Sleuth Kit Java Bindings (JNI)  4.12.1
Java bindings for using The Sleuth Kit
org.sleuthkit.datamodel.Blackboard Class Reference

Classes

class  ArtifactsPostedEvent
 
class  BlackboardException
 

Public Member Functions

boolean artifactExists (Content content, BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributes) throws TskCoreException
 
boolean artifactExists (Content content, BlackboardArtifact.ARTIFACT_TYPE artifactType, Collection< BlackboardAttribute > attributes) throws TskCoreException
 
Score deleteAnalysisResult (AnalysisResult analysisResult) throws TskCoreException
 
Score deleteAnalysisResult (long artifactObjId, CaseDbTransaction transaction) throws TskCoreException
 
AnalysisResult getAnalysisResultById (long artifactObjId) throws TskCoreException
 
List< AnalysisResultgetAnalysisResults (long dataSourceObjId, Integer artifactTypeID) throws TskCoreException
 
List< AnalysisResultgetAnalysisResults (long sourceObjId) throws TskCoreException
 
List< AnalysisResultgetAnalysisResults (long sourceObjId, int artifactTypeId) throws TskCoreException
 
List< AnalysisResultgetAnalysisResultsByType (int artifactTypeId) throws TskCoreException
 
List< AnalysisResultgetAnalysisResultsByType (int artifactTypeId, long dataSourceObjId) throws TskCoreException
 
List< AnalysisResultgetAnalysisResultsWhere (String whereClause) throws TskCoreException
 
List< BlackboardArtifactgetArtifacts (int artifactTypeID, long dataSourceObjId) throws TskCoreException
 
List< BlackboardArtifactgetArtifacts (Collection< BlackboardArtifact.Type > artifactTypes, Collection< Long > dataSourceObjIds) throws TskCoreException
 
List< BlackboardArtifactgetArtifacts (BlackboardArtifact.Type artifactType, BlackboardAttribute.Type attributeType, String value, Long dataSourceObjId, boolean showRejected) throws TskCoreException
 
long getArtifactsCount (int artifactTypeID, long dataSourceObjId) throws TskCoreException
 
long getArtifactsCount (int artifactTypeID) throws TskCoreException
 
BlackboardArtifact.Type getArtifactType (String artTypeName) throws TskCoreException
 
BlackboardArtifact.Type getArtifactType (int artTypeId) throws TskCoreException
 
List< BlackboardArtifact.Type > getArtifactTypesInUse (long dataSourceObjId) throws TskCoreException
 
BlackboardAttribute.Type getAttributeType (String attrTypeName) throws TskCoreException
 
ArrayList< BlackboardAttributegetBlackboardAttributes (final BlackboardArtifact artifact) throws TskCoreException
 
DataArtifact getDataArtifactById (long artifactObjId) throws TskCoreException
 
List< DataArtifactgetDataArtifacts (long dataSourceObjId, Integer artifactTypeID) throws TskCoreException
 
List< DataArtifactgetDataArtifacts (int artifactTypeID, long dataSourceObjId) throws TskCoreException
 
List< DataArtifactgetDataArtifacts (int artifactTypeID) throws TskCoreException
 
List< DataArtifactgetDataArtifactsWhere (String whereClause) throws TskCoreException
 
List< BlackboardArtifactgetExactMatchKeywordSearchResults (String keyword, TskData.KeywordSearchQueryType searchType, String kwsListName, Long dataSourceId) throws TskCoreException
 
List< BlackboardArtifactgetKeywordSearchResults (String keyword, String regex, TskData.KeywordSearchQueryType searchType, String kwsListName, Long dataSourceId) throws TskCoreException
 
BlackboardArtifact.Type getOrAddArtifactType (String typeName, String displayName) throws BlackboardException
 
BlackboardArtifact.Type getOrAddArtifactType (String typeName, String displayName, BlackboardArtifact.Category category) throws BlackboardException
 
synchronized BlackboardAttribute.Type getOrAddAttributeType (String typeName, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName) throws BlackboardException
 
boolean hasAnalysisResults (long sourceObjId) throws TskCoreException
 
boolean hasDataArtifacts (long sourceObjId) throws TskCoreException
 
AnalysisResultAdded newAnalysisResult (BlackboardArtifact.Type artifactType, long objId, Long dataSourceObjId, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList) throws BlackboardException, TskCoreException
 
AnalysisResultAdded newAnalysisResult (BlackboardArtifact.Type artifactType, long objId, Long dataSourceObjId, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, CaseDbTransaction transaction) throws BlackboardException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, long sourceObjId, Long dataSourceObjId, Collection< BlackboardAttribute > attributes, Long osAccountId) throws TskCoreException
 
DataArtifact newDataArtifact (BlackboardArtifact.Type artifactType, long sourceObjId, Long dataSourceObjId, Collection< BlackboardAttribute > attributes, Long osAccountObjId, final CaseDbTransaction transaction) throws TskCoreException
 
void postArtifact (BlackboardArtifact artifact, String moduleName) throws BlackboardException
 
void postArtifact (BlackboardArtifact artifact, String moduleName, Long ingestJobId) throws BlackboardException
 
void postArtifacts (Collection< BlackboardArtifact > artifacts, String moduleName) throws BlackboardException
 
void postArtifacts (Collection< BlackboardArtifact > artifacts, String moduleName, Long ingestJobId) throws BlackboardException
 

Detailed Description

A representation of the blackboard, a place where artifacts and their attributes are posted.

Definition at line 53 of file Blackboard.java.

Member Function Documentation

boolean org.sleuthkit.datamodel.Blackboard.artifactExists ( Content  content,
BlackboardArtifact.Type  artifactType,
Collection< BlackboardAttribute attributes 
) throws TskCoreException

Determines whether or not an artifact of a given type with a given set of attributes already exists for a given content.

Parameters
contentThe content.
artifactTypeThe artifact type.
attributesThe attributes.
Returns
True or false
Exceptions
TskCoreExceptionThe exception is thrown if there is an issue querying the case database.

Definition at line 2012 of file Blackboard.java.

Referenced by org.sleuthkit.datamodel.Blackboard.artifactExists().

boolean org.sleuthkit.datamodel.Blackboard.artifactExists ( Content  content,
BlackboardArtifact.ARTIFACT_TYPE  artifactType,
Collection< BlackboardAttribute attributes 
) throws TskCoreException

Determines whether or not an artifact of a given type with a given set of attributes already exists for a given content.

Parameters
contentThe content.
artifactTypeThe artifact type.
attributesThe attributes.
Returns
True or false
Exceptions
TskCoreExceptionThe exception is thrown if there is an issue querying the case database.
Deprecated:
Use artifactExists(Content content, BlackboardArtifact.Type artifactType, Collection<BlackboardAttribute> attributes) instead.

Definition at line 2038 of file Blackboard.java.

References org.sleuthkit.datamodel.Blackboard.artifactExists(), and org.sleuthkit.datamodel.Blackboard.getArtifactType().

Score org.sleuthkit.datamodel.Blackboard.deleteAnalysisResult ( AnalysisResult  analysisResult) throws TskCoreException

Delete the specified analysis result.

Deletes the result from blackboard_artifacts and tsk_analysis_results, and recalculates and updates the aggregate score of the content. Fires an event to indicate that the analysis result has been deleted and that the score of the item has changed.

Parameters
analysisResultAnalysisResult to delete.
Returns
New score of the content.
Exceptions
TskCoreException

Definition at line 904 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

Referenced by org.sleuthkit.datamodel.Blackboard.deleteAnalysisResult().

Score org.sleuthkit.datamodel.Blackboard.deleteAnalysisResult ( long  artifactObjId,
CaseDbTransaction  transaction 
) throws TskCoreException

Delete the specified analysis result.

Deletes the result from blackboard_artifacts and tsk_analysis_results, and recalculates and updates the aggregate score of the content.

Parameters
artifactObjIdArtifact Obj Id to be deleted
transaction
Returns
Exceptions
TskCoreException

Definition at line 933 of file Blackboard.java.

References org.sleuthkit.datamodel.Blackboard.deleteAnalysisResult(), and org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere().

AnalysisResult org.sleuthkit.datamodel.Blackboard.getAnalysisResultById ( long  artifactObjId) throws TskCoreException

Get the analysis results by its artifact_obj_id.

Parameters
artifactObjIdArtifact object id of the analysis result.
Returns
AnalysisResult.
Exceptions
TskCoreExceptionIf a critical error occurred within TSK core.

Definition at line 1249 of file Blackboard.java.

References org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere().

Referenced by org.sleuthkit.datamodel.SleuthkitCase.getArtifactByArtifactId(), and org.sleuthkit.datamodel.SleuthkitCase.getArtifactById().

List<AnalysisResult> org.sleuthkit.datamodel.Blackboard.getAnalysisResults ( long  dataSourceObjId,
Integer  artifactTypeID 
) throws TskCoreException

Gets all analysis results of a given type for a given data source. To get all the analysis results for the data source, pass null for the type ID.

Parameters
dataSourceObjIdThe object ID of the data source.
artifactTypeIDThe type ID of the desired analysis results or null.
Returns
A list of the analysis results, possibly empty.
Exceptions
TskCoreExceptionThis exception is thrown if there is an error querying the case database.

Definition at line 1046 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

Referenced by org.sleuthkit.datamodel.Report.getAllAnalysisResults(), org.sleuthkit.datamodel.AbstractContent.getAllAnalysisResults(), org.sleuthkit.datamodel.BlackboardArtifact.getAllAnalysisResults(), org.sleuthkit.datamodel.Report.getAnalysisResults(), org.sleuthkit.datamodel.AbstractContent.getAnalysisResults(), and org.sleuthkit.datamodel.BlackboardArtifact.getAnalysisResults().

List<AnalysisResult> org.sleuthkit.datamodel.Blackboard.getAnalysisResults ( long  sourceObjId) throws TskCoreException

Get all analysis results for a given object.

Parameters
sourceObjIdObject id.
Returns
list of analysis results.
Exceptions
TskCoreExceptionexception thrown if a critical error occurs within TSK core.

Definition at line 1069 of file Blackboard.java.

References org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere().

List<AnalysisResult> org.sleuthkit.datamodel.Blackboard.getAnalysisResults ( long  sourceObjId,
int  artifactTypeId 
) throws TskCoreException

Get analysis results of the given type, for the given object.

Parameters
sourceObjIdObject id.
artifactTypeIdResult type to get.
Returns
list of analysis results.
Exceptions
TskCoreExceptionexception thrown if a critical error occurs within TSK core.

Definition at line 1181 of file Blackboard.java.

References org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere(), and org.sleuthkit.datamodel.Blackboard.getArtifactType().

List<AnalysisResult> org.sleuthkit.datamodel.Blackboard.getAnalysisResultsByType ( int  artifactTypeId) throws TskCoreException

Get all analysis results of given artifact type.

Parameters
artifactTypeIdThe artifact type id for which to search.
Returns
The list of analysis results.
Exceptions
TskCoreExceptionException thrown if a critical error occurs within TSK core.

Definition at line 1014 of file Blackboard.java.

References org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere().

List<AnalysisResult> org.sleuthkit.datamodel.Blackboard.getAnalysisResultsByType ( int  artifactTypeId,
long  dataSourceObjId 
) throws TskCoreException

Get all analysis results of given artifact type.

Parameters
artifactTypeIdThe artifact type id for which to search.
dataSourceObjIdObject Id of the data source to look under.
Returns
The list of analysis results.
Exceptions
TskCoreExceptionException thrown if a critical error occurs within TSK core.

Definition at line 1029 of file Blackboard.java.

References org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere().

List<AnalysisResult> org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere ( String  whereClause) throws TskCoreException
List<BlackboardArtifact> org.sleuthkit.datamodel.Blackboard.getArtifacts ( int  artifactTypeID,
long  dataSourceObjId 
) throws TskCoreException

Get all blackboard artifacts of a given type. Does not included rejected artifacts.

Parameters
artifactTypeIDartifact type to get
dataSourceObjIddata source to look under
Returns
list of blackboard artifacts
Exceptions
TskCoreExceptionexception thrown if a critical error occurs within TSK core

Definition at line 1697 of file Blackboard.java.

References org.sleuthkit.datamodel.Blackboard.getArtifactType().

List<BlackboardArtifact> org.sleuthkit.datamodel.Blackboard.getArtifacts ( Collection< BlackboardArtifact.Type >  artifactTypes,
Collection< Long >  dataSourceObjIds 
) throws TskCoreException

Get all blackboard artifacts of the given type(s) for the given data source(s). Does not included rejected artifacts.

Parameters
artifactTypeslist of artifact types to get
dataSourceObjIdsdata sources to look under
Returns
list of blackboard artifacts
Exceptions
TskCoreExceptionexception thrown if a critical error occurs within TSK core

Definition at line 1714 of file Blackboard.java.

References org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.Blackboard.getAnalysisResultsWhere(), and org.sleuthkit.datamodel.Blackboard.getDataArtifactsWhere().

List<BlackboardArtifact> org.sleuthkit.datamodel.Blackboard.getArtifacts ( BlackboardArtifact.Type  artifactType,
BlackboardAttribute.Type  attributeType,
String  value,
Long  dataSourceObjId,
boolean  showRejected 
) throws TskCoreException

Get all blackboard artifacts of the given type that contain attribute of given type and value, for a given data source(s).

Parameters
artifactTypeartifact type to get
attributeTypeattribute type to be included
valueattribute value to be included. can be empty.
dataSourceObjIddata source to look under. If Null, then search all data sources.
showRejecteda flag whether to display rejected artifacts
Returns
list of blackboard artifacts
Exceptions
TskCoreExceptionexception thrown if a critical error occurs within TSK core

Definition at line 1777 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.BlackboardArtifact.ReviewStatus.REJECTED, and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

long org.sleuthkit.datamodel.Blackboard.getArtifactsCount ( int  artifactTypeID,
long  dataSourceObjId 
) throws TskCoreException

Get count of all blackboard artifacts of a given type for the given data source. Does not include rejected artifacts.

Parameters
artifactTypeIDartifact type id (must exist in database)
dataSourceObjIddata source object id
Returns
count of blackboard artifacts
Exceptions
TskCoreExceptionexception thrown if a critical error occurs within TSK core

Definition at line 1665 of file Blackboard.java.

long org.sleuthkit.datamodel.Blackboard.getArtifactsCount ( int  artifactTypeID) throws TskCoreException

Get count of all blackboard artifacts of a given type. Does not include rejected artifacts.

Parameters
artifactTypeIDartifact type id (must exist in database)
Returns
count of blackboard artifacts
Exceptions
TskCoreExceptionexception thrown if a critical error occurs within TSK core

Definition at line 1681 of file Blackboard.java.

BlackboardArtifact.Type org.sleuthkit.datamodel.Blackboard.getArtifactType ( String  artTypeName) throws TskCoreException
BlackboardArtifact.Type org.sleuthkit.datamodel.Blackboard.getArtifactType ( int  artTypeId) throws TskCoreException

Get the artifact type associated with an artifact type id.

Parameters
artTypeIdAn artifact type id.
Returns
The artifact type.
Exceptions
TskCoreExceptionIf an error occurs accessing the case database or no value is found.

Definition at line 400 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.fromID(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

List<BlackboardArtifact.Type> org.sleuthkit.datamodel.Blackboard.getArtifactTypesInUse ( long  dataSourceObjId) throws TskCoreException

Gets the list of all artifact types in use for the given data source. Gets both standard and custom types.

Parameters
dataSourceObjIddata source object id
Returns
The list of artifact types
Exceptions
TskCoreExceptionexception thrown if a critical error occurred within tsk core

Definition at line 1623 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.fromID(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

BlackboardAttribute.Type org.sleuthkit.datamodel.Blackboard.getAttributeType ( String  attrTypeName) throws TskCoreException

Get the attribute type associated with an attribute type name.

Parameters
attrTypeNameAn attribute type name.
Returns
An attribute type or null if the attribute type does not exist.
Exceptions
TskCoreExceptionIf an error occurs accessing the case database.

Definition at line 278 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromType(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

Referenced by org.sleuthkit.datamodel.SleuthkitCase.getAttributeType(), and org.sleuthkit.datamodel.SleuthkitCase.getMatchingAttributes().

ArrayList<BlackboardAttribute> org.sleuthkit.datamodel.Blackboard.getBlackboardAttributes ( final BlackboardArtifact  artifact) throws TskCoreException
DataArtifact org.sleuthkit.datamodel.Blackboard.getDataArtifactById ( long  artifactObjId) throws TskCoreException

Get the data artifact with the given artifact obj id.

Parameters
artifactObjIdObject id of the data artifact to get.
Returns
Data artifact with given artifact object id.
Exceptions
TskCoreExceptionexception thrown if a critical error occurs within TSK core.

Definition at line 1409 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.Blackboard.getDataArtifactsWhere(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

Referenced by org.sleuthkit.datamodel.SleuthkitCase.getArtifactByArtifactId(), and org.sleuthkit.datamodel.SleuthkitCase.getArtifactById().

List<DataArtifact> org.sleuthkit.datamodel.Blackboard.getDataArtifacts ( long  dataSourceObjId,
Integer  artifactTypeID 
) throws TskCoreException

Gets all data artifacts of a given type for a given data source. To get all the data artifacts for the data source, pass null for the type ID.

Parameters
dataSourceObjIdThe object ID of the data source.
artifactTypeIDThe type ID of the desired artifacts or null.
Returns
A list of the data artifacts, possibly empty.
Exceptions
TskCoreExceptionThis exception is thrown if there is an error querying the case database.

Definition at line 1329 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.Blackboard.getDataArtifactsWhere(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

List<DataArtifact> org.sleuthkit.datamodel.Blackboard.getDataArtifacts ( int  artifactTypeID,
long  dataSourceObjId 
) throws TskCoreException

Get all data artifacts of a given type for a given data source.

Parameters
artifactTypeIDArtifact type to get.
dataSourceObjIdData source to look under.
Returns
List of data artifacts. May be an empty list.
Exceptions
TskCoreExceptionexception thrown if a critical error occurs within TSK core.

Definition at line 1353 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, org.sleuthkit.datamodel.Blackboard.getArtifactType(), org.sleuthkit.datamodel.Blackboard.getDataArtifactsWhere(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

List<DataArtifact> org.sleuthkit.datamodel.Blackboard.getDataArtifacts ( int  artifactTypeID) throws TskCoreException

Get all data artifacts of a given type.

Parameters
artifactTypeIDArtifact type to get.
Returns
List of data artifacts. May be an empty list.
Exceptions
TskCoreExceptionexception thrown if a critical error occurs within TSK core.

Definition at line 1382 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, org.sleuthkit.datamodel.Blackboard.getArtifactType(), org.sleuthkit.datamodel.Blackboard.getDataArtifactsWhere(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

List<DataArtifact> org.sleuthkit.datamodel.Blackboard.getDataArtifactsWhere ( String  whereClause) throws TskCoreException

Get all data artifacts matching the given where sub-clause.

Parameters
whereClauseSQL Where sub-clause, specifies conditions to match.
Returns
List of data artifacts. May be an empty list.
Exceptions
TskCoreExceptionexception thrown if a critical error occurs within TSK core.

Definition at line 1438 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), and org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock().

Referenced by org.sleuthkit.datamodel.Blackboard.getArtifacts(), org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifact(), org.sleuthkit.datamodel.Blackboard.getDataArtifactById(), and org.sleuthkit.datamodel.Blackboard.getDataArtifacts().

List<BlackboardArtifact> org.sleuthkit.datamodel.Blackboard.getExactMatchKeywordSearchResults ( String  keyword,
TskData.KeywordSearchQueryType  searchType,
String  kwsListName,
Long  dataSourceId 
) throws TskCoreException

Returns a list of "Exact match / Literal" keyword hits blackboard artifacts according to the input conditions.

Parameters
keywordThe keyword string to search for. This should always be populated unless you are trying to get all keyword hits of specific keyword search type or keyword list name.
searchTypeType of keyword search query.
kwsListName(Optional) Name of the keyword list for which the search results are for. If not specified, then the results will be for ad-hoc keyword searches.
dataSourceId(Optional) Data source id of the target data source. If null, then the results will be for all data sources.
Returns
A list of keyword hits blackboard artifacts
Exceptions
TskCoreExceptionIf an exception is encountered while running database query to obtain the keyword hits.

Definition at line 1833 of file Blackboard.java.

References org.sleuthkit.datamodel.Blackboard.getKeywordSearchResults().

List<BlackboardArtifact> org.sleuthkit.datamodel.Blackboard.getKeywordSearchResults ( String  keyword,
String  regex,
TskData.KeywordSearchQueryType  searchType,
String  kwsListName,
Long  dataSourceId 
) throws TskCoreException

Returns a list of keyword hits blackboard artifacts according to the input conditions.

Parameters
keywordThe keyword string to search for. This should always be populated unless you are trying to get all keyword hits of specific keyword search type or keyword list name.
regexFor substring and regex keyword search types, the regex/substring query string should be specified as well as the keyword. It should be empty for literal exact match keyword search types.
searchTypeType of keyword search query.
kwsListName(Optional) Name of the keyword list for which the search results are for. If not specified, then the results will be for ad-hoc keyword searches.
dataSourceId(Optional) Data source id of the target data source. If null, then the results will be for all data sources.
Returns
A list of keyword hits blackboard artifacts
Exceptions
TskCoreExceptionIf an exception is encountered while running database query to obtain the keyword hits.

Definition at line 1862 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.acquireSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.BlackboardAttribute.Type.getTypeID(), org.sleuthkit.datamodel.BlackboardArtifact.Type.getTypeID(), org.sleuthkit.datamodel.SleuthkitCase.releaseSingleUserCaseReadLock(), org.sleuthkit.datamodel.BlackboardAttribute.Type.TSK_KEYWORD, org.sleuthkit.datamodel.BlackboardArtifact.Type.TSK_KEYWORD_HIT, org.sleuthkit.datamodel.BlackboardAttribute.Type.TSK_KEYWORD_REGEXP, org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_SEARCH_TYPE, and org.sleuthkit.datamodel.BlackboardAttribute.Type.TSK_SET_NAME.

Referenced by org.sleuthkit.datamodel.Blackboard.getExactMatchKeywordSearchResults().

BlackboardArtifact.Type org.sleuthkit.datamodel.Blackboard.getOrAddArtifactType ( String  typeName,
String  displayName 
) throws BlackboardException

Gets an artifact type, creating it if it does not already exist. Use this method to define custom artifact types.

This assumes that the artifact type is of category DATA_ARTIFACT.

Parameters
typeNameThe type name of the artifact type.
displayNameThe display name of the artifact type.
Returns
A type object representing the artifact type.
Exceptions
BlackboardExceptionIf there is a problem getting or adding the artifact type.

Definition at line 182 of file Blackboard.java.

References org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT.

BlackboardArtifact.Type org.sleuthkit.datamodel.Blackboard.getOrAddArtifactType ( String  typeName,
String  displayName,
BlackboardArtifact.Category  category 
) throws BlackboardException

Gets an artifact type, creating it if it does not already exist. Use this method to define custom artifact types.

Parameters
typeNameThe type name of the artifact type.
displayNameThe display name of the artifact type.
categoryThe artifact type category.
Returns
A type object representing the artifact type.
Exceptions
BlackboardExceptionIf there is a problem getting or adding the artifact type.

Definition at line 199 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), org.sleuthkit.datamodel.Blackboard.getArtifactType(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

synchronized BlackboardAttribute.Type org.sleuthkit.datamodel.Blackboard.getOrAddAttributeType ( String  typeName,
BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE  valueType,
String  displayName 
) throws BlackboardException

Gets an attribute type, creating it if it does not already exist. Use this method to define custom attribute types.

NOTE: This method is synchronized to prevent simultaneous access from different threads, but there is still the possibility of concurrency issues from different clients.

Parameters
typeNameThe type name of the attribute type.
valueTypeThe value type of the attribute type.
displayNameThe display name of the attribute type.
Returns
A type object representing the attribute type.
Exceptions
BlackboardExceptionIf there is a problem getting or adding the attribute type.

Definition at line 1526 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromType(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

Referenced by org.sleuthkit.datamodel.SleuthkitCase.addArtifactAttributeType().

boolean org.sleuthkit.datamodel.Blackboard.hasAnalysisResults ( long  sourceObjId) throws TskCoreException

Returns true if there are analysis results belonging to the sourceObjId.

Parameters
sourceObjIdThe source content object id.
Returns
True if there are analysis results belonging to this source obj id.
Exceptions
TskCoreException

Definition at line 1115 of file Blackboard.java.

References org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT.

boolean org.sleuthkit.datamodel.Blackboard.hasDataArtifacts ( long  sourceObjId) throws TskCoreException

Returns true if there are data artifacts belonging to the sourceObjId.

Parameters
sourceObjIdThe source content object id.
Returns
True if there are data artifacts belonging to this source obj id.
Exceptions
TskCoreException

Definition at line 1101 of file Blackboard.java.

References org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT.

AnalysisResultAdded org.sleuthkit.datamodel.Blackboard.newAnalysisResult ( BlackboardArtifact.Type  artifactType,
long  objId,
Long  dataSourceObjId,
Score  score,
String  conclusion,
String  configuration,
String  justification,
Collection< BlackboardAttribute attributesList 
) throws BlackboardException, TskCoreException

Adds new analysis result artifact.

Parameters
artifactTypeType of analysis result artifact to create.
objIdObject id of parent.
dataSourceObjIdData source object id, may be null.
scoreScore associated with this analysis result.
conclusionConclusion of the analysis, may be null or an empty string.
configurationConfiguration associated with this analysis, may be null or an empty string.
justificationJustification, may be null or an empty string.
attributesListAttributes to be attached to this analysis result artifact.
Returns
AnalysisResultAdded The analysis return added and the current aggregate score of content.
Exceptions
TskCoreException
BlackboardExceptionexception thrown if a critical error occurs within TSK core

Definition at line 814 of file Blackboard.java.

References org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.SleuthkitCase.beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

Referenced by org.sleuthkit.datamodel.Report.newAnalysisResult(), org.sleuthkit.datamodel.AbstractContent.newAnalysisResult(), org.sleuthkit.datamodel.BlackboardArtifact.newAnalysisResult(), and org.sleuthkit.datamodel.Report.newArtifact().

AnalysisResultAdded org.sleuthkit.datamodel.Blackboard.newAnalysisResult ( BlackboardArtifact.Type  artifactType,
long  objId,
Long  dataSourceObjId,
Score  score,
String  conclusion,
String  configuration,
String  justification,
Collection< BlackboardAttribute attributesList,
CaseDbTransaction  transaction 
) throws BlackboardException

Adds new analysis result artifact.

Parameters
artifactTypeType of analysis result artifact to create.
objIdObject id of parent.
dataSourceObjIdData source object id, may be null.
scoreScore associated with this analysis result.
conclusionConclusion of the analysis, may be null or an empty string.
configurationConfiguration associated with this analysis, may be null or an empty string.
justificationJustification, may be null or an empty string.
attributesListAttributes to be attached to this analysis result artifact.
transactionDB transaction to use.
Returns
AnalysisResultAdded The analysis return added and the current aggregate score of content.
Exceptions
BlackboardExceptionexception thrown if a critical error occurs within TSK core

Definition at line 863 of file Blackboard.java.

References org.sleuthkit.datamodel.BlackboardArtifact.addAttributes(), org.sleuthkit.datamodel.BlackboardArtifact.Category.ANALYSIS_RESULT, org.sleuthkit.datamodel.AnalysisResult.getScore(), and org.sleuthkit.datamodel.SleuthkitCase.getScoringManager().

DataArtifact org.sleuthkit.datamodel.Blackboard.newDataArtifact ( BlackboardArtifact.Type  artifactType,
long  sourceObjId,
Long  dataSourceObjId,
Collection< BlackboardAttribute attributes,
Long  osAccountId 
) throws TskCoreException

Add a new data artifact with the given type.

Parameters
artifactTypeThe type of the data artifact.
sourceObjIdThe content that is the source of this artifact.
dataSourceObjIdThe data source the artifact source content belongs to, may be the same as the sourceObjId. May be null.
attributesThe attributes. May be empty or null.
osAccountIdThe OS account id associated with the artifact. May be null.
Returns
DataArtifact A new data artifact.
Exceptions
TskCoreExceptionIf a critical error occurs within tsk core.

Definition at line 2165 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.beginTransaction(), org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.commit(), org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, and org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction.rollback().

Referenced by org.sleuthkit.datamodel.Report.newDataArtifact(), and org.sleuthkit.datamodel.AbstractContent.newDataArtifact().

DataArtifact org.sleuthkit.datamodel.Blackboard.newDataArtifact ( BlackboardArtifact.Type  artifactType,
long  sourceObjId,
Long  dataSourceObjId,
Collection< BlackboardAttribute attributes,
Long  osAccountObjId,
final CaseDbTransaction  transaction 
) throws TskCoreException

Add a new data artifact with the given type.

This api executes in the context of the given transaction.

Parameters
artifactTypeThe type of the data artifact.
sourceObjIdThe content that is the source of this artifact.
dataSourceObjIdThe data source the artifact source content belongs to, may be the same as the sourceObjId. May be null.
attributesThe attributes. May be empty or null.
osAccountObjIdThe OS account associated with the artifact. May be null.
transactionThe transaction in the scope of which the operation is to be performed.
Returns
DataArtifact New blackboard artifact
Exceptions
TskCoreExceptionIf a critical error occurs within tsk core.

Definition at line 2209 of file Blackboard.java.

References org.sleuthkit.datamodel.OsAccountInstance.OsAccountInstanceType.ACCESSED, org.sleuthkit.datamodel.BlackboardArtifact.addAttributes(), org.sleuthkit.datamodel.TskData.ObjectType.ARTIFACT, org.sleuthkit.datamodel.BlackboardArtifact.Category.DATA_ARTIFACT, org.sleuthkit.datamodel.SleuthkitCase.getOsAccountManager(), org.sleuthkit.datamodel.OsAccountManager.newOsAccountInstance(), and org.sleuthkit.datamodel.BlackboardArtifact.ReviewStatus.UNDECIDED.

void org.sleuthkit.datamodel.Blackboard.postArtifact ( BlackboardArtifact  artifact,
String  moduleName 
) throws BlackboardException

Posts an artifact to the blackboard. The artifact should be complete (all attributes have been added) before it is posted. Posting the artifact triggers the creation of appropriate timeline events, if any, and broadcast of a notification that the artifact is ready for further analysis.

Parameters
artifactThe artifact.
moduleNameThe display name of the module posting the artifact.
Exceptions
BlackboardExceptionThe exception is thrown if there is an issue posting the artifact.
Deprecated:
Use postArtifact(BlackboardArtifact artifact, String moduleName, Long ingestJobId) instead.

Definition at line 99 of file Blackboard.java.

References org.sleuthkit.datamodel.Blackboard.postArtifacts().

void org.sleuthkit.datamodel.Blackboard.postArtifact ( BlackboardArtifact  artifact,
String  moduleName,
Long  ingestJobId 
) throws BlackboardException

Posts an artifact to the blackboard. The artifact should be complete (all attributes have been added) before it is posted. Posting the artifact triggers the creation of appropriate timeline events, if any, and broadcast of a notification that the artifact is ready for further analysis.

Parameters
artifactThe artifact.
moduleNameThe display name of the module posting the artifact.
ingestJobIdThe numeric identifier of the ingest job for which the artifact was posted, may be null.
Exceptions
BlackboardExceptionThe exception is thrown if there is an issue posting the artifact.

Definition at line 138 of file Blackboard.java.

References org.sleuthkit.datamodel.Blackboard.postArtifacts().

void org.sleuthkit.datamodel.Blackboard.postArtifacts ( Collection< BlackboardArtifact artifacts,
String  moduleName 
) throws BlackboardException

Posts a collection of artifacts to the blackboard. The artifacts should be complete (all attributes have been added) before they are posted. Posting the artifacts triggers the creation of appropriate timeline events, if any, and broadcast of a notification that the artifacts are ready for further analysis.

Parameters
artifactsThe artifacts.
moduleNameThe display name of the module posting the artifacts.
Exceptions
BlackboardExceptionThe exception is thrown if there is an issue posting the artifact.
Deprecated:
postArtifacts(Collection<BlackboardArtifact> artifacts, String moduleName, Long ingestJobId)

Definition at line 119 of file Blackboard.java.

Referenced by org.sleuthkit.datamodel.Blackboard.postArtifact().

void org.sleuthkit.datamodel.Blackboard.postArtifacts ( Collection< BlackboardArtifact artifacts,
String  moduleName,
Long  ingestJobId 
) throws BlackboardException

Posts a collection of artifacts to the blackboard. The artifacts should be complete (all attributes have been added) before they are posted. Posting the artifacts triggers the creation of appropriate timeline events, if any, and broadcast of a notification that the artifacts are ready for further analysis.

Parameters
artifactsThe artifacts.
moduleNameThe display name of the module posting the artifacts.
ingestJobIdThe numeric identifier of the ingest job for which the artifacts were posted, may be null.
Exceptions
BlackboardExceptionThe exception is thrown if there is an issue posting the artifact.

Definition at line 157 of file Blackboard.java.

References org.sleuthkit.datamodel.SleuthkitCase.getTimelineManager().


The documentation for this class was generated from the following file:

Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.