Sleuth Kit Java Bindings (JNI) 4.14.0
Java bindings for using The Sleuth Kit
Loading...
Searching...
No Matches
BlackboardAttribute.java
Go to the documentation of this file.
1/*
2 * Sleuth Kit Data Model
3 *
4 * Copyright 2011-2021 Basis Technology Corp.
5 * Contact: carrier <at> sleuthkit <dot> org
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License");
8 * you may not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS,
15 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 */
19package org.sleuthkit.datamodel;
20
21import java.io.Serializable;
22import java.util.Arrays;
23import java.util.Collections;
24import java.util.List;
25import java.util.Objects;
26import java.util.ResourceBundle;
27import java.util.TimeZone;
28import java.util.logging.Level;
29import java.util.logging.Logger;
30
46
47 private static final Logger LOGGER = Logger.getLogger(BlackboardAttribute.class.getName());
48
49 private static final ResourceBundle bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle");
50
51 private String context;
52 private String sources;
53
54 private long artifactID;
55
56 // Cached parent artifact. This field is populated lazily upon the first
57 // call to getParentArtifact().
58 private BlackboardArtifact parentArtifact;
59
60 // The parent data source is defined as being
61 // the data source of the parent artifact.
62 private Long parentDataSourceID;
63
76 public BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, int valueInt) throws IllegalArgumentException {
77 super(new BlackboardAttribute.Type(attributeType), valueInt);
78 this.sources = replaceNulls(source);
79 this.context = "";
80 }
81
94 public BlackboardAttribute(Type attributeType, String source, int valueInt) throws IllegalArgumentException {
95 super(attributeType, valueInt);
96 this.sources = replaceNulls(source);
97 this.context = "";
98 }
99
115 public BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, long valueLong) throws IllegalArgumentException {
116 super(new BlackboardAttribute.Type(attributeType), valueLong);
117 this.sources = replaceNulls(source);
118 this.context = "";
119 }
120
135 public BlackboardAttribute(Type attributeType, String source, long valueLong) throws IllegalArgumentException {
136 super(attributeType, valueLong);
137 this.sources = replaceNulls(source);
138 this.context = "";
139 }
140
153 public BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, double valueDouble) throws IllegalArgumentException {
154 super(new BlackboardAttribute.Type(attributeType), valueDouble);
155 this.sources = replaceNulls(source);
156 this.context = "";
157 }
158
171 public BlackboardAttribute(Type attributeType, String source, double valueDouble) throws IllegalArgumentException {
172 super(attributeType, valueDouble);
173 this.sources = replaceNulls(source);
174 this.context = "";
175 }
176
191 public BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, String valueString) throws IllegalArgumentException {
192 super(new BlackboardAttribute.Type(attributeType), valueString);
193 this.sources = replaceNulls(source);
194 this.context = "";
195 }
196
209 public BlackboardAttribute(Type attributeType, String source, String valueString) throws IllegalArgumentException {
210 super(attributeType, valueString);
211 this.sources = replaceNulls(source);
212 this.context = "";
213 }
214
227 public BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, byte[] valueBytes) throws IllegalArgumentException {
228 super(new BlackboardAttribute.Type(attributeType), valueBytes);
229 this.sources = replaceNulls(source);
230 this.context = "";
231 }
232
245 public BlackboardAttribute(Type attributeType, String source, byte[] valueBytes) throws IllegalArgumentException {
246 super(attributeType, valueBytes);
247 this.sources = replaceNulls(source);
248 this.context = "";
249 }
250
258 public long getArtifactID() {
259 return artifactID;
260 }
261
267 void setArtifactId(long artifactID) {
268 this.artifactID = artifactID;
269 }
270
276 public List<String> getSources() {
277 if (null != sources && !this.sources.isEmpty()) {
278 List<String> modules = Arrays.asList(sources.split(","));
279 return modules;
280 } else {
281 return Collections.emptyList();
282 }
283 }
284
292 public void addSource(String source) throws TskCoreException {
293 this.sources = getCaseDatabase().addSourceToArtifactAttribute(this, source);
294 }
295
308 if (parentArtifact == null) {
309 parentArtifact = getCaseDatabase().getBlackboardArtifact(getArtifactID());
310 }
311 return parentArtifact;
312 }
313
314 @Override
315 public int hashCode() {
316 return Objects.hash(
317 this.getAttributeType(), this.getValueInt(), this.getValueLong(), this.getValueDouble(),
318 this.getValueString(), this.getValueBytes(), this.getSources(), getContext());
319 }
320
321 @Override
322 public boolean equals(Object that) {
323 if (this == that) {
324 return true;
325 } else if (that instanceof BlackboardAttribute) {
327 Object[] thisObject = new Object[]{this.getSources(), this.getContext()};
328 Object[] otherObject = new Object[]{other.getSources(), other.getContext()};
329 return areValuesEqual(that) && Objects.deepEquals(thisObject, otherObject);
330 } else {
331 return false;
332 }
333 }
334
335 @Override
336 public String toString() {
337 return "BlackboardAttribute{" + "artifactID=" + getArtifactID() + ", attributeType=" + getAttributeType().toString() + ", moduleName=" + getSources() + ", context=" + context + ", valueInt=" + getValueInt() + ", valueLong=" + getValueLong() + ", valueDouble=" + getValueDouble() + ", valueString=" + getValueString() + ", valueBytes=" + Arrays.toString(getValueBytes()) + ", Case=" + getCaseDatabase() + '}'; //NON-NLS
338 }
339
345 @Override
346 public String getDisplayString() {
347 switch (getAttributeType().getValueType()) {
348 case DATETIME: {
349 try {
350 if (parentDataSourceID == null) {
352 parentDataSourceID = parent.getDataSourceObjectID();
353 }
354 final Content dataSource = parentDataSourceID != null ? getCaseDatabase().getContentById(parentDataSourceID) : null;
355 if ((dataSource != null) && (dataSource instanceof Image)) {
356 // return the date/time string in the timezone associated with the datasource,
357 Image image = (Image) dataSource;
358 TimeZone tzone = TimeZone.getTimeZone(image.getTimeZone());
359 return TimeUtilities.epochToTime(getValueLong(), tzone);
360 }
361 } catch (TskException ex) {
362 LOGGER.log(Level.WARNING, "Could not get timezone for image", ex); //NON-NLS
363 }
364 // return time string in default timezone
366 }
367 default: {
368 return super.getDisplayString();
369 }
370 }
371 }
372
391 BlackboardAttribute(long artifactID, BlackboardAttribute.Type attributeType, String source, String context,
392 int valueInt, long valueLong, double valueDouble, String valueString, byte[] valueBytes,
393 SleuthkitCase sleuthkitCase) {
394
395 super(attributeType, valueInt, valueLong, valueDouble, valueString, valueBytes, sleuthkitCase);
396 this.artifactID = artifactID;
397 this.sources = replaceNulls(source);
398 this.context = replaceNulls(context);
399 }
400
407 void setParentDataSourceID(Long parentDataSourceID) {
408 this.parentDataSourceID = parentDataSourceID;
409 }
410
419 String getSourcesCSV() {
420 return sources;
421 }
422
426 public static final class Type implements Serializable {
427
428 public static final Type TSK_URL = new Type(1, "TSK_URL", bundle.getString("BlackboardAttribute.tskUrl.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
429 public static final Type TSK_DATETIME = new Type(2, "TSK_DATETIME", bundle.getString("BlackboardAttribute.tskDatetime.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME);
430 public static final Type TSK_NAME = new Type(3, "TSK_NAME", bundle.getString("BlackboardAttribute.tskName.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
431 public static final Type TSK_PROG_NAME = new Type(4, "TSK_PROG_NAME", bundle.getString("BlackboardAttribute.tskProgName.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
432 public static final Type TSK_VALUE = new Type(6, "TSK_VALUE", bundle.getString("BlackboardAttribute.tskValue.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
433 public static final Type TSK_FLAG = new Type(7, "TSK_FLAG", bundle.getString("BlackboardAttribute.tskFlag.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
434 public static final Type TSK_PATH = new Type(8, "TSK_PATH", bundle.getString("BlackboardAttribute.tskPath.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
435 public static final Type TSK_KEYWORD = new Type(10, "TSK_KEYWORD", bundle.getString("BlackboardAttribute.tskKeyword.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
436 public static final Type TSK_KEYWORD_REGEXP = new Type(11, "TSK_KEYWORD_REGEXP", bundle.getString("BlackboardAttribute.tskKeywordRegexp.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
437 public static final Type TSK_KEYWORD_PREVIEW = new Type(12, "TSK_KEYWORD_PREVIEW", bundle.getString("BlackboardAttribute.tskKeywordPreview.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
438
439 // TSK_KEYWORD_SET (id: 13) has been deprecated. Please use TSK_SET_NAME instead.
440 public static final Type TSK_USER_NAME = new Type(14, "TSK_USER_NAME", bundle.getString("BlackboardAttribute.tskUserName.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
441 public static final Type TSK_DOMAIN = new Type(15, "TSK_DOMAIN", bundle.getString("BlackboardAttribute.tskDomain.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
442 public static final Type TSK_PASSWORD = new Type(16, "TSK_PASSWORD", bundle.getString("BlackboardAttribute.tskPassword.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
443 public static final Type TSK_NAME_PERSON = new Type(17, "TSK_NAME_PERSON", bundle.getString("BlackboardAttribute.tskNamePerson.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
444 public static final Type TSK_DEVICE_MODEL = new Type(18, "TSK_DEVICE_MODEL", bundle.getString("BlackboardAttribute.tskDeviceModel.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
445 public static final Type TSK_DEVICE_MAKE = new Type(19, "TSK_DEVICE_MAKE", bundle.getString("BlackboardAttribute.tskDeviceMake.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
446 public static final Type TSK_DEVICE_ID = new Type(20, "TSK_DEVICE_ID", bundle.getString("BlackboardAttribute.tskDeviceId.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
447 public static final Type TSK_EMAIL = new Type(21, "TSK_EMAIL", bundle.getString("BlackboardAttribute.tskEmail.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
448 public static final Type TSK_HASH_MD5 = new Type(22, "TSK_HASH_MD5", bundle.getString("BlackboardAttribute.tskHashMd5.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
449 public static final Type TSK_HASH_SHA1 = new Type(23, "TSK_HASH_SHA1", bundle.getString("BlackboardAttribute.tskHashSha1.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
450 public static final Type TSK_HASH_SHA2_256 = new Type(24, "TSK_HASH_SHA2_256", bundle.getString("BlackboardAttribute.tskHashSha225.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
451 public static final Type TSK_HASH_SHA2_512 = new Type(25, "TSK_HASH_SHA2_512", bundle.getString("BlackboardAttribute.tskHashSha2512.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
452 public static final Type TSK_TEXT = new Type(26, "TSK_TEXT", bundle.getString("BlackboardAttribute.tskText.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
453 public static final Type TSK_TEXT_FILE = new Type(27, "TSK_TEXT_FILE", bundle.getString("BlackboardAttribute.tskTextFile.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
454 public static final Type TSK_TEXT_LANGUAGE = new Type(28, "TSK_TEXT_LANGUAGE", bundle.getString("BlackboardAttribute.tskTextLanguage.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
455 public static final Type TSK_ENTROPY = new Type(29, "TSK_ENTROPY", bundle.getString("BlackboardAttribute.tskEntropy.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE);
456
457 // TSK_HASHSET_NAME (id: 30) has been deprecated. Please use TSK_SET_NAME instead.
458 // TSK_INTERESTING_FILE (id: 31) has been deprecated. Please use TSK_INTERESTING_ITEM analysis result instead.
459 public static final Type TSK_REFERRER = new Type(32, "TSK_REFERRER", bundle.getString("BlackboardAttribute.tskReferrer.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
460 public static final Type TSK_DATETIME_ACCESSED = new Type(33, "TSK_DATETIME_ACCESSED", bundle.getString("BlackboardAttribute.tskDateTimeAccessed.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME);
461 public static final Type TSK_IP_ADDRESS = new Type(34, "TSK_IP_ADDRESS", bundle.getString("BlackboardAttribute.tskIpAddress.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
462 public static final Type TSK_PHONE_NUMBER = new Type(35, "TSK_PHONE_NUMBER", bundle.getString("BlackboardAttribute.tskPhoneNumber.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
463 public static final Type TSK_PATH_ID = new Type(36, "TSK_PATH_ID", bundle.getString("BlackboardAttribute.tskPathId.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG);
464 public static final Type TSK_SET_NAME = new Type(37, "TSK_SET_NAME", bundle.getString("BlackboardAttribute.tskSetName.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
465
466 // TSK_ENCRYPTION_DETECTED (id: 38) has been deprecated. Please use TSK_ENCRYPTION_DETECTED as an artifact.
467 public static final Type TSK_MALWARE_DETECTED = new Type(39, "TSK_MALWARE_DETECTED", bundle.getString("BlackboardAttribute.tskMalwareDetected.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER);
468 public static final Type TSK_STEG_DETECTED = new Type(40, "TSK_STEG_DETECTED", bundle.getString("BlackboardAttribute.tskStegDetected.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER);
469 public static final Type TSK_EMAIL_TO = new Type(41, "TSK_EMAIL_TO", bundle.getString("BlackboardAttribute.tskEmailTo.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
470 public static final Type TSK_EMAIL_CC = new Type(42, "TSK_EMAIL_CC", bundle.getString("BlackboardAttribute.tskEmailCc.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
471 public static final Type TSK_EMAIL_BCC = new Type(43, "TSK_EMAIL_BCC", bundle.getString("BlackboardAttribute.tskEmailBcc.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
472 public static final Type TSK_EMAIL_FROM = new Type(44, "TSK_EMAIL_FROM", bundle.getString("BlackboardAttribute.tskEmailFrom.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
473 public static final Type TSK_EMAIL_CONTENT_PLAIN = new Type(45, "TSK_EMAIL_CONTENT_PLAIN", bundle.getString("BlackboardAttribute.tskEmailContentPlain.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
474 public static final Type TSK_EMAIL_CONTENT_HTML = new Type(46, "TSK_EMAIL_CONTENT_HTML", bundle.getString("BlackboardAttribute.tskEmailContentHtml.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
475 public static final Type TSK_EMAIL_CONTENT_RTF = new Type(47, "TSK_EMAIL_CONTENT_RTF", bundle.getString("BlackboardAttribute.tskEmailContentRtf.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
476 public static final Type TSK_MSG_ID = new Type(48, "TSK_MSG_ID", bundle.getString("BlackboardAttribute.tskMsgId.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
477 public static final Type TSK_MSG_REPLY_ID = new Type(49, "TSK_MSG_REPLY_ID", bundle.getString("BlackboardAttribute.tskMsgReplyId.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
478 public static final Type TSK_DATETIME_RCVD = new Type(50, "TSK_DATETIME_RCVD", bundle.getString("BlackboardAttribute.tskDateTimeRcvd.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME);
479 public static final Type TSK_DATETIME_SENT = new Type(51, "TSK_DATETIME_SENT", bundle.getString("BlackboardAttribute.tskDateTimeSent.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME);
480 public static final Type TSK_SUBJECT = new Type(52, "TSK_SUBJECT", bundle.getString("BlackboardAttribute.tskSubject.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
481 public static final Type TSK_TITLE = new Type(53, "TSK_TITLE", bundle.getString("BlackboardAttribute.tskTitle.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
482 public static final Type TSK_GEO_LATITUDE = new Type(54, "TSK_GEO_LATITUDE", bundle.getString("BlackboardAttribute.tskGeoLatitude.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE);
483 public static final Type TSK_GEO_LONGITUDE = new Type(55, "TSK_GEO_LONGITUDE", bundle.getString("BlackboardAttribute.tskGeoLongitude.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE);
484 public static final Type TSK_GEO_VELOCITY = new Type(56, "TSK_GEO_VELOCITY", bundle.getString("BlackboardAttribute.tskGeoVelocity.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE);
485 public static final Type TSK_GEO_ALTITUDE = new Type(57, "TSK_GEO_ALTITUDE", bundle.getString("BlackboardAttribute.tskGeoAltitude.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE);
486 public static final Type TSK_GEO_BEARING = new Type(58, "TSK_GEO_BEARING", bundle.getString("BlackboardAttribute.tskGeoBearing.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
487 public static final Type TSK_GEO_HPRECISION = new Type(59, "TSK_GEO_HPRECISION", bundle.getString("BlackboardAttribute.tskGeoHPrecision.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE);
488 public static final Type TSK_GEO_VPRECISION = new Type(60, "TSK_GEO_VPRECISION", bundle.getString("BlackboardAttribute.tskGeoVPrecision.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE);
489 public static final Type TSK_GEO_MAPDATUM = new Type(61, "TSK_GEO_MAPDATUM", bundle.getString("BlackboardAttribute.tskGeoMapDatum.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
490
491 // TSK_FILE_TYPE_SIG (id: 62) has been deprecated. Please use the mime type field of the AbstractFile object instead.
492 public static final Type TSK_FILE_TYPE_EXT = new Type(63, "TSK_FILE_TYPE_EXT", bundle.getString("BlackboardAttribute.tskFileTypeExt.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
493
494 // TSK_TAGGED_ARTIFACT (id: 64) has been deprected. Please create a tag as an artifact.
495 // TSK_TAG_NAME (id: 65) has been deprecated. Please create a tag as an artifact.
496 public static final Type TSK_COMMENT = new Type(66, "TSK_COMMENT", bundle.getString("BlackboardAttribute.tskComment.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
497 public static final Type TSK_URL_DECODED = new Type(67, "TSK_URL_DECODED", bundle.getString("BlackboardAttribute.tskUrlDecoded.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
498 public static final Type TSK_DATETIME_CREATED = new Type(68, "TSK_DATETIME_CREATED", bundle.getString("BlackboardAttribute.tskDateTimeCreated.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME);
499 public static final Type TSK_DATETIME_MODIFIED = new Type(69, "TSK_DATETIME_MODIFIED", bundle.getString("BlackboardAttribute.tskDateTimeModified.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME);
500 public static final Type TSK_PROCESSOR_ARCHITECTURE = new Type(70, "TSK_PROCESSOR_ARCHITECTURE", bundle.getString("BlackboardAttribute.tskProcessorArchitecture.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
501 public static final Type TSK_VERSION = new Type(71, "TSK_VERSION", bundle.getString("BlackboardAttribute.tskVersion.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
502 public static final Type TSK_USER_ID = new Type(72, "TSK_USER_ID", bundle.getString("BlackboardAttribute.tskUserId.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
503 public static final Type TSK_DESCRIPTION = new Type(73, "TSK_DESCRIPTION", bundle.getString("BlackboardAttribute.tskDescription.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
504 public static final Type TSK_MESSAGE_TYPE = new Type(74, "TSK_MESSAGE_TYPE", bundle.getString("BlackboardAttribute.tskMessageType.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // SMS or MMS or IM ...
505 public static final Type TSK_PHONE_NUMBER_HOME = new Type(75, "TSK_PHONE_NUMBER_HOME", bundle.getString("BlackboardAttribute.tskPhoneNumberHome.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
506 public static final Type TSK_PHONE_NUMBER_OFFICE = new Type(76, "TSK_PHONE_NUMBER_OFFICE", bundle.getString("BlackboardAttribute.tskPhoneNumberOffice.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
507 public static final Type TSK_PHONE_NUMBER_MOBILE = new Type(77, "TSK_PHONE_NUMBER_MOBILE", bundle.getString("BlackboardAttribute.tskPhoneNumberMobile.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
508 public static final Type TSK_PHONE_NUMBER_FROM = new Type(78, "TSK_PHONE_NUMBER_FROM", bundle.getString("BlackboardAttribute.tskPhoneNumberFrom.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
509 public static final Type TSK_PHONE_NUMBER_TO = new Type(79, "TSK_PHONE_NUMBER_TO", bundle.getString("BlackboardAttribute.tskPhoneNumberTo.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
510 public static final Type TSK_DIRECTION = new Type(80, "TSK_DIRECTION", bundle.getString("BlackboardAttribute.tskDirection.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // Msg/Call direction: incoming, outgoing
511 public static final Type TSK_EMAIL_HOME = new Type(81, "TSK_EMAIL_HOME", bundle.getString("BlackboardAttribute.tskEmailHome.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
512 public static final Type TSK_EMAIL_OFFICE = new Type(82, "TSK_EMAIL_OFFICE", bundle.getString("BlackboardAttribute.tskEmailOffice.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
513 public static final Type TSK_DATETIME_START = new Type(83, "TSK_DATETIME_START", bundle.getString("BlackboardAttribute.tskDateTimeStart.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME); // start time of an event - call log, Calendar entry
514 public static final Type TSK_DATETIME_END = new Type(84, "TSK_DATETIME_END", bundle.getString("BlackboardAttribute.tskDateTimeEnd.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME); // end time of an event - call log, Calendar entry
515 public static final Type TSK_CALENDAR_ENTRY_TYPE = new Type(85, "TSK_CALENDAR_ENTRY_TYPE", bundle.getString("BlackboardAttribute.tskCalendarEntryType.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // meeting, task,
516 public static final Type TSK_LOCATION = new Type(86, "TSK_LOCATION", bundle.getString("BlackboardAttribute.tskLocation.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // Location string associated with an event - Conf Room Name, Address ....
517 public static final Type TSK_SHORTCUT = new Type(87, "TSK_SHORTCUT", bundle.getString("BlackboardAttribute.tskShortcut.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // Short Cut string - short code or dial string for Speed dial, a URL short cut - e.g. bitly string, Windows Desktop Short cut name etc.
518 public static final Type TSK_DEVICE_NAME = new Type(88, "TSK_DEVICE_NAME", bundle.getString("BlackboardAttribute.tskDeviceName.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // device name - a user assigned (usually) device name - such as "Joe's computer", "bob_win8", "BT Headset"
519 public static final Type TSK_CATEGORY = new Type(89, "TSK_CATEGORY", bundle.getString("BlackboardAttribute.tskCategory.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // category/type, possible value set varies by the artifact
520 public static final Type TSK_EMAIL_REPLYTO = new Type(90, "TSK_EMAIL_REPLYTO", bundle.getString("BlackboardAttribute.tskEmailReplyTo.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // ReplyTo address
521 public static final Type TSK_SERVER_NAME = new Type(91, "TSK_SERVER_NAME", bundle.getString("BlackboardAttribute.tskServerName.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // server name, e.g. a mail server name - "smtp.google.com", a DNS server name...
522 public static final Type TSK_COUNT = new Type(92, "TSK_COUNT", bundle.getString("BlackboardAttribute.tskCount.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER); // Count related to the artifact
523 public static final Type TSK_MIN_COUNT = new Type(93, "TSK_MIN_COUNT", bundle.getString("BlackboardAttribute.tskMinCount.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER); // Minimum number/count
524 public static final Type TSK_PATH_SOURCE = new Type(94, "TSK_PATH_SOURCE", bundle.getString("BlackboardAttribute.tskPathSource.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // Path to a source file related to the artifact
525 public static final Type TSK_PERMISSIONS = new Type(95, "TSK_PERMISSIONS", bundle.getString("BlackboardAttribute.tskPermissions.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // Permissions
526 public static final Type TSK_ASSOCIATED_ARTIFACT = new Type(96, "TSK_ASSOCIATED_ARTIFACT", bundle.getString("BlackboardAttribute.tskAssociatedArtifact.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG); // Artifact ID of a related artifact
527 public static final Type TSK_ISDELETED = new Type(97, "TSK_ISDELETED", bundle.getString("BlackboardAttribute.tskIsDeleted.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // boolean to indicate that the artifact is recovered fom deleted content
528 public static final Type TSK_GEO_LATITUDE_START = new Type(98, "TSK_GEO_LATITUDE_START", bundle.getString("BlackboardAttribute.tskGeoLatitudeStart.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE); // Starting location lattitude
529 public static final Type TSK_GEO_LATITUDE_END = new Type(99, "TSK_GEO_LATITUDE_END", bundle.getString("BlackboardAttribute.tskGeoLatitudeEnd.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE); // Ending location lattitude
530 public static final Type TSK_GEO_LONGITUDE_START = new Type(100, "TSK_GEO_LONGITUDE_START", bundle.getString("BlackboardAttribute.tskGeoLongitudeStart.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE); // Starting location longitude
531 public static final Type TSK_GEO_LONGITUDE_END = new Type(101, "TSK_GEO_LONGITUDE_END", bundle.getString("BlackboardAttribute.tskGeoLongitudeEnd.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE); //Ending Location longitude
532 public static final Type TSK_READ_STATUS = new Type(102, "TSK_READ_STATUS", bundle.getString("BlackboardAttribute.tskReadStatus.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER); // Message read status: 1 if read, 0 if unread
533 public static final Type TSK_LOCAL_PATH = new Type(103, "TSK_LOCAL_PATH", bundle.getString("BlackboardAttribute.tskLocalPath.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // Local path to a network drive
534 public static final Type TSK_REMOTE_PATH = new Type(104, "TSK_REMOTE_PATH", bundle.getString("BlackboardAttribute.tskRemotePath.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // Remote path of a network drive
535 public static final Type TSK_TEMP_DIR = new Type(105, "TSK_TEMP_DIR", bundle.getString("BlackboardAttribute.tskTempDir.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // Default temporary files directory
536 public static final Type TSK_PRODUCT_ID = new Type(106, "TSK_PRODUCT_ID", bundle.getString("BlackboardAttribute.tskProductId.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // Product ID
537 public static final Type TSK_OWNER = new Type(107, "TSK_OWNER", bundle.getString("BlackboardAttribute.tskOwner.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // Registered owner of a piece of software
538 public static final Type TSK_ORGANIZATION = new Type(108, "TSK_ORGANIZATION", bundle.getString("BlackboardAttribute.tskOrganization.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING); // Registered Organization for a piece of software
539 public static final Type TSK_CARD_NUMBER = new Type(109, "TSK_CARD_NUMBER", bundle.getString("BlackboardAttribute.tskCardNumber.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
540 public static final Type TSK_CARD_EXPIRATION = new Type(110, "TSK_CARD_EXPIRATION", bundle.getString("BlackboardAttribute.tskCardExpiration.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
541 public static final Type TSK_CARD_SERVICE_CODE = new Type(111, "TSK_CARD_SERVICE_CODE", bundle.getString("BlackboardAttribute.tskCardServiceCode.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
542 public static final Type TSK_CARD_DISCRETIONARY = new Type(112, "TSK_CARD_DISCRETIONARY", bundle.getString("BlackboardAttribute.tskCardDiscretionary.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
543 public static final Type TSK_CARD_LRC = new Type(113, "TSK_CARD_LRC", bundle.getString("BlackboardAttribute.tskCardLRC.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
544 public static final Type TSK_KEYWORD_SEARCH_DOCUMENT_ID = new Type(114, "TSK_KEYWORD_SEARCH_DOCUMENT_ID", bundle.getString("BlackboardAttribute.tskKeywordSearchDocumentID.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
545 public static final Type TSK_CARD_SCHEME = new Type(115, "TSK_CARD_SCHEME", bundle.getString("BlackboardAttribute.tskCardScheme.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
546 public static final Type TSK_CARD_TYPE = new Type(116, "TSK_CARD_TYPE", bundle.getString("BlackboardAttribute.tskCardType.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
547 public static final Type TSK_BRAND_NAME = new Type(117, "TSK_BRAND_NAME", bundle.getString("BlackboardAttribute.tskBrandName.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
548 public static final Type TSK_BANK_NAME = new Type(118, "TSK_BANK_NAME", bundle.getString("BlackboardAttribute.tskBankName.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
549 public static final Type TSK_COUNTRY = new Type(119, "TSK_COUNTRY", bundle.getString("BlackboardAttribute.tskCountry.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
550 public static final Type TSK_CITY = new Type(120, "TSK_CITY", bundle.getString("BlackboardAttribute.tskCity.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
551 public static final Type TSK_ACCOUNT_TYPE = new Type(121, "TSK_ACCOUNT_TYPE", bundle.getString("BlackboardAttribute.tskAccountType.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
552
556 public static final Type TSK_KEYWORD_SEARCH_TYPE = new Type(122, "TSK_KEYWORD_SEARCH_TYPE", bundle.getString("BlackboardAttribute.tskKeywordSearchType.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER);
557 public static final Type TSK_HEADERS = new Type(123, "TSK_HEADERS", bundle.getString("BlackboardAttribute.tskHeaders.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
558 public static final Type TSK_ID = new Type(124, "TSK_ID", bundle.getString("BlackboardAttribute.tskId.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
559 public static final Type TSK_SSID = new Type(125, "TSK_SSID", bundle.getString("BlackboardAttribute.tskSsid.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
560 public static final Type TSK_BSSID = new Type(126, "TSK_BSSID", bundle.getString("BlackboardAttribute.tskBssid.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
561 public static final Type TSK_MAC_ADDRESS = new Type(127, "TSK_MAC_ADDRESS", bundle.getString("BlackboardAttribute.tskMacAddress.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
562 public static final Type TSK_IMEI = new Type(128, "TSK_IMEI", bundle.getString("BlackboardAttribute.tskImei.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
563 public static final Type TSK_IMSI = new Type(129, "TSK_IMSI", bundle.getString("BlackboardAttribute.tskImsi.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
564 public static final Type TSK_ICCID = new Type(130, "TSK_ICCID", bundle.getString("BlackboardAttribute.tskIccid.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
565 public static final Type TSK_THREAD_ID = new Type(131, "TSK_THREAD_ID", bundle.getString("BlackboardAttribute.tskthreadid.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
570 public static final Type TSK_TL_EVENT_TYPE = new Type(132, "TSK_TL_EVENT_TYPE", bundle.getString("BlackboardAttribute.tskTLEventType.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG);
571 public static final Type TSK_DATETIME_DELETED = new Type(133, "TSK_DATETIME_DELETED", bundle.getString("BlackboardAttribute.tskdatetimedeleted.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME);
572 public static final Type TSK_DATETIME_PASSWORD_RESET = new Type(134, "TSK_DATETIME_PASSWORD_RESET", bundle.getString("BlackboardAttribute.tskdatetimepwdreset.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME);
573 public static final Type TSK_DATETIME_PASSWORD_FAIL = new Type(135, "TSK_DATETIME_PWD_FAIL", bundle.getString("BlackboardAttribute.tskdatetimepwdfail.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME);
574 public static final Type TSK_DISPLAY_NAME = new Type(136, "TSK_DISPLAY_NAME", bundle.getString("BlackboardAttribute.tskdisplayname.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
575 public static final Type TSK_PASSWORD_SETTINGS = new Type(137, "TSK_PASSWORD_SETTINGS", bundle.getString("BlackboardAttribute.tskpasswordsettings.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
576 public static final Type TSK_ACCOUNT_SETTINGS = new Type(138, "TSK_ACCOUNT_SETTINGS", bundle.getString("BlackboardAttribute.tskaccountsettings.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
577 public static final Type TSK_PASSWORD_HINT = new Type(139, "TSK_PASSWORD_HINT", bundle.getString("BlackboardAttribute.tskpasswordhint.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
578 public static final Type TSK_GROUPS = new Type(140, "TSK_GROUPS", bundle.getString("BlackboardAttribute.tskgroups.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
579 /*
580 * Use
581 * org.sleuthkit.datamodel.blackboardutils.attributes.MessageAttachments
582 * to create and process TSK_ATTACHMENTS attributes.
583 */
584 public static final Type TSK_ATTACHMENTS = new Type(141, "TSK_ATTACHMENTS", bundle.getString("BlackboardAttribute.tskattachments.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.JSON);
585 /*
586 * Use org.sleuthkit.datamodel.blackboardutils.attributes.GeoTrackPoints
587 * to create and process TSK_GEO_TRACKPOINTS attributes.
588 */
589 public static final Type TSK_GEO_TRACKPOINTS = new Type(142, "TSK_GEO_TRACKPOINTS", bundle.getString("BlackboardAttribute.tskgeopath.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.JSON);
590 /*
591 * Use org.sleuthkit.datamodel.blackboardutils.attributes.GeoWaypoints
592 * to create and process TSK_GEO_WAYPOINTS attributes.
593 */
594 public static final Type TSK_GEO_WAYPOINTS = new Type(143, "TSK_GEO_WAYPOINTS", bundle.getString("BlackboardAttribute.tskgeowaypoints.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.JSON);
595 public static final Type TSK_DISTANCE_TRAVELED = new Type(144, "TSK_DISTANCE_TRAVELED", bundle.getString("BlackboardAttribute.tskdistancetraveled.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE);
596 public static final Type TSK_DISTANCE_FROM_HOMEPOINT = new Type(145, "TSK_DISTANCE_FROM_HOMEPOINT", bundle.getString("BlackboardAttribute.tskdistancefromhome.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE);
597 public static final Type TSK_HASH_PHOTODNA = new Type(146, "TSK_HASH_PHOTODNA", bundle.getString("BlackboardAttribute.tskhashphotodna.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
598 public static final Type TSK_BYTES_SENT = new Type(147, "TSK_BYTES_SENT", bundle.getString("BlackboardAttribute.tskbytessent.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG);
599 public static final Type TSK_BYTES_RECEIVED = new Type(148, "TSK_BYTES_RECEIVED", bundle.getString("BlackboardAttribute.tskbytesreceived.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG);
600 public static final Type TSK_LAST_PRINTED_DATETIME = new Type(149, "TSK_LAST_PRINTED_DATETIME", bundle.getString("BlackboardAttribute.tsklastprinteddatetime.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME);
601 public static final Type TSK_RULE = new Type(150, "TSK_RULE", bundle.getString("BlackboardAttribute.tskrule.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
602 public static final Type TSK_ACTIVITY_TYPE = new Type(151, "TSK_ACTIVITY_TYPE", bundle.getString("BlackboardAttribute.tskActivityType.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
603 /*
604 * Use org.sleuthkit.datamodel.blackboardutils.attributes.GeoAreaPoints
605 * to create and process TSK_GEO_AREAPOINTS attributes.
606 */
607 public static final Type TSK_GEO_AREAPOINTS = new Type(152, "TSK_GEO_AREAPOINTS", bundle.getString("BlackboardAttribute.tskgeoareapoints.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.JSON);
608 public static final Type TSK_REALM = new Type(153, "TSK_REALM", bundle.getString("BlackboardAttribute.tskRealm.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
609 public static final Type TSK_HOST = new Type(154, "TSK_HOST", bundle.getString("BlackboardAttribute.tskHost.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
610 public static final Type TSK_HOME_DIR = new Type(155, "TSK_HOME_DIR", bundle.getString("BlackboardAttribute.tskHomeDir.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
611 public static final Type TSK_IS_ADMIN = new Type(156, "TSK_IS_ADMIN", bundle.getString("BlackboardAttribute.tskIsAdmin.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER);
612 public static final Type TSK_CORRELATION_TYPE = new Type(157, "TSK_CORRELATION_TYPE", bundle.getString("BlackboardAttribute.tskCorrelationType.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
613 public static final Type TSK_CORRELATION_VALUE = new Type(158, "TSK_CORRELATION_VALUE", bundle.getString("BlackboardAttribute.tskCorrelationValue.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
614 public static final Type TSK_OTHER_CASES = new Type(159, "TSK_OTHER_CASES", bundle.getString("BlackboardAttribute.tskOtherCases.text"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING);
615
616 // NOTE: When adding a new standard BlackboardAttribute.Type, add the instance and then add to the STANDARD_TYPES list.
620 static final List<Type> STANDARD_TYPES = Collections.unmodifiableList(Arrays.asList(
621 TSK_URL,
623 TSK_NAME,
625 TSK_VALUE,
626 TSK_FLAG,
627 TSK_PATH,
638 TSK_EMAIL,
643 TSK_TEXT,
667 TSK_TITLE,
703 TSK_COUNT,
718 TSK_OWNER,
731 TSK_CITY,
735 TSK_ID,
736 TSK_SSID,
737 TSK_BSSID,
739 TSK_IMEI,
740 TSK_IMSI,
741 TSK_ICCID,
761 TSK_RULE,
764 TSK_REALM,
765 TSK_HOST,
771 ));
772
773 private static final long serialVersionUID = 1L;
774 private final String typeName;
775 private final int typeID;
776 private final String displayName;
777 private final TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType;
778
787 public Type(int typeID, String typeName, String displayName, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType) {
788 this.typeID = typeID;
789 this.typeName = typeName;
790 this.displayName = displayName;
791 this.valueType = valueType;
792 }
793
800 public Type(BlackboardAttribute.ATTRIBUTE_TYPE type) {
801 this.typeID = type.getTypeID();
802 this.typeName = type.getLabel();
803 this.displayName = type.getDisplayName();
804 this.valueType = type.getValueType();
805 }
806
813 return this.valueType;
814 }
815
821 public String getTypeName() {
822 return this.typeName;
823 }
824
830 public int getTypeID() {
831 return this.typeID;
832 }
833
839 public String getDisplayName() {
840 return this.displayName;
841 }
842
843 @Override
844 public boolean equals(Object that) {
845 if (this == that) {
846 return true;
847 } else if (!(that instanceof BlackboardAttribute.Type)) {
848 return false;
849 } else {
850 return ((BlackboardAttribute.Type) that).sameType(this);
851 }
852 }
853
862 private boolean sameType(BlackboardAttribute.Type that) {
863 return this.typeName.equals(that.getTypeName())
864 && this.displayName.equals(that.getDisplayName())
865 && this.typeID == that.getTypeID()
866 && this.valueType == that.getValueType();
867 }
868
869 @Override
870 public int hashCode() {
871 int hash = 7;
872 hash = 63 * hash + Objects.hashCode(this.typeID);
873 hash = 63 * hash + Objects.hashCode(this.displayName);
874 hash = 63 * hash + Objects.hashCode(this.typeName);
875 hash = 63 * hash + Objects.hashCode(this.valueType);
876 return hash;
877 }
878
879 @Override
880 public String toString() {
881 return "(typeID= " + this.typeID
882 + ", displayName=" + this.displayName
883 + ", typeName=" + this.typeName
884 + ", valueType=" + this.valueType + ")";
885 }
886 }
887
892 public enum TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE {
893
897 STRING(0, "String"), //NON-NLS
901 INTEGER(1, "Integer"), //NON-NLS
905 LONG(2, "Long"), //NON-NLS
909 DOUBLE(3, "Double"), //NON-NLS
913 BYTE(4, "Byte"), //NON-NLS
918 DATETIME(5, "DateTime"),
922 JSON(6, "Json");
923
924 private final long typeId;
925 private final String typeName;
926
927 /*
928 * TODO (AUT-2070): Add a localized displayName field and a
929 * getDisplayName method for API consistency.
930 */
937 private TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE(long type, String typeName) {
938 this.typeId = type;
939 this.typeName = typeName;
940 }
941
950 public long getType() {
951 return typeId;
952 }
953
962 public String getLabel() {
963 return this.typeName;
964 }
965
980 static public TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromType(long typeId) {
981 for (TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType : TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.values()) {
982 if (valueType.getType() == typeId) {
983 return valueType;
984 }
985 }
986 throw new IllegalArgumentException("No TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE matching type: " + typeId);
987 }
988
1003 static public TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromLabel(String typeName) {
1004 for (TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType : TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.values()) {
1005 if (valueType.getLabel().equals(typeName)) {
1006 return valueType;
1007 }
1008 }
1009 throw new IllegalArgumentException("No TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE matching type: " + typeName);
1010 }
1011
1012 }
1013
1020 public enum ATTRIBUTE_TYPE {
1021
1022 TSK_URL(1, "TSK_URL", //NON-NLS
1023 bundle.getString("BlackboardAttribute.tskUrl.text"),
1025 TSK_DATETIME(2, "TSK_DATETIME", //NON-NLS
1026 bundle.getString("BlackboardAttribute.tskDatetime.text"),
1028 TSK_NAME(3, "TSK_NAME", //NON-NLS
1029 bundle.getString("BlackboardAttribute.tskName.text"),
1031 TSK_PROG_NAME(4, "TSK_PROG_NAME", //NON-NLS
1032 bundle.getString("BlackboardAttribute.tskProgName.text"),
1034 TSK_VALUE(6, "TSK_VALUE", //NON-NLS
1035 bundle.getString("BlackboardAttribute.tskValue.text"),
1037 TSK_FLAG(7, "TSK_FLAG", //NON-NLS
1038 bundle.getString("BlackboardAttribute.tskFlag.text"),
1040 TSK_PATH(8, "TSK_PATH", //NON-NLS
1041 bundle.getString("BlackboardAttribute.tskPath.text"),
1043 TSK_KEYWORD(10, "TSK_KEYWORD", //NON-NLS
1044 bundle.getString("BlackboardAttribute.tskKeyword.text"),
1046 TSK_KEYWORD_REGEXP(11, "TSK_KEYWORD_REGEXP", //NON-NLS
1047 bundle.getString("BlackboardAttribute.tskKeywordRegexp.text"),
1049 TSK_KEYWORD_PREVIEW(12, "TSK_KEYWORD_PREVIEW", //NON-NLS
1050 bundle.getString("BlackboardAttribute.tskKeywordPreview.text"),
1055 @Deprecated
1056 TSK_KEYWORD_SET(13, "TSK_KEYWORD_SET", //NON-NLS
1057 bundle.getString("BlackboardAttribute.tskKeywordSet.text"),
1059 TSK_USER_NAME(14, "TSK_USER_NAME", //NON-NLS
1060 bundle.getString("BlackboardAttribute.tskUserName.text"),
1062 TSK_DOMAIN(15, "TSK_DOMAIN", //NON-NLS
1063 bundle.getString("BlackboardAttribute.tskDomain.text"),
1065 TSK_PASSWORD(16, "TSK_PASSWORD", //NON-NLS
1066 bundle.getString("BlackboardAttribute.tskPassword.text"),
1068 TSK_NAME_PERSON(17, "TSK_NAME_PERSON", //NON-NLS
1069 bundle.getString("BlackboardAttribute.tskNamePerson.text"),
1071 TSK_DEVICE_MODEL(18, "TSK_DEVICE_MODEL", //NON-NLS
1072 bundle.getString("BlackboardAttribute.tskDeviceModel.text"),
1074 TSK_DEVICE_MAKE(19, "TSK_DEVICE_MAKE", //NON-NLS
1075 bundle.getString("BlackboardAttribute.tskDeviceMake.text"),
1077 TSK_DEVICE_ID(20, "TSK_DEVICE_ID", //NON-NLS
1078 bundle.getString("BlackboardAttribute.tskDeviceId.text"),
1080 TSK_EMAIL(21, "TSK_EMAIL", //NON-NLS
1081 bundle.getString("BlackboardAttribute.tskEmail.text"),
1083 TSK_HASH_MD5(22, "TSK_HASH_MD5", //NON-NLS
1084 bundle.getString("BlackboardAttribute.tskHashMd5.text"),
1086 TSK_HASH_SHA1(23, "TSK_HASH_SHA1", //NON-NLS
1087 bundle.getString("BlackboardAttribute.tskHashSha1.text"),
1089 TSK_HASH_SHA2_256(24, "TSK_HASH_SHA2_256", //NON-NLS
1090 bundle.getString("BlackboardAttribute.tskHashSha225.text"),
1092 TSK_HASH_SHA2_512(25, "TSK_HASH_SHA2_512", //NON-NLS
1093 bundle.getString("BlackboardAttribute.tskHashSha2512.text"),
1095 TSK_TEXT(26, "TSK_TEXT", //NON-NLS
1096 bundle.getString("BlackboardAttribute.tskText.text"),
1098 TSK_TEXT_FILE(27, "TSK_TEXT_FILE", //NON-NLS
1099 bundle.getString("BlackboardAttribute.tskTextFile.text"),
1101 TSK_TEXT_LANGUAGE(28, "TSK_TEXT_LANGUAGE", //NON-NLS
1102 bundle.getString("BlackboardAttribute.tskTextLanguage.text"),
1104 TSK_ENTROPY(29, "TSK_ENTROPY", //NON-NLS
1105 bundle.getString("BlackboardAttribute.tskEntropy.text"),
1110 @Deprecated
1111 TSK_HASHSET_NAME(30, "TSK_HASHSET_NAME", //NON-NLS
1112 bundle.getString("BlackboardAttribute.tskHashsetName.text"),
1117 @Deprecated
1118 TSK_INTERESTING_FILE(31, "TSK_INTERESTING_FILE", //NON-NLS
1119 bundle.getString("BlackboardAttribute.tskInterestingFile.text"),
1121 TSK_REFERRER(32, "TSK_REFERRER", //NON-NLS
1122 bundle.getString("BlackboardAttribute.tskReferrer.text"),
1124 TSK_DATETIME_ACCESSED(33, "TSK_DATETIME_ACCESSED", //NON-NLS
1125 bundle.getString("BlackboardAttribute.tskDateTimeAccessed.text"),
1127 TSK_IP_ADDRESS(34, "TSK_IP_ADDRESS", //NON-NLS
1128 bundle.getString("BlackboardAttribute.tskIpAddress.text"),
1130 TSK_PHONE_NUMBER(35, "TSK_PHONE_NUMBER", //NON-NLS
1131 bundle.getString("BlackboardAttribute.tskPhoneNumber.text"),
1133 TSK_PATH_ID(36, "TSK_PATH_ID", //NON-NLS
1134 bundle.getString("BlackboardAttribute.tskPathId.text"),
1136 TSK_SET_NAME(37, "TSK_SET_NAME", //NON-NLS
1137 bundle.getString("BlackboardAttribute.tskSetName.text"),
1142 @Deprecated
1143 TSK_ENCRYPTION_DETECTED(38, "TSK_ENCRYPTION_DETECTED", //NON-NLS
1144 bundle.getString("BlackboardAttribute.tskEncryptionDetected.text"),
1146 TSK_MALWARE_DETECTED(39, "TSK_MALWARE_DETECTED", //NON-NLS
1147 bundle.getString("BlackboardAttribute.tskMalwareDetected.text"),
1149 TSK_STEG_DETECTED(40, "TSK_STEG_DETECTED", //NON-NLS
1150 bundle.getString("BlackboardAttribute.tskStegDetected.text"),
1152 TSK_EMAIL_TO(41, "TSK_EMAIL_TO", //NON-NLS
1153 bundle.getString("BlackboardAttribute.tskEmailTo.text"),
1155 TSK_EMAIL_CC(42, "TSK_EMAIL_CC", //NON-NLS
1156 bundle.getString("BlackboardAttribute.tskEmailCc.text"),
1158 TSK_EMAIL_BCC(43, "TSK_EMAIL_BCC", //NON-NLS
1159 bundle.getString("BlackboardAttribute.tskEmailBcc.text"),
1161 TSK_EMAIL_FROM(44, "TSK_EMAIL_FROM", //NON-NLS
1162 bundle.getString("BlackboardAttribute.tskEmailFrom.text"),
1164 TSK_EMAIL_CONTENT_PLAIN(45, "TSK_EMAIL_CONTENT_PLAIN", //NON-NLS
1165 bundle.getString("BlackboardAttribute.tskEmailContentPlain.text"),
1167 TSK_EMAIL_CONTENT_HTML(46, "TSK_EMAIL_CONTENT_HTML", //NON-NLS
1168 bundle.getString("BlackboardAttribute.tskEmailContentHtml.text"),
1170 TSK_EMAIL_CONTENT_RTF(47, "TSK_EMAIL_CONTENT_RTF", //NON-NLS
1171 bundle.getString("BlackboardAttribute.tskEmailContentRtf.text"),
1173 TSK_MSG_ID(48, "TSK_MSG_ID", //NON-NLS
1174 bundle.getString("BlackboardAttribute.tskMsgId.text"),
1176 TSK_MSG_REPLY_ID(49, "TSK_MSG_REPLY_ID", //NON-NLS
1177 bundle.getString("BlackboardAttribute.tskMsgReplyId.text"),
1179 TSK_DATETIME_RCVD(50, "TSK_DATETIME_RCVD", //NON-NLS
1180 bundle.getString("BlackboardAttribute.tskDateTimeRcvd.text"),
1182 TSK_DATETIME_SENT(51, "TSK_DATETIME_SENT", //NON-NLS
1183 bundle.getString("BlackboardAttribute.tskDateTimeSent.text"),
1185 TSK_SUBJECT(52, "TSK_SUBJECT", //NON-NLS
1186 bundle.getString("BlackboardAttribute.tskSubject.text"),
1188 TSK_TITLE(53, "TSK_TITLE", //NON-NLS
1189 bundle.getString("BlackboardAttribute.tskTitle.text"),
1191 TSK_GEO_LATITUDE(54, "TSK_GEO_LATITUDE", //NON-NLS
1192 bundle.getString("BlackboardAttribute.tskGeoLatitude.text"),
1194 TSK_GEO_LONGITUDE(55, "TSK_GEO_LONGITUDE", //NON-NLS
1195 bundle.getString("BlackboardAttribute.tskGeoLongitude.text"),
1197 TSK_GEO_VELOCITY(56, "TSK_GEO_VELOCITY", //NON-NLS
1198 bundle.getString("BlackboardAttribute.tskGeoVelocity.text"),
1200 TSK_GEO_ALTITUDE(57, "TSK_GEO_ALTITUDE", //NON-NLS
1201 bundle.getString("BlackboardAttribute.tskGeoAltitude.text"),
1203 TSK_GEO_BEARING(58, "TSK_GEO_BEARING", //NON-NLS
1204 bundle.getString("BlackboardAttribute.tskGeoBearing.text"),
1206 TSK_GEO_HPRECISION(59, "TSK_GEO_HPRECISION", //NON-NLS
1207 bundle.getString("BlackboardAttribute.tskGeoHPrecision.text"),
1209 TSK_GEO_VPRECISION(60, "TSK_GEO_VPRECISION", //NON-NLS
1210 bundle.getString("BlackboardAttribute.tskGeoVPrecision.text"),
1212 TSK_GEO_MAPDATUM(61, "TSK_GEO_MAPDATUM", //NON-NLS
1213 bundle.getString("BlackboardAttribute.tskGeoMapDatum.text"),
1219 @Deprecated
1220 TSK_FILE_TYPE_SIG(62, "TSK_FILE_TYPE_SIG", //NON-NLS
1221 bundle.getString("BlackboardAttribute.tskFileTypeSig.text"),
1223 TSK_FILE_TYPE_EXT(63, "TSK_FILE_TYPE_EXT", //NON-NLS
1224 bundle.getString("BlackboardAttribute.tskFileTypeExt.text"),
1230 @Deprecated
1231 TSK_TAGGED_ARTIFACT(64, "TSK_TAGGED_ARTIFACT", //NON-NLS
1232 bundle.getString("BlackboardAttribute.tskTaggedArtifact.text"),
1238 @Deprecated
1239 TSK_TAG_NAME(65, "TSK_TAG_NAME", //NON-NLS
1240 bundle.getString("BlackboardAttribute.tskTagName.text"),
1242 TSK_COMMENT(66, "TSK_COMMENT", //NON-NLS
1243 bundle.getString("BlackboardAttribute.tskComment.text"),
1245 TSK_URL_DECODED(67, "TSK_URL_DECODED", //NON-NLS
1246 bundle.getString("BlackboardAttribute.tskUrlDecoded.text"),
1248 TSK_DATETIME_CREATED(68, "TSK_DATETIME_CREATED", //NON-NLS
1249 bundle.getString("BlackboardAttribute.tskDateTimeCreated.text"),
1251 TSK_DATETIME_MODIFIED(69, "TSK_DATETIME_MODIFIED", //NON-NLS
1252 bundle.getString("BlackboardAttribute.tskDateTimeModified.text"),
1254 TSK_PROCESSOR_ARCHITECTURE(70, "TSK_PROCESSOR_ARCHITECTURE", //NON-NLS
1255 bundle.getString("BlackboardAttribute.tskProcessorArchitecture.text"),
1257 TSK_VERSION(71, "TSK_VERSION", //NON-NLS
1258 bundle.getString("BlackboardAttribute.tskVersion.text"),
1260 TSK_USER_ID(72, "TSK_USER_ID", //NON-NLS
1261 bundle.getString("BlackboardAttribute.tskUserId.text"),
1263 TSK_DESCRIPTION(73, "TSK_DESCRIPTION", //NON-NLS
1264 bundle.getString("BlackboardAttribute.tskDescription.text"),
1266 TSK_MESSAGE_TYPE(74, "TSK_MESSAGE_TYPE", //NON-NLS
1267 bundle.getString("BlackboardAttribute.tskMessageType.text"),
1268 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // SMS or MMS or IM ...
1269 TSK_PHONE_NUMBER_HOME(75, "TSK_PHONE_NUMBER_HOME", //NON-NLS
1270 bundle.getString("BlackboardAttribute.tskPhoneNumberHome.text"),
1272 TSK_PHONE_NUMBER_OFFICE(76, "TSK_PHONE_NUMBER_OFFICE", //NON-NLS
1273 bundle.getString("BlackboardAttribute.tskPhoneNumberOffice.text"),
1275 TSK_PHONE_NUMBER_MOBILE(77, "TSK_PHONE_NUMBER_MOBILE", //NON-NLS
1276 bundle.getString("BlackboardAttribute.tskPhoneNumberMobile.text"),
1278 TSK_PHONE_NUMBER_FROM(78, "TSK_PHONE_NUMBER_FROM", //NON-NLS
1279 bundle.getString("BlackboardAttribute.tskPhoneNumberFrom.text"),
1281 TSK_PHONE_NUMBER_TO(79, "TSK_PHONE_NUMBER_TO", //NON-NLS
1282 bundle.getString("BlackboardAttribute.tskPhoneNumberTo.text"),
1284 TSK_DIRECTION(80, "TSK_DIRECTION", //NON-NLS
1285 bundle.getString("BlackboardAttribute.tskDirection.text"),
1286 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Msg/Call direction: incoming, outgoing
1287 TSK_EMAIL_HOME(81, "TSK_EMAIL_HOME", //NON-NLS
1288 bundle.getString("BlackboardAttribute.tskEmailHome.text"),
1290 TSK_EMAIL_OFFICE(82, "TSK_EMAIL_OFFICE", //NON-NLS
1291 bundle.getString("BlackboardAttribute.tskEmailOffice.text"),
1293 TSK_DATETIME_START(83, "TSK_DATETIME_START", //NON-NLS
1294 bundle.getString("BlackboardAttribute.tskDateTimeStart.text"),
1295 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME), // start time of an event - call log, Calendar entry
1296 TSK_DATETIME_END(84, "TSK_DATETIME_END", //NON-NLS
1297 bundle.getString("BlackboardAttribute.tskDateTimeEnd.text"),
1298 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME), // end time of an event - call log, Calendar entry
1299 TSK_CALENDAR_ENTRY_TYPE(85, "TSK_CALENDAR_ENTRY_TYPE", //NON-NLS
1300 bundle.getString("BlackboardAttribute.tskCalendarEntryType.text"),
1302 TSK_LOCATION(86, "TSK_LOCATION", //NON-NLS
1303 bundle.getString("BlackboardAttribute.tskLocation.text"),
1304 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Location string associated with an event - Conf Room Name, Address ....
1305 TSK_SHORTCUT(87, "TSK_SHORTCUT", //NON-NLS
1306 bundle.getString("BlackboardAttribute.tskShortcut.text"),
1307 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Short Cut string - short code or dial string for Speed dial, a URL short cut - e.g. bitly string, Windows Desktop Short cut name etc.
1308 TSK_DEVICE_NAME(88, "TSK_DEVICE_NAME", //NON-NLS
1309 bundle.getString("BlackboardAttribute.tskDeviceName.text"),
1310 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // device name - a user assigned (usually) device name - such as "Joe's computer", "bob_win8", "BT Headset"
1311 TSK_CATEGORY(89, "TSK_CATEGORY", //NON-NLS
1312 bundle.getString("BlackboardAttribute.tskCategory.text"),
1313 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // category/type, possible value set varies by the artifact
1314 TSK_EMAIL_REPLYTO(90, "TSK_EMAIL_REPLYTO", //NON-NLS
1315 bundle.getString("BlackboardAttribute.tskEmailReplyTo.text"),
1316 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // ReplyTo address
1317 TSK_SERVER_NAME(91, "TSK_SERVER_NAME", //NON-NLS
1318 bundle.getString("BlackboardAttribute.tskServerName.text"),
1319 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // server name, e.g. a mail server name - "smtp.google.com", a DNS server name...
1320 TSK_COUNT(92, "TSK_COUNT", //NON-NLS
1321 bundle.getString("BlackboardAttribute.tskCount.text"),
1322 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER), // Count related to the artifact
1323 TSK_MIN_COUNT(93, "TSK_MIN_COUNT", //NON-NLS
1324 bundle.getString("BlackboardAttribute.tskMinCount.text"),
1325 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER), // Minimum number/count
1326 TSK_PATH_SOURCE(94, "TSK_PATH_SOURCE", //NON-NLS
1327 bundle.getString("BlackboardAttribute.tskPathSource.text"),
1328 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Path to a source file related to the artifact
1329 TSK_PERMISSIONS(95, "TSK_PERMISSIONS", //NON-NLS
1330 bundle.getString("BlackboardAttribute.tskPermissions.text"),
1332 TSK_ASSOCIATED_ARTIFACT(96, "TSK_ASSOCIATED_ARTIFACT", //NON-NLS
1333 bundle.getString("BlackboardAttribute.tskAssociatedArtifact.text"),
1334 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG), // Artifact ID of a related artifact
1335 TSK_ISDELETED(97, "TSK_ISDELETED", //NON-NLS
1336 bundle.getString("BlackboardAttribute.tskIsDeleted.text"),
1337 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // boolean to indicate that the artifact is recovered fom deleted content
1338 TSK_GEO_LATITUDE_START(98, "TSK_GEO_LATITUDE_START", //NON-NLS
1339 bundle.getString("BlackboardAttribute.tskGeoLatitudeStart.text"),
1340 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE), // Starting location lattitude
1341 TSK_GEO_LATITUDE_END(99, "TSK_GEO_LATITUDE_END", //NON-NLS
1342 bundle.getString("BlackboardAttribute.tskGeoLatitudeEnd.text"),
1343 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE), // Ending location lattitude
1344 TSK_GEO_LONGITUDE_START(100, "TSK_GEO_LONGITUDE_START", //NON-NLS
1345 bundle.getString("BlackboardAttribute.tskGeoLongitudeStart.text"),
1346 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE), // Starting location longitude
1347 TSK_GEO_LONGITUDE_END(101, "TSK_GEO_LONGITUDE_END", //NON-NLS
1348 bundle.getString("BlackboardAttribute.tskGeoLongitudeEnd.text"),
1349 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE), //Ending Location longitude
1350 TSK_READ_STATUS(102, "TSK_READ_STATUS", //NON-NLS
1351 bundle.getString("BlackboardAttribute.tskReadStatus.text"),
1352 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER), // Message read status: 1 if read, 0 if unread
1353 TSK_LOCAL_PATH(103, "TSK_LOCAL_PATH", //NON-NLS
1354 bundle.getString("BlackboardAttribute.tskLocalPath.text"),
1355 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Local path to a network drive
1356 TSK_REMOTE_PATH(104, "TSK_REMOTE_PATH", //NON-NLS
1357 bundle.getString("BlackboardAttribute.tskRemotePath.text"),
1358 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Remote path of a network drive
1359 TSK_TEMP_DIR(105, "TSK_TEMP_DIR", //NON-NLS
1360 bundle.getString("BlackboardAttribute.tskTempDir.text"),
1361 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Default temporary files directory
1362 TSK_PRODUCT_ID(106, "TSK_PRODUCT_ID", //NON-NLS
1363 bundle.getString("BlackboardAttribute.tskProductId.text"),
1365 TSK_OWNER(107, "TSK_OWNER", //NON-NLS
1366 bundle.getString("BlackboardAttribute.tskOwner.text"),
1367 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Registered owner of a piece of software
1368 TSK_ORGANIZATION(108, "TSK_ORGANIZATION", //NON-NLS
1369 bundle.getString("BlackboardAttribute.tskOrganization.text"),
1370 TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Registered Organization for a piece of software
1371 TSK_CARD_NUMBER(109, "TSK_CARD_NUMBER", //NON-NLS
1372 bundle.getString("BlackboardAttribute.tskCardNumber.text"),
1374 TSK_CARD_EXPIRATION(110, "TSK_CARD_EXPIRATION", //for card as 4 digits MMYY //NON-NLS
1375 bundle.getString("BlackboardAttribute.tskCardExpiration.text"),
1377 TSK_CARD_SERVICE_CODE(111, "TSK_CARD_SERVICE_CODE", // 3 digits //NON-NLS
1378 bundle.getString("BlackboardAttribute.tskCardServiceCode.text"),
1380 TSK_CARD_DISCRETIONARY(112, "TSK_CARD_DISCRETIONARY", //data used at the discretion of the issuer //NON-NLS
1381 bundle.getString("BlackboardAttribute.tskCardDiscretionary.text"),
1383 TSK_CARD_LRC(113, "TSK_CARD_LRC", //NON-NLS //Longitudunal Redundancy Check character //NON-NLS
1384 bundle.getString("BlackboardAttribute.tskCardLRC.text"),
1386 TSK_KEYWORD_SEARCH_DOCUMENT_ID(114, "TSK_KEYWORD_SEARCH_DOCUMENT_ID", //NON-NLS
1387 bundle.getString("BlackboardAttribute.tskKeywordSearchDocumentID.text"),
1389 TSK_CARD_SCHEME(115, "TSK_CARD_SCHEME", //amex, visa, mastercard, discover, etc //NON-NLS
1390 bundle.getString("BlackboardAttribute.tskCardScheme.text"),
1392 TSK_CARD_TYPE(116, "TSK_CARD_TYPE", // debit vs credit //NON-NLS
1393 bundle.getString("BlackboardAttribute.tskCardType.text"),
1395 TSK_BRAND_NAME(117, "TSK_BRAND_NAME",
1396 bundle.getString("BlackboardAttribute.tskBrandName.text"),
1398 TSK_BANK_NAME(118, "TSK_BANK_NAME",
1399 bundle.getString("BlackboardAttribute.tskBankName.text"),
1401 TSK_COUNTRY(119, "TSK_COUNTRY",
1402 bundle.getString("BlackboardAttribute.tskCountry.text"),
1404 TSK_CITY(120, "TSK_CITY",
1405 bundle.getString("BlackboardAttribute.tskCity.text"),
1407 TSK_ACCOUNT_TYPE(121, "TSK_ACCOUNT_TYPE",
1408 bundle.getString("BlackboardAttribute.tskAccountType.text"),
1413 TSK_KEYWORD_SEARCH_TYPE(122, "TSK_KEYWORD_SEARCH_TYPE", //NON-NLS
1414 bundle.getString("BlackboardAttribute.tskKeywordSearchType.text"),
1416 TSK_HEADERS(123, "TSK_HEADERS", //NON-NLS
1417 bundle.getString("BlackboardAttribute.tskHeaders.text"),
1419 TSK_ID(124, "TSK_ID", //NON-NLS
1420 bundle.getString("BlackboardAttribute.tskId.text"),
1422 TSK_SSID(125, "TSK_SSID", //NON-NLS
1423 bundle.getString("BlackboardAttribute.tskSsid.text"),
1425 TSK_BSSID(126, "TSK_BSSID", //NON-NLS
1426 bundle.getString("BlackboardAttribute.tskBssid.text"),
1428 TSK_MAC_ADDRESS(127, "TSK_MAC_ADDRESS", //NON-NLS
1429 bundle.getString("BlackboardAttribute.tskMacAddress.text"),
1431 TSK_IMEI(128, "TSK_IMEI", //NON-NLS
1432 bundle.getString("BlackboardAttribute.tskImei.text"),
1434 TSK_IMSI(129, "TSK_IMSI", //NON-NLS
1435 bundle.getString("BlackboardAttribute.tskImsi.text"),
1437 TSK_ICCID(130, "TSK_ICCID", //NON-NLS
1438 bundle.getString("BlackboardAttribute.tskIccid.text"),
1440 TSK_THREAD_ID(131, "TSK_THREAD_ID",
1441 bundle.getString("BlackboardAttribute.tskthreadid.text"),
1447 TSK_TL_EVENT_TYPE(132, "TSK_TL_EVENT_TYPE", //NON-NLS
1448 bundle.getString("BlackboardAttribute.tskTLEventType.text"),
1450 TSK_DATETIME_DELETED(133, "TSK_DATETIME_DELETED", //NON-NLS
1451 bundle.getString("BlackboardAttribute.tskdatetimedeleted.text"),
1453 TSK_DATETIME_PASSWORD_RESET(134, "TSK_DATETIME_PASSWORD_RESET",
1454 bundle.getString("BlackboardAttribute.tskdatetimepwdreset.text"),
1456 TSK_DATETIME_PASSWORD_FAIL(135, "TSK_DATETIME_PWD_FAIL",
1457 bundle.getString("BlackboardAttribute.tskdatetimepwdfail.text"),
1459 TSK_DISPLAY_NAME(136, "TSK_DISPLAY_NAME",
1460 bundle.getString("BlackboardAttribute.tskdisplayname.text"),
1462 TSK_PASSWORD_SETTINGS(137, "TSK_PASSWORD_SETTINGS",
1463 bundle.getString("BlackboardAttribute.tskpasswordsettings.text"),
1465 TSK_ACCOUNT_SETTINGS(138, "TSK_ACCOUNT_SETTINGS",
1466 bundle.getString("BlackboardAttribute.tskaccountsettings.text"),
1468 TSK_PASSWORD_HINT(139, "TSK_PASSWORD_HINT",
1469 bundle.getString("BlackboardAttribute.tskpasswordhint.text"),
1471 TSK_GROUPS(140, "TSK_GROUPS",
1472 bundle.getString("BlackboardAttribute.tskgroups.text"),
1474 /*
1475 * Use
1476 * org.sleuthkit.datamodel.blackboardutils.attributes.MessageAttachments
1477 * to create and process TSK_ATTACHMENTS attributes.
1478 */
1479 TSK_ATTACHMENTS(141, "TSK_ATTACHMENTS",
1480 bundle.getString("BlackboardAttribute.tskattachments.text"),
1482 /*
1483 * Use org.sleuthkit.datamodel.blackboardutils.attributes.GeoTrackPoints
1484 * to create and process TSK_GEO_TRACKPOINTS attributes.
1485 */
1486 TSK_GEO_TRACKPOINTS(142, "TSK_GEO_TRACKPOINTS",
1487 bundle.getString("BlackboardAttribute.tskgeopath.text"),
1489 /*
1490 * Use org.sleuthkit.datamodel.blackboardutils.attributes.GeoWaypoints
1491 * to create and process TSK_GEO_WAYPOINTS attributes.
1492 */
1493 TSK_GEO_WAYPOINTS(143, "TSK_GEO_WAYPOINTS",
1494 bundle.getString("BlackboardAttribute.tskgeowaypoints.text"),
1496 TSK_DISTANCE_TRAVELED(144, "TSK_DISTANCE_TRAVELED",
1497 bundle.getString("BlackboardAttribute.tskdistancetraveled.text"),
1499 TSK_DISTANCE_FROM_HOMEPOINT(145, "TSK_DISTANCE_FROM_HOMEPOINT",
1500 bundle.getString("BlackboardAttribute.tskdistancefromhome.text"),
1502 TSK_HASH_PHOTODNA(146, "TSK_HASH_PHOTODNA",
1503 bundle.getString("BlackboardAttribute.tskhashphotodna.text"),
1505 TSK_BYTES_SENT(147, "TSK_BYTES_SENT",
1506 bundle.getString("BlackboardAttribute.tskbytessent.text"),
1508 TSK_BYTES_RECEIVED(148, "TSK_BYTES_RECEIVED",
1509 bundle.getString("BlackboardAttribute.tskbytesreceived.text"),
1511 TSK_LAST_PRINTED_DATETIME(149, "TSK_LAST_PRINTED_DATETIME",
1512 bundle.getString("BlackboardAttribute.tsklastprinteddatetime.text"),
1514 TSK_RULE(150, "TSK_RULE",
1515 bundle.getString("BlackboardAttribute.tskrule.text"),
1517 TSK_ACTIVITY_TYPE(151, "TSK_ACTIVITY_TYPE",
1518 bundle.getString("BlackboardAttribute.tskActivityType.text"),
1520 /*
1521 * Use org.sleuthkit.datamodel.blackboardutils.attributes.GeoAreaPoints
1522 * to create and process TSK_GEO_AREAPOINTS attributes.
1523 */
1524 TSK_GEO_AREAPOINTS(152, "TSK_GEO_AREAPOINTS",
1525 bundle.getString("BlackboardAttribute.tskgeoareapoints.text"),
1527 TSK_REALM(153, "TSK_REALM",
1528 bundle.getString("BlackboardAttribute.tskRealm.text"),
1530 TSK_HOST(154, "TSK_HOST",
1531 bundle.getString("BlackboardAttribute.tskHost.text"),
1533 TSK_HOME_DIR(155, "TSK_HOME_DIR",
1534 bundle.getString("BlackboardAttribute.tskHomeDir.text"),
1536 TSK_IS_ADMIN(156, "TSK_IS_ADMIN",
1537 bundle.getString("BlackboardAttribute.tskIsAdmin.text"),
1539 TSK_CORRELATION_TYPE(157, "TSK_CORRELATION_TYPE",
1540 bundle.getString("BlackboardAttribute.tskCorrelationType.text"),
1542 TSK_CORRELATION_VALUE(158, "TSK_CORRELATION_VALUE",
1543 bundle.getString("BlackboardAttribute.tskCorrelationValue.text"),
1545 TSK_OTHER_CASES(159, "TSK_OTHER_CASES",
1546 bundle.getString("BlackboardAttribute.tskOtherCases.text"),
1548
1549 private final int typeID;
1550 private final String typeName;
1551 private final String displayName;
1552 private final TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType;
1553
1562 private ATTRIBUTE_TYPE(int typeID, String typeName, String displayName, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType) {
1563 this.typeID = typeID;
1564 this.typeName = typeName;
1565 this.displayName = displayName;
1566 this.valueType = valueType;
1567 }
1568
1574 public int getTypeID() {
1575 return this.typeID;
1576 }
1577
1586 public String getLabel() {
1587 return this.typeName;
1588 }
1589
1595 public String getDisplayName() {
1596 return this.displayName;
1597 }
1598
1605 return this.valueType;
1606 }
1607
1621 static public ATTRIBUTE_TYPE fromID(int typeID) {
1622 for (ATTRIBUTE_TYPE attrType : ATTRIBUTE_TYPE.values()) {
1623 if (attrType.getTypeID() == typeID) {
1624 return attrType;
1625 }
1626 }
1627 throw new IllegalArgumentException("No ATTRIBUTE_TYPE matching type: " + typeID);
1628 }
1629
1643 static public ATTRIBUTE_TYPE fromLabel(String typeName) {
1644 for (ATTRIBUTE_TYPE attrType : ATTRIBUTE_TYPE.values()) {
1645 if (attrType.getLabel().equals(typeName)) {
1646 return attrType;
1647 }
1648 }
1649 throw new IllegalArgumentException("No ATTRIBUTE_TYPE matching type: " + typeName);
1650 }
1651
1652 }
1653
1670 @Deprecated
1671 public BlackboardAttribute(int attributeTypeID, String moduleName, int valueInt) throws IllegalArgumentException {
1672 this(ATTRIBUTE_TYPE.fromID(attributeTypeID), moduleName, valueInt);
1673 }
1674
1692 @Deprecated
1693 public BlackboardAttribute(int attributeTypeID, String moduleName, String context,
1694 int valueInt) {
1695 this(attributeTypeID, moduleName, valueInt);
1696 this.context = replaceNulls(context);
1697 }
1698
1717 @Deprecated
1718 public BlackboardAttribute(int attributeTypeID, String moduleName,
1719 long valueLong) throws IllegalArgumentException {
1720 this(ATTRIBUTE_TYPE.fromID(attributeTypeID), moduleName, valueLong);
1721 }
1722
1742 @Deprecated
1743 public BlackboardAttribute(int attributeTypeID, String moduleName, String context,
1744 long valueLong) {
1745 this(attributeTypeID, moduleName, valueLong);
1746 this.context = replaceNulls(context);
1747 }
1748
1765 @Deprecated
1766 public BlackboardAttribute(int attributeTypeID, String moduleName,
1767 double valueDouble) throws IllegalArgumentException {
1768 this(ATTRIBUTE_TYPE.fromID(attributeTypeID), moduleName, valueDouble);
1769 }
1770
1788 @Deprecated
1789 public BlackboardAttribute(int attributeTypeID, String moduleName, String context,
1790 double valueDouble) {
1791 this(attributeTypeID, moduleName, valueDouble);
1792 this.context = replaceNulls(context);
1793 }
1794
1811 @Deprecated
1812 public BlackboardAttribute(int attributeTypeID, String moduleName, String valueString) throws IllegalArgumentException {
1813 this(ATTRIBUTE_TYPE.fromID(attributeTypeID), moduleName, valueString);
1814 }
1815
1833 @Deprecated
1834 public BlackboardAttribute(int attributeTypeID, String moduleName, String context,
1835 String valueString) {
1836 this(attributeTypeID, moduleName, valueString);
1837 this.context = replaceNulls(context);
1838 }
1839
1856 @Deprecated
1857 public BlackboardAttribute(int attributeTypeID, String moduleName, byte[] valueBytes) throws IllegalArgumentException {
1858 this(ATTRIBUTE_TYPE.fromID(attributeTypeID), moduleName, valueBytes);
1859 }
1860
1878 @Deprecated
1879 public BlackboardAttribute(int attributeTypeID, String moduleName, String context,
1880 byte[] valueBytes) {
1881 this(attributeTypeID, moduleName, valueBytes);
1882 this.context = replaceNulls(context);
1883 }
1884
1895 @Deprecated
1896 protected void setArtifactID(long artifactID) {
1897 setArtifactId(artifactID);
1898 }
1899
1911 @Deprecated
1912 protected void setCase(SleuthkitCase sleuthkitCase) {
1913 setCaseDatabase(sleuthkitCase);
1914 }
1915
1923 @Deprecated
1924 public String getContext() {
1925 return context;
1926 }
1927
1935 @Deprecated
1936 String getContextString() {
1937 return context;
1938 }
1939
1947 @Deprecated
1948 public int getAttributeTypeID() {
1949 return getAttributeType().getTypeID();
1950 }
1951
1961 @Deprecated
1963 return getAttributeType().getTypeName();
1964 }
1965
1976 @Deprecated
1978 return getAttributeType().getDisplayName();
1979 }
1980
1989 @Deprecated
1990 public String getModuleName() {
1991 return getSourcesCSV();
1992 }
1993
1994}
AbstractAttribute(BlackboardAttribute.Type attributeType, int valueInt)
BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType()
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType()
Type(int typeID, String typeName, String displayName, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType)
Type(BlackboardAttribute.ATTRIBUTE_TYPE type)
BlackboardAttribute(int attributeTypeID, String moduleName, long valueLong)
BlackboardAttribute(int attributeTypeID, String moduleName, int valueInt)
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, long valueLong)
BlackboardAttribute(int attributeTypeID, String moduleName, String context, String valueString)
BlackboardAttribute(Type attributeType, String source, int valueInt)
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, String valueString)
BlackboardAttribute(Type attributeType, String source, String valueString)
BlackboardAttribute(int attributeTypeID, String moduleName, String valueString)
BlackboardAttribute(Type attributeType, String source, byte[] valueBytes)
BlackboardAttribute(int attributeTypeID, String moduleName, String context, int valueInt)
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, int valueInt)
BlackboardAttribute(int attributeTypeID, String moduleName, String context, double valueDouble)
BlackboardAttribute(Type attributeType, String source, long valueLong)
BlackboardAttribute(int attributeTypeID, String moduleName, String context, long valueLong)
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, double valueDouble)
BlackboardAttribute(int attributeTypeID, String moduleName, String context, byte[] valueBytes)
BlackboardAttribute(int attributeTypeID, String moduleName, double valueDouble)
BlackboardAttribute(Type attributeType, String source, double valueDouble)
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, byte[] valueBytes)
BlackboardAttribute(int attributeTypeID, String moduleName, byte[] valueBytes)
static String epochToTime(long epoch)
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromLabel(String typeName)

Copyright © 2011-2024 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.