Sleuth Kit Java Bindings (JNI)  4.3
Java bindings for using The Sleuth Kit
BlackboardAttribute.java
Go to the documentation of this file.
1 /*
2  * Sleuth Kit Data Model
3  *
4  * Copyright 2011-2017 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.io.Serializable;
22 import java.util.Arrays;
23 import java.util.Collections;
24 import java.util.List;
25 import java.util.Objects;
26 import java.util.ResourceBundle;
27 
42 public class BlackboardAttribute {
43 
44  private static final char[] HEX_ARRAY = "0123456789ABCDEF".toCharArray();
45  private static final ResourceBundle bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle");
46  private BlackboardAttribute.Type attributeType;
47  private final int valueInt;
48  private final long valueLong;
49  private final double valueDouble;
50  private final String valueString;
51  private final byte[] valueBytes;
52  private String context;
53  private long artifactID;
54  private SleuthkitCase sleuthkitCase;
55  private String sources;
56 
60  public static final class Type implements Serializable {
61 
62  private static final long serialVersionUID = 1L;
63  private final String typeName;
64  private final int typeID;
65  private final String displayName;
66  private final TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType;
67 
76  public Type(int typeID, String typeName, String displayName, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType) {
77  this.typeID = typeID;
78  this.typeName = typeName;
79  this.displayName = displayName;
80  this.valueType = valueType;
81  }
82 
89  public Type(BlackboardAttribute.ATTRIBUTE_TYPE type) {
90  this.typeID = type.getTypeID();
91  this.typeName = type.getLabel();
92  this.displayName = type.getDisplayName();
93  this.valueType = type.getValueType();
94  }
95 
101  public TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType() {
102  return this.valueType;
103  }
104 
110  public String getTypeName() {
111  return this.typeName;
112  }
113 
119  public int getTypeID() {
120  return this.typeID;
121  }
122 
128  public String getDisplayName() {
129  return this.displayName;
130  }
131 
132  @Override
133  public boolean equals(Object that) {
134  if (this == that) {
135  return true;
136  } else if (!(that instanceof BlackboardAttribute.Type)) {
137  return false;
138  } else {
139  return ((BlackboardAttribute.Type) that).sameType(this);
140  }
141  }
142 
151  private boolean sameType(BlackboardAttribute.Type that) {
152  return this.typeName.equals(that.getTypeName())
153  && this.displayName.equals(that.getDisplayName())
154  && this.typeID == that.getTypeID()
155  && this.valueType == that.getValueType();
156  }
157 
158  @Override
159  public int hashCode() {
160  int hash = 7;
161  hash = 63 * hash + Objects.hashCode(this.typeID);
162  hash = 63 * hash + Objects.hashCode(this.displayName);
163  hash = 63 * hash + Objects.hashCode(this.typeName);
164  hash = 63 * hash + Objects.hashCode(this.valueType);
165  return hash;
166  }
167 
168  @Override
169  public String toString() {
170  return "(typeID= " + this.typeID
171  + ", displayName=" + this.displayName
172  + ", typeName=" + this.typeName
173  + ", valueType=" + this.valueType + ")";
174  }
175  }
176 
181  public enum TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE {
182 
186  STRING(0, "String"), //NON-NLS
190  INTEGER(1, "Integer"), //NON-NLS
194  LONG(2, "Long"), //NON-NLS
198  DOUBLE(3, "Double"), //NON-NLS
202  BYTE(4, "Byte"), //NON-NLS
207  DATETIME(5, "DateTime");
208 
209  private final long typeId;
210  private final String typeName;
211 
212  /*
213  * TODO (AUT-2070): Add a localized displayName field and a
214  * getDisplayName method for API consistency.
215  */
222  private TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE(long type, String typeName) {
223  this.typeId = type;
224  this.typeName = typeName;
225  }
226 
235  public long getType() {
236  return typeId;
237  }
238 
247  public String getLabel() {
248  return this.typeName;
249  }
250 
265  static public TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromType(long typeId) {
266  for (TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType : TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.values()) {
267  if (valueType.getType() == typeId) {
268  return valueType;
269  }
270  }
271  throw new IllegalArgumentException("No TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE matching type: " + typeId);
272  }
273 
288  static public TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromLabel(String typeName) {
289  for (TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType : TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.values()) {
290  if (valueType.getLabel().equals(typeName)) {
291  return valueType;
292  }
293  }
294  throw new IllegalArgumentException("No TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE matching type: " + typeName);
295  }
296 
297  }
298 
305  public enum ATTRIBUTE_TYPE {
306 
307  TSK_URL(1, "TSK_URL", //NON-NLS
308  bundle.getString("BlackboardAttribute.tskUrl.text"),
309  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
310  TSK_DATETIME(2, "TSK_DATETIME", //NON-NLS
311  bundle.getString("BlackboardAttribute.tskDatetime.text"),
312  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME),
313  TSK_NAME(3, "TSK_NAME", //NON-NLS
314  bundle.getString("BlackboardAttribute.tskName.text"),
315  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
316  TSK_PROG_NAME(4, "TSK_PROG_NAME", //NON-NLS
317  bundle.getString("BlackboardAttribute.tskProgName.text"),
318  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
319  TSK_VALUE(6, "TSK_VALUE", //NON-NLS
320  bundle.getString("BlackboardAttribute.tskValue.text"),
321  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
322  TSK_FLAG(7, "TSK_FLAG", //NON-NLS
323  bundle.getString("BlackboardAttribute.tskFlag.text"),
324  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
325  TSK_PATH(8, "TSK_PATH", //NON-NLS
326  bundle.getString("BlackboardAttribute.tskPath.text"),
327  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
328  TSK_KEYWORD(10, "TSK_KEYWORD", //NON-NLS
329  bundle.getString("BlackboardAttribute.tskKeyword.text"),
330  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
331  TSK_KEYWORD_REGEXP(11, "TSK_KEYWORD_REGEXP", //NON-NLS
332  bundle.getString("BlackboardAttribute.tskKeywordRegexp.text"),
333  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
334  TSK_KEYWORD_PREVIEW(12, "TSK_KEYWORD_PREVIEW", //NON-NLS
335  bundle.getString("BlackboardAttribute.tskKeywordPreview.text"),
336  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
340  @Deprecated
341  TSK_KEYWORD_SET(13, "TSK_KEYWORD_SET", //NON-NLS
342  bundle.getString("BlackboardAttribute.tskKeywordSet.text"),
343  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
344  TSK_USER_NAME(14, "TSK_USER_NAME", //NON-NLS
345  bundle.getString("BlackboardAttribute.tskUserName.text"),
346  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
347  TSK_DOMAIN(15, "TSK_DOMAIN", //NON-NLS
348  bundle.getString("BlackboardAttribute.tskDomain.text"),
349  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
350  TSK_PASSWORD(16, "TSK_PASSWORD", //NON-NLS
351  bundle.getString("BlackboardAttribute.tskPassword.text"),
352  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
353  TSK_NAME_PERSON(17, "TSK_NAME_PERSON", //NON-NLS
354  bundle.getString("BlackboardAttribute.tskNamePerson.text"),
355  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
356  TSK_DEVICE_MODEL(18, "TSK_DEVICE_MODEL", //NON-NLS
357  bundle.getString("BlackboardAttribute.tskDeviceModel.text"),
358  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
359  TSK_DEVICE_MAKE(19, "TSK_DEVICE_MAKE", //NON-NLS
360  bundle.getString("BlackboardAttribute.tskDeviceMake.text"),
361  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
362  TSK_DEVICE_ID(20, "TSK_DEVICE_ID", //NON-NLS
363  bundle.getString("BlackboardAttribute.tskDeviceId.text"),
364  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
365  TSK_EMAIL(21, "TSK_EMAIL", //NON-NLS
366  bundle.getString("BlackboardAttribute.tskEmail.text"),
367  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
368  TSK_HASH_MD5(22, "TSK_HASH_MD5", //NON-NLS
369  bundle.getString("BlackboardAttribute.tskHashMd5.text"),
370  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
371  TSK_HASH_SHA1(23, "TSK_HASH_SHA1", //NON-NLS
372  bundle.getString("BlackboardAttribute.tskHashSha1.text"),
373  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
374  TSK_HASH_SHA2_256(24, "TSK_HASH_SHA2_256", //NON-NLS
375  bundle.getString("BlackboardAttribute.tskHashSha225.text"),
376  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
377  TSK_HASH_SHA2_512(25, "TSK_HASH_SHA2_512", //NON-NLS
378  bundle.getString("BlackboardAttribute.tskHashSha2512.text"),
379  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
380  TSK_TEXT(26, "TSK_TEXT", //NON-NLS
381  bundle.getString("BlackboardAttribute.tskText.text"),
382  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
383  TSK_TEXT_FILE(27, "TSK_TEXT_FILE", //NON-NLS
384  bundle.getString("BlackboardAttribute.tskTextFile.text"),
385  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
386  TSK_TEXT_LANGUAGE(28, "TSK_TEXT_LANGUAGE", //NON-NLS
387  bundle.getString("BlackboardAttribute.tskTextLanguage.text"),
388  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
389  TSK_ENTROPY(29, "TSK_ENTROPY", //NON-NLS
390  bundle.getString("BlackboardAttribute.tskEntropy.text"),
391  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE),
395  @Deprecated
396  TSK_HASHSET_NAME(30, "TSK_HASHSET_NAME", //NON-NLS
397  bundle.getString("BlackboardAttribute.tskHashsetName.text"),
398  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
402  @Deprecated
403  TSK_INTERESTING_FILE(31, "TSK_INTERESTING_FILE", //NON-NLS
404  bundle.getString("BlackboardAttribute.tskInterestingFile.text"),
405  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG),
406  TSK_REFERRER(32, "TSK_REFERRER", //NON-NLS
407  bundle.getString("BlackboardAttribute.tskReferrer.text"),
408  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
409  TSK_DATETIME_ACCESSED(33, "TSK_DATETIME_ACCESSED", //NON-NLS
410  bundle.getString("BlackboardAttribute.tskDateTimeAccessed.text"),
411  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME),
412  TSK_IP_ADDRESS(34, "TSK_IP_ADDRESS", //NON-NLS
413  bundle.getString("BlackboardAttribute.tskIpAddress.text"),
414  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
415  TSK_PHONE_NUMBER(35, "TSK_PHONE_NUMBER", //NON-NLS
416  bundle.getString("BlackboardAttribute.tskPhoneNumber.text"),
417  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
418  TSK_PATH_ID(36, "TSK_PATH_ID", //NON-NLS
419  bundle.getString("BlackboardAttribute.tskPathId.text"),
420  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG),
421  TSK_SET_NAME(37, "TSK_SET_NAME", //NON-NLS
422  bundle.getString("BlackboardAttribute.tskSetName.text"),
423  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
427  @Deprecated
428  TSK_ENCRYPTION_DETECTED(38, "TSK_ENCRYPTION_DETECTED", //NON-NLS
429  bundle.getString("BlackboardAttribute.tskEncryptionDetected.text"),
430  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER),
431  TSK_MALWARE_DETECTED(39, "TSK_MALWARE_DETECTED", //NON-NLS
432  bundle.getString("BlackboardAttribute.tskMalwareDetected.text"),
433  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER),
434  TSK_STEG_DETECTED(40, "TSK_STEG_DETECTED", //NON-NLS
435  bundle.getString("BlackboardAttribute.tskStegDetected.text"),
436  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER),
437  TSK_EMAIL_TO(41, "TSK_EMAIL_TO", //NON-NLS
438  bundle.getString("BlackboardAttribute.tskEmailTo.text"),
439  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
440  TSK_EMAIL_CC(42, "TSK_EMAIL_CC", //NON-NLS
441  bundle.getString("BlackboardAttribute.tskEmailCc.text"),
442  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
443  TSK_EMAIL_BCC(43, "TSK_EMAIL_BCC", //NON-NLS
444  bundle.getString("BlackboardAttribute.tskEmailBcc.text"),
445  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
446  TSK_EMAIL_FROM(44, "TSK_EMAIL_FROM", //NON-NLS
447  bundle.getString("BlackboardAttribute.tskEmailFrom.text"),
448  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
449  TSK_EMAIL_CONTENT_PLAIN(45, "TSK_EMAIL_CONTENT_PLAIN", //NON-NLS
450  bundle.getString("BlackboardAttribute.tskEmailContentPlain.text"),
451  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
452  TSK_EMAIL_CONTENT_HTML(46, "TSK_EMAIL_CONTENT_HTML", //NON-NLS
453  bundle.getString("BlackboardAttribute.tskEmailContentHtml.text"),
454  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
455  TSK_EMAIL_CONTENT_RTF(47, "TSK_EMAIL_CONTENT_RTF", //NON-NLS
456  bundle.getString("BlackboardAttribute.tskEmailContentRtf.text"),
457  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
458  TSK_MSG_ID(48, "TSK_MSG_ID", //NON-NLS
459  bundle.getString("BlackboardAttribute.tskMsgId.text"),
460  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
461  TSK_MSG_REPLY_ID(49, "TSK_MSG_REPLY_ID", //NON-NLS
462  bundle.getString("BlackboardAttribute.tskMsgReplyId.text"),
463  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
464  TSK_DATETIME_RCVD(50, "TSK_DATETIME_RCVD", //NON-NLS
465  bundle.getString("BlackboardAttribute.tskDateTimeRcvd.text"),
466  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME),
467  TSK_DATETIME_SENT(51, "TSK_DATETIME_SENT", //NON-NLS
468  bundle.getString("BlackboardAttribute.tskDateTimeSent.text"),
469  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME),
470  TSK_SUBJECT(52, "TSK_SUBJECT", //NON-NLS
471  bundle.getString("BlackboardAttribute.tskSubject.text"),
472  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
473  TSK_TITLE(53, "TSK_TITLE", //NON-NLS
474  bundle.getString("BlackboardAttribute.tskTitle.text"),
475  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
476  TSK_GEO_LATITUDE(54, "TSK_GEO_LATITUDE", //NON-NLS
477  bundle.getString("BlackboardAttribute.tskGeoLatitude.text"),
478  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE),
479  TSK_GEO_LONGITUDE(55, "TSK_GEO_LONGITUDE", //NON-NLS
480  bundle.getString("BlackboardAttribute.tskGeoLongitude.text"),
481  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE),
482  TSK_GEO_VELOCITY(56, "TSK_GEO_VELOCITY", //NON-NLS
483  bundle.getString("BlackboardAttribute.tskGeoVelocity.text"),
484  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE),
485  TSK_GEO_ALTITUDE(57, "TSK_GEO_ALTITUDE", //NON-NLS
486  bundle.getString("BlackboardAttribute.tskGeoAltitude.text"),
487  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE),
488  TSK_GEO_BEARING(58, "TSK_GEO_BEARING", //NON-NLS
489  bundle.getString("BlackboardAttribute.tskGeoBearing.text"),
490  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
491  TSK_GEO_HPRECISION(59, "TSK_GEO_HPRECISION", //NON-NLS
492  bundle.getString("BlackboardAttribute.tskGeoHPrecision.text"),
493  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE),
494  TSK_GEO_VPRECISION(60, "TSK_GEO_VPRECISION", //NON-NLS
495  bundle.getString("BlackboardAttribute.tskGeoVPrecision.text"),
496  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE),
497  TSK_GEO_MAPDATUM(61, "TSK_GEO_MAPDATUM", //NON-NLS
498  bundle.getString("BlackboardAttribute.tskGeoMapDatum.text"),
499  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
504  @Deprecated
505  TSK_FILE_TYPE_SIG(62, "TSK_FILE_TYPE_SIG", //NON-NLS
506  bundle.getString("BlackboardAttribute.tskFileTypeSig.text"),
507  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
508  TSK_FILE_TYPE_EXT(63, "TSK_FILE_TYPE_EXT", //NON-NLS
509  bundle.getString("BlackboardAttribute.tskFileTypeExt.text"),
510  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
515  @Deprecated
516  TSK_TAGGED_ARTIFACT(64, "TSK_TAGGED_ARTIFACT", //NON-NLS
517  bundle.getString("BlackboardAttribute.tskTaggedArtifact.text"),
518  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG),
523  @Deprecated
524  TSK_TAG_NAME(65, "TSK_TAG_NAME", //NON-NLS
525  bundle.getString("BlackboardAttribute.tskTagName.text"),
526  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
527  TSK_COMMENT(66, "TSK_COMMENT", //NON-NLS
528  bundle.getString("BlackboardAttribute.tskComment.text"),
529  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
530  TSK_URL_DECODED(67, "TSK_URL_DECODED", //NON-NLS
531  bundle.getString("BlackboardAttribute.tskUrlDecoded.text"),
532  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
533  TSK_DATETIME_CREATED(68, "TSK_DATETIME_CREATED", //NON-NLS
534  bundle.getString("BlackboardAttribute.tskDateTimeCreated.text"),
535  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME),
536  TSK_DATETIME_MODIFIED(69, "TSK_DATETIME_MODIFIED", //NON-NLS
537  bundle.getString("BlackboardAttribute.tskDateTimeModified.text"),
538  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME),
539  TSK_PROCESSOR_ARCHITECTURE(70, "TSK_PROCESSOR_ARCHITECTURE", //NON-NLS
540  bundle.getString("BlackboardAttribute.tskProcessorArchitecture.text"),
541  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
542  TSK_VERSION(71, "TSK_VERSION", //NON-NLS
543  bundle.getString("BlackboardAttribute.tskVersion.text"),
544  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
545  TSK_USER_ID(72, "TSK_USER_ID", //NON-NLS
546  bundle.getString("BlackboardAttribute.tskUserId.text"),
547  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
548  TSK_DESCRIPTION(73, "TSK_DESCRIPTION", //NON-NLS
549  bundle.getString("BlackboardAttribute.tskDescription.text"),
550  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
551  TSK_MESSAGE_TYPE(74, "TSK_MESSAGE_TYPE", //NON-NLS
552  bundle.getString("BlackboardAttribute.tskMessageType.text"),
553  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // SMS or MMS or IM ...
554  TSK_PHONE_NUMBER_HOME(75, "TSK_PHONE_NUMBER_HOME", //NON-NLS
555  bundle.getString("BlackboardAttribute.tskPhoneNumberHome.text"),
556  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
557  TSK_PHONE_NUMBER_OFFICE(76, "TSK_PHONE_NUMBER_OFFICE", //NON-NLS
558  bundle.getString("BlackboardAttribute.tskPhoneNumberOffice.text"),
559  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
560  TSK_PHONE_NUMBER_MOBILE(77, "TSK_PHONE_NUMBER_MOBILE", //NON-NLS
561  bundle.getString("BlackboardAttribute.tskPhoneNumberMobile.text"),
562  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
563  TSK_PHONE_NUMBER_FROM(78, "TSK_PHONE_NUMBER_FROM", //NON-NLS
564  bundle.getString("BlackboardAttribute.tskPhoneNumberFrom.text"),
565  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
566  TSK_PHONE_NUMBER_TO(79, "TSK_PHONE_NUMBER_TO", //NON-NLS
567  bundle.getString("BlackboardAttribute.tskPhoneNumberTo.text"),
568  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
569  TSK_DIRECTION(80, "TSK_DIRECTION", //NON-NLS
570  bundle.getString("BlackboardAttribute.tskDirection.text"),
571  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Msg/Call direction: incoming, outgoing
572  TSK_EMAIL_HOME(81, "TSK_EMAIL_HOME", //NON-NLS
573  bundle.getString("BlackboardAttribute.tskEmailHome.text"),
574  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
575  TSK_EMAIL_OFFICE(82, "TSK_EMAIL_OFFICE", //NON-NLS
576  bundle.getString("BlackboardAttribute.tskEmailOffice.text"),
577  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
578  TSK_DATETIME_START(83, "TSK_DATETIME_START", //NON-NLS
579  bundle.getString("BlackboardAttribute.tskDateTimeStart.text"),
580  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME), // start time of an event - call log, Calendar entry
581  TSK_DATETIME_END(84, "TSK_DATETIME_END", //NON-NLS
582  bundle.getString("BlackboardAttribute.tskDateTimeEnd.text"),
583  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME), // end time of an event - call log, Calendar entry
584  TSK_CALENDAR_ENTRY_TYPE(85, "TSK_CALENDAR_ENTRY_TYPE", //NON-NLS
585  bundle.getString("BlackboardAttribute.tskCalendarEntryType.text"),
586  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // meeting, task,
587  TSK_LOCATION(86, "TSK_LOCATION", //NON-NLS
588  bundle.getString("BlackboardAttribute.tskLocation.text"),
589  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Location string associated with an event - Conf Room Name, Address ....
590  TSK_SHORTCUT(87, "TSK_SHORTCUT", //NON-NLS
591  bundle.getString("BlackboardAttribute.tskShortcut.text"),
592  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Short Cut string - short code or dial string for Speed dial, a URL short cut - e.g. bitly string, Windows Desktop Short cut name etc.
593  TSK_DEVICE_NAME(88, "TSK_DEVICE_NAME", //NON-NLS
594  bundle.getString("BlackboardAttribute.tskDeviceName.text"),
595  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // device name - a user assigned (usually) device name - such as "Joe's computer", "bob_win8", "BT Headset"
596  TSK_CATEGORY(89, "TSK_CATEGORY", //NON-NLS
597  bundle.getString("BlackboardAttribute.tskCategory.text"),
598  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // category/type, possible value set varies by the artifact
599  TSK_EMAIL_REPLYTO(90, "TSK_EMAIL_REPLYTO", //NON-NLS
600  bundle.getString("BlackboardAttribute.tskEmailReplyTo.text"),
601  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // ReplyTo address
602  TSK_SERVER_NAME(91, "TSK_SERVER_NAME", //NON-NLS
603  bundle.getString("BlackboardAttribute.tskServerName.text"),
604  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // server name, e.g. a mail server name - "smtp.google.com", a DNS server name...
605  TSK_COUNT(92, "TSK_COUNT", //NON-NLS
606  bundle.getString("BlackboardAttribute.tskCount.text"),
607  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER), // Count related to the artifact
608  TSK_MIN_COUNT(93, "TSK_MIN_COUNT", //NON-NLS
609  bundle.getString("BlackboardAttribute.tskMinCount.text"),
610  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER), // Minimum number/count
611  TSK_PATH_SOURCE(94, "TSK_PATH_SOURCE", //NON-NLS
612  bundle.getString("BlackboardAttribute.tskPathSource.text"),
613  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Path to a source file related to the artifact
614  TSK_PERMISSIONS(95, "TSK_PERMISSIONS", //NON-NLS
615  bundle.getString("BlackboardAttribute.tskPermissions.text"),
616  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Permissions
617  TSK_ASSOCIATED_ARTIFACT(96, "TSK_ASSOCIATED_ARTIFACT", //NON-NLS
618  bundle.getString("BlackboardAttribute.tskAssociatedArtifact.text"),
619  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG), // Artifact ID of a related artifact
620  TSK_ISDELETED(97, "TSK_ISDELETED", //NON-NLS
621  bundle.getString("BlackboardAttribute.tskIsDeleted.text"),
622  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // boolean to indicate that the artifact is recovered fom deleted content
623  TSK_GEO_LATITUDE_START(98, "TSK_GEO_LATITUDE_START", //NON-NLS
624  bundle.getString("BlackboardAttribute.tskGeoLatitudeStart.text"),
625  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE), // Starting location lattitude
626  TSK_GEO_LATITUDE_END(99, "TSK_GEO_LATITUDE_END", //NON-NLS
627  bundle.getString("BlackboardAttribute.tskGeoLatitudeEnd.text"),
628  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE), // Ending location lattitude
629  TSK_GEO_LONGITUDE_START(100, "TSK_GEO_LONGITUDE_START", //NON-NLS
630  bundle.getString("BlackboardAttribute.tskGeoLongitudeStart.text"),
631  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE), // Starting location longitude
632  TSK_GEO_LONGITUDE_END(101, "TSK_GEO_LONGITUDE_END", //NON-NLS
633  bundle.getString("BlackboardAttribute.tskGeoLongitudeEnd.text"),
634  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE), //Ending Location longitude
635  TSK_READ_STATUS(102, "TSK_READ_STATUS", //NON-NLS
636  bundle.getString("BlackboardAttribute.tskReadStatus.text"),
637  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER), // Message read status: 1 if read, 0 if unread
638  TSK_LOCAL_PATH(103, "TSK_LOCAL_PATH", //NON-NLS
639  bundle.getString("BlackboardAttribute.tskLocalPath.text"),
640  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Local path to a network drive
641  TSK_REMOTE_PATH(104, "TSK_REMOTE_PATH", //NON-NLS
642  bundle.getString("BlackboardAttribute.tskRemotePath.text"),
643  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Remote path of a network drive
644  TSK_TEMP_DIR(105, "TSK_TEMP_DIR", //NON-NLS
645  bundle.getString("BlackboardAttribute.tskTempDir.text"),
646  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Default temporary files directory
647  TSK_PRODUCT_ID(106, "TSK_PRODUCT_ID", //NON-NLS
648  bundle.getString("BlackboardAttribute.tskProductId.text"),
649  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Product ID
650  TSK_OWNER(107, "TSK_OWNER", //NON-NLS
651  bundle.getString("BlackboardAttribute.tskOwner.text"),
652  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Registered owner of a piece of software
653  TSK_ORGANIZATION(108, "TSK_ORGANIZATION", //NON-NLS
654  bundle.getString("BlackboardAttribute.tskOrganization.text"),
655  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING), // Registered Organization for a piece of software
656  TSK_CARD_NUMBER(109, "TSK_CARD_NUMBER", //NON-NLS
657  bundle.getString("BlackboardAttribute.tskCardNumber.text"),
658  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
659  TSK_CARD_EXPIRATION(110, "TSK_CARD_EXPIRATION", //for card as 4 digits MMYY //NON-NLS
660  bundle.getString("BlackboardAttribute.tskCardExpiration.text"),
661  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
662  TSK_CARD_SERVICE_CODE(111, "TSK_CARD_SERVICE_CODE", // 3 digits //NON-NLS
663  bundle.getString("BlackboardAttribute.tskCardServiceCode.text"),
664  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
665  TSK_CARD_DISCRETIONARY(112, "TSK_CARD_DISCRETIONARY", //data used at the discretion of the issuer //NON-NLS
666  bundle.getString("BlackboardAttribute.tskCardDiscretionary.text"),
667  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
668  TSK_CARD_LRC(113, "TSK_CARD_LRC", //NON-NLS //Longitudunal Redundancy Check character //NON-NLS
669  bundle.getString("BlackboardAttribute.tskCardLRC.text"),
670  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
671  TSK_KEYWORD_SEARCH_DOCUMENT_ID(114, "TSK_KEYWORD_SEARCH_DOCUMENT_ID", //NON-NLS
672  bundle.getString("BlackboardAttribute.tskKeywordSearchDocumentID.text"),
673  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
674  TSK_CARD_SCHEME(115, "TSK_CARD_SCHEME", //amex, visa, mastercard, discover, etc //NON-NLS
675  bundle.getString("BlackboardAttribute.tskCardScheme.text"),
676  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
677  TSK_CARD_TYPE(116, "TSK_CARD_TYPE", // debit vs credit //NON-NLS
678  bundle.getString("BlackboardAttribute.tskCardType.text"),
679  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
680  TSK_BRAND_NAME(117, "TSK_BRAND_NAME",
681  bundle.getString("BlackboardAttribute.tskBrandName.text"),
682  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
683  TSK_BANK_NAME(118, "TSK_BANK_NAME",
684  bundle.getString("BlackboardAttribute.tskBankName.text"),
685  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
686  TSK_COUNTRY(119, "TSK_COUNTRY",
687  bundle.getString("BlackboardAttribute.tskCountry.text"),
688  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
689  TSK_CITY(120, "TSK_CITY",
690  bundle.getString("BlackboardAttribute.tskCity.text"),
691  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
692  TSK_ACCOUNT_TYPE(121, "TSK_ACCOUNT_TYPE",
693  bundle.getString("BlackboardAttribute.tskAccountType.text"),
694  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
695  TSK_KEYWORD_SEARCH_TYPE(122, "TSK_KEYWORD_SEARCH_TYPE", // Keyword search type, exact match, sub-string or regex //NON-NLS
696  bundle.getString("BlackboardAttribute.tskKeywordSearchType.text"),
697  TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER);
698 
699  private final int typeID;
700  private final String typeName;
701  private final String displayName;
702  private final TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType;
703 
712  private ATTRIBUTE_TYPE(int typeID, String typeName, String displayName, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType) {
713  this.typeID = typeID;
714  this.typeName = typeName;
715  this.displayName = displayName;
716  this.valueType = valueType;
717  }
718 
724  public int getTypeID() {
725  return this.typeID;
726  }
727 
736  public String getLabel() {
737  return this.typeName;
738  }
739 
745  public String getDisplayName() {
746  return this.displayName;
747  }
748 
754  public TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType() {
755  return this.valueType;
756  }
757 
771  static public ATTRIBUTE_TYPE fromID(int typeID) {
772  for (ATTRIBUTE_TYPE attrType : ATTRIBUTE_TYPE.values()) {
773  if (attrType.getTypeID() == typeID) {
774  return attrType;
775  }
776  }
777  throw new IllegalArgumentException("No ATTRIBUTE_TYPE matching type: " + typeID);
778  }
779 
793  static public ATTRIBUTE_TYPE fromLabel(String typeName) {
794  for (ATTRIBUTE_TYPE attrType : ATTRIBUTE_TYPE.values()) {
795  if (attrType.getLabel().equals(typeName)) {
796  return attrType;
797  }
798  }
799  throw new IllegalArgumentException("No ATTRIBUTE_TYPE matching type: " + typeName);
800  }
801 
802  }
803 
816  public BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, int valueInt) throws IllegalArgumentException {
817  if (attributeType.getValueType() != TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER) {
818  throw new IllegalArgumentException("Value types do not match");
819  }
820  this.artifactID = 0;
821  this.attributeType = new BlackboardAttribute.Type(attributeType);
822  this.sources = replaceNulls(source);
823  this.valueInt = valueInt;
824  this.valueLong = 0;
825  this.valueDouble = 0;
826  this.valueString = "";
827  this.valueBytes = new byte[0];
828  this.context = "";
829  }
830 
843  public BlackboardAttribute(Type attributeType, String source, int valueInt) throws IllegalArgumentException {
844  if (attributeType.getValueType() != TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER) {
845  throw new IllegalArgumentException("Type mismatched with value type");
846  }
847  this.artifactID = 0;
848  this.attributeType = attributeType;
849  this.sources = replaceNulls(source);
850  this.valueInt = valueInt;
851  this.valueLong = 0;
852  this.valueDouble = 0;
853  this.valueString = "";
854  this.valueBytes = new byte[0];
855  this.context = "";
856  }
857 
873  public BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, long valueLong) throws IllegalArgumentException {
874  if (attributeType.getValueType() != TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG
875  && attributeType.getValueType() != TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
876  throw new IllegalArgumentException("Value types do not match");
877  }
878  this.artifactID = 0;
879  this.attributeType = new BlackboardAttribute.Type(attributeType);
880  this.sources = replaceNulls(source);
881  this.valueInt = 0;
882  this.valueLong = valueLong;
883  this.valueDouble = 0;
884  this.valueString = "";
885  this.valueBytes = new byte[0];
886  this.context = "";
887  }
888 
903  public BlackboardAttribute(Type attributeType, String source, long valueLong) throws IllegalArgumentException {
904  if (attributeType.getValueType() != TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG
905  && attributeType.getValueType() != TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
906  throw new IllegalArgumentException("Type mismatched with value type");
907  }
908  this.artifactID = 0;
909  this.attributeType = attributeType;
910  this.sources = replaceNulls(source);
911  this.valueInt = 0;
912  this.valueLong = valueLong;
913  this.valueDouble = 0;
914  this.valueString = "";
915  this.valueBytes = new byte[0];
916  this.context = "";
917  }
918 
931  public BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, double valueDouble) throws IllegalArgumentException {
932  if (attributeType.getValueType() != TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE) {
933  throw new IllegalArgumentException("Value types do not match");
934  }
935  this.artifactID = 0;
936  this.attributeType = new BlackboardAttribute.Type(attributeType);
937  this.sources = replaceNulls(source);
938  this.valueInt = 0;
939  this.valueLong = 0;
940  this.valueDouble = valueDouble;
941  this.valueString = "";
942  this.valueBytes = new byte[0];
943  this.context = "";
944 
945  }
946 
959  public BlackboardAttribute(Type attributeType, String source, double valueDouble) throws IllegalArgumentException {
960  if (attributeType.getValueType() != TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE) {
961  throw new IllegalArgumentException("Type mismatched with value type");
962  }
963  this.artifactID = 0;
964  this.attributeType = attributeType;
965  this.sources = replaceNulls(source);
966  this.valueInt = 0;
967  this.valueLong = 0;
968  this.valueDouble = valueDouble;
969  this.valueString = "";
970  this.valueBytes = new byte[0];
971  this.context = "";
972  }
973 
986  public BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, String valueString) throws IllegalArgumentException {
987  if (attributeType.getValueType() != TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING) {
988  throw new IllegalArgumentException("Value types do not match");
989  }
990  this.artifactID = 0;
991  this.attributeType = new BlackboardAttribute.Type(attributeType);
992  this.sources = replaceNulls(source);
993  this.valueInt = 0;
994  this.valueLong = 0;
995  this.valueDouble = 0;
996  if (valueString == null) {
997  this.valueString = "";
998  } else {
999  this.valueString = replaceNulls(valueString);
1000  }
1001  this.valueBytes = new byte[0];
1002  this.context = "";
1003  }
1004 
1017  public BlackboardAttribute(Type attributeType, String source, String valueString) throws IllegalArgumentException {
1018  if (attributeType.getValueType() != TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING) {
1019  throw new IllegalArgumentException("Type mismatched with value type");
1020  }
1021  this.artifactID = 0;
1022  this.attributeType = attributeType;
1023  this.sources = replaceNulls(source);
1024  this.valueInt = 0;
1025  this.valueLong = 0;
1026  this.valueDouble = 0;
1027  if (valueString == null) {
1028  this.valueString = "";
1029  } else {
1030  this.valueString = replaceNulls(valueString);
1031  }
1032  this.valueBytes = new byte[0];
1033  this.context = "";
1034  }
1035 
1048  public BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, byte[] valueBytes) throws IllegalArgumentException {
1049  if (attributeType.getValueType() != TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE) {
1050  throw new IllegalArgumentException("Value types do not match");
1051  }
1052  this.artifactID = 0;
1053  this.attributeType = new BlackboardAttribute.Type(attributeType);
1054  this.sources = replaceNulls(source);
1055  this.context = "";
1056  this.valueInt = 0;
1057  this.valueLong = 0;
1058  this.valueDouble = 0;
1059  this.valueString = "";
1060  if (valueBytes == null) {
1061  this.valueBytes = new byte[0];
1062  } else {
1063  this.valueBytes = valueBytes;
1064  }
1065  }
1066 
1079  public BlackboardAttribute(Type attributeType, String source, byte[] valueBytes) throws IllegalArgumentException {
1080  if (attributeType.getValueType() != TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE) {
1081  throw new IllegalArgumentException("Type mismatched with value type");
1082  }
1083  this.artifactID = 0;
1084  this.attributeType = attributeType;
1085  this.sources = replaceNulls(source);
1086  this.context = "";
1087  this.valueInt = 0;
1088  this.valueLong = 0;
1089  this.valueDouble = 0;
1090  this.valueString = "";
1091  if (valueBytes == null) {
1092  this.valueBytes = new byte[0];
1093  } else {
1094  this.valueBytes = valueBytes;
1095  }
1096  }
1097 
1105  public long getArtifactID() {
1106  return artifactID;
1107  }
1108 
1114  public BlackboardAttribute.Type getAttributeType() {
1115  return this.attributeType;
1116  }
1117 
1123  public TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType() {
1124  return attributeType.getValueType();
1125  }
1126 
1133  public int getValueInt() {
1134  return valueInt;
1135  }
1136 
1143  public long getValueLong() {
1144  return valueLong;
1145  }
1146 
1153  public double getValueDouble() {
1154  return valueDouble;
1155  }
1156 
1163  public String getValueString() {
1164  return valueString;
1165  }
1166 
1173  public byte[] getValueBytes() {
1174  return Arrays.copyOf(valueBytes, valueBytes.length);
1175  }
1176 
1182  public List<String> getSources() {
1183  if (null != sources && !this.sources.isEmpty()) {
1184  List<String> modules = Arrays.asList(sources.split(","));
1185  return modules;
1186  } else {
1187  return Collections.emptyList();
1188  }
1189  }
1190 
1198  public void addSource(String source) throws TskCoreException {
1199  this.sources = sleuthkitCase.addSourceToArtifactAttribute(this, source);
1200  }
1201 
1213  public BlackboardArtifact getParentArtifact() throws TskCoreException {
1214  return sleuthkitCase.getBlackboardArtifact(artifactID);
1215  }
1216 
1217  @Override
1218  public int hashCode() {
1219  int hash = 5;
1220  hash = 97 * hash + (int) (this.artifactID ^ (this.artifactID >>> 32));
1221  return hash;
1222  }
1223 
1224  @Override
1225  public boolean equals(Object obj) {
1226  if (obj == null) {
1227  return false;
1228  }
1229  if (getClass() != obj.getClass()) {
1230  return false;
1231  }
1232  final BlackboardAttribute other = (BlackboardAttribute) obj;
1233  return this.artifactID == other.getArtifactID();
1234  }
1235 
1236  @Override
1237  public String toString() {
1238  return "BlackboardAttribute{" + "artifactID=" + artifactID + ", attributeType=" + attributeType.toString() + ", moduleName=" + sources + ", context=" + context + ", valueInt=" + valueInt + ", valueLong=" + valueLong + ", valueDouble=" + valueDouble + ", valueString=" + valueString + ", valueBytes=" + Arrays.toString(valueBytes) + ", Case=" + sleuthkitCase + '}'; //NON-NLS
1239  }
1240 
1246  public String getDisplayString() {
1247  switch (attributeType.getValueType()) {
1248  case STRING:
1249  return getValueString();
1250  case INTEGER:
1251  if (attributeType.getTypeID() == ATTRIBUTE_TYPE.TSK_READ_STATUS.getTypeID()) {
1252  if (getValueInt() == 0) {
1253  return "Unread";
1254  } else {
1255  return "Read";
1256  }
1257  }
1258  return Integer.toString(getValueInt());
1259  case LONG:
1260  // SHOULD at some point figure out how to convert times in here
1261  // based on preferred formats and such. Perhaps provide another
1262  // method that takes a formatter argument.
1263  return Long.toString(getValueLong());
1264  case DOUBLE:
1265  return Double.toString(getValueDouble());
1266  case BYTE:
1267  return bytesToHexString(getValueBytes());
1268  case DATETIME:
1269  return FsContent.epochToTime(getValueLong());
1270  }
1271  return "";
1272  }
1273 
1292  BlackboardAttribute(long artifactID, BlackboardAttribute.Type attributeType, String source, String context,
1293  int valueInt, long valueLong, double valueDouble, String valueString, byte[] valueBytes,
1294  SleuthkitCase sleuthkitCase) {
1295 
1296  this.artifactID = artifactID;
1297  this.attributeType = attributeType;
1298  this.sources = replaceNulls(source);
1299  this.context = replaceNulls(context);
1300  this.valueInt = valueInt;
1301  this.valueLong = valueLong;
1302  this.valueDouble = valueDouble;
1303  if (valueString == null) {
1304  this.valueString = "";
1305  } else {
1306  this.valueString = replaceNulls(valueString);
1307  }
1308  if (valueBytes == null) {
1309  this.valueBytes = new byte[0];
1310  } else {
1311  this.valueBytes = valueBytes;
1312  }
1313  this.sleuthkitCase = sleuthkitCase;
1314  }
1315 
1322  void setCaseDatabase(SleuthkitCase sleuthkitCase) {
1323  this.sleuthkitCase = sleuthkitCase;
1324  }
1325 
1331  void setArtifactId(long artifactID) {
1332  this.artifactID = artifactID;
1333  }
1334 
1343  String getSourcesCSV() {
1344  return sources;
1345  }
1346 
1354  static String bytesToHexString(byte[] bytes) {
1355  // from http://stackoverflow.com/questions/9655181/convert-from-byte-array-to-hex-string-in-java
1356  char[] hexChars = new char[bytes.length * 2];
1357  for (int j = 0; j < bytes.length; j++) {
1358  int v = bytes[j] & 0xFF;
1359  hexChars[j * 2] = HEX_ARRAY[v >>> 4];
1360  hexChars[j * 2 + 1] = HEX_ARRAY[v & 0x0F];
1361  }
1362  return new String(hexChars);
1363  }
1364 
1372  private String replaceNulls(String text) {
1373  return text.replace((char) 0x00, (char) 0x1A);
1374  }
1375 
1392  @Deprecated
1393  public BlackboardAttribute(int attributeTypeID, String moduleName, int valueInt) throws IllegalArgumentException {
1394  this(ATTRIBUTE_TYPE.fromID(attributeTypeID), moduleName, valueInt);
1395  }
1396 
1414  @Deprecated
1415  public BlackboardAttribute(int attributeTypeID, String moduleName, String context,
1416  int valueInt) {
1417  this(attributeTypeID, moduleName, valueInt);
1418  this.context = replaceNulls(context);
1419  }
1420 
1438  @Deprecated
1439  public BlackboardAttribute(int attributeTypeID, String moduleName,
1440  long valueLong) throws IllegalArgumentException {
1441  this(ATTRIBUTE_TYPE.fromID(attributeTypeID), moduleName, valueLong);
1442  }
1443 
1462  @Deprecated
1463  public BlackboardAttribute(int attributeTypeID, String moduleName, String context,
1464  long valueLong) {
1465  this(attributeTypeID, moduleName, valueLong);
1466  this.context = replaceNulls(context);
1467  }
1468 
1485  @Deprecated
1486  public BlackboardAttribute(int attributeTypeID, String moduleName,
1487  double valueDouble) throws IllegalArgumentException {
1488  this(ATTRIBUTE_TYPE.fromID(attributeTypeID), moduleName, valueDouble);
1489  }
1490 
1508  @Deprecated
1509  public BlackboardAttribute(int attributeTypeID, String moduleName, String context,
1510  double valueDouble) {
1511  this(attributeTypeID, moduleName, valueDouble);
1512  this.context = replaceNulls(context);
1513  }
1514 
1531  @Deprecated
1532  public BlackboardAttribute(int attributeTypeID, String moduleName, String valueString) throws IllegalArgumentException {
1533  this(ATTRIBUTE_TYPE.fromID(attributeTypeID), moduleName, valueString);
1534  }
1535 
1553  @Deprecated
1554  public BlackboardAttribute(int attributeTypeID, String moduleName, String context,
1555  String valueString) {
1556  this(attributeTypeID, moduleName, valueString);
1557  this.context = replaceNulls(context);
1558  }
1559 
1576  @Deprecated
1577  public BlackboardAttribute(int attributeTypeID, String moduleName, byte[] valueBytes) throws IllegalArgumentException {
1578  this(ATTRIBUTE_TYPE.fromID(attributeTypeID), moduleName, valueBytes);
1579  }
1580 
1598  @Deprecated
1599  public BlackboardAttribute(int attributeTypeID, String moduleName, String context,
1600  byte[] valueBytes) {
1601  this(attributeTypeID, moduleName, valueBytes);
1602  this.context = replaceNulls(context);
1603  }
1604 
1615  @Deprecated
1616  protected void setArtifactID(long artifactID) {
1617  setArtifactId(artifactID);
1618  }
1619 
1631  @Deprecated
1632  protected void setCase(SleuthkitCase sleuthkitCase) {
1633  setCaseDatabase(sleuthkitCase);
1634  }
1635 
1643  @Deprecated
1644  public String getContext() {
1645  return context;
1646  }
1647 
1655  @Deprecated
1656  String getContextString() {
1657  return context;
1658  }
1659 
1667  @Deprecated
1668  public int getAttributeTypeID() {
1669  return attributeType.getTypeID();
1670  }
1671 
1681  @Deprecated
1682  public String getAttributeTypeName() throws TskCoreException {
1683  return attributeType.getTypeName();
1684  }
1685 
1696  @Deprecated
1697  public String getAttributeTypeDisplayName() throws TskCoreException {
1698  return attributeType.getDisplayName();
1699  }
1700 
1709  @Deprecated
1710  public String getModuleName() {
1711  return sources;
1712  }
1713 
1714 }
org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.displayName
final String displayName
Definition: BlackboardAttribute.java:701
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(int attributeTypeID, String moduleName, String context, byte[] valueBytes)
Definition: BlackboardAttribute.java:1599
org.sleuthkit.datamodel.BlackboardAttribute.Type.Type
Type(int typeID, String typeName, String displayName, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType)
Definition: BlackboardAttribute.java:76
org.sleuthkit.datamodel.AbstractFile.epochToTime
static String epochToTime(long epoch)
Definition: AbstractFile.java:1043
org.sleuthkit.datamodel.BlackboardAttribute.getValueType
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType()
Definition: BlackboardAttribute.java:1123
org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.fromID
static ATTRIBUTE_TYPE fromID(int typeID)
Definition: BlackboardAttribute.java:771
org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE
DOUBLE
Definition: BlackboardAttribute.java:198
org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.typeName
final String typeName
Definition: BlackboardAttribute.java:700
org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME
DATETIME
Definition: BlackboardAttribute.java:207
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(Type attributeType, String source, long valueLong)
Definition: BlackboardAttribute.java:903
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(Type attributeType, String source, int valueInt)
Definition: BlackboardAttribute.java:843
org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.getLabel
String getLabel()
Definition: BlackboardAttribute.java:736
org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE
BYTE
Definition: BlackboardAttribute.java:202
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(int attributeTypeID, String moduleName, String context, int valueInt)
Definition: BlackboardAttribute.java:1415
org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.getType
long getType()
Definition: BlackboardAttribute.java:235
org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.ATTRIBUTE_TYPE
ATTRIBUTE_TYPE(int typeID, String typeName, String displayName, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType)
Definition: BlackboardAttribute.java:712
org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.getLabel
String getLabel()
Definition: BlackboardAttribute.java:247
org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifact
BlackboardArtifact getBlackboardArtifact(long artifactID)
Definition: SleuthkitCase.java:2282
org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE(long type, String typeName)
Definition: BlackboardAttribute.java:222
org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromLabel
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromLabel(String typeName)
Definition: BlackboardAttribute.java:288
org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER
INTEGER
Definition: BlackboardAttribute.java:190
org.sleuthkit.datamodel.BlackboardAttribute.Type.getValueType
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType()
Definition: BlackboardAttribute.java:101
org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE
Definition: BlackboardAttribute.java:181
org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.typeId
final long typeId
Definition: BlackboardAttribute.java:209
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(int attributeTypeID, String moduleName, int valueInt)
Definition: BlackboardAttribute.java:1393
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(int attributeTypeID, String moduleName, String valueString)
Definition: BlackboardAttribute.java:1532
org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.getDisplayName
String getDisplayName()
Definition: BlackboardAttribute.java:745
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(int attributeTypeID, String moduleName, double valueDouble)
Definition: BlackboardAttribute.java:1486
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, String valueString)
Definition: BlackboardAttribute.java:986
org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.getValueType
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType()
Definition: BlackboardAttribute.java:754
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(Type attributeType, String source, byte[] valueBytes)
Definition: BlackboardAttribute.java:1079
org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_READ_STATUS
TSK_READ_STATUS
Definition: BlackboardAttribute.java:635
org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromType
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromType(long typeId)
Definition: BlackboardAttribute.java:265
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(int attributeTypeID, String moduleName, String context, double valueDouble)
Definition: BlackboardAttribute.java:1509
org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING
STRING
Definition: BlackboardAttribute.java:186
org.sleuthkit.datamodel.FsContent
Definition: FsContent.java:39
org.sleuthkit.datamodel.BlackboardAttribute.Type.valueType
final TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType
Definition: BlackboardAttribute.java:66
org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.fromLabel
static ATTRIBUTE_TYPE fromLabel(String typeName)
Definition: BlackboardAttribute.java:793
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, long valueLong)
Definition: BlackboardAttribute.java:873
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, int valueInt)
Definition: BlackboardAttribute.java:816
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(Type attributeType, String source, double valueDouble)
Definition: BlackboardAttribute.java:959
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, double valueDouble)
Definition: BlackboardAttribute.java:931
org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.typeName
final String typeName
Definition: BlackboardAttribute.java:210
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(int attributeTypeID, String moduleName, String context, long valueLong)
Definition: BlackboardAttribute.java:1463
org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.getTypeID
int getTypeID()
Definition: BlackboardAttribute.java:724
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(int attributeTypeID, String moduleName, String context, String valueString)
Definition: BlackboardAttribute.java:1554
org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.typeID
final int typeID
Definition: BlackboardAttribute.java:699
org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE
Definition: BlackboardAttribute.java:305
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(int attributeTypeID, String moduleName, long valueLong)
Definition: BlackboardAttribute.java:1439
org.sleuthkit.datamodel.BlackboardAttribute.Type.Type
Type(BlackboardAttribute.ATTRIBUTE_TYPE type)
Definition: BlackboardAttribute.java:89
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(int attributeTypeID, String moduleName, byte[] valueBytes)
Definition: BlackboardAttribute.java:1577
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, byte[] valueBytes)
Definition: BlackboardAttribute.java:1048
org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG
LONG
Definition: BlackboardAttribute.java:194
org.sleuthkit.datamodel.BlackboardAttribute.Type.sameType
boolean sameType(BlackboardAttribute.Type that)
Definition: BlackboardAttribute.java:151
org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.valueType
final TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType
Definition: BlackboardAttribute.java:702
org.sleuthkit.datamodel.BlackboardAttribute.BlackboardAttribute
BlackboardAttribute(Type attributeType, String source, String valueString)
Definition: BlackboardAttribute.java:1017

Copyright © 2011-2015 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.