19 package org.sleuthkit.datamodel;
21 import java.io.Serializable;
22 import java.io.UnsupportedEncodingException;
23 import java.text.MessageFormat;
24 import java.util.ArrayList;
25 import java.util.Collection;
26 import java.util.HashMap;
27 import java.util.List;
29 import java.util.Objects;
30 import java.util.ResourceBundle;
31 import java.util.HashSet;
48 private static final ResourceBundle
bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
57 private final List<BlackboardAttribute>
attrsCache =
new ArrayList<BlackboardAttribute>();
89 this.artifactId = artifactID;
92 this.artifactTypeId = artifactTypeID;
97 this.checkedHasChildren =
false;
98 this.hasChildren =
false;
99 this.childrenCount = -1;
121 BlackboardArtifact(
SleuthkitCase sleuthkitCase,
long artifactID,
long sourceObjId,
long artifactObjID,
int artifactTypeID, String artifactTypeName, String displayName, ReviewStatus reviewStatus,
boolean isNew) {
129 this.loadedCacheFromDb =
true;
198 StringBuilder shortDescription =
new StringBuilder(
"");
200 case TSK_WEB_BOOKMARK:
202 case TSK_WEB_DOWNLOAD:
203 case TSK_WEB_HISTORY:
206 case TSK_KEYWORD_HIT:
209 case TSK_DEVICE_ATTACHED:
256 shortDescription.append(
" ");
257 shortDescription.append(MessageFormat.format(bundle.getString(
"BlackboardArtifact.shortDescriptionDate.text"), date.
getDisplayString()));
286 attribute.setArtifactId(artifactId);
289 attrsCache.add(attribute);
301 ArrayList<BlackboardAttribute> attributes;
302 if (
false == loadedCacheFromDb) {
305 attrsCache.addAll(attributes);
306 loadedCacheFromDb =
true;
308 attributes =
new ArrayList<BlackboardAttribute>(
attrsCache);
330 if (attribute.getAttributeType().equals(attributeType)) {
347 if (attributes.isEmpty()) {
351 attribute.setArtifactId(artifactId);
355 attrsCache.addAll(attributes);
368 if (uniquePath == null) {
371 if (myParent != null) {
380 if (parent == null) {
381 ObjectInfo parentInfo;
384 }
catch (TskCoreException ex) {
403 return new ArrayList<BlackboardArtifact>();
419 return new ArrayList<BlackboardArtifact>();
435 return new ArrayList<BlackboardArtifact>();
450 return new ArrayList<BlackboardArtifact>();
564 return new ArrayList<BlackboardAttribute>();
577 return new HashSet<String>();
593 throw new TskCoreException(
"Cannot create artifact of an artifact. Not supported.");
608 throw new TskCoreException(
"Cannot create artifact of an artifact. Not supported.");
621 return v.
visit(
this);
633 if (
object == null) {
636 if (getClass() !=
object.getClass()) {
651 hash = 41 * hash + (int) (this.artifactId ^ (this.artifactId >>> 32));
662 return "BlackboardArtifact{" +
"artifactID=" + artifactId +
", objID=" +
getObjectID() +
", artifactObjID=" + artifactObjId +
", artifactTypeID=" + artifactTypeId +
", artifactTypeName=" + artifactTypeName +
", displayName=" + displayName +
", Case=" +
getSleuthkitCase() +
'}';
677 return visitor.
visit(
this);
689 if (contentBytes == null) {
697 return contentBytes.length;
724 if (contentBytes == null) {
728 if (0 == contentBytes.length) {
733 long readLen = Math.min(contentBytes.length - offset, len);
734 System.arraycopy(contentBytes, 0, buf, 0, (
int) readLen);
736 return (
int) readLen;
747 if (myParent == null) {
761 StringBuilder artifactContents =
new StringBuilder();
766 }
catch (TskCoreException ex) {
767 throw new TskCoreException(
"Unable to get datasource for artifact: " + this.
toString(), ex);
769 if (dataSource == null) {
770 throw new TskCoreException(
"Datasource was null for artifact: " + this.
toString());
775 artifactContents.append(attribute.getAttributeType().getDisplayName());
776 artifactContents.append(
" : ");
777 artifactContents.append(attribute.getDisplayString());
778 artifactContents.append(System.lineSeparator());
780 }
catch (TskCoreException ex) {
781 throw new TskCoreException(
"Unable to get attributes for artifact: " + this.
toString(), ex);
785 contentBytes = artifactContents.toString().getBytes(
"UTF-8");
786 }
catch (UnsupportedEncodingException ex) {
787 throw new TskCoreException(
"Failed to convert artifact string to bytes for artifact: " + this.
toString(), ex);
795 public static final class Type implements Serializable {
809 public Type(
int typeID, String typeName, String displayName) {
862 }
else if (!(that instanceof
Type)) {
865 return ((Type) that).sameType(
this);
890 hash = 83 * hash + Objects.hashCode(this.typeID);
891 hash = 83 * hash + Objects.hashCode(this.displayName);
892 hash = 83 * hash + Objects.hashCode(this.typeName);
907 TSK_GEN_INFO(1,
"TSK_GEN_INFO",
908 bundle.getString(
"BlackboardArtifact.tskGenInfo.text")),
912 TSK_WEB_BOOKMARK(2,
"TSK_WEB_BOOKMARK",
913 bundle.getString(
"BlackboardArtifact.tskWebBookmark.text")),
917 TSK_WEB_COOKIE(3,
"TSK_WEB_COOKIE",
918 bundle.getString(
"BlackboardArtifact.tskWebCookie.text")),
922 TSK_WEB_HISTORY(4,
"TSK_WEB_HISTORY",
923 bundle.getString(
"BlackboardArtifact.tskWebHistory.text")),
927 TSK_WEB_DOWNLOAD(5,
"TSK_WEB_DOWNLOAD",
928 bundle.getString(
"BlackboardArtifact.tskWebDownload.text")),
932 TSK_RECENT_OBJECT(6,
"TSK_RECENT_OBJ",
933 bundle.getString(
"BlackboardArtifact.tsk.recentObject.text")),
937 TSK_GPS_TRACKPOINT(7,
"TSK_GPS_TRACKPOINT",
938 bundle.getString(
"BlackboardArtifact.tskGpsTrackpoint.text")),
942 TSK_INSTALLED_PROG(8,
"TSK_INSTALLED_PROG",
943 bundle.getString(
"BlackboardArtifact.tskInstalledProg.text")),
947 TSK_KEYWORD_HIT(9,
"TSK_KEYWORD_HIT",
948 bundle.getString(
"BlackboardArtifact.tskKeywordHits.text")),
952 TSK_HASHSET_HIT(10,
"TSK_HASHSET_HIT",
953 bundle.getString(
"BlackboardArtifact.tskHashsetHit.text")),
957 TSK_DEVICE_ATTACHED(11,
"TSK_DEVICE_ATTACHED",
958 bundle.getString(
"BlackboardArtifact.tskDeviceAttached.text")),
963 TSK_INTERESTING_FILE_HIT(12,
"TSK_INTERESTING_FILE_HIT",
964 bundle.getString(
"BlackboardArtifact.tskInterestingFileHit.text")),
968 TSK_EMAIL_MSG(13,
"TSK_EMAIL_MSG",
969 bundle.getString(
"BlackboardArtifact.tskEmailMsg.text")),
973 TSK_EXTRACTED_TEXT(14,
"TSK_EXTRACTED_TEXT",
974 bundle.getString(
"BlackboardArtifact.tskExtractedText.text")),
978 TSK_WEB_SEARCH_QUERY(15,
"TSK_WEB_SEARCH_QUERY",
979 bundle.getString(
"BlackboardArtifact.tskWebSearchQuery.text")),
983 TSK_METADATA_EXIF(16,
"TSK_METADATA_EXIF",
984 bundle.getString(
"BlackboardArtifact.tskMetadataExif.text")),
991 TSK_TAG_FILE(17,
"TSK_TAG_FILE",
992 bundle.getString(
"BlackboardArtifact.tagFile.text")),
999 TSK_TAG_ARTIFACT(18,
"TSK_TAG_ARTIFACT",
1000 bundle.getString(
"BlackboardArtifact.tskTagArtifact.text")),
1004 TSK_OS_INFO(19,
"TSK_OS_INFO",
1005 bundle.getString(
"BlackboardArtifact.tskOsInfo.text")),
1009 TSK_OS_ACCOUNT(20,
"TSK_OS_ACCOUNT",
1010 bundle.getString(
"BlackboardArtifact.tskOsAccount.text")),
1014 TSK_SERVICE_ACCOUNT(21,
"TSK_SERVICE_ACCOUNT",
1015 bundle.getString(
"BlackboardArtifact.tskServiceAccount.text")),
1022 TSK_TOOL_OUTPUT(22,
"TSK_TOOL_OUTPUT",
1023 bundle.getString(
"BlackboardArtifact.tskToolOutput.text")),
1028 TSK_CONTACT(23,
"TSK_CONTACT",
1029 bundle.getString(
"BlackboardArtifact.tskContact.text")),
1034 TSK_MESSAGE(24,
"TSK_MESSAGE",
1035 bundle.getString(
"BlackboardArtifact.tskMessage.text")),
1039 TSK_CALLLOG(25,
"TSK_CALLLOG",
1040 bundle.getString(
"BlackboardArtifact.tskCalllog.text")),
1044 TSK_CALENDAR_ENTRY(26,
"TSK_CALENDAR_ENTRY",
1045 bundle.getString(
"BlackboardArtifact.tskCalendarEntry.text")),
1049 TSK_SPEED_DIAL_ENTRY(27,
"TSK_SPEED_DIAL_ENTRY",
1050 bundle.getString(
"BlackboardArtifact.tskSpeedDialEntry.text")),
1054 TSK_BLUETOOTH_PAIRING(28,
"TSK_BLUETOOTH_PAIRING",
1055 bundle.getString(
"BlackboardArtifact.tskBluetoothPairing.text")),
1059 TSK_GPS_BOOKMARK(29,
"TSK_GPS_BOOKMARK",
1060 bundle.getString(
"BlackboardArtifact.tskGpsBookmark.text")),
1064 TSK_GPS_LAST_KNOWN_LOCATION(30,
"TSK_GPS_LAST_KNOWN_LOCATION",
1065 bundle.getString(
"BlackboardArtifact.tskGpsLastKnownLocation.text")),
1069 TSK_GPS_SEARCH(31,
"TSK_GPS_SEARCH",
1070 bundle.getString(
"BlackboardArtifact.tskGpsSearch.text")),
1074 TSK_PROG_RUN(32,
"TSK_PROG_RUN",
1075 bundle.getString(
"BlackboardArtifact.tskProgRun.text")),
1079 TSK_ENCRYPTION_DETECTED(33,
"TSK_ENCRYPTION_DETECTED",
1080 bundle.getString(
"BlackboardArtifact.tskEncryptionDetected.text")),
1084 TSK_EXT_MISMATCH_DETECTED(34,
"TSK_EXT_MISMATCH_DETECTED",
1085 bundle.getString(
"BlackboardArtifact.tskExtMismatchDetected.text")),
1090 TSK_INTERESTING_ARTIFACT_HIT(35,
"TSK_INTERESTING_ARTIFACT_HIT",
1091 bundle.getString(
"BlackboardArtifact.tskInterestingArtifactHit.text")),
1095 TSK_GPS_ROUTE(36,
"TSK_GPS_ROUTE",
1096 bundle.getString(
"BlackboardArtifact.tskGpsRoute.text")),
1100 TSK_REMOTE_DRIVE(37,
"TSK_REMOTE_DRIVE",
1101 bundle.getString(
"BlackboardArtifact.tskRemoteDrive.text")),
1105 TSK_FACE_DETECTED(38,
"TSK_FACE_DETECTED",
1106 bundle.getString(
"BlackboardArtifact.tskFaceDetected.text")),
1110 TSK_ACCOUNT(39,
"TSK_ACCOUNT",
1111 bundle.getString(
"BlackboardArtifact.tskAccount.text"));
1125 this.typeId = typeId;
1158 if (value.getLabel().equals(label)) {
1162 throw new IllegalArgumentException(
"No ARTIFACT_TYPE matching type: " + label);
1175 if (value.getTypeID() == id) {
1179 throw new IllegalArgumentException(
"No ARTIFACT_TYPE matching type: " +
id);
1204 return visitor.
visit(
this);
1218 private final Integer
id;
1221 private final static Map<Integer, ReviewStatus> idToStatus =
new HashMap<Integer, ReviewStatus>();
1225 idToStatus.put(status.getID(), status);
1240 this.displayName = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle").getString(displayNameKey);
1251 return idToStatus.get(
id);
1303 protected BlackboardArtifact(
SleuthkitCase sleuthkitCase,
long artifactID,
long objID,
long artifactObjID,
int artifactTypeID, String artifactTypeName, String displayName) {
1323 if (loadedCacheFromDb ==
false) {
1326 attrsCache.addAll(attrs);
1327 loadedCacheFromDb =
true;
1329 ArrayList<BlackboardAttribute> filteredAttributes =
new ArrayList<BlackboardAttribute>();
1331 if (attr.getAttributeType().getTypeID() == attributeType.getTypeID()) {
1332 filteredAttributes.add(attr);
1335 return filteredAttributes;
1353 List<Long> childrenIDs =
new ArrayList<Long>();
1355 childrenIDs.addAll(
getSleuthkitCase().getBlackboardArtifactChildrenIds(
this));
1362 if (childrenCount != -1) {
1368 hasChildren = childrenCount > 0;
1369 checkedHasChildren =
true;
1376 if (checkedHasChildren ==
true) {
1382 hasChildren = childrenCount > 0;
1383 checkedHasChildren =
true;
1398 List<Content> children =
new ArrayList<Content>();
static ARTIFACT_TYPE fromID(int id)
synchronized String getUniquePath()
long getAllArtifactsCount()
final SleuthkitCase sleuthkitCase
ArrayList< BlackboardArtifact > getArtifacts(int artifactTypeID)
ArrayList< BlackboardAttribute > getBlackboardAttributes(final BlackboardArtifact artifact)
static final ResourceBundle bundle
static ARTIFACT_TYPE fromLabel(String label)
void addBlackboardAttributes(Collection< BlackboardAttribute > attributes, int artifactTypeId)
volatile int childrenCount
volatile boolean checkedHasChildren
Type(int typeID, String typeName, String displayName)
String getArtifactTypeName()
void addAttributes(Collection< BlackboardAttribute > attributes)
void addBlackboardAttribute(BlackboardAttribute attr, int artifactTypeId)
List< BlackboardAttribute > getAttributes(final BlackboardAttribute.ATTRIBUTE_TYPE attributeType)
long getArtifactsCount(int artifactTypeID)
Content getContentById(long id)
BlackboardArtifact getGenInfoArtifact()
final int read(byte[] buf, long offset, long len)
String getShortDescription()
SleuthkitCase getSleuthkitCase()
void addAttribute(BlackboardAttribute attribute)
boolean equals(Object object)
ReviewStatus getReviewStatus()
BlackboardArtifact(SleuthkitCase sleuthkitCase, long artifactID, long objID, long artifactObjID, int artifactTypeID, String artifactTypeName, String displayName)
ArrayList< BlackboardArtifact > getArtifacts(BlackboardArtifact.ARTIFACT_TYPE type)
Set< String > getHashSetNames()
boolean sameType(Type that)
public< T > T accept(SleuthkitItemVisitor< T > visitor)
String getDisplayString()
BlackboardArtifact newArtifact(int artifactTypeID)
volatile boolean hasChildren
BlackboardAttribute getAttribute(BlackboardAttribute.Type attributeType)
ReviewStatus(Integer id, String name, String displayNameKey)
List< Long > getChildrenIds()
long getArtifactsCount(String artifactTypeName)
BlackboardArtifact getGenInfoArtifact(boolean create)
final String artifactTypeName
ARTIFACT_TYPE(int typeId, String label, String displayName)
ArrayList< BlackboardArtifact > getArtifacts(String artifactTypeName)
final List< BlackboardAttribute > attrsCache
BlackboardAttribute.Type getAttributeType()
List< BlackboardAttribute > getAttributes()
List< Content > getChildren()
synchronized Content getParent()
boolean equals(Object that)
boolean loadedCacheFromDb
void loadArtifactContent()
static final long serialVersionUID
ArrayList< BlackboardArtifact > getAllArtifacts()
final ReviewStatus reviewStatus
long getArtifactsCount(BlackboardArtifact.ARTIFACT_TYPE type)
ArrayList< BlackboardAttribute > getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE attr_type)
static ReviewStatus withID(int id)
BlackboardArtifact newArtifact(BlackboardArtifact.ARTIFACT_TYPE type)