19 package org.sleuthkit.datamodel;
21 import java.io.Serializable;
22 import java.util.Arrays;
23 import java.util.Collections;
24 import java.util.List;
25 import java.util.Objects;
26 import java.util.ResourceBundle;
27 import java.util.TimeZone;
28 import java.util.logging.Level;
29 import java.util.logging.Logger;
47 private static final char[] HEX_ARRAY =
"0123456789ABCDEF".toCharArray();
50 private static final ResourceBundle bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
52 private final int valueInt;
53 private final long valueLong;
54 private final double valueDouble;
55 private final String valueString;
56 private final byte[] valueBytes;
57 private String context;
58 private long artifactID;
60 private String sources;
76 throw new IllegalArgumentException(
"Value types do not match");
80 this.sources = replaceNulls(source);
81 this.valueInt = valueInt;
84 this.valueString =
"";
85 this.valueBytes =
new byte[0];
103 throw new IllegalArgumentException(
"Type mismatched with value type");
106 this.attributeType = attributeType;
107 this.sources = replaceNulls(source);
108 this.valueInt = valueInt;
110 this.valueDouble = 0;
111 this.valueString =
"";
112 this.valueBytes =
new byte[0];
134 throw new IllegalArgumentException(
"Value types do not match");
138 this.sources = replaceNulls(source);
140 this.valueLong = valueLong;
141 this.valueDouble = 0;
142 this.valueString =
"";
143 this.valueBytes =
new byte[0];
164 throw new IllegalArgumentException(
"Type mismatched with value type");
167 this.attributeType = attributeType;
168 this.sources = replaceNulls(source);
170 this.valueLong = valueLong;
171 this.valueDouble = 0;
172 this.valueString =
"";
173 this.valueBytes =
new byte[0];
191 throw new IllegalArgumentException(
"Value types do not match");
195 this.sources = replaceNulls(source);
198 this.valueDouble = valueDouble;
199 this.valueString =
"";
200 this.valueBytes =
new byte[0];
219 throw new IllegalArgumentException(
"Type mismatched with value type");
222 this.attributeType = attributeType;
223 this.sources = replaceNulls(source);
226 this.valueDouble = valueDouble;
227 this.valueString =
"";
228 this.valueBytes =
new byte[0];
246 throw new IllegalArgumentException(
"Value types do not match");
250 this.sources = replaceNulls(source);
253 this.valueDouble = 0;
254 if (valueString == null) {
255 this.valueString =
"";
257 this.valueString = replaceNulls(valueString);
259 this.valueBytes =
new byte[0];
277 throw new IllegalArgumentException(
"Type mismatched with value type");
280 this.attributeType = attributeType;
281 this.sources = replaceNulls(source);
284 this.valueDouble = 0;
285 if (valueString == null) {
286 this.valueString =
"";
288 this.valueString = replaceNulls(valueString);
290 this.valueBytes =
new byte[0];
308 throw new IllegalArgumentException(
"Value types do not match");
312 this.sources = replaceNulls(source);
316 this.valueDouble = 0;
317 this.valueString =
"";
318 if (valueBytes == null) {
319 this.valueBytes =
new byte[0];
321 this.valueBytes = valueBytes;
339 throw new IllegalArgumentException(
"Type mismatched with value type");
342 this.attributeType = attributeType;
343 this.sources = replaceNulls(source);
347 this.valueDouble = 0;
348 this.valueString =
"";
349 if (valueBytes == null) {
350 this.valueBytes =
new byte[0];
352 this.valueBytes = valueBytes;
373 return this.attributeType;
432 return Arrays.copyOf(valueBytes, valueBytes.length);
441 if (null != sources && !this.sources.isEmpty()) {
442 List<String> modules = Arrays.asList(sources.split(
","));
445 return Collections.emptyList();
457 this.sources = sleuthkitCase.addSourceToArtifactAttribute(
this, source);
478 hash = 97 * hash + (int) (this.artifactID ^ (this.artifactID >>> 32));
487 if (getClass() != obj.getClass()) {
496 return "BlackboardAttribute{" +
"artifactID=" + artifactID +
", attributeType=" + attributeType.
toString() +
", moduleName=" + sources +
", context=" + context +
", valueInt=" + valueInt +
", valueLong=" + valueLong +
", valueDouble=" + valueDouble +
", valueString=" + valueString +
", valueBytes=" + Arrays.toString(valueBytes) +
", Case=" + sleuthkitCase +
'}';
530 if ((dataSource != null) && (dataSource instanceof
Image )) {
532 Image image = (Image) dataSource;
533 TimeZone tzone = TimeZone.getTimeZone(image.
getTimeZone());
537 LOGGER.log(Level.WARNING,
"Could not get timezone for image", ex);
565 int valueInt,
long valueLong,
double valueDouble, String valueString, byte[] valueBytes,
568 this.artifactID = artifactID;
569 this.attributeType = attributeType;
570 this.sources = replaceNulls(source);
571 this.context = replaceNulls(context);
572 this.valueInt = valueInt;
573 this.valueLong = valueLong;
574 this.valueDouble = valueDouble;
575 if (valueString == null) {
576 this.valueString =
"";
578 this.valueString = replaceNulls(valueString);
580 if (valueBytes == null) {
581 this.valueBytes =
new byte[0];
583 this.valueBytes = valueBytes;
585 this.sleuthkitCase = sleuthkitCase;
594 void setCaseDatabase(SleuthkitCase sleuthkitCase) {
595 this.sleuthkitCase = sleuthkitCase;
603 void setArtifactId(
long artifactID) {
604 this.artifactID = artifactID;
615 String getSourcesCSV() {
626 static String bytesToHexString(byte[] bytes) {
628 char[] hexChars =
new char[bytes.length * 2];
629 for (
int j = 0; j < bytes.length; j++) {
630 int v = bytes[j] & 0xFF;
631 hexChars[j * 2] = HEX_ARRAY[v >>> 4];
632 hexChars[j * 2 + 1] = HEX_ARRAY[v & 0x0F];
634 return new String(hexChars);
644 private String replaceNulls(String text) {
645 return text.replace((
char) 0x00, (
char) 0x1A);
651 public static final class Type implements Serializable {
653 private static final long serialVersionUID = 1L;
654 private final String typeName;
655 private final int typeID;
656 private final String displayName;
668 this.typeID = typeID;
669 this.typeName = typeName;
670 this.displayName = displayName;
671 this.valueType = valueType;
681 this.typeID = type.getTypeID();
682 this.typeName = type.getLabel();
683 this.displayName = type.getDisplayName();
684 this.valueType = type.getValueType();
693 return this.valueType;
702 return this.typeName;
720 return this.displayName;
743 return this.typeName.equals(that.getTypeName())
744 && this.displayName.equals(that.getDisplayName())
745 && this.typeID == that.getTypeID()
746 && this.valueType == that.getValueType();
752 hash = 63 * hash + Objects.hashCode(this.typeID);
753 hash = 63 * hash + Objects.hashCode(this.displayName);
754 hash = 63 * hash + Objects.hashCode(this.typeName);
755 hash = 63 * hash + Objects.hashCode(this.valueType);
761 return "(typeID= " + this.typeID
762 +
", displayName=" + this.displayName
763 +
", typeName=" + this.typeName
764 +
", valueType=" + this.valueType +
")";
800 private final long typeId;
801 private final String typeName;
815 this.typeName = typeName;
839 return this.typeName;
858 if (valueType.
getType() == typeId) {
862 throw new IllegalArgumentException(
"No TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE matching type: " + typeId);
881 if (valueType.
getLabel().equals(typeName)) {
885 throw new IllegalArgumentException(
"No TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE matching type: " + typeName);
898 TSK_URL(1,
"TSK_URL",
899 bundle.getString(
"BlackboardAttribute.tskUrl.text"),
901 TSK_DATETIME(2,
"TSK_DATETIME",
902 bundle.getString(
"BlackboardAttribute.tskDatetime.text"),
904 TSK_NAME(3,
"TSK_NAME",
905 bundle.getString(
"BlackboardAttribute.tskName.text"),
907 TSK_PROG_NAME(4,
"TSK_PROG_NAME",
908 bundle.getString(
"BlackboardAttribute.tskProgName.text"),
910 TSK_VALUE(6,
"TSK_VALUE",
911 bundle.getString(
"BlackboardAttribute.tskValue.text"),
913 TSK_FLAG(7,
"TSK_FLAG",
914 bundle.getString(
"BlackboardAttribute.tskFlag.text"),
916 TSK_PATH(8,
"TSK_PATH",
917 bundle.getString(
"BlackboardAttribute.tskPath.text"),
919 TSK_KEYWORD(10,
"TSK_KEYWORD",
920 bundle.getString(
"BlackboardAttribute.tskKeyword.text"),
922 TSK_KEYWORD_REGEXP(11,
"TSK_KEYWORD_REGEXP",
923 bundle.getString(
"BlackboardAttribute.tskKeywordRegexp.text"),
925 TSK_KEYWORD_PREVIEW(12,
"TSK_KEYWORD_PREVIEW",
926 bundle.getString(
"BlackboardAttribute.tskKeywordPreview.text"),
932 TSK_KEYWORD_SET(13,
"TSK_KEYWORD_SET",
933 bundle.getString(
"BlackboardAttribute.tskKeywordSet.text"),
935 TSK_USER_NAME(14,
"TSK_USER_NAME",
936 bundle.getString(
"BlackboardAttribute.tskUserName.text"),
938 TSK_DOMAIN(15,
"TSK_DOMAIN",
939 bundle.getString(
"BlackboardAttribute.tskDomain.text"),
941 TSK_PASSWORD(16,
"TSK_PASSWORD",
942 bundle.getString(
"BlackboardAttribute.tskPassword.text"),
944 TSK_NAME_PERSON(17,
"TSK_NAME_PERSON",
945 bundle.getString(
"BlackboardAttribute.tskNamePerson.text"),
947 TSK_DEVICE_MODEL(18,
"TSK_DEVICE_MODEL",
948 bundle.getString(
"BlackboardAttribute.tskDeviceModel.text"),
950 TSK_DEVICE_MAKE(19,
"TSK_DEVICE_MAKE",
951 bundle.getString(
"BlackboardAttribute.tskDeviceMake.text"),
953 TSK_DEVICE_ID(20,
"TSK_DEVICE_ID",
954 bundle.getString(
"BlackboardAttribute.tskDeviceId.text"),
956 TSK_EMAIL(21,
"TSK_EMAIL",
957 bundle.getString(
"BlackboardAttribute.tskEmail.text"),
959 TSK_HASH_MD5(22,
"TSK_HASH_MD5",
960 bundle.getString(
"BlackboardAttribute.tskHashMd5.text"),
962 TSK_HASH_SHA1(23,
"TSK_HASH_SHA1",
963 bundle.getString(
"BlackboardAttribute.tskHashSha1.text"),
965 TSK_HASH_SHA2_256(24,
"TSK_HASH_SHA2_256",
966 bundle.getString(
"BlackboardAttribute.tskHashSha225.text"),
968 TSK_HASH_SHA2_512(25,
"TSK_HASH_SHA2_512",
969 bundle.getString(
"BlackboardAttribute.tskHashSha2512.text"),
971 TSK_TEXT(26,
"TSK_TEXT",
972 bundle.getString(
"BlackboardAttribute.tskText.text"),
974 TSK_TEXT_FILE(27,
"TSK_TEXT_FILE",
975 bundle.getString(
"BlackboardAttribute.tskTextFile.text"),
977 TSK_TEXT_LANGUAGE(28,
"TSK_TEXT_LANGUAGE",
978 bundle.getString(
"BlackboardAttribute.tskTextLanguage.text"),
980 TSK_ENTROPY(29,
"TSK_ENTROPY",
981 bundle.getString(
"BlackboardAttribute.tskEntropy.text"),
987 TSK_HASHSET_NAME(30,
"TSK_HASHSET_NAME",
988 bundle.getString(
"BlackboardAttribute.tskHashsetName.text"),
994 TSK_INTERESTING_FILE(31,
"TSK_INTERESTING_FILE",
995 bundle.getString(
"BlackboardAttribute.tskInterestingFile.text"),
997 TSK_REFERRER(32,
"TSK_REFERRER",
998 bundle.getString(
"BlackboardAttribute.tskReferrer.text"),
1000 TSK_DATETIME_ACCESSED(33,
"TSK_DATETIME_ACCESSED",
1001 bundle.getString(
"BlackboardAttribute.tskDateTimeAccessed.text"),
1003 TSK_IP_ADDRESS(34,
"TSK_IP_ADDRESS",
1004 bundle.getString(
"BlackboardAttribute.tskIpAddress.text"),
1006 TSK_PHONE_NUMBER(35,
"TSK_PHONE_NUMBER",
1007 bundle.getString(
"BlackboardAttribute.tskPhoneNumber.text"),
1009 TSK_PATH_ID(36,
"TSK_PATH_ID",
1010 bundle.getString(
"BlackboardAttribute.tskPathId.text"),
1012 TSK_SET_NAME(37,
"TSK_SET_NAME",
1013 bundle.getString(
"BlackboardAttribute.tskSetName.text"),
1019 TSK_ENCRYPTION_DETECTED(38,
"TSK_ENCRYPTION_DETECTED",
1020 bundle.getString(
"BlackboardAttribute.tskEncryptionDetected.text"),
1022 TSK_MALWARE_DETECTED(39,
"TSK_MALWARE_DETECTED",
1023 bundle.getString(
"BlackboardAttribute.tskMalwareDetected.text"),
1025 TSK_STEG_DETECTED(40,
"TSK_STEG_DETECTED",
1026 bundle.getString(
"BlackboardAttribute.tskStegDetected.text"),
1028 TSK_EMAIL_TO(41,
"TSK_EMAIL_TO",
1029 bundle.getString(
"BlackboardAttribute.tskEmailTo.text"),
1031 TSK_EMAIL_CC(42,
"TSK_EMAIL_CC",
1032 bundle.getString(
"BlackboardAttribute.tskEmailCc.text"),
1034 TSK_EMAIL_BCC(43,
"TSK_EMAIL_BCC",
1035 bundle.getString(
"BlackboardAttribute.tskEmailBcc.text"),
1037 TSK_EMAIL_FROM(44,
"TSK_EMAIL_FROM",
1038 bundle.getString(
"BlackboardAttribute.tskEmailFrom.text"),
1040 TSK_EMAIL_CONTENT_PLAIN(45,
"TSK_EMAIL_CONTENT_PLAIN",
1041 bundle.getString(
"BlackboardAttribute.tskEmailContentPlain.text"),
1043 TSK_EMAIL_CONTENT_HTML(46,
"TSK_EMAIL_CONTENT_HTML",
1044 bundle.getString(
"BlackboardAttribute.tskEmailContentHtml.text"),
1046 TSK_EMAIL_CONTENT_RTF(47,
"TSK_EMAIL_CONTENT_RTF",
1047 bundle.getString(
"BlackboardAttribute.tskEmailContentRtf.text"),
1049 TSK_MSG_ID(48,
"TSK_MSG_ID",
1050 bundle.getString(
"BlackboardAttribute.tskMsgId.text"),
1052 TSK_MSG_REPLY_ID(49,
"TSK_MSG_REPLY_ID",
1053 bundle.getString(
"BlackboardAttribute.tskMsgReplyId.text"),
1055 TSK_DATETIME_RCVD(50,
"TSK_DATETIME_RCVD",
1056 bundle.getString(
"BlackboardAttribute.tskDateTimeRcvd.text"),
1058 TSK_DATETIME_SENT(51,
"TSK_DATETIME_SENT",
1059 bundle.getString(
"BlackboardAttribute.tskDateTimeSent.text"),
1061 TSK_SUBJECT(52,
"TSK_SUBJECT",
1062 bundle.getString(
"BlackboardAttribute.tskSubject.text"),
1064 TSK_TITLE(53,
"TSK_TITLE",
1065 bundle.getString(
"BlackboardAttribute.tskTitle.text"),
1067 TSK_GEO_LATITUDE(54,
"TSK_GEO_LATITUDE",
1068 bundle.getString(
"BlackboardAttribute.tskGeoLatitude.text"),
1070 TSK_GEO_LONGITUDE(55,
"TSK_GEO_LONGITUDE",
1071 bundle.getString(
"BlackboardAttribute.tskGeoLongitude.text"),
1073 TSK_GEO_VELOCITY(56,
"TSK_GEO_VELOCITY",
1074 bundle.getString(
"BlackboardAttribute.tskGeoVelocity.text"),
1076 TSK_GEO_ALTITUDE(57,
"TSK_GEO_ALTITUDE",
1077 bundle.getString(
"BlackboardAttribute.tskGeoAltitude.text"),
1079 TSK_GEO_BEARING(58,
"TSK_GEO_BEARING",
1080 bundle.getString(
"BlackboardAttribute.tskGeoBearing.text"),
1082 TSK_GEO_HPRECISION(59,
"TSK_GEO_HPRECISION",
1083 bundle.getString(
"BlackboardAttribute.tskGeoHPrecision.text"),
1085 TSK_GEO_VPRECISION(60,
"TSK_GEO_VPRECISION",
1086 bundle.getString(
"BlackboardAttribute.tskGeoVPrecision.text"),
1088 TSK_GEO_MAPDATUM(61,
"TSK_GEO_MAPDATUM",
1089 bundle.getString(
"BlackboardAttribute.tskGeoMapDatum.text"),
1096 TSK_FILE_TYPE_SIG(62,
"TSK_FILE_TYPE_SIG",
1097 bundle.getString(
"BlackboardAttribute.tskFileTypeSig.text"),
1099 TSK_FILE_TYPE_EXT(63,
"TSK_FILE_TYPE_EXT",
1100 bundle.getString(
"BlackboardAttribute.tskFileTypeExt.text"),
1107 TSK_TAGGED_ARTIFACT(64,
"TSK_TAGGED_ARTIFACT",
1108 bundle.getString(
"BlackboardAttribute.tskTaggedArtifact.text"),
1115 TSK_TAG_NAME(65,
"TSK_TAG_NAME",
1116 bundle.getString(
"BlackboardAttribute.tskTagName.text"),
1118 TSK_COMMENT(66,
"TSK_COMMENT",
1119 bundle.getString(
"BlackboardAttribute.tskComment.text"),
1121 TSK_URL_DECODED(67,
"TSK_URL_DECODED",
1122 bundle.getString(
"BlackboardAttribute.tskUrlDecoded.text"),
1124 TSK_DATETIME_CREATED(68,
"TSK_DATETIME_CREATED",
1125 bundle.getString(
"BlackboardAttribute.tskDateTimeCreated.text"),
1127 TSK_DATETIME_MODIFIED(69,
"TSK_DATETIME_MODIFIED",
1128 bundle.getString(
"BlackboardAttribute.tskDateTimeModified.text"),
1130 TSK_PROCESSOR_ARCHITECTURE(70,
"TSK_PROCESSOR_ARCHITECTURE",
1131 bundle.getString(
"BlackboardAttribute.tskProcessorArchitecture.text"),
1133 TSK_VERSION(71,
"TSK_VERSION",
1134 bundle.getString(
"BlackboardAttribute.tskVersion.text"),
1136 TSK_USER_ID(72,
"TSK_USER_ID",
1137 bundle.getString(
"BlackboardAttribute.tskUserId.text"),
1139 TSK_DESCRIPTION(73,
"TSK_DESCRIPTION",
1140 bundle.getString(
"BlackboardAttribute.tskDescription.text"),
1142 TSK_MESSAGE_TYPE(74,
"TSK_MESSAGE_TYPE",
1143 bundle.getString(
"BlackboardAttribute.tskMessageType.text"),
1145 TSK_PHONE_NUMBER_HOME(75,
"TSK_PHONE_NUMBER_HOME",
1146 bundle.getString(
"BlackboardAttribute.tskPhoneNumberHome.text"),
1148 TSK_PHONE_NUMBER_OFFICE(76,
"TSK_PHONE_NUMBER_OFFICE",
1149 bundle.getString(
"BlackboardAttribute.tskPhoneNumberOffice.text"),
1151 TSK_PHONE_NUMBER_MOBILE(77,
"TSK_PHONE_NUMBER_MOBILE",
1152 bundle.getString(
"BlackboardAttribute.tskPhoneNumberMobile.text"),
1154 TSK_PHONE_NUMBER_FROM(78,
"TSK_PHONE_NUMBER_FROM",
1155 bundle.getString(
"BlackboardAttribute.tskPhoneNumberFrom.text"),
1157 TSK_PHONE_NUMBER_TO(79,
"TSK_PHONE_NUMBER_TO",
1158 bundle.getString(
"BlackboardAttribute.tskPhoneNumberTo.text"),
1160 TSK_DIRECTION(80,
"TSK_DIRECTION",
1161 bundle.getString(
"BlackboardAttribute.tskDirection.text"),
1163 TSK_EMAIL_HOME(81,
"TSK_EMAIL_HOME",
1164 bundle.getString(
"BlackboardAttribute.tskEmailHome.text"),
1166 TSK_EMAIL_OFFICE(82,
"TSK_EMAIL_OFFICE",
1167 bundle.getString(
"BlackboardAttribute.tskEmailOffice.text"),
1169 TSK_DATETIME_START(83,
"TSK_DATETIME_START",
1170 bundle.getString(
"BlackboardAttribute.tskDateTimeStart.text"),
1172 TSK_DATETIME_END(84,
"TSK_DATETIME_END",
1173 bundle.getString(
"BlackboardAttribute.tskDateTimeEnd.text"),
1175 TSK_CALENDAR_ENTRY_TYPE(85,
"TSK_CALENDAR_ENTRY_TYPE",
1176 bundle.getString(
"BlackboardAttribute.tskCalendarEntryType.text"),
1178 TSK_LOCATION(86,
"TSK_LOCATION",
1179 bundle.getString(
"BlackboardAttribute.tskLocation.text"),
1181 TSK_SHORTCUT(87,
"TSK_SHORTCUT",
1182 bundle.getString(
"BlackboardAttribute.tskShortcut.text"),
1184 TSK_DEVICE_NAME(88,
"TSK_DEVICE_NAME",
1185 bundle.getString(
"BlackboardAttribute.tskDeviceName.text"),
1187 TSK_CATEGORY(89,
"TSK_CATEGORY",
1188 bundle.getString(
"BlackboardAttribute.tskCategory.text"),
1190 TSK_EMAIL_REPLYTO(90,
"TSK_EMAIL_REPLYTO",
1191 bundle.getString(
"BlackboardAttribute.tskEmailReplyTo.text"),
1193 TSK_SERVER_NAME(91,
"TSK_SERVER_NAME",
1194 bundle.getString(
"BlackboardAttribute.tskServerName.text"),
1196 TSK_COUNT(92,
"TSK_COUNT",
1197 bundle.getString(
"BlackboardAttribute.tskCount.text"),
1199 TSK_MIN_COUNT(93,
"TSK_MIN_COUNT",
1200 bundle.getString(
"BlackboardAttribute.tskMinCount.text"),
1202 TSK_PATH_SOURCE(94,
"TSK_PATH_SOURCE",
1203 bundle.getString(
"BlackboardAttribute.tskPathSource.text"),
1205 TSK_PERMISSIONS(95,
"TSK_PERMISSIONS",
1206 bundle.getString(
"BlackboardAttribute.tskPermissions.text"),
1208 TSK_ASSOCIATED_ARTIFACT(96,
"TSK_ASSOCIATED_ARTIFACT",
1209 bundle.getString(
"BlackboardAttribute.tskAssociatedArtifact.text"),
1211 TSK_ISDELETED(97,
"TSK_ISDELETED",
1212 bundle.getString(
"BlackboardAttribute.tskIsDeleted.text"),
1214 TSK_GEO_LATITUDE_START(98,
"TSK_GEO_LATITUDE_START",
1215 bundle.getString(
"BlackboardAttribute.tskGeoLatitudeStart.text"),
1217 TSK_GEO_LATITUDE_END(99,
"TSK_GEO_LATITUDE_END",
1218 bundle.getString(
"BlackboardAttribute.tskGeoLatitudeEnd.text"),
1220 TSK_GEO_LONGITUDE_START(100,
"TSK_GEO_LONGITUDE_START",
1221 bundle.getString(
"BlackboardAttribute.tskGeoLongitudeStart.text"),
1223 TSK_GEO_LONGITUDE_END(101,
"TSK_GEO_LONGITUDE_END",
1224 bundle.getString(
"BlackboardAttribute.tskGeoLongitudeEnd.text"),
1226 TSK_READ_STATUS(102,
"TSK_READ_STATUS",
1227 bundle.getString(
"BlackboardAttribute.tskReadStatus.text"),
1229 TSK_LOCAL_PATH(103,
"TSK_LOCAL_PATH",
1230 bundle.getString(
"BlackboardAttribute.tskLocalPath.text"),
1232 TSK_REMOTE_PATH(104,
"TSK_REMOTE_PATH",
1233 bundle.getString(
"BlackboardAttribute.tskRemotePath.text"),
1235 TSK_TEMP_DIR(105,
"TSK_TEMP_DIR",
1236 bundle.getString(
"BlackboardAttribute.tskTempDir.text"),
1238 TSK_PRODUCT_ID(106,
"TSK_PRODUCT_ID",
1239 bundle.getString(
"BlackboardAttribute.tskProductId.text"),
1241 TSK_OWNER(107,
"TSK_OWNER",
1242 bundle.getString(
"BlackboardAttribute.tskOwner.text"),
1244 TSK_ORGANIZATION(108,
"TSK_ORGANIZATION",
1245 bundle.getString(
"BlackboardAttribute.tskOrganization.text"),
1247 TSK_CARD_NUMBER(109,
"TSK_CARD_NUMBER",
1248 bundle.getString(
"BlackboardAttribute.tskCardNumber.text"),
1250 TSK_CARD_EXPIRATION(110,
"TSK_CARD_EXPIRATION",
1251 bundle.getString(
"BlackboardAttribute.tskCardExpiration.text"),
1253 TSK_CARD_SERVICE_CODE(111,
"TSK_CARD_SERVICE_CODE",
1254 bundle.getString(
"BlackboardAttribute.tskCardServiceCode.text"),
1256 TSK_CARD_DISCRETIONARY(112,
"TSK_CARD_DISCRETIONARY",
1257 bundle.getString(
"BlackboardAttribute.tskCardDiscretionary.text"),
1259 TSK_CARD_LRC(113,
"TSK_CARD_LRC",
1260 bundle.getString(
"BlackboardAttribute.tskCardLRC.text"),
1262 TSK_KEYWORD_SEARCH_DOCUMENT_ID(114,
"TSK_KEYWORD_SEARCH_DOCUMENT_ID",
1263 bundle.getString(
"BlackboardAttribute.tskKeywordSearchDocumentID.text"),
1265 TSK_CARD_SCHEME(115,
"TSK_CARD_SCHEME",
1266 bundle.getString(
"BlackboardAttribute.tskCardScheme.text"),
1268 TSK_CARD_TYPE(116,
"TSK_CARD_TYPE",
1269 bundle.getString(
"BlackboardAttribute.tskCardType.text"),
1271 TSK_BRAND_NAME(117,
"TSK_BRAND_NAME",
1272 bundle.getString(
"BlackboardAttribute.tskBrandName.text"),
1274 TSK_BANK_NAME(118,
"TSK_BANK_NAME",
1275 bundle.getString(
"BlackboardAttribute.tskBankName.text"),
1277 TSK_COUNTRY(119,
"TSK_COUNTRY",
1278 bundle.getString(
"BlackboardAttribute.tskCountry.text"),
1280 TSK_CITY(120,
"TSK_CITY",
1281 bundle.getString(
"BlackboardAttribute.tskCity.text"),
1283 TSK_ACCOUNT_TYPE(121,
"TSK_ACCOUNT_TYPE",
1284 bundle.getString(
"BlackboardAttribute.tskAccountType.text"),
1289 TSK_KEYWORD_SEARCH_TYPE(122,
"TSK_KEYWORD_SEARCH_TYPE",
1290 bundle.getString(
"BlackboardAttribute.tskKeywordSearchType.text"),
1292 TSK_HEADERS(123,
"TSK_HEADERS",
1293 bundle.getString(
"BlackboardAttribute.tskHeaders.text"),
1295 TSK_ID(124,
"TSK_ID",
1296 bundle.getString(
"BlackboardAttribute.tskId.text"),
1299 private final int typeID;
1300 private final String typeName;
1301 private final String displayName;
1313 this.typeID = typeID;
1314 this.typeName = typeName;
1315 this.displayName = displayName;
1316 this.valueType = valueType;
1337 return this.typeName;
1346 return this.displayName;
1355 return this.valueType;
1373 if (attrType.getTypeID() == typeID) {
1377 throw new IllegalArgumentException(
"No ATTRIBUTE_TYPE matching type: " + typeID);
1395 if (attrType.getLabel().equals(typeName)) {
1399 throw new IllegalArgumentException(
"No ATTRIBUTE_TYPE matching type: " + typeName);
1421 public BlackboardAttribute(
int attributeTypeID, String moduleName,
int valueInt)
throws IllegalArgumentException {
1445 this(attributeTypeID, moduleName, valueInt);
1446 this.context = replaceNulls(context);
1469 long valueLong)
throws IllegalArgumentException {
1495 this(attributeTypeID, moduleName, valueLong);
1496 this.context = replaceNulls(context);
1517 double valueDouble)
throws IllegalArgumentException {
1540 double valueDouble) {
1541 this(attributeTypeID, moduleName, valueDouble);
1542 this.context = replaceNulls(context);
1562 public BlackboardAttribute(
int attributeTypeID, String moduleName, String valueString)
throws IllegalArgumentException {
1585 String valueString) {
1586 this(attributeTypeID, moduleName, valueString);
1587 this.context = replaceNulls(context);
1607 public BlackboardAttribute(
int attributeTypeID, String moduleName, byte[] valueBytes)
throws IllegalArgumentException {
1630 byte[] valueBytes) {
1631 this(attributeTypeID, moduleName, valueBytes);
1632 this.context = replaceNulls(context);
1647 setArtifactId(artifactID);
1663 setCaseDatabase(sleuthkitCase);
1686 String getContextString() {
1699 return attributeType.getTypeID();
1713 return attributeType.getTypeName();
1728 return attributeType.getDisplayName();
BlackboardAttribute(int attributeTypeID, String moduleName, String context, byte[] valueBytes)
void setCase(SleuthkitCase sleuthkitCase)
Type(int typeID, String typeName, String displayName, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType)
String getAttributeTypeDisplayName()
static String epochToTime(long epoch)
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType()
static ATTRIBUTE_TYPE fromID(int typeID)
void setArtifactID(long artifactID)
String getAttributeTypeName()
BlackboardAttribute(Type attributeType, String source, long valueLong)
BlackboardAttribute(Type attributeType, String source, int valueInt)
BlackboardAttribute(int attributeTypeID, String moduleName, String context, int valueInt)
BlackboardArtifact getBlackboardArtifact(long artifactID)
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromLabel(String typeName)
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType()
BlackboardAttribute(int attributeTypeID, String moduleName, int valueInt)
BlackboardAttribute(int attributeTypeID, String moduleName, String valueString)
String getDisplayString()
BlackboardAttribute(int attributeTypeID, String moduleName, double valueDouble)
boolean equals(Object obj)
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, String valueString)
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType()
BlackboardAttribute(Type attributeType, String source, byte[] valueBytes)
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromType(long typeId)
BlackboardAttribute(int attributeTypeID, String moduleName, String context, double valueDouble)
BlackboardAttribute.Type getAttributeType()
boolean equals(Object that)
static ATTRIBUTE_TYPE fromLabel(String typeName)
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, long valueLong)
BlackboardArtifact getParentArtifact()
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, int valueInt)
BlackboardAttribute(Type attributeType, String source, double valueDouble)
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, double valueDouble)
BlackboardAttribute(int attributeTypeID, String moduleName, String context, long valueLong)
BlackboardAttribute(int attributeTypeID, String moduleName, String context, String valueString)
BlackboardAttribute(int attributeTypeID, String moduleName, long valueLong)
Type(BlackboardAttribute.ATTRIBUTE_TYPE type)
BlackboardAttribute(int attributeTypeID, String moduleName, byte[] valueBytes)
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, byte[] valueBytes)
void addSource(String source)
List< String > getSources()
BlackboardAttribute(Type attributeType, String source, String valueString)