Autopsy  3.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
ArtifactStringContent.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2013 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 import java.text.SimpleDateFormat;
22 import java.util.Arrays;
23 import java.util.TimeZone;
24 import java.util.logging.Level;
25 
26 import org.openide.util.NbBundle;
27 import org.sleuthkit.autopsy.coreutils.Logger;
28 import org.sleuthkit.datamodel.BlackboardArtifact;
29 import org.sleuthkit.datamodel.BlackboardAttribute;
30 import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
31 import org.sleuthkit.datamodel.Content;
32 import org.sleuthkit.datamodel.TskCoreException;
33 import org.sleuthkit.datamodel.TskException;
34 
41 public class ArtifactStringContent implements StringContent {
42 
43  BlackboardArtifact artifact;
44  private String stringContent = "";
45  static final Logger logger = Logger.getLogger(ArtifactStringContent.class.getName());
46  private static SimpleDateFormat dateFormatter = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
47 
48  public ArtifactStringContent(BlackboardArtifact art) {
49  artifact = art;
50  }
51 
52  @Override
53  public String getString() {
54  if (stringContent.isEmpty()) {
55  try {
56  StringBuilder buffer = new StringBuilder();
57  buffer.append("<html>\n"); //NON-NLS
58  buffer.append("<body>\n"); //NON-NLS
59 
60  // artifact name header
61  buffer.append("<h4>"); //NON-NLS
62  buffer.append(artifact.getDisplayName());
63  buffer.append("</h4>\n"); //NON-NLS
64 
65  // start table for attributes
66  buffer.append("<table border='0'>"); //NON-NLS
67  buffer.append("<tr>"); //NON-NLS
68  buffer.append("</tr>\n"); //NON-NLS
69 
70  // cycle through each attribute and display in a row in the table.
71  for (BlackboardAttribute attr : artifact.getAttributes()) {
72 
73  // name column
74  buffer.append("<tr><td>"); //NON-NLS
75  buffer.append(attr.getAttributeTypeDisplayName());
76  buffer.append("</td>"); //NON-NLS
77 
78  // value column
79  buffer.append("<td>"); //NON-NLS
80  if (attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID()
81  || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED.getTypeID()
82  || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_CREATED.getTypeID()
83  || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_MODIFIED.getTypeID()
84  || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_RCVD.getTypeID()
85  || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_SENT.getTypeID()
86  || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_START.getTypeID()
87  || attr.getAttributeTypeID() == ATTRIBUTE_TYPE.TSK_DATETIME_END.getTypeID() ) {
88  long epoch = attr.getValueLong();
89  String time = "0000-00-00 00:00:00";
90  if (epoch != 0) {
91  dateFormatter.setTimeZone(getTimeZone(artifact));
92  time = dateFormatter.format(new java.util.Date(epoch * 1000));
93  }
94  buffer.append(time);
95  } else {
96  switch (attr.getValueType()) {
97  case STRING:
98  String str = attr.getValueString();
99  str = str.replaceAll(" ", "&nbsp;"); //NON-NLS
100  str = str.replaceAll("<", "&lt;"); //NON-NLS
101  str = str.replaceAll(">", "&gt;"); //NON-NLS
102  str = str.replaceAll("(\r\n|\n)", "<br />"); //NON-NLS
103  buffer.append(str);
104  break;
105  case INTEGER:
106  buffer.append(attr.getValueInt());
107  break;
108  case LONG:
109  buffer.append(attr.getValueLong());
110  break;
111  case DOUBLE:
112  buffer.append(attr.getValueDouble());
113  break;
114  case BYTE:
115  buffer.append(Arrays.toString(attr.getValueBytes()));
116  break;
117  }
118  }
119  if (!"".equals(attr.getContext())) {
120  buffer.append(" (");
121  buffer.append(attr.getContext());
122  buffer.append(")");
123  }
124  buffer.append("</td>"); //NON-NLS
125  buffer.append("</tr>\n"); //NON-NLS
126  }
127 
128  final Content content = getAssociatedContent(artifact);
129 
130  String path = "";
131  try {
132  path = content.getUniquePath();
133  } catch (TskCoreException ex) {
134  logger.log(Level.SEVERE, "Exception while calling Content.getUniquePath() on {0} : {1}", new Object[]{content, ex.getLocalizedMessage()}); //NON-NLS
135  }
136 
137  //add file path
138 
139  buffer.append("<tr>"); //NON-NLS
140  buffer.append("<td>"); //NON-NLS
141  buffer.append(NbBundle.getMessage(this.getClass(), "ArtifactStringContent.getStr.srcFilePath.text"));
142  buffer.append("</td>"); //NON-NLS
143  buffer.append("<td>"); //NON-NLS
144  buffer.append(path);
145  buffer.append("</td>"); //NON-NLS
146  buffer.append("</tr>\n"); //NON-NLS
147 
148 
149  // add artifact ID (useful for debugging)
150  buffer.append("<tr><td>"); //NON-NLS
151  buffer.append(NbBundle.getMessage(this.getClass(), "ArtifactStringContent.getStr.artifactId.text"));
152  buffer.append("</td><td>"); //NON-NLS
153  buffer.append(artifact.getArtifactID());
154  buffer.append("</td>"); //NON-NLS
155  buffer.append("</tr>\n"); //NON-NLS
156 
157 
158  buffer.append("</table>"); //NON-NLS
159  buffer.append("</html>\n"); //NON-NLS
160 
161  stringContent = buffer.toString();
162  } catch (TskException ex) {
163  stringContent = NbBundle.getMessage(this.getClass(), "ArtifactStringContent.getStr.err");
164  }
165  }
166 
167  return stringContent;
168  }
169 
170  private static Content getAssociatedContent(BlackboardArtifact artifact){
171  try {
172  return artifact.getSleuthkitCase().getContentById(artifact.getObjectID());
173  } catch (TskException ex) {
174  logger.log(Level.WARNING, "Getting file failed", ex); //NON-NLS
175  }
176  throw new IllegalArgumentException(NbBundle.getMessage(ArtifactStringContent.class, "ArtifactStringContent.exception.msg"));
177  }
178 
179  private static TimeZone getTimeZone(BlackboardArtifact artifact) {
180  return ContentUtils.getTimeZone(getAssociatedContent(artifact));
181 
182  }
183 }
org::sleuthkit.autopsy.datamodel.ArtifactStringContent.dateFormatter
static SimpleDateFormat dateFormatter
Definition: ArtifactStringContent.java:46
org::sleuthkit.autopsy.datamodel.ContentUtils
Definition: ContentUtils.java:50
org::sleuthkit.autopsy.datamodel.StringContent
Definition: StringContent.java:12
org::sleuthkit::datamodel::BlackboardAttribute::ATTRIBUTE_TYPE::TSK_DATETIME_START
TSK_DATETIME_START
org::sleuthkit.autopsy.datamodel.ArtifactStringContent.getAssociatedContent
static Content getAssociatedContent(BlackboardArtifact artifact)
Definition: ArtifactStringContent.java:170
org::sleuthkit::datamodel::BlackboardAttribute::ATTRIBUTE_TYPE::TSK_DATETIME
TSK_DATETIME
org::sleuthkit.autopsy.datamodel.ArtifactStringContent.getString
String getString()
Definition: ArtifactStringContent.java:53
org::sleuthkit.autopsy.datamodel.ArtifactStringContent
Definition: ArtifactStringContent.java:41
org::sleuthkit::datamodel::BlackboardAttribute::ATTRIBUTE_TYPE::TSK_DATETIME_RCVD
TSK_DATETIME_RCVD
org::sleuthkit::datamodel::BlackboardAttribute::ATTRIBUTE_TYPE::TSK_DATETIME_SENT
TSK_DATETIME_SENT
org::sleuthkit.autopsy.datamodel.ArtifactStringContent.getTimeZone
static TimeZone getTimeZone(BlackboardArtifact artifact)
Definition: ArtifactStringContent.java:179
org::sleuthkit::datamodel::Content
org::sleuthkit::datamodel::BlackboardAttribute::ATTRIBUTE_TYPE::TSK_DATETIME_END
TSK_DATETIME_END
org::sleuthkit.autopsy.datamodel.ArtifactStringContent.stringContent
String stringContent
Definition: ArtifactStringContent.java:44
org::sleuthkit::datamodel::BlackboardArtifact::getAttributes
List< BlackboardAttribute > getAttributes()
org::sleuthkit::datamodel::BlackboardAttribute::ATTRIBUTE_TYPE::TSK_DATETIME_ACCESSED
TSK_DATETIME_ACCESSED
org::sleuthkit::datamodel::BlackboardAttribute::ATTRIBUTE_TYPE::TSK_DATETIME_CREATED
TSK_DATETIME_CREATED
org::sleuthkit::datamodel::BlackboardAttribute::ATTRIBUTE_TYPE
org::sleuthkit::datamodel::BlackboardAttribute::ATTRIBUTE_TYPE::TSK_DATETIME_MODIFIED
TSK_DATETIME_MODIFIED
org::sleuthkit.autopsy.datamodel.ContentUtils.getTimeZone
static TimeZone getTimeZone(Content c)
Definition: ContentUtils.java:126
org::sleuthkit.autopsy.datamodel.ArtifactStringContent.ArtifactStringContent
ArtifactStringContent(BlackboardArtifact art)
Definition: ArtifactStringContent.java:48
org::sleuthkit.autopsy.coreutils.Logger.getLogger
static Logger getLogger(String name)
Definition: Logger.java:131
org::sleuthkit::datamodel::Content::getUniquePath
String getUniquePath()

Copyright © 2012-2015 Basis Technology. Generated on: Mon Oct 19 2015
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.