BlackboardArtifact.java

Go to the documentation of this file.

/*
 * Sleuth Kit Data Model
 *
 * Copyright 2011-2017 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *       http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.datamodel;

import java.io.Serializable;
import java.io.UnsupportedEncodingException;
import java.text.MessageFormat;
import java.util.ArrayList;
import java.util.Collection;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.ResourceBundle;
import java.util.Set;
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
import org.sleuthkit.datamodel.SleuthkitCase.ObjectInfo;

public class BlackboardArtifact implements Content {

        private static final ResourceBundle bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle");
        private final long artifactId;
        private final long sourceObjId;                         // refers to objID of parent/source object
        private final long artifactObjId;                       // objId of the artifact in tsk_objects. TBD: replace artifactID with this
        private final long dataSourceObjId;                     // objId of the data source in tsk_objects.
        private final int artifactTypeId;
        private final String artifactTypeName;
        private final String displayName;
        private ReviewStatus reviewStatus;
        private final SleuthkitCase sleuthkitCase;
        private final List<BlackboardAttribute> attrsCache = new ArrayList<BlackboardAttribute>();
        private boolean loadedCacheFromDb = false;
        private Content parent;
        private String uniquePath;

        private byte[] contentBytes = null;

        private volatile boolean checkedHasChildren;
        private volatile boolean hasChildren;
        private volatile int childrenCount;

        BlackboardArtifact(SleuthkitCase sleuthkitCase, long artifactID, long sourceObjId, long artifactObjId, long dataSourceObjId, int artifactTypeID, String artifactTypeName, String displayName, ReviewStatus reviewStatus) {

                this.sleuthkitCase = sleuthkitCase;
                this.artifactId = artifactID;
                this.sourceObjId = sourceObjId;
                this.artifactObjId = artifactObjId;
                this.artifactTypeId = artifactTypeID;
                this.dataSourceObjId = dataSourceObjId;
                this.artifactTypeName = artifactTypeName;
                this.displayName = displayName;
                this.reviewStatus = reviewStatus;

                this.checkedHasChildren = false;
                this.hasChildren = false;
                this.childrenCount = -1;

        }

        BlackboardArtifact(SleuthkitCase sleuthkitCase, long artifactID, long sourceObjId, long artifactObjID, long dataSourceObjID, int artifactTypeID, String artifactTypeName, String displayName, ReviewStatus reviewStatus, boolean isNew) {
                this(sleuthkitCase, artifactID, sourceObjId, artifactObjID, dataSourceObjID, artifactTypeID, artifactTypeName, displayName, reviewStatus);
                if (isNew) {
                        /*
                         * If this object represents a newly created artifact, then its
                         * collection of attributes has already been populated and there is
                         * no need to fetch them form the case database.
                         */
                        this.loadedCacheFromDb = true;
                }
        }

        public SleuthkitCase getSleuthkitCase() {
                return sleuthkitCase;
        }

        public long getArtifactID() {
                return this.artifactId;
        }

        public long getObjectID() {
                return this.sourceObjId;
        }

        long getDataSourceObjectID() {
                return this.dataSourceObjId;
        }

        public int getArtifactTypeID() {
                return this.artifactTypeId;
        }

        public String getArtifactTypeName() {
                return this.artifactTypeName;
        }

        public String getDisplayName() {
                return this.displayName;
        }

        public String getShortDescription() throws TskCoreException {
                BlackboardAttribute attr = null;
                StringBuilder shortDescription = new StringBuilder("");
                switch (ARTIFACT_TYPE.fromID(artifactTypeId)) {
                        case TSK_WEB_BOOKMARK:  //web_bookmark, web_cookie, web_download, and web_history are the same attribute for now
                        case TSK_WEB_COOKIE:
                        case TSK_WEB_DOWNLOAD:
                        case TSK_WEB_HISTORY:
                                attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DOMAIN));
                                break;
                        case TSK_KEYWORD_HIT:
                                attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW));
                                break;
                        case TSK_DEVICE_ATTACHED:
                                attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_ID));
                                break;
                        case TSK_CONTACT: //contact, message, and calllog are the same attributes for now
                        case TSK_MESSAGE:
                        case TSK_CALLLOG:
                                //get the first of these attributes which exists and is non null
                                final ATTRIBUTE_TYPE[] typesThatCanHaveName = {ATTRIBUTE_TYPE.TSK_NAME,
                                        ATTRIBUTE_TYPE.TSK_PHONE_NUMBER,
                                        ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM,
                                        ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO,
                                        ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_HOME,
                                        ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_MOBILE,
                                        ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_OFFICE,
                                        ATTRIBUTE_TYPE.TSK_EMAIL,
                                        ATTRIBUTE_TYPE.TSK_EMAIL_FROM,
                                        ATTRIBUTE_TYPE.TSK_EMAIL_TO,
                                        ATTRIBUTE_TYPE.TSK_EMAIL_HOME,
                                        ATTRIBUTE_TYPE.TSK_EMAIL_OFFICE}; //in the order we want to use them 
                                for (ATTRIBUTE_TYPE t : typesThatCanHaveName) {
                                        attr = getAttribute(new BlackboardAttribute.Type(t));
                                        if (attr != null && !attr.getDisplayString().isEmpty()) {
                                                break;
                                        }
                                }
                                break;
                        default:
                                break;
                }
                if (attr != null) {
                        shortDescription.append(attr.getAttributeType().getDisplayName()).append(": ").append(attr.getDisplayString());
                } else {
                        shortDescription.append(getDisplayName());
                }
                //get the first of these date attributes which exists and is non null
                final ATTRIBUTE_TYPE[] typesThatCanHaveDate = {ATTRIBUTE_TYPE.TSK_DATETIME,
                        ATTRIBUTE_TYPE.TSK_DATETIME_SENT,
                        ATTRIBUTE_TYPE.TSK_DATETIME_RCVD,
                        ATTRIBUTE_TYPE.TSK_DATETIME_CREATED,
                        ATTRIBUTE_TYPE.TSK_DATETIME_MODIFIED,
                        ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED,
                        ATTRIBUTE_TYPE.TSK_DATETIME_START,
                        ATTRIBUTE_TYPE.TSK_DATETIME_END};  //in the order we want to use them 
                BlackboardAttribute date;
                for (ATTRIBUTE_TYPE t : typesThatCanHaveDate) {
                        date = getAttribute(new BlackboardAttribute.Type(t));
                        if (date != null && !date.getDisplayString().isEmpty()) {
                                shortDescription.append(" ");
                                shortDescription.append(MessageFormat.format(bundle.getString("BlackboardArtifact.shortDescriptionDate.text"), date.getDisplayString()));  //NON-NLS
                                break;
                        }
                }
                return shortDescription.toString();
        }

        public ReviewStatus getReviewStatus() {
                return reviewStatus;
        }

        public void setReviewStatus(ReviewStatus newStatus) throws TskCoreException {
                getSleuthkitCase().setReviewStatus(this, newStatus);
                reviewStatus = newStatus;
        }
        
        public void addAttribute(BlackboardAttribute attribute) throws TskCoreException {
                attribute.setArtifactId(artifactId);
                attribute.setCaseDatabase(getSleuthkitCase());
                getSleuthkitCase().addBlackboardAttribute(attribute, this.artifactTypeId);
                attrsCache.add(attribute);
        }

        public List<BlackboardAttribute> getAttributes() throws TskCoreException {
                ArrayList<BlackboardAttribute> attributes;
                if (false == loadedCacheFromDb) {
                        attributes = getSleuthkitCase().getBlackboardAttributes(this);
                        attrsCache.clear();
                        attrsCache.addAll(attributes);
                        loadedCacheFromDb = true;
                } else {
                        attributes = new ArrayList<BlackboardAttribute>(attrsCache);
                }
                return attributes;
        }

        public BlackboardAttribute getAttribute(BlackboardAttribute.Type attributeType) throws TskCoreException {
                List<BlackboardAttribute> attributes = this.getAttributes();
                for (BlackboardAttribute attribute : attributes) {
                        if (attribute.getAttributeType().equals(attributeType)) {
                                return attribute;
                        }
                }
                return null;
        }

        public void addAttributes(Collection<BlackboardAttribute> attributes) throws TskCoreException {
                if (attributes.isEmpty()) {
                        return;
                }
                for (BlackboardAttribute attribute : attributes) {
                        attribute.setArtifactId(artifactId);
                        attribute.setCaseDatabase(getSleuthkitCase());
                }
                getSleuthkitCase().addBlackboardAttributes(attributes, artifactTypeId);
                attrsCache.addAll(attributes);
        }

        @Override
        public synchronized String getUniquePath() throws TskCoreException {

                // Return the path of the parrent file
                if (uniquePath == null) {
                        uniquePath = "";
                        Content myParent = getParent();
                        if (myParent != null) {
                                uniquePath = myParent.getUniquePath();
                        }
                }
                return uniquePath;
        }

        @Override
        public synchronized Content getParent() throws TskCoreException {
                if (parent == null) {
                        ObjectInfo parentInfo;
                        try {
                                parentInfo = getSleuthkitCase().getParentInfo(this);
                        } catch (TskCoreException ex) {
                                // there is not parent; not an error if we've got a data source
                                return null;
                        }
                        parent = getSleuthkitCase().getContentById(parentInfo.getId());
                }
                return parent;
        }

        @Override
        public ArrayList<BlackboardArtifact> getAllArtifacts() throws TskCoreException {
                // Currently we don't have any artifacts derived from an artifact.
                return new ArrayList<BlackboardArtifact>();
        }

        @Override
        public ArrayList<BlackboardArtifact> getArtifacts(String artifactTypeName) throws TskCoreException {
                // Currently we don't have any artifacts derived from an artifact.
                return new ArrayList<BlackboardArtifact>();
        }

        @Override
        public ArrayList<BlackboardArtifact> getArtifacts(int artifactTypeID) throws TskCoreException {
                // Currently we don't have any artifacts derived from an artifact.
                return new ArrayList<BlackboardArtifact>();
        }

        @Override
        public ArrayList<BlackboardArtifact> getArtifacts(BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException {
                // Currently we don't have any artifacts derived from an artifact.
                return new ArrayList<BlackboardArtifact>();
        }

        @Override
        public long getAllArtifactsCount() throws TskCoreException {
                // Currently we don't have any artifacts derived from an artifact.
                return 0;
        }

        @Override
        public long getArtifactsCount(String artifactTypeName) throws TskCoreException {
                // Currently we don't have any artifacts derived from an artifact.
                return 0;
        }

        @Override
        public long getArtifactsCount(int artifactTypeID) throws TskCoreException {
                // Currently we don't have any artifacts derived from an artifact.
                return 0;
        }

        @Override
        public long getArtifactsCount(BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException {
                // Currently we don't have any artifacts derived from an artifact.
                return 0;
        }

        @Override
        public BlackboardArtifact getGenInfoArtifact() throws TskCoreException {
                // Currently we don't have any artifacts derived from an artifact.
                return null;
        }

        @Override
        public BlackboardArtifact getGenInfoArtifact(boolean create) throws TskCoreException {
                // Currently we don't have any artifacts derived from an artifact.
                if (create) {
                        throw new TskCoreException("Artifacts of artifacts are not supported.");
                }

                return null;
        }

        @Override
        public ArrayList<BlackboardAttribute> getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException {
                // Currently we don't have any artifacts derived from an artifact.
                return new ArrayList<BlackboardAttribute>();
        }

        @Override
        public Set<String> getHashSetNames() throws TskCoreException {
                // Currently we don't have any artifacts derived from an artifact.
                return new HashSet<String>();
        }

        @Override
        public BlackboardArtifact newArtifact(int artifactTypeID) throws TskCoreException {
                throw new TskCoreException("Cannot create artifact of an artifact. Not supported.");
        }

        @Override
        public BlackboardArtifact newArtifact(BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException {
                throw new TskCoreException("Cannot create artifact of an artifact. Not supported.");
        }

        @Override
        public <T> T accept(ContentVisitor<T> v) {
                return v.visit(this);
        }

        @Override
        public boolean equals(Object object) {
                if (object == null) {
                        return false;
                }
                if (getClass() != object.getClass()) {
                        return false;
                }
                final BlackboardArtifact other = (BlackboardArtifact) object;
                return artifactId == other.getArtifactID();
        }

        @Override
        public int hashCode() {
                int hash = 7;
                hash = 41 * hash + (int) (this.artifactId ^ (this.artifactId >>> 32));
                return hash;
        }

        @Override
        public String toString() {
                return "BlackboardArtifact{" + "artifactID=" + artifactId + ", objID=" + getObjectID() + ", artifactObjID=" + artifactObjId + ", artifactTypeID=" + artifactTypeId + ", artifactTypeName=" + artifactTypeName + ", displayName=" + displayName + ", Case=" + getSleuthkitCase() + '}'; //NON-NLS
        }

        @Override
        public <T> T accept(SleuthkitItemVisitor<T> visitor) {
                return visitor.visit(this);
        }

        @Override
        public long getSize() {

                if (contentBytes == null) {
                        try {
                                loadArtifactContent();
                        } catch (TskCoreException ex) {
                                return 0;
                        }
                }

                return contentBytes.length;
        }

        @Override
        public void close() {
                contentBytes = null;
        }

        @Override
        public final int read(byte[] buf, long offset, long len) throws TskCoreException {

                if (contentBytes == null) {
                        loadArtifactContent();
                }

                if (0 == contentBytes.length) {
                        return 0;
                }

                // Copy bytes
                long readLen = Math.min(contentBytes.length - offset, len);
                System.arraycopy(contentBytes, 0, buf, 0, (int) readLen);

                return (int) readLen;
        }

        @Override
        public String getName() {
                return this.displayName + getArtifactID();
        }

        @Override
        public Content getDataSource() throws TskCoreException {
                Content myParent = getParent();
                if (myParent == null) {
                        return null;
                }

                return myParent.getDataSource();
        }

        private void loadArtifactContent() throws TskCoreException {
                StringBuilder artifactContents = new StringBuilder();

                Content dataSource = null;
                try {
                        dataSource = getDataSource();
                } catch (TskCoreException ex) {
                        throw new TskCoreException("Unable to get datasource for artifact: " + this.toString(), ex);
                }
                if (dataSource == null) {
                        throw new TskCoreException("Datasource was null for artifact: " + this.toString());
                }

                try {
                        for (BlackboardAttribute attribute : getAttributes()) {
                                artifactContents.append(attribute.getAttributeType().getDisplayName());
                                artifactContents.append(" : ");
                                artifactContents.append(attribute.getDisplayString());
                                artifactContents.append(System.lineSeparator());
                        }
                } catch (TskCoreException ex) {
                        throw new TskCoreException("Unable to get attributes for artifact: " + this.toString(), ex);
                }

                try {
                        contentBytes = artifactContents.toString().getBytes("UTF-8");
                } catch (UnsupportedEncodingException ex) {
                        throw new TskCoreException("Failed to convert artifact string to bytes for artifact: " + this.toString(), ex);
                }

        }

        public static final class Type implements Serializable {

                private static final long serialVersionUID = 1L;
                private final String typeName;
                private final int typeID;
                private final String displayName;

                public Type(int typeID, String typeName, String displayName) {
                        this.typeID = typeID;
                        this.typeName = typeName;
                        this.displayName = displayName;
                }

                public Type(ARTIFACT_TYPE type) {
                        this(type.getTypeID(), type.getLabel(), type.getDisplayName());
                }

                public String getTypeName() {
                        return this.typeName;
                }

                public int getTypeID() {
                        return this.typeID;
                }

                public String getDisplayName() {
                        return this.displayName;
                }

                @Override
                public boolean equals(Object that) {
                        if (this == that) {
                                return true;
                        } else if (!(that instanceof Type)) {
                                return false;
                        } else {
                                return ((Type) that).sameType(this);
                        }
                }

                private boolean sameType(Type that) {
                        return this.typeName.equals(that.getTypeName())
                                        && this.displayName.equals(that.getDisplayName())
                                        && this.typeID == that.getTypeID();
                }

                @Override
                public int hashCode() {
                        int hash = 11;
                        hash = 83 * hash + Objects.hashCode(this.typeID);
                        hash = 83 * hash + Objects.hashCode(this.displayName);
                        hash = 83 * hash + Objects.hashCode(this.typeName);
                        return hash;
                }
        }

        public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {

                TSK_GEN_INFO(1, "TSK_GEN_INFO", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskGenInfo.text")),
                TSK_WEB_BOOKMARK(2, "TSK_WEB_BOOKMARK", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskWebBookmark.text")),
                TSK_WEB_COOKIE(3, "TSK_WEB_COOKIE",
                                bundle.getString("BlackboardArtifact.tskWebCookie.text")), //NON-NLS                            
                TSK_WEB_HISTORY(4, "TSK_WEB_HISTORY", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskWebHistory.text")),
                TSK_WEB_DOWNLOAD(5, "TSK_WEB_DOWNLOAD", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskWebDownload.text")),
                TSK_RECENT_OBJECT(6, "TSK_RECENT_OBJ", //NON-NLS
                                bundle.getString("BlackboardArtifact.tsk.recentObject.text")),
                TSK_GPS_TRACKPOINT(7, "TSK_GPS_TRACKPOINT", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskGpsTrackpoint.text")),
                TSK_INSTALLED_PROG(8, "TSK_INSTALLED_PROG", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskInstalledProg.text")),
                TSK_KEYWORD_HIT(9, "TSK_KEYWORD_HIT",
                                bundle.getString("BlackboardArtifact.tskKeywordHits.text")),
                TSK_HASHSET_HIT(10, "TSK_HASHSET_HIT", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskHashsetHit.text")),
                TSK_DEVICE_ATTACHED(11, "TSK_DEVICE_ATTACHED", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskDeviceAttached.text")),
                TSK_INTERESTING_FILE_HIT(12, "TSK_INTERESTING_FILE_HIT", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskInterestingFileHit.text")), 

                TSK_EMAIL_MSG(13, "TSK_EMAIL_MSG", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskEmailMsg.text")),
                TSK_EXTRACTED_TEXT(14, "TSK_EXTRACTED_TEXT", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskExtractedText.text")),
                TSK_WEB_SEARCH_QUERY(15, "TSK_WEB_SEARCH_QUERY", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskWebSearchQuery.text")),
                TSK_METADATA_EXIF(16, "TSK_METADATA_EXIF", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskMetadataExif.text")),
                @Deprecated
                TSK_TAG_FILE(17, "TSK_TAG_FILE", //NON-NLS
                                bundle.getString("BlackboardArtifact.tagFile.text")),
                @Deprecated
                TSK_TAG_ARTIFACT(18, "TSK_TAG_ARTIFACT", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskTagArtifact.text")),
                TSK_OS_INFO(19, "TSK_OS_INFO", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskOsInfo.text")),
                TSK_OS_ACCOUNT(20, "TSK_OS_ACCOUNT", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskOsAccount.text")),
                TSK_SERVICE_ACCOUNT(21, "TSK_SERVICE_ACCOUNT", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskServiceAccount.text")),
                @Deprecated
                TSK_TOOL_OUTPUT(22, "TSK_TOOL_OUTPUT", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskToolOutput.text")),
                TSK_CONTACT(23, "TSK_CONTACT", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskContact.text")),
                TSK_MESSAGE(24, "TSK_MESSAGE", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskMessage.text")),
                TSK_CALLLOG(25, "TSK_CALLLOG", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskCalllog.text")),
                TSK_CALENDAR_ENTRY(26, "TSK_CALENDAR_ENTRY", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskCalendarEntry.text")),
                TSK_SPEED_DIAL_ENTRY(27, "TSK_SPEED_DIAL_ENTRY", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskSpeedDialEntry.text")),
                TSK_BLUETOOTH_PAIRING(28, "TSK_BLUETOOTH_PAIRING", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskBluetoothPairing.text")),
                TSK_GPS_BOOKMARK(29, "TSK_GPS_BOOKMARK", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskGpsBookmark.text")),
                TSK_GPS_LAST_KNOWN_LOCATION(30, "TSK_GPS_LAST_KNOWN_LOCATION", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskGpsLastKnownLocation.text")),
                TSK_GPS_SEARCH(31, "TSK_GPS_SEARCH", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskGpsSearch.text")),
                TSK_PROG_RUN(32, "TSK_PROG_RUN", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskProgRun.text")),
                TSK_ENCRYPTION_DETECTED(33, "TSK_ENCRYPTION_DETECTED", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskEncryptionDetected.text")),
                TSK_EXT_MISMATCH_DETECTED(34, "TSK_EXT_MISMATCH_DETECTED", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskExtMismatchDetected.text")),
                TSK_INTERESTING_ARTIFACT_HIT(35, "TSK_INTERESTING_ARTIFACT_HIT", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskInterestingArtifactHit.text")),
                TSK_GPS_ROUTE(36, "TSK_GPS_ROUTE", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskGpsRoute.text")),
                TSK_REMOTE_DRIVE(37, "TSK_REMOTE_DRIVE", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskRemoteDrive.text")),
                TSK_FACE_DETECTED(38, "TSK_FACE_DETECTED", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskFaceDetected.text")),
                TSK_ACCOUNT(39, "TSK_ACCOUNT", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskAccount.text")),
                TSK_ENCRYPTION_SUSPECTED(40, "TSK_ENCRYPTION_SUSPECTED", //NON-NLS
                                bundle.getString("BlackboardArtifact.tskEncryptionSuspected.text"));

                private final String label;
                private final int typeId;
                private final String displayName;

                private ARTIFACT_TYPE(int typeId, String label, String displayName) {
                        this.typeId = typeId;
                        this.label = label;
                        this.displayName = displayName;
                }

                public int getTypeID() {
                        return this.typeId;
                }

                public String getLabel() {
                        return this.label;
                }

                static public ARTIFACT_TYPE fromLabel(String label) {
                        for (ARTIFACT_TYPE value : ARTIFACT_TYPE.values()) {
                                if (value.getLabel().equals(label)) {
                                        return value;
                                }
                        }
                        throw new IllegalArgumentException("No ARTIFACT_TYPE matching type: " + label);
                }

                static public ARTIFACT_TYPE fromID(int id) {
                        for (ARTIFACT_TYPE value : ARTIFACT_TYPE.values()) {
                                if (value.getTypeID() == id) {
                                        return value;
                                }
                        }
                        throw new IllegalArgumentException("No ARTIFACT_TYPE matching type: " + id);
                }

                public String getDisplayName() {
                        return displayName;
                }

                @Override
                public <T> T accept(SleuthkitItemVisitor<T> visitor) {
                        return visitor.visit(this);
                }

        }

        public enum ReviewStatus {

                APPROVED(1, "APPROVED", "ReviewStatus.Approved"), //approved by human user
                REJECTED(2, "REJECTED", "ReviewStatus.Rejected"), //rejected by humna user
                UNDECIDED(3, "UNDECIDED", "ReviewStatus.Undecided"); // not yet reviewed by human user

                private final Integer id;
                private final String name;
                private final String displayName;
                private final static Map<Integer, ReviewStatus> idToStatus = new HashMap<Integer, ReviewStatus>();

                static {
                        for (ReviewStatus status : values()) {
                                idToStatus.put(status.getID(), status);
                        }
                }

                private ReviewStatus(Integer id, String name, String displayNameKey) {
                        this.id = id;
                        this.name = name;
                        this.displayName = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle").getString(displayNameKey);
                }

                public static ReviewStatus withID(int id) {
                        return idToStatus.get(id);
                }

                public Integer getID() {
                        return id;
                }

                String getName() {
                        return name;
                }

                public String getDisplayName() {
                        return displayName;
                }
        }

        @Deprecated
        protected BlackboardArtifact(SleuthkitCase sleuthkitCase, long artifactID, long objID, long artifactObjID, long dataSourceObjId, int artifactTypeID, String artifactTypeName, String displayName) {
                this(sleuthkitCase, artifactID, objID, artifactObjID, dataSourceObjId, artifactTypeID, artifactTypeName, displayName, ReviewStatus.UNDECIDED);
        }

        @Deprecated
        public List<BlackboardAttribute> getAttributes(final BlackboardAttribute.ATTRIBUTE_TYPE attributeType) throws TskCoreException {
                if (loadedCacheFromDb == false) {
                        List<BlackboardAttribute> attrs = getSleuthkitCase().getBlackboardAttributes(this);
                        attrsCache.clear();
                        attrsCache.addAll(attrs);
                        loadedCacheFromDb = true;
                }
                ArrayList<BlackboardAttribute> filteredAttributes = new ArrayList<BlackboardAttribute>();
                for (BlackboardAttribute attr : attrsCache) {
                        if (attr.getAttributeType().getTypeID() == attributeType.getTypeID()) {
                                filteredAttributes.add(attr);
                        }
                }
                return filteredAttributes;
        }

        @Override
        public long getId() {
                return this.artifactObjId;
        }

        @Override
        public List<Long> getChildrenIds() throws TskCoreException {
                List<Long> childrenIDs = new ArrayList<Long>();
                childrenIDs.addAll(getSleuthkitCase().getAbstractFileChildrenIds(this));
                childrenIDs.addAll(getSleuthkitCase().getBlackboardArtifactChildrenIds(this));

                return childrenIDs;
        }

        @Override
        public int getChildrenCount() throws TskCoreException {
                if (childrenCount != -1) {
                        return childrenCount;
                }

                childrenCount = this.getSleuthkitCase().getContentChildrenCount(this);

                hasChildren = childrenCount > 0;
                checkedHasChildren = true;

                return childrenCount;
        }

        @Override
        public boolean hasChildren() throws TskCoreException {
                if (checkedHasChildren == true) {
                        return hasChildren;
                }

                childrenCount = this.getSleuthkitCase().getContentChildrenCount(this);

                hasChildren = childrenCount > 0;
                checkedHasChildren = true;

                return hasChildren;
        }

        @Override
        public List<Content> getChildren() throws TskCoreException {
                List<Content> children = new ArrayList<Content>();
                children.addAll(getSleuthkitCase().getAbstractFileChildren(this));
                children.addAll(getSleuthkitCase().getBlackboardArtifactChildren(this));

                return children;
        }
}