org.sleuthkit.datamodel.BlackboardArtifact Class Reference

Inherits org.sleuthkit.datamodel.Content.

Inherited by org.sleuthkit.datamodel.AnalysisResult, and org.sleuthkit.datamodel.DataArtifact.

Classes
enum	ARTIFACT_TYPE
enum	Category
enum	ReviewStatus
class	Type

Public Member Functions
void	addAttribute (BlackboardAttribute attribute) throws TskCoreException
void	addAttributes (Collection< BlackboardAttribute > attributes) throws TskCoreException
void	addAttributes (Collection< BlackboardAttribute > attributes, final SleuthkitCase.CaseDbTransaction caseDbTransaction) throws TskCoreException
void	close ()
boolean	equals (Object object)
Score	getAggregateScore () throws TskCoreException
List< AnalysisResult >	getAllAnalysisResults () throws TskCoreException
ArrayList< BlackboardArtifact >	getAllArtifacts () throws TskCoreException
long	getAllArtifactsCount () throws TskCoreException
List< DataArtifact >	getAllDataArtifacts () throws TskCoreException
List< AnalysisResult >	getAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException
long	getArtifactID ()
ArrayList< BlackboardArtifact >	getArtifacts (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (int artifactTypeID) throws TskCoreException
ArrayList< BlackboardArtifact >	getArtifacts (String artifactTypeName) throws TskCoreException
long	getArtifactsCount (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
long	getArtifactsCount (int artifactTypeID) throws TskCoreException
long	getArtifactsCount (String artifactTypeName) throws TskCoreException
int	getArtifactTypeID ()
String	getArtifactTypeName ()
BlackboardAttribute	getAttribute (BlackboardAttribute.Type attributeType) throws TskCoreException
List< BlackboardAttribute >	getAttributes () throws TskCoreException
List< BlackboardAttribute >	getAttributes (final BlackboardAttribute.ATTRIBUTE_TYPE attributeType) throws TskCoreException
List< Content >	getChildren () throws TskCoreException
int	getChildrenCount () throws TskCoreException
List< Long >	getChildrenIds () throws TskCoreException
Content	getDataSource () throws TskCoreException
Long	getDataSourceObjectID ()
String	getDisplayName ()
BlackboardArtifact	getGenInfoArtifact () throws TskCoreException
BlackboardArtifact	getGenInfoArtifact (boolean create) throws TskCoreException
ArrayList< BlackboardAttribute >	getGenInfoAttributes (BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException
Set< String >	getHashSetNames () throws TskCoreException
long	getId ()
String	getName ()
long	getObjectID ()
Content	getParent () throws TskCoreException
ReviewStatus	getReviewStatus ()
String	getShortDescription () throws TskCoreException
long	getSize ()
SleuthkitCase	getSleuthkitCase ()
BlackboardArtifact.Type	getType () throws TskCoreException
String	getUniquePath () throws TskCoreException
boolean	hasChildren () throws TskCoreException
int	hashCode ()
AnalysisResultAdded	newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException
AnalysisResultAdded	newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException
BlackboardArtifact	newArtifact (BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException
BlackboardArtifact	newArtifact (int artifactTypeID) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException
final int	read (byte[] buf, long offset, long len) throws TskCoreException
void	setReviewStatus (ReviewStatus newStatus) throws TskCoreException
String	toString ()
Public Member Functions inherited from org.sleuthkit.datamodel.Content
List< AnalysisResult >	getAnalysisResults (BlackboardArtifact.Type artifactType) throws TskCoreException
AnalysisResultAdded	newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws TskCoreException
AnalysisResultAdded	newAnalysisResult (BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId) throws TskCoreException
DataArtifact	newDataArtifact (BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId) throws TskCoreException

Protected Member Functions
	BlackboardArtifact (SleuthkitCase sleuthkitCase, long artifactID, long objID, long artifactObjID, long dataSourceObjId, int artifactTypeID, String artifactTypeName, String displayName)

Detailed Description

An artifact that has been posted to the blackboard. Artifacts store analysis results (such as hash set hits) and extracted data (such as a web bookmark). An artifact is a typed collection of name value pairs (attributes) that is associated with its source content (A data source, a file, or another artifact). Both standard artifact types and custom artifact types are supported.

IMPORTANT NOTE: No more than one attribute of a given type should be added to an artifact. It is undefined about which will be used.

Definition at line 54 of file BlackboardArtifact.java.

Constructor & Destructor Documentation

BlackboardArtifact()

org.sleuthkit.datamodel.BlackboardArtifact.BlackboardArtifact ( SleuthkitCase sleuthkitCase, long artifactID, long objID, long artifactObjID, long dataSourceObjId, int artifactTypeID, String artifactTypeName, String displayName )

protected

Constructs an artifact that has been posted to the blackboard. An artifact is a typed collection of name value pairs (attributes) that is associated with its source content (either a data source, or file within a data source). Both standard artifact types and custom artifact types are supported.

Parameters

sleuthkitCase	The SleuthKit case (case database) that contains the artifact data.
artifactID	The unique id for this artifact.
objID	The unique id of the content with which this artifact is associated.
artifactObjID	The unique id of the artifact, in tsk_objects
dataSourceObjId	The id of the data source
artifactTypeID	The type id of this artifact.
artifactTypeName	The type name of this artifact.
displayName	The display name of this artifact.

Deprecated

Use new BlackboardArtifact(SleuthkitCase, long, long, int, String, String, ReviewStatus) instead.

Definition at line 2320 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.BlackboardArtifact.ReviewStatus.UNDECIDED.

Member Function Documentation

addAttribute()

void org.sleuthkit.datamodel.BlackboardArtifact.addAttribute

(

BlackboardAttribute

attribute

)

throws TskCoreException

Adds an attribute to this artifact.

IMPORTANT NOTE: No more than one attribute of a given type should be added to an artifact.

Parameters

attribute

The attribute to add

Exceptions

TskCoreException

If an error occurs and the attribute was not added to the artifact.

Definition at line 406 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.SleuthkitCase.addBlackboardAttribute(), and getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.AccountFileInstance.addAttribute().

addAttributes() [1/2]

void org.sleuthkit.datamodel.BlackboardArtifact.addAttributes

(

Collection< BlackboardAttribute >

attributes

)

throws TskCoreException

Adds a collection of attributes to this artifact in a single operation (faster than adding each attribute individually).

Parameters

attributes

The collection of attributes.

Exceptions

TskCoreException

If an error occurs and the attributes were not added to the artifact.

Definition at line 479 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.SleuthkitCase.addBlackboardAttributes(), and getSleuthkitCase().

Referenced by org.sleuthkit.datamodel.AccountFileInstance.addAttributes(), org.sleuthkit.datamodel.blackboardutils.CommunicationArtifactsHelper.addCalllog(), org.sleuthkit.datamodel.Blackboard.newAnalysisResult(), and org.sleuthkit.datamodel.Blackboard.newDataArtifact().

addAttributes() [2/2]

void org.sleuthkit.datamodel.BlackboardArtifact.addAttributes	(	Collection< BlackboardAttribute >	attributes,
		final SleuthkitCase.CaseDbTransaction	caseDbTransaction ) throws TskCoreException

Adds a collection of attributes to this artifact in a single operation (faster than adding each attribute individually) within a transaction supplied by the caller.

Parameters

attributes	The collection of attributes.
caseDbTransaction	The transaction in the scope of which the operation is to be performed, managed by the caller. Null is not permitted.

Exceptions

TskCoreException

If an error occurs and the attributes were not added to the artifact. If caseDbTransaction is null or if attributes is null or empty.

Definition at line 506 of file BlackboardArtifact.java.

References getSleuthkitCase().

close()

void org.sleuthkit.datamodel.BlackboardArtifact.close

(

)

Close the Content object.

Implements org.sleuthkit.datamodel.Content.

Definition at line 942 of file BlackboardArtifact.java.

equals()

boolean org.sleuthkit.datamodel.BlackboardArtifact.equals

(

Object

object

)

Tests this artifact for equality with another object.

Parameters

object

The other object.

Returns

True or false.

Definition at line 870 of file BlackboardArtifact.java.

References getArtifactID().

getAggregateScore()

Score org.sleuthkit.datamodel.BlackboardArtifact.getAggregateScore

(

)

throws TskCoreException

Returns the final score for the content object.

Returns

Score.

Exceptions

TskCoreException

if critical error occurred within tsk core.

Implements org.sleuthkit.datamodel.Content.

Definition at line 582 of file BlackboardArtifact.java.

getAllAnalysisResults()

List< AnalysisResult > org.sleuthkit.datamodel.BlackboardArtifact.getAllAnalysisResults

(

)

throws TskCoreException

Get all analysis results associated with this content.

Returns

A list of analysis results.

Exceptions

TskCoreException

If critical error occurred within tsk core.

Implements org.sleuthkit.datamodel.Content.

Definition at line 572 of file BlackboardArtifact.java.

getAllArtifacts()

ArrayList< BlackboardArtifact > org.sleuthkit.datamodel.BlackboardArtifact.getAllArtifacts

(

)

throws TskCoreException

Get all artifacts associated with this content

Returns

a list of blackboard artifacts

Exceptions

TskCoreException

if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 566 of file BlackboardArtifact.java.

getAllArtifactsCount()

long org.sleuthkit.datamodel.BlackboardArtifact.getAllArtifactsCount

(

)

throws TskCoreException

Get count of all artifacts associated with this content

Returns

count of all blackboard artifacts for this content

Exceptions

TskCoreException

if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 647 of file BlackboardArtifact.java.

getAllDataArtifacts()

List< DataArtifact > org.sleuthkit.datamodel.BlackboardArtifact.getAllDataArtifacts

(

)

throws TskCoreException

Get all data artifacts associated with this content.

Returns

A list of data artifacts.

Exceptions

TskCoreException

If critical error occurred within tsk core.

Implements org.sleuthkit.datamodel.Content.

Definition at line 577 of file BlackboardArtifact.java.

getAnalysisResults()

List< AnalysisResult > org.sleuthkit.datamodel.BlackboardArtifact.getAnalysisResults

(

BlackboardArtifact.Type

artifactType

)

throws TskCoreException

Definition at line 588 of file BlackboardArtifact.java.

getArtifactID()

long org.sleuthkit.datamodel.BlackboardArtifact.getArtifactID

(

)

Gets the unique id for this artifact.

Returns

The artifact id.

Definition at line 162 of file BlackboardArtifact.java.

Referenced by equals(), and getName().

getArtifacts() [1/3]

ArrayList< BlackboardArtifact > org.sleuthkit.datamodel.BlackboardArtifact.getArtifacts

(

BlackboardArtifact.ARTIFACT_TYPE

type

)

throws TskCoreException

Get all artifacts associated with this content that have the given type

Parameters

type	type to look up

Returns

a list of blackboard artifacts matching the type

Exceptions

TskCoreException

if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 634 of file BlackboardArtifact.java.

getArtifacts() [2/3]

ArrayList< BlackboardArtifact > org.sleuthkit.datamodel.BlackboardArtifact.getArtifacts

(

int

artifactTypeID

)

throws TskCoreException

Get all artifacts associated with this content that have the given type id

Parameters

artifactTypeID

type id to look up

Returns

a list of blackboard artifacts matching the type

Exceptions

TskCoreException

if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 619 of file BlackboardArtifact.java.

getArtifacts() [3/3]

ArrayList< BlackboardArtifact > org.sleuthkit.datamodel.BlackboardArtifact.getArtifacts

(

String

artifactTypeName

)

throws TskCoreException

Get all artifacts associated with this content that have the given type name

Parameters

artifactTypeName

name of the type to look up

Returns

a list of blackboard artifacts matching the type

Exceptions

TskCoreException

if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 603 of file BlackboardArtifact.java.

getArtifactsCount() [1/3]

long org.sleuthkit.datamodel.BlackboardArtifact.getArtifactsCount

(

BlackboardArtifact.ARTIFACT_TYPE

type

)

throws TskCoreException

Get count of all artifacts associated with this content that have the given type

Parameters

type	type to look up

Returns

count of blackboard artifacts matching the type

Exceptions

TskCoreException

if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 695 of file BlackboardArtifact.java.

getArtifactsCount() [2/3]

long org.sleuthkit.datamodel.BlackboardArtifact.getArtifactsCount

(

int

artifactTypeID

)

throws TskCoreException

Get count of all artifacts associated with this content that have the given type id

Parameters

artifactTypeID

type id to look up

Returns

count of blackboard artifacts matching the type

Exceptions

TskCoreException

if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 679 of file BlackboardArtifact.java.

getArtifactsCount() [3/3]

long org.sleuthkit.datamodel.BlackboardArtifact.getArtifactsCount

(

String

artifactTypeName

)

throws TskCoreException

Get count of all artifacts associated with this content that have the given type name

Parameters

artifactTypeName

name of the type to look up

Returns

count of blackboard artifacts matching the type

Exceptions

TskCoreException

if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 663 of file BlackboardArtifact.java.

getArtifactTypeID()

int org.sleuthkit.datamodel.BlackboardArtifact.getArtifactTypeID

(

)

Gets the artifact type id for this artifact.

Returns

The artifact type id.

Definition at line 191 of file BlackboardArtifact.java.

Referenced by getType().

getArtifactTypeName()

String org.sleuthkit.datamodel.BlackboardArtifact.getArtifactTypeName

(

)

Gets the artifact type name for this artifact.

Returns

The artifact type name.

Definition at line 216 of file BlackboardArtifact.java.

getAttribute()

BlackboardAttribute org.sleuthkit.datamodel.BlackboardArtifact.getAttribute

(

BlackboardAttribute.Type

attributeType

)

throws TskCoreException

Gets the attribute of this artifact that matches a given type.

IMPORTANT NOTE: No more than one attribute of a given type should be added to an artifact.

Parameters

attributeType

The attribute type.

Returns

The first attribute of the given type, or null if there are no attributes of that type.

Exceptions

TskCoreException

If an error occurs and the attribute is not fetched.

Definition at line 460 of file BlackboardArtifact.java.

References getAttributes().

Referenced by org.sleuthkit.datamodel.AccountFileInstance.getAttribute(), and getShortDescription().

getAttributes() [1/2]

List< BlackboardAttribute > org.sleuthkit.datamodel.BlackboardArtifact.getAttributes

(

)

throws TskCoreException

Gets the attributes of this artifact.

Returns

The attributes.

Exceptions

TskCoreException

If an error occurs and the attributes cannot be fetched.

Definition at line 421 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.SleuthkitCase.getBlackboard(), org.sleuthkit.datamodel.Blackboard.getBlackboardAttributes(), and getSleuthkitCase().

Referenced by getAttribute().

getAttributes() [2/2]

List< BlackboardAttribute > org.sleuthkit.datamodel.BlackboardArtifact.getAttributes

(

final BlackboardAttribute.ATTRIBUTE_TYPE

attributeType

)

throws TskCoreException

Gets all attributes associated with this artifact that are of the given attribute type.

Parameters

attributeType

the type of attributes to get

Returns

a list of attributes of the given type

Exceptions

TskCoreException

if a critical error occurs and the attributes are not fetched

Deprecated

An artifact should not have multiple attributes of the same type. Use getAttribute(BlackboardAttribute.Type) instead.

Definition at line 2339 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.SleuthkitCase.getBlackboardAttributes(), and getSleuthkitCase().

getChildren()

List< Content > org.sleuthkit.datamodel.BlackboardArtifact.getChildren

(

)

throws TskCoreException

Get all children of this artifact, if any.

Returns

A list of the children.

Exceptions

TskCoreException

if there was an error querying the case database.

Implements org.sleuthkit.datamodel.Content.

Definition at line 2414 of file BlackboardArtifact.java.

References getSleuthkitCase().

getChildrenCount()

int org.sleuthkit.datamodel.BlackboardArtifact.getChildrenCount

(

)

throws TskCoreException

Returns count of children objects. Note, this should be more efficient than getting children and counting them.

Returns

children count

Exceptions

TskCoreException

if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 2378 of file BlackboardArtifact.java.

References getSleuthkitCase().

getChildrenIds()

List< Long > org.sleuthkit.datamodel.BlackboardArtifact.getChildrenIds

(

)

throws TskCoreException

Gets the object ids of children of this artifact, if any

Returns

A list of the object ids of children.

Exceptions

TskCoreException

if there was an error querying the case database.

Implements org.sleuthkit.datamodel.Content.

Definition at line 2369 of file BlackboardArtifact.java.

References getSleuthkitCase().

getDataSource()

Content org.sleuthkit.datamodel.BlackboardArtifact.getDataSource

(

)

throws TskCoreException

Gets the root data source (image, virtual directory, etc.) of this content.

Returns

Content associated with data source or null if one can't be found

Exceptions

TskCoreException

if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 983 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.SleuthkitCase.getContentById(), and getSleuthkitCase().

Referenced by newAnalysisResult().

getDataSourceObjectID()

Long org.sleuthkit.datamodel.BlackboardArtifact.getDataSourceObjectID

(

)

Gets the object id of the data source for this artifact.

Returns

The data source object id, may be null.

Definition at line 182 of file BlackboardArtifact.java.

Referenced by org.sleuthkit.datamodel.BlackboardAttribute.getDisplayString().

getDisplayName()

String org.sleuthkit.datamodel.BlackboardArtifact.getDisplayName

(

)

Gets the artifact type display name for this artifact.

Returns

The artifact type display name.

Definition at line 225 of file BlackboardArtifact.java.

Referenced by getShortDescription().

getGenInfoArtifact() [1/2]

BlackboardArtifact org.sleuthkit.datamodel.BlackboardArtifact.getGenInfoArtifact

(

)

throws TskCoreException

Return the TSK_GEN_INFO artifact for the file so that individual attributes can be added to it. Creates one if it does not already exist.

Returns

Instance of the TSK_GEN_INFO artifact

Exceptions

TskCoreException

Implements org.sleuthkit.datamodel.Content.

Definition at line 709 of file BlackboardArtifact.java.

getGenInfoArtifact() [2/2]

BlackboardArtifact org.sleuthkit.datamodel.BlackboardArtifact.getGenInfoArtifact

(

boolean

create

)

throws TskCoreException

Return the TSK_GEN_INFO artifact for the file so that individual attributes can be added to it. If one does not create, behavior depends on the create argument.

Parameters

create

If true, an artifact will be created if it does not already exist.

Returns

Instance of the TSK_GEN_INFO artifact or null if artifact does not already exist and create was set to false

Exceptions

TskCoreException

Implements org.sleuthkit.datamodel.Content.

Definition at line 728 of file BlackboardArtifact.java.

getGenInfoAttributes()

ArrayList< BlackboardAttribute > org.sleuthkit.datamodel.BlackboardArtifact.getGenInfoAttributes

(

BlackboardAttribute.ATTRIBUTE_TYPE

attr_type

)

throws TskCoreException

Return attributes of a given type from TSK_GEN_INFO.

Parameters

attr_type

Attribute type to find inside of the TSK_GEN_INFO artifact.

Returns

Attributes

Exceptions

org.sleuthkit.datamodel.TskCoreException

Implements org.sleuthkit.datamodel.Content.

Definition at line 748 of file BlackboardArtifact.java.

getHashSetNames()

Set< String > org.sleuthkit.datamodel.BlackboardArtifact.getHashSetNames

(

)

throws TskCoreException

Get the names of all the hashsets that this content is in.

Returns

the names of the hashsets that this content is in

Exceptions

TskCoreException

if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 761 of file BlackboardArtifact.java.

getId()

long org.sleuthkit.datamodel.BlackboardArtifact.getId

(

)

Returns the unique object ID that was assigned to it in the database. This is a Sleuth Kit database-assigned number.

Returns

object id

Implements org.sleuthkit.datamodel.Content.

Definition at line 2356 of file BlackboardArtifact.java.

Referenced by newAnalysisResult(), and newAnalysisResult().

getName()

String org.sleuthkit.datamodel.BlackboardArtifact.getName

(

)

Get the name of this content object (does not include parent path)

Returns

the name

Implements org.sleuthkit.datamodel.Content.

Definition at line 978 of file BlackboardArtifact.java.

References getArtifactID().

getObjectID()

long org.sleuthkit.datamodel.BlackboardArtifact.getObjectID

(

)

Gets the object id of the source content (data source or file within a data source) of this artifact

Returns

The object id.

Definition at line 172 of file BlackboardArtifact.java.

Referenced by org.sleuthkit.datamodel.SleuthkitCase.getAllBlackboardArtifactTags(), org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactTagByID(), org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactTagsByTagName(), org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifactTagsByTagName(), and toString().

getParent()

Content org.sleuthkit.datamodel.BlackboardArtifact.getParent

(

)

throws TskCoreException

Returns

returns the parent of this Content object or null if there isn't one as is the case for Image.

Exceptions

TskCoreException

Implements org.sleuthkit.datamodel.Content.

Definition at line 551 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.SleuthkitCase.getContentById(), and getSleuthkitCase().

Referenced by getUniquePath().

getReviewStatus()

ReviewStatus org.sleuthkit.datamodel.BlackboardArtifact.getReviewStatus

(

)

Gets the review status of this artifact, i.e., whether it has been approved, rejected, or is still waiting for a decision from the user.

Returns

The review status.

Definition at line 378 of file BlackboardArtifact.java.

getShortDescription()

String org.sleuthkit.datamodel.BlackboardArtifact.getShortDescription

(

)

throws TskCoreException

Gets a short description for this artifact.

Returns

The description, may be the empty string.

Exceptions

TskCoreException

if there is a problem creating the description.

Definition at line 236 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.fromID(), getAttribute(), org.sleuthkit.datamodel.AbstractAttribute.getAttributeType(), getDisplayName(), org.sleuthkit.datamodel.BlackboardAttribute.getDisplayString(), org.sleuthkit.datamodel.BlackboardAttribute.toString(), org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CARD_NUMBER, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_END, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_MODIFIED, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_RCVD, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_NAME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_HOME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_OFFICE, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ID, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MAC_ADDRESS, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_HOME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_MOBILE, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_OFFICE, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REMOTE_PATH, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SSID, and org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT.

getSize()

long org.sleuthkit.datamodel.BlackboardArtifact.getSize

(

)

Get the (reported) size of the content object. Artifact content is a string dump of all its attributes.

Returns

size of the content in bytes

Implements org.sleuthkit.datamodel.Content.

Definition at line 925 of file BlackboardArtifact.java.

getSleuthkitCase()

SleuthkitCase org.sleuthkit.datamodel.BlackboardArtifact.getSleuthkitCase

(

)

Gets the SleuthKit case (case database) that contains the data for this artifact.

Returns

The SleuthKit case (case database) object.

Definition at line 153 of file BlackboardArtifact.java.

Referenced by addAttribute(), addAttributes(), addAttributes(), getAttributes(), getAttributes(), getChildren(), getChildrenCount(), getChildrenIds(), getDataSource(), getParent(), getType(), hasChildren(), setReviewStatus(), and toString().

getType()

BlackboardArtifact.Type org.sleuthkit.datamodel.BlackboardArtifact.getType

(

)

throws TskCoreException

Gets the artifact type for this artifact.

Returns

The artifact type.

Exceptions

TskCoreException

Definition at line 202 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.Blackboard.getArtifactType(), getArtifactTypeID(), org.sleuthkit.datamodel.SleuthkitCase.getBlackboard(), and getSleuthkitCase().

getUniquePath()

String org.sleuthkit.datamodel.BlackboardArtifact.getUniquePath

(

)

throws TskCoreException

This overiding implementation returns the unique path of the parent. It does not include the Artifact name in the unique path.

Exceptions

org.sleuthkit.datamodel.TskCoreException

Implements org.sleuthkit.datamodel.Content.

Definition at line 533 of file BlackboardArtifact.java.

References getParent(), and org.sleuthkit.datamodel.Content.getUniquePath().

hasChildren()

boolean org.sleuthkit.datamodel.BlackboardArtifact.hasChildren

(

)

throws TskCoreException

Returns true if the content object has children objects. Note, this should be more efficient than getting children and checking it empty.

Returns

true if has children, false otherwise.

Exceptions

TskCoreException

if critical error occurred within tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 2392 of file BlackboardArtifact.java.

References getSleuthkitCase().

hashCode()

int org.sleuthkit.datamodel.BlackboardArtifact.hashCode

(

)

Gets the hash code for this artifact.

Returns

The hash code.

Definition at line 887 of file BlackboardArtifact.java.

newAnalysisResult() [1/2]

AnalysisResultAdded org.sleuthkit.datamodel.BlackboardArtifact.newAnalysisResult	(	BlackboardArtifact.Type	artifactType,
		Score	score,
		String	conclusion,
		String	configuration,
		String	justification,
		Collection< BlackboardAttribute >	attributesList ) throws TskCoreException

Definition at line 786 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), getDataSource(), getId(), org.sleuthkit.datamodel.Content.getId(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

Referenced by org.sleuthkit.datamodel.Blackboard.newAnalysisResult().

newAnalysisResult() [2/2]

AnalysisResultAdded org.sleuthkit.datamodel.BlackboardArtifact.newAnalysisResult	(	BlackboardArtifact.Type	artifactType,
		Score	score,
		String	conclusion,
		String	configuration,
		String	justification,
		Collection< BlackboardAttribute >	attributesList,
		long	dataSourceId ) throws TskCoreException

Definition at line 803 of file BlackboardArtifact.java.

References org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), getId(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

newArtifact() [1/2]

BlackboardArtifact org.sleuthkit.datamodel.BlackboardArtifact.newArtifact

(

BlackboardArtifact.ARTIFACT_TYPE

type

)

throws TskCoreException

Create and add an artifact associated with this content to the blackboard

Parameters

type	artifact enum type

Returns

the blackboard artifact created (the artifact type id can be looked up from this)

Exceptions

TskCoreException

if critical error occurred within tsk core

Deprecated

Use the Blackboard to create Data Artifacts and Analysis Results.

Implements org.sleuthkit.datamodel.Content.

Definition at line 845 of file BlackboardArtifact.java.

newArtifact() [2/2]

BlackboardArtifact org.sleuthkit.datamodel.BlackboardArtifact.newArtifact

(

int

artifactTypeID

)

throws TskCoreException

Create and add an artifact associated with this content to the blackboard

Parameters

artifactTypeID

id of the artifact type (if the id doesn't already exist an exception will be thrown)

Returns

the blackboard artifact created (the artifact type id can be looked up from this)

Exceptions

TskCoreException

if critical error occurred within tsk core

Deprecated

Use the Blackboard to create Data Artifacts and Analysis Results.

Implements org.sleuthkit.datamodel.Content.

Definition at line 781 of file BlackboardArtifact.java.

newDataArtifact() [1/3]

DataArtifact org.sleuthkit.datamodel.BlackboardArtifact.newDataArtifact	(	BlackboardArtifact.Type	artifactType,
		Collection< BlackboardAttribute >	attributesList ) throws TskCoreException

Definition at line 827 of file BlackboardArtifact.java.

References newDataArtifact().

newDataArtifact() [2/3]

DataArtifact org.sleuthkit.datamodel.BlackboardArtifact.newDataArtifact	(	BlackboardArtifact.Type	artifactType,
		Collection< BlackboardAttribute >	attributesList,
		Long	osAccountId ) throws TskCoreException

Definition at line 817 of file BlackboardArtifact.java.

Referenced by newDataArtifact().

newDataArtifact() [3/3]

DataArtifact org.sleuthkit.datamodel.BlackboardArtifact.newDataArtifact	(	BlackboardArtifact.Type	artifactType,
		Collection< BlackboardAttribute >	attributesList,
		Long	osAccountId,
		long	dataSourceId ) throws TskCoreException

Definition at line 822 of file BlackboardArtifact.java.

read()

final int org.sleuthkit.datamodel.BlackboardArtifact.read	(	byte[]	buf,
		long	offset,
		long	len ) throws TskCoreException

Reads content data for this artifact Artifact content is a string dump of all its attributes.

Parameters

buf	a character array of data (in bytes) to copy read data to
offset	byte offset in the content to start reading from
len	number of bytes to read into buf.

Returns

num of bytes read, or -1 on error

Exceptions

TskCoreException

if critical error occurred during read in the tsk core

Implements org.sleuthkit.datamodel.Content.

Definition at line 960 of file BlackboardArtifact.java.

setReviewStatus()

void org.sleuthkit.datamodel.BlackboardArtifact.setReviewStatus

(

ReviewStatus

newStatus

)

throws TskCoreException

Sets the review status of this artifact, i.e., whether it has been approved, rejected, or is still waiting for a decision from the user.

Parameters

newStatus

new status of the artifact

Exceptions

TskCoreException

If an error occurs

Definition at line 390 of file BlackboardArtifact.java.

References getSleuthkitCase(), and org.sleuthkit.datamodel.SleuthkitCase.setReviewStatus().

toString()

String org.sleuthkit.datamodel.BlackboardArtifact.toString

(

)

Gets a string representation of this artifact.

Returns

The string.

Definition at line 899 of file BlackboardArtifact.java.

References getObjectID(), and getSleuthkitCase().

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/sleuthkit/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java