19 package org.sleuthkit.datamodel;
21 import com.google.common.net.InternetDomainName;
23 import java.net.URISyntaxException;
24 import java.util.stream.Collectors;
25 import java.util.stream.Stream;
26 import org.apache.commons.lang3.StringUtils;
32 class TimelineEventTypes {
34 private TimelineEventTypes() {
42 final static class EmptyExtractor
implements TimelineEventArtifactTypeImpl.TSKCoreCheckedFunction<BlackboardArtifact, String> {
45 public String apply(BlackboardArtifact ignored)
throws TskCoreException {
50 static class URLArtifactEventType
extends TimelineEventArtifactTypeSingleDescription {
52 URLArtifactEventType(
int typeID, String displayName, TimelineEventType superType, BlackboardArtifact.Type artifactType, BlackboardAttribute.Type timeAttribute, BlackboardAttribute.Type descriptionAttribute) {
53 super(typeID, displayName, superType, artifactType, timeAttribute, descriptionAttribute);
56 TimelineEventDescription parseDescription(String fullDescriptionRaw, String medDescriptionRaw, String shortDescriptionRaw) {
64 String fullDescription = fullDescriptionRaw;
66 URI uri =
new URI(fullDescription);
67 String host = uri.getHost();
69 host = StringUtils.strip(fullDescription,
"./");
72 String shortDescription;
73 if (InternetDomainName.isValid(host)) {
74 InternetDomainName domain = InternetDomainName.from(host);
75 shortDescription = (domain.isUnderPublicSuffix())
76 ? domain.topPrivateDomain().toString()
79 shortDescription = host;
82 String mediumDescription =
new URI(uri.getScheme(), uri.getUserInfo(), host, uri.getPort(), uri.getPath(), null, null).toString();
84 return new TimelineEventDescription(fullDescription, mediumDescription, shortDescription);
85 }
catch (URISyntaxException ex) {
87 return new TimelineEventDescription(fullDescription);
92 static class FilePathEventType
extends TimelineEventTypeImpl {
94 FilePathEventType(
long typeID, String displayName, TimelineEventType.HierarchyLevel eventTypeZoomLevel, TimelineEventType superType) {
95 super(typeID, displayName, eventTypeZoomLevel, superType);
98 TimelineEventDescription parseDescription(String fullDescription, String medDescription, String shortDescription) {
99 return parseFilePathDescription(fullDescription);
104 static class FilePathArtifactEventType
extends TimelineEventArtifactTypeSingleDescription {
106 FilePathArtifactEventType(
int typeID, String displayName, TimelineEventType superType, BlackboardArtifact.Type artifactType, BlackboardAttribute.Type timeAttribute, BlackboardAttribute.Type descriptionAttribute) {
107 super(typeID, displayName, superType, artifactType, timeAttribute, descriptionAttribute);
110 TimelineEventDescription parseDescription(String fullDescriptionRaw, String medDescriptionRaw, String shortDescriptionRaw) {
111 return parseFilePathDescription(fullDescriptionRaw);
123 static TimelineEventDescription parseFilePathDescription(String fullDescription) {
125 String[] split = fullDescription.split(
"/");
126 String mediumDescription = Stream.of(split)
127 .filter(StringUtils::isNotBlank)
128 .limit(Math.max(1, split.length - 2))
129 .collect(Collectors.joining(
"/",
"/",
""))
130 .replaceAll(
"//",
"/");
132 String shortDescription = Stream.of(split)
133 .filter(StringUtils::isNotBlank)
135 .collect(Collectors.joining(
"/",
"/",
""))
136 .replaceAll(
"//",
"/");
137 return new TimelineEventDescription(fullDescription, mediumDescription, shortDescription);