackboard. Artifacts store analysis results (such as hash set hits) and extracted data (such as a web bookmark). An artifact is a typed collection of name value pairs (attributes) that is associated with its source content (A data source, a file, or another artifact). Both standard artifact types and custom artifact types are supported.
IMPORTANT NOTE: No more than one attribute of a given type should be added to an artifact. It is undefined about which will be used.
Definition at line 54 of file BlackboardArtifact.java.
|
protected |
Constructs an artifact that has been posted to the blackboard. An artifact is a typed collection of name value pairs (attributes) that is associated with its source content (either a data source, or file within a data source). Both standard artifact types and custom artifact types are supported.
sleuthkitCase | The SleuthKit case (case database) that contains the artifact data. |
artifactID | The unique id for this artifact. |
objID | The unique id of the content with which this artifact is associated. |
artifactObjID | The unique id of the artifact, in tsk_objects |
dataSourceObjId | The id of the data source |
artifactTypeID | The type id of this artifact. |
artifactTypeName | The type name of this artifact. |
displayName | The display name of this artifact. |
Definition at line 2320 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.BlackboardArtifact.ReviewStatus.UNDECIDED.
void org.sleuthkit.datamodel.BlackboardArtifact.addAttribute | ( | BlackboardAttribute | attribute | ) | throws TskCoreException |
Adds an attribute to this artifact.
IMPORTANT NOTE: No more than one attribute of a given type should be added to an artifact.
attribute | The attribute to add |
TskCoreException | If an error occurs and the attribute was not added to the artifact. |
Definition at line 406 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.SleuthkitCase.addBlackboardAttribute(), and org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().
Referenced by org.sleuthkit.datamodel.AccountFileInstance.addAttribute().
void org.sleuthkit.datamodel.BlackboardArtifact.addAttributes | ( | Collection< BlackboardAttribute > | attributes | ) | throws TskCoreException |
Adds a collection of attributes to this artifact in a single operation (faster than adding each attribute individually).
attributes | The collection of attributes. |
TskCoreException | If an error occurs and the attributes were not added to the artifact. |
Definition at line 479 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.SleuthkitCase.addBlackboardAttributes(), and org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().
Referenced by org.sleuthkit.datamodel.AccountFileInstance.addAttributes(), org.sleuthkit.datamodel.blackboardutils.CommunicationArtifactsHelper.addCalllog(), org.sleuthkit.datamodel.Blackboard.newAnalysisResult(), and org.sleuthkit.datamodel.Blackboard.newDataArtifact().
void org.sleuthkit.datamodel.BlackboardArtifact.addAttributes | ( | Collection< BlackboardAttribute > | attributes, |
final SleuthkitCase.CaseDbTransaction | caseDbTransaction | ||
) | throws TskCoreException |
Adds a collection of attributes to this artifact in a single operation (faster than adding each attribute individually) within a transaction supplied by the caller.
attributes | The collection of attributes. |
caseDbTransaction | The transaction in the scope of which the operation is to be performed, managed by the caller. Null is not permitted. |
TskCoreException | If an error occurs and the attributes were not added to the artifact. If caseDbTransaction is null or if attributes is null or empty. |
Definition at line 506 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().
void org.sleuthkit.datamodel.BlackboardArtifact.close | ( | ) |
Close the Content object.
Implements org.sleuthkit.datamodel.Content.
Definition at line 942 of file BlackboardArtifact.java.
boolean org.sleuthkit.datamodel.BlackboardArtifact.equals | ( | Object | object | ) |
Tests this artifact for equality with another object.
object | The other object. |
Definition at line 870 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.BlackboardArtifact.getArtifactID().
Score org.sleuthkit.datamodel.BlackboardArtifact.getAggregateScore | ( | ) | throws TskCoreException |
Returns the final score for the content object.
TskCoreException | if critical error occurred within tsk core. |
Implements org.sleuthkit.datamodel.Content.
Definition at line 582 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.ScoringManager.getAggregateScore(), and org.sleuthkit.datamodel.SleuthkitCase.getScoringManager().
List<AnalysisResult> org.sleuthkit.datamodel.BlackboardArtifact.getAllAnalysisResults | ( | ) | throws TskCoreException |
Get all analysis results associated with this content.
TskCoreException | If critical error occurred within tsk core. |
Implements org.sleuthkit.datamodel.Content.
Definition at line 572 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.Blackboard.getAnalysisResults(), and org.sleuthkit.datamodel.SleuthkitCase.getBlackboard().
ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.BlackboardArtifact.getAllArtifacts | ( | ) | throws TskCoreException |
Get all artifacts associated with this content
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 566 of file BlackboardArtifact.java.
long org.sleuthkit.datamodel.BlackboardArtifact.getAllArtifactsCount | ( | ) | throws TskCoreException |
Get count of all artifacts associated with this content
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 647 of file BlackboardArtifact.java.
List<DataArtifact> org.sleuthkit.datamodel.BlackboardArtifact.getAllDataArtifacts | ( | ) | throws TskCoreException |
Get all data artifacts associated with this content.
TskCoreException | If critical error occurred within tsk core. |
Implements org.sleuthkit.datamodel.Content.
Definition at line 577 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.SleuthkitCase.getBlackboard().
List<AnalysisResult> org.sleuthkit.datamodel.BlackboardArtifact.getAnalysisResults | ( | BlackboardArtifact.Type | artifactType | ) | throws TskCoreException |
Definition at line 588 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.Blackboard.getAnalysisResults(), and org.sleuthkit.datamodel.SleuthkitCase.getBlackboard().
long org.sleuthkit.datamodel.BlackboardArtifact.getArtifactID | ( | ) |
Gets the unique id for this artifact.
Definition at line 162 of file BlackboardArtifact.java.
Referenced by org.sleuthkit.datamodel.BlackboardArtifact.equals(), org.sleuthkit.datamodel.BlackboardArtifact.getName(), and org.sleuthkit.datamodel.SleuthkitCase.setReviewStatus().
ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.BlackboardArtifact.getArtifacts | ( | String | artifactTypeName | ) | throws TskCoreException |
Get all artifacts associated with this content that have the given type name
artifactTypeName | name of the type to look up |
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 603 of file BlackboardArtifact.java.
ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.BlackboardArtifact.getArtifacts | ( | int | artifactTypeID | ) | throws TskCoreException |
Get all artifacts associated with this content that have the given type id
artifactTypeID | type id to look up |
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 619 of file BlackboardArtifact.java.
ArrayList<BlackboardArtifact> org.sleuthkit.datamodel.BlackboardArtifact.getArtifacts | ( | BlackboardArtifact.ARTIFACT_TYPE | type | ) | throws TskCoreException |
Get all artifacts associated with this content that have the given type
type | type to look up |
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 634 of file BlackboardArtifact.java.
long org.sleuthkit.datamodel.BlackboardArtifact.getArtifactsCount | ( | String | artifactTypeName | ) | throws TskCoreException |
Get count of all artifacts associated with this content that have the given type name
artifactTypeName | name of the type to look up |
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 663 of file BlackboardArtifact.java.
long org.sleuthkit.datamodel.BlackboardArtifact.getArtifactsCount | ( | int | artifactTypeID | ) | throws TskCoreException |
Get count of all artifacts associated with this content that have the given type id
artifactTypeID | type id to look up |
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 679 of file BlackboardArtifact.java.
long org.sleuthkit.datamodel.BlackboardArtifact.getArtifactsCount | ( | BlackboardArtifact.ARTIFACT_TYPE | type | ) | throws TskCoreException |
Get count of all artifacts associated with this content that have the given type
type | type to look up |
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 695 of file BlackboardArtifact.java.
int org.sleuthkit.datamodel.BlackboardArtifact.getArtifactTypeID | ( | ) |
Gets the artifact type id for this artifact.
Definition at line 191 of file BlackboardArtifact.java.
Referenced by org.sleuthkit.datamodel.BlackboardArtifact.getType().
String org.sleuthkit.datamodel.BlackboardArtifact.getArtifactTypeName | ( | ) |
Gets the artifact type name for this artifact.
Definition at line 216 of file BlackboardArtifact.java.
BlackboardAttribute org.sleuthkit.datamodel.BlackboardArtifact.getAttribute | ( | BlackboardAttribute.Type | attributeType | ) | throws TskCoreException |
Gets the attribute of this artifact that matches a given type.
IMPORTANT NOTE: No more than one attribute of a given type should be added to an artifact.
attributeType | The attribute type. |
TskCoreException | If an error occurs and the attribute is not fetched. |
Definition at line 460 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.BlackboardArtifact.getAttributes().
Referenced by org.sleuthkit.datamodel.AccountFileInstance.getAttribute(), and org.sleuthkit.datamodel.BlackboardArtifact.getShortDescription().
List<BlackboardAttribute> org.sleuthkit.datamodel.BlackboardArtifact.getAttributes | ( | ) | throws TskCoreException |
Gets the attributes of this artifact.
TskCoreException | If an error occurs and the attributes cannot be fetched. |
Definition at line 421 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.SleuthkitCase.getBlackboard(), org.sleuthkit.datamodel.Blackboard.getBlackboardAttributes(), and org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().
Referenced by org.sleuthkit.datamodel.BlackboardArtifact.getAttribute(), and org.sleuthkit.datamodel.AbstractContent.getGenInfoAttributes().
List<BlackboardAttribute> org.sleuthkit.datamodel.BlackboardArtifact.getAttributes | ( | final BlackboardAttribute.ATTRIBUTE_TYPE | attributeType | ) | throws TskCoreException |
Gets all attributes associated with this artifact that are of the given attribute type.
attributeType | the type of attributes to get |
TskCoreException | if a critical error occurs and the attributes are not fetched |
Definition at line 2339 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.SleuthkitCase.getBlackboardAttributes(), and org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().
List<Content> org.sleuthkit.datamodel.BlackboardArtifact.getChildren | ( | ) | throws TskCoreException |
Get all children of this artifact, if any.
TskCoreException | if there was an error querying the case database. |
Implements org.sleuthkit.datamodel.Content.
Definition at line 2414 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().
int org.sleuthkit.datamodel.BlackboardArtifact.getChildrenCount | ( | ) | throws TskCoreException |
Returns count of children objects. Note, this should be more efficient than getting children and counting them.
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 2378 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().
List<Long> org.sleuthkit.datamodel.BlackboardArtifact.getChildrenIds | ( | ) | throws TskCoreException |
Gets the object ids of children of this artifact, if any
TskCoreException | if there was an error querying the case database. |
Implements org.sleuthkit.datamodel.Content.
Definition at line 2369 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().
Content org.sleuthkit.datamodel.BlackboardArtifact.getDataSource | ( | ) | throws TskCoreException |
Gets the root data source (image, virtual directory, etc.) of this content.
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 983 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.SleuthkitCase.getContentById(), and org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().
Referenced by org.sleuthkit.datamodel.BlackboardArtifact.newAnalysisResult().
Long org.sleuthkit.datamodel.BlackboardArtifact.getDataSourceObjectID | ( | ) |
Gets the object id of the data source for this artifact.
Definition at line 182 of file BlackboardArtifact.java.
Referenced by org.sleuthkit.datamodel.BlackboardAttribute.getDisplayString().
String org.sleuthkit.datamodel.BlackboardArtifact.getDisplayName | ( | ) |
Gets the artifact type display name for this artifact.
Definition at line 225 of file BlackboardArtifact.java.
Referenced by org.sleuthkit.datamodel.BlackboardArtifact.getShortDescription().
BlackboardArtifact org.sleuthkit.datamodel.BlackboardArtifact.getGenInfoArtifact | ( | ) | throws TskCoreException |
Return the TSK_GEN_INFO artifact for the file so that individual attributes can be added to it. Creates one if it does not already exist.
TskCoreException |
Implements org.sleuthkit.datamodel.Content.
Definition at line 709 of file BlackboardArtifact.java.
BlackboardArtifact org.sleuthkit.datamodel.BlackboardArtifact.getGenInfoArtifact | ( | boolean | create | ) | throws TskCoreException |
Return the TSK_GEN_INFO artifact for the file so that individual attributes can be added to it. If one does not create, behavior depends on the create argument.
create | If true, an artifact will be created if it does not already exist. |
TskCoreException |
Implements org.sleuthkit.datamodel.Content.
Definition at line 728 of file BlackboardArtifact.java.
ArrayList<BlackboardAttribute> org.sleuthkit.datamodel.BlackboardArtifact.getGenInfoAttributes | ( | BlackboardAttribute.ATTRIBUTE_TYPE | attr_type | ) | throws TskCoreException |
Return attributes of a given type from TSK_GEN_INFO.
attr_type | Attribute type to find inside of the TSK_GEN_INFO artifact. |
org.sleuthkit.datamodel.TskCoreException |
Implements org.sleuthkit.datamodel.Content.
Definition at line 748 of file BlackboardArtifact.java.
Set<String> org.sleuthkit.datamodel.BlackboardArtifact.getHashSetNames | ( | ) | throws TskCoreException |
Get the names of all the hashsets that this content is in.
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 761 of file BlackboardArtifact.java.
long org.sleuthkit.datamodel.BlackboardArtifact.getId | ( | ) |
Returns the unique object ID that was assigned to it in the database. This is a Sleuth Kit database-assigned number.
Implements org.sleuthkit.datamodel.Content.
Definition at line 2356 of file BlackboardArtifact.java.
Referenced by org.sleuthkit.datamodel.BlackboardArtifact.newAnalysisResult().
String org.sleuthkit.datamodel.BlackboardArtifact.getName | ( | ) |
Get the name of this content object (does not include parent path)
Implements org.sleuthkit.datamodel.Content.
Definition at line 978 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.BlackboardArtifact.getArtifactID().
long org.sleuthkit.datamodel.BlackboardArtifact.getObjectID | ( | ) |
Gets the object id of the source content (data source or file within a data source) of this artifact
Definition at line 172 of file BlackboardArtifact.java.
Referenced by org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactTagsByTagName(), org.sleuthkit.datamodel.AccountFileInstance.getFile(), and org.sleuthkit.datamodel.BlackboardArtifact.toString().
Content org.sleuthkit.datamodel.BlackboardArtifact.getParent | ( | ) | throws TskCoreException |
TskCoreException |
Implements org.sleuthkit.datamodel.Content.
Definition at line 551 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.SleuthkitCase.getContentById(), and org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().
Referenced by org.sleuthkit.datamodel.BlackboardArtifact.getUniquePath().
ReviewStatus org.sleuthkit.datamodel.BlackboardArtifact.getReviewStatus | ( | ) |
Gets the review status of this artifact, i.e., whether it has been approved, rejected, or is still waiting for a decision from the user.
Definition at line 378 of file BlackboardArtifact.java.
String org.sleuthkit.datamodel.BlackboardArtifact.getShortDescription | ( | ) | throws TskCoreException |
Gets a short description for this artifact.
TskCoreException | if there is a problem creating the description. |
Definition at line 236 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.fromID(), org.sleuthkit.datamodel.BlackboardArtifact.getAttribute(), org.sleuthkit.datamodel.AbstractAttribute.getAttributeType(), org.sleuthkit.datamodel.BlackboardArtifact.getDisplayName(), org.sleuthkit.datamodel.BlackboardAttribute.getDisplayString(), org.sleuthkit.datamodel.BlackboardAttribute.toString(), org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CARD_NUMBER, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_END, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_MODIFIED, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_RCVD, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_NAME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_HOME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_OFFICE, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ID, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MAC_ADDRESS, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_HOME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_MOBILE, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_OFFICE, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REMOTE_PATH, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SSID, and org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT.
long org.sleuthkit.datamodel.BlackboardArtifact.getSize | ( | ) |
Get the (reported) size of the content object. Artifact content is a string dump of all its attributes.
Implements org.sleuthkit.datamodel.Content.
Definition at line 925 of file BlackboardArtifact.java.
SleuthkitCase org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase | ( | ) |
Gets the SleuthKit case (case database) that contains the data for this artifact.
Definition at line 153 of file BlackboardArtifact.java.
Referenced by org.sleuthkit.datamodel.BlackboardArtifact.addAttribute(), org.sleuthkit.datamodel.BlackboardArtifact.addAttributes(), org.sleuthkit.datamodel.BlackboardArtifact.getAttributes(), org.sleuthkit.datamodel.BlackboardArtifact.getChildren(), org.sleuthkit.datamodel.BlackboardArtifact.getChildrenCount(), org.sleuthkit.datamodel.BlackboardArtifact.getChildrenIds(), org.sleuthkit.datamodel.BlackboardArtifact.getDataSource(), org.sleuthkit.datamodel.AccountFileInstance.getFile(), org.sleuthkit.datamodel.BlackboardArtifact.getParent(), org.sleuthkit.datamodel.BlackboardArtifact.getType(), org.sleuthkit.datamodel.BlackboardArtifact.hasChildren(), org.sleuthkit.datamodel.BlackboardArtifact.setReviewStatus(), and org.sleuthkit.datamodel.BlackboardArtifact.toString().
BlackboardArtifact.Type org.sleuthkit.datamodel.BlackboardArtifact.getType | ( | ) | throws TskCoreException |
Gets the artifact type for this artifact.
TskCoreException |
Definition at line 202 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.Blackboard.getArtifactType(), org.sleuthkit.datamodel.BlackboardArtifact.getArtifactTypeID(), org.sleuthkit.datamodel.SleuthkitCase.getBlackboard(), and org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().
String org.sleuthkit.datamodel.BlackboardArtifact.getUniquePath | ( | ) | throws TskCoreException |
This overiding implementation returns the unique path of the parent. It does not include the Artifact name in the unique path.
org.sleuthkit.datamodel.TskCoreException |
Implements org.sleuthkit.datamodel.Content.
Definition at line 533 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.BlackboardArtifact.getParent(), and org.sleuthkit.datamodel.Content.getUniquePath().
boolean org.sleuthkit.datamodel.BlackboardArtifact.hasChildren | ( | ) | throws TskCoreException |
Returns true if the content object has children objects. Note, this should be more efficient than getting children and checking it empty.
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 2392 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().
int org.sleuthkit.datamodel.BlackboardArtifact.hashCode | ( | ) |
Gets the hash code for this artifact.
Definition at line 887 of file BlackboardArtifact.java.
AnalysisResultAdded org.sleuthkit.datamodel.BlackboardArtifact.newAnalysisResult | ( | BlackboardArtifact.Type | artifactType, |
Score | score, | ||
String | conclusion, | ||
String | configuration, | ||
String | justification, | ||
Collection< BlackboardAttribute > | attributesList | ||
) | throws TskCoreException |
Definition at line 786 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.SleuthkitCase.beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), org.sleuthkit.datamodel.SleuthkitCase.getBlackboard(), org.sleuthkit.datamodel.BlackboardArtifact.getDataSource(), org.sleuthkit.datamodel.Content.getId(), org.sleuthkit.datamodel.BlackboardArtifact.getId(), org.sleuthkit.datamodel.Blackboard.newAnalysisResult(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().
AnalysisResultAdded org.sleuthkit.datamodel.BlackboardArtifact.newAnalysisResult | ( | BlackboardArtifact.Type | artifactType, |
Score | score, | ||
String | conclusion, | ||
String | configuration, | ||
String | justification, | ||
Collection< BlackboardAttribute > | attributesList, | ||
long | dataSourceId | ||
) | throws TskCoreException |
Definition at line 803 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.SleuthkitCase.beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), org.sleuthkit.datamodel.SleuthkitCase.getBlackboard(), org.sleuthkit.datamodel.BlackboardArtifact.getId(), org.sleuthkit.datamodel.Blackboard.newAnalysisResult(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().
BlackboardArtifact org.sleuthkit.datamodel.BlackboardArtifact.newArtifact | ( | int | artifactTypeID | ) | throws TskCoreException |
Create and add an artifact associated with this content to the blackboard
artifactTypeID | id of the artifact type (if the id doesn't already exist an exception will be thrown) |
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 781 of file BlackboardArtifact.java.
Referenced by org.sleuthkit.datamodel.AbstractFile.newArtifact().
BlackboardArtifact org.sleuthkit.datamodel.BlackboardArtifact.newArtifact | ( | BlackboardArtifact.ARTIFACT_TYPE | type | ) | throws TskCoreException |
Create and add an artifact associated with this content to the blackboard
type | artifact enum type |
TskCoreException | if critical error occurred within tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 845 of file BlackboardArtifact.java.
DataArtifact org.sleuthkit.datamodel.BlackboardArtifact.newDataArtifact | ( | BlackboardArtifact.Type | artifactType, |
Collection< BlackboardAttribute > | attributesList, | ||
Long | osAccountId | ||
) | throws TskCoreException |
Definition at line 817 of file BlackboardArtifact.java.
Referenced by org.sleuthkit.datamodel.BlackboardArtifact.newDataArtifact(), and org.sleuthkit.datamodel.AbstractFile.newDataArtifact().
DataArtifact org.sleuthkit.datamodel.BlackboardArtifact.newDataArtifact | ( | BlackboardArtifact.Type | artifactType, |
Collection< BlackboardAttribute > | attributesList, | ||
Long | osAccountId, | ||
long | dataSourceId | ||
) | throws TskCoreException |
Definition at line 822 of file BlackboardArtifact.java.
DataArtifact org.sleuthkit.datamodel.BlackboardArtifact.newDataArtifact | ( | BlackboardArtifact.Type | artifactType, |
Collection< BlackboardAttribute > | attributesList | ||
) | throws TskCoreException |
Definition at line 827 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.BlackboardArtifact.newDataArtifact().
final int org.sleuthkit.datamodel.BlackboardArtifact.read | ( | byte[] | buf, |
long | offset, | ||
long | len | ||
) | throws TskCoreException |
Reads content data for this artifact Artifact content is a string dump of all its attributes.
buf | a character array of data (in bytes) to copy read data to |
offset | byte offset in the content to start reading from |
len | number of bytes to read into buf. |
TskCoreException | if critical error occurred during read in the tsk core |
Implements org.sleuthkit.datamodel.Content.
Definition at line 960 of file BlackboardArtifact.java.
void org.sleuthkit.datamodel.BlackboardArtifact.setReviewStatus | ( | ReviewStatus | newStatus | ) | throws TskCoreException |
Sets the review status of this artifact, i.e., whether it has been approved, rejected, or is still waiting for a decision from the user.
newStatus | new status of the artifact |
TskCoreException | If an error occurs |
Definition at line 390 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase(), and org.sleuthkit.datamodel.SleuthkitCase.setReviewStatus().
String org.sleuthkit.datamodel.BlackboardArtifact.toString | ( | ) |
Gets a string representation of this artifact.
Definition at line 899 of file BlackboardArtifact.java.
References org.sleuthkit.datamodel.BlackboardArtifact.getObjectID(), and org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase().
Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.