AppDBParserHelper.java

Go to the documentation of this file.

/*
 * Autopsy Forensic Browser
 *
 * Copyright 2019 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.coreutils;

import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.List;
import java.util.logging.Level;
import org.apache.commons.lang3.StringUtils;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.AccountFileInstance;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
import org.sleuthkit.datamodel.Account;
import org.sleuthkit.datamodel.Blackboard;
import org.sleuthkit.datamodel.DataSource;
import org.sleuthkit.datamodel.Relationship;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskDataException;


public final class AppDBParserHelper  {
    
    private static final Logger logger = Logger.getLogger(AppDBParserHelper.class.getName());
    
    public enum MessageReadStatusEnum {

        UNKNOWN,    
        UNREAD,     
        READ        
    }
    
    public enum CommunicationDirection
    {
        UNKNOWN("Unknown"),
        INCOMING("Incoming"),
        OUTGOING("Outgoing");
        
        private final String dirStr;

        CommunicationDirection(String dir) {
            this.dirStr = dir;
        }

        public String getString() {
            return dirStr;
        }
    }
    
    public enum CallMediaType
    {
        UNKNOWN("Unknown"),
        AUDIO("Audio"),
        VIDEO("Video");
        
        private final String typeStr;

        CallMediaType(String type) {
            this.typeStr = type;
        }

        public String getString() {
            return typeStr;
        }
    }
    

    private final AbstractFile dbAbstractFile;
    private final String moduleName;
    
    // 'self' account for the application. 
    private final AccountFileInstance selfAccountInstance;
    
    // type of accounts to be created for the Application using this helper
    private final Account.Type accountsType;
    
    public AppDBParserHelper(String moduleName, AbstractFile dbFile, Account.Type accountsType) throws TskCoreException {
        
        this.moduleName = moduleName;
        this.dbAbstractFile = dbFile;
        this.accountsType = accountsType;
        this.selfAccountInstance = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(Account.Type.DEVICE, ((DataSource)dbFile.getDataSource()).getDeviceId(), moduleName, dbFile);
    }
    
    public AppDBParserHelper(String moduleName, AbstractFile dbFile, Account.Type accountsType, Account.Type selfAccountType, Account.Address selfAccountAddress) throws TskCoreException {
        
        this.moduleName = moduleName;
        this.dbAbstractFile = dbFile;
        this.accountsType = accountsType;
        
        this.selfAccountInstance = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(selfAccountType, selfAccountAddress.getUniqueID(), moduleName, dbFile);
    }
        
    public AppDBParserHelper(String moduleName, AbstractFile dbFile) {
        this.moduleName = moduleName;
        this.dbAbstractFile = dbFile;
        this.selfAccountInstance = null;
        this.accountsType = null;
    }
    
  
    public BlackboardArtifact addContact(String contactAccountUniqueID, String contactName, 
                                         String phoneNumber, String homePhoneNumber, 
                                         String mobilePhoneNumber, String emailAddr) {
        return addContact(contactAccountUniqueID, contactName,phoneNumber, 
                           homePhoneNumber,mobilePhoneNumber, emailAddr, 
                           Collections.<BlackboardAttribute>emptyList() );
    }
    
    
    public BlackboardArtifact addContact(String contactAccountUniqueID, String contactName, 
                                         String phoneNumber, String homePhoneNumber, 
                                         String mobilePhoneNumber, String emailAddr,
                                         Collection<BlackboardAttribute> additionalAttributes) {
       
        BlackboardArtifact contactArtifact = null;
        try {
            // Create TSK_CONTACT artifact
            contactArtifact = this.dbAbstractFile.newArtifact(ARTIFACT_TYPE.TSK_CONTACT);
            
            // Add basic attributes for name phonenumber email, if specified
            contactArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME, moduleName, contactName));
            
            if (!StringUtils.isEmpty(phoneNumber)) {
                  contactArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER, moduleName, phoneNumber));
            }
            if (!StringUtils.isEmpty(homePhoneNumber)) {
                  contactArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_HOME, moduleName, homePhoneNumber));
            }
            if (!StringUtils.isEmpty(mobilePhoneNumber)) {
                  contactArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_MOBILE, moduleName, mobilePhoneNumber));
            }
            if (!StringUtils.isEmpty(emailAddr)) {
                contactArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL, moduleName, emailAddr));
            }
            
            // Add additional specified attributes
            for (BlackboardAttribute additionalAttribute: additionalAttributes) {
                contactArtifact.addAttribute(additionalAttribute);
            }
            
            // Find/Create an account instance for the contact
            // Create a relationship between selfAccount and contactAccount
            AccountFileInstance contactAccountInstance = createAccountInstance(accountsType, contactAccountUniqueID);
            if (selfAccountInstance != null) {
                addRelationship (selfAccountInstance, contactAccountInstance, contactArtifact, Relationship.Type.CONTACT, 0 );
            }
            
            // post artifact 
            Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifact(contactArtifact, this.moduleName);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Unable to add contact artifact", ex); //NON-NLS
            return null;
        } 
        catch (Blackboard.BlackboardException ex) {
            logger.log(Level.SEVERE, String.format("Unable to post artifact %s", ((contactArtifact != null)? contactArtifact.getArtifactID() : "")), ex);  //NON-NLS
        }
        
        return contactArtifact;
    }
    

    private  AccountFileInstance createAccountInstance(Account.Type accountType, String accountUniqueID ) throws TskCoreException {
        return Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(accountType, accountUniqueID,  moduleName, this.dbAbstractFile);
    }
    
    
    private void addRelationship(AccountFileInstance selfAccountInstance, AccountFileInstance otherAccountInstance, 
                                    BlackboardArtifact sourceArtifact, Relationship.Type relationshipType, long dateTime) {
        try {
            if (selfAccountInstance.getAccount() != otherAccountInstance.getAccount()) {
                Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().addRelationships(selfAccountInstance,
                    Collections.singletonList(otherAccountInstance), sourceArtifact, relationshipType, dateTime);
            }
        } catch (TskCoreException | TskDataException ex) {
            logger.log(Level.SEVERE, String.format("Unable to add relationship between account %s and account %s", selfAccountInstance.toString(), otherAccountInstance.toString()), ex); //NON-NLS
        }
    }
    
    
    public BlackboardArtifact addMessage( 
                                String messageType, 
                                CommunicationDirection direction, 
                                Account.Address fromAddress, 
                                Account.Address toAddress, 
                                long dateTime, MessageReadStatusEnum readStatus, 
                                String subject, String messageText, String threadId) {
        return addMessage(messageType,  direction,  
                          fromAddress,  toAddress, dateTime,  readStatus,  
                          subject, messageText,  threadId, 
                          Collections.<BlackboardAttribute>emptyList());
    }
    
    public BlackboardArtifact addMessage( String messageType, 
                                CommunicationDirection direction, 
                                Account.Address fromAddress, 
                                Account.Address toAddress, 
                                long dateTime, MessageReadStatusEnum readStatus, String subject, 
                                String messageText, String threadId,
                                Collection<BlackboardAttribute> otherAttributesList) {
        
        return addMessage(messageType, direction,
                fromAddress,
                Arrays.asList(toAddress),
                dateTime, readStatus,
                subject, messageText, threadId,
                otherAttributesList);
    }
    
    public BlackboardArtifact addMessage( String messageType, 
                CommunicationDirection direction, 
                Account.Address fromAddress, 
                List<Account.Address> recipientsList, 
                long dateTime, MessageReadStatusEnum readStatus, 
                String subject, String messageText, String threadId) {
        return addMessage( messageType,  direction,  
                          fromAddress,  recipientsList, 
                          dateTime,  readStatus,  
                          subject, messageText,  threadId, 
                          Collections.<BlackboardAttribute>emptyList());
    }
    
    
    public BlackboardArtifact addMessage( String messageType, 
                CommunicationDirection direction, 
                Account.Address fromAddress, 
                List<Account.Address> recipientsList, 
                long dateTime, MessageReadStatusEnum readStatus, 
                String subject, String messageText, 
                String threadId, 
                Collection<BlackboardAttribute> otherAttributesList) {
       
        // Created message artifact.  
        BlackboardArtifact msgArtifact = null;
        try {
            // Create TSK_MESSAGE artifact
            msgArtifact = dbAbstractFile.newArtifact(ARTIFACT_TYPE.TSK_MESSAGE);
            if (dateTime > 0) {
                msgArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME, moduleName, dateTime));
            }
            if (readStatus != MessageReadStatusEnum.UNKNOWN) {
                msgArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_READ_STATUS, moduleName, (readStatus == MessageReadStatusEnum.READ) ? 1 : 0));
            }

            // Add basic attribute, if the correspond value is specified
            if (!StringUtils.isEmpty(messageType)) {
                msgArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE, moduleName, messageType));
            }
            if (direction != CommunicationDirection.UNKNOWN) {
                msgArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DIRECTION, moduleName, direction.getString()));
            }
            if (fromAddress != null && !StringUtils.isEmpty(fromAddress.getDisplayName())) {
                msgArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM, moduleName, fromAddress.getDisplayName()));
            }
            // Create a comma separated string of recipients
            String toAddresses =  addressListToString(recipientsList);
            if (toAddresses != null && !StringUtils.isEmpty(toAddresses)) {
                msgArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO, moduleName, toAddresses));
            }

            if (!StringUtils.isEmpty(subject)) {
                msgArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_SUBJECT, moduleName, subject));
            }
            if (!StringUtils.isEmpty(messageText)) {
                msgArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_TEXT, moduleName, messageText));
            }
            if (!StringUtils.isEmpty(threadId)) {
                msgArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_THREAD_ID, moduleName, threadId));
            }

            // Add other specified attributes
            for (BlackboardAttribute otherAttribute: otherAttributesList) {
                msgArtifact.addAttribute(otherAttribute);
            }

            // Find/create an account instance for sender
            if (fromAddress != null) {
                AccountFileInstance senderAccountInstance = createAccountInstance(accountsType, fromAddress.getUniqueID());

               // Create a relationship between selfAccount and sender account
               if (selfAccountInstance != null) {
                   addRelationship (selfAccountInstance, senderAccountInstance, msgArtifact, Relationship.Type.MESSAGE, dateTime );
               }
            }

            // Find/create an account instance for each recipient  
            if (recipientsList != null) {
                for(Account.Address recipient : recipientsList) {

                   AccountFileInstance recipientAccountInstance = createAccountInstance(accountsType, recipient.getUniqueID());

                   // Create a relationship between selfAccount and recipient account
                   if (selfAccountInstance != null) {
                       addRelationship (selfAccountInstance, recipientAccountInstance, msgArtifact, Relationship.Type.MESSAGE, dateTime );
                   }
                }
            }

            // post artifact 
            Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifact(msgArtifact, this.moduleName);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Unable to add message artifact", ex); //NON-NLS
            return null;
        } 
        catch (Blackboard.BlackboardException ex) {
            logger.log(Level.SEVERE, String.format("Unable to post artifact %s", ((msgArtifact != null)? msgArtifact.getArtifactID() : "")), ex);  //NON-NLS
        }
        
        // return the artifact
        return msgArtifact; 
    }
     
    public BlackboardArtifact addCalllog(CommunicationDirection direction, 
                                    Account.Address fromAddress, Account.Address toAddress, 
                                    long startDateTime, long endDateTime) {
        return addCalllog(direction, fromAddress, toAddress, 
                            startDateTime, endDateTime, 
                            CallMediaType.UNKNOWN);
    }
    
    public BlackboardArtifact addCalllog(CommunicationDirection direction, 
                                    Account.Address fromAddress, Account.Address toAddress, 
                                    long startDateTime, long endDateTime, CallMediaType mediaType) {
        return addCalllog(direction, fromAddress, toAddress, 
                            startDateTime, endDateTime, mediaType,
                            Collections.<BlackboardAttribute>emptyList());
    }
    
    public BlackboardArtifact addCalllog(CommunicationDirection direction, 
                                    Account.Address fromAddress, 
                                    Account.Address toAddress, 
                                    long startDateTime, long endDateTime, 
                                    CallMediaType mediaType, 
                                    Collection<BlackboardAttribute> otherAttributesList) {
        return addCalllog(direction, 
                            fromAddress, 
                            Arrays.asList(toAddress), 
                            startDateTime, endDateTime, 
                            mediaType,
                            otherAttributesList);
    }
    
    public BlackboardArtifact addCalllog(CommunicationDirection direction, 
                                Account.Address fromAddress, 
                                Collection<Account.Address> toAddressList, 
                                long startDateTime, long endDateTime) {
    
         return addCalllog(direction, fromAddress, toAddressList, 
                            startDateTime, endDateTime, 
                            CallMediaType.UNKNOWN);
    }
    
    public BlackboardArtifact addCalllog(CommunicationDirection direction, 
                                Account.Address fromAddress, 
                                Collection<Account.Address> toAddressList, 
                                long startDateTime, long endDateTime,
                                CallMediaType mediaType) {
    
         return addCalllog(direction, fromAddress, toAddressList, 
                            startDateTime, endDateTime, 
                            mediaType,
                            Collections.<BlackboardAttribute>emptyList());
    }
    
    public BlackboardArtifact addCalllog(CommunicationDirection direction, 
                                Account.Address fromAddress, 
                                Collection<Account.Address> toAddressList, 
                                long startDateTime, long endDateTime,
                                CallMediaType mediaType,
                                Collection<BlackboardAttribute> otherAttributesList) {
        BlackboardArtifact callLogArtifact = null;
        try {
            // Create TSK_CALLLOG artifact
            callLogArtifact = dbAbstractFile.newArtifact(ARTIFACT_TYPE.TSK_CALLLOG);
            
            // Add basic attributes 
            if (startDateTime > 0) {
                callLogArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_START, moduleName, startDateTime));
            }
            if (endDateTime > 0) {
                callLogArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_END, moduleName, endDateTime));
            }
            
            if (direction != CommunicationDirection.UNKNOWN) {
                callLogArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DIRECTION, moduleName, direction.getString()));
            }
            if (fromAddress != null) {
                callLogArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM, moduleName, fromAddress.getUniqueID()));
                if (!StringUtils.isEmpty(fromAddress.getDisplayName())) {
                    callLogArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME, moduleName, fromAddress.getDisplayName()));
                }
            }
            
            // Create a comma separated string of recipients
            String toAddresses =  addressListToString(toAddressList);
            if (!StringUtils.isEmpty(toAddresses)) {
                callLogArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO, moduleName, toAddresses));
            }
            
            // Add other specified attributes
            for (BlackboardAttribute otherAttribute: otherAttributesList) {
                callLogArtifact.addAttribute(otherAttribute);
            }
            
            // Create a relationship between selfAccount and caller
            if (fromAddress != null) {
                AccountFileInstance callerAccountInstance = createAccountInstance(accountsType, fromAddress.getUniqueID());
                if (selfAccountInstance != null) {
                   addRelationship (selfAccountInstance, callerAccountInstance, callLogArtifact, Relationship.Type.CALL_LOG, (startDateTime > 0) ? startDateTime : 0 );
               }
            }
            
             // Create a relationship between selfAccount and each callee
            if (toAddressList != null) {
                for(Account.Address callee : toAddressList) {
                   AccountFileInstance calleeAccountInstance = createAccountInstance(accountsType, callee.getUniqueID());
                   if (selfAccountInstance != null) {
                       addRelationship (selfAccountInstance, calleeAccountInstance, callLogArtifact, Relationship.Type.CALL_LOG, (startDateTime > 0) ? startDateTime : 0 );
                   }
                }
            }
           
            // post artifact 
            Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifact(callLogArtifact, this.moduleName);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Unable to add calllog artifact", ex); //NON-NLS
            return null;
        } 
        catch (Blackboard.BlackboardException ex) {
            logger.log(Level.SEVERE, String.format("Unable to post artifact %s", ((callLogArtifact != null)? callLogArtifact.getArtifactID() : "")), ex);  //NON-NLS
        }
        
        // return the artifact
        return callLogArtifact;      
    }
    
   
    public BlackboardArtifact addWebBookmark(String url, String title, long creationTime, String progName) {
          return addWebBookmark(url, title,  creationTime, progName,
                            Collections.<BlackboardAttribute>emptyList());
    }
    
    public BlackboardArtifact addWebBookmark(String url, String title, long creationTime, String progName,
             Collection<BlackboardAttribute> otherAttributesList) {
        
        BlackboardArtifact bookMarkArtifact = null;
        try {
            // Create artifact
            bookMarkArtifact = dbAbstractFile.newArtifact(ARTIFACT_TYPE.TSK_WEB_BOOKMARK);
            
            // Add basic attributes 
            bookMarkArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL, moduleName, url));
            if (creationTime > 0) {
                bookMarkArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, moduleName, creationTime));
            }
            
            if (!StringUtils.isEmpty(title)) {
                bookMarkArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_TITLE, moduleName, title));
            }
            if (!StringUtils.isEmpty(url)) {
                bookMarkArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DOMAIN, moduleName, NetworkUtils.extractDomain(url)));
            }
            if (!StringUtils.isEmpty(progName)) {
                bookMarkArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME, moduleName, progName));
            }
            
            // Add other specified attributes
            for (BlackboardAttribute otherAttribute: otherAttributesList) {
                bookMarkArtifact.addAttribute(otherAttribute);
            }
            
            // post artifact 
            Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifact(bookMarkArtifact, this.moduleName);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Unable to add bookmark artifact", ex); //NON-NLS
            return null;
        } 
        catch (Blackboard.BlackboardException ex) {
            logger.log(Level.SEVERE, String.format("Unable to post artifact %s", ((bookMarkArtifact != null)? bookMarkArtifact.getArtifactID() : "")), ex);  //NON-NLS
        }
        
        // return the artifact
        return bookMarkArtifact;  
    }
    
    
     public BlackboardArtifact addWebCookie(String url, long creationTime, 
             String name, String value, String programName) {
        
        return addWebCookie(url, creationTime, name, value, programName,
                 Collections.<BlackboardAttribute>emptyList());
    }
     
    public BlackboardArtifact addWebCookie(String url,
            long creationTime, String name, String value, String programName,
            Collection<BlackboardAttribute> otherAttributesList) {
        
        
        BlackboardArtifact cookieArtifact = null;
        try {
            // Create artifact
            cookieArtifact = dbAbstractFile.newArtifact(ARTIFACT_TYPE.TSK_WEB_COOKIE);
            
            // Add basic attributes 
            cookieArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL, moduleName, url));
            if (creationTime > 0) {
                cookieArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME, moduleName, creationTime));
            }
            
            if (!StringUtils.isEmpty(name)) {
                cookieArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME, moduleName, name));
            }
            if (!StringUtils.isEmpty(value)) {
                cookieArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_VALUE, moduleName, value));
            }
            if (!StringUtils.isEmpty(url)) {
                cookieArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DOMAIN, moduleName, NetworkUtils.extractDomain(url)));
            }
            if (!StringUtils.isEmpty(programName)) {
                cookieArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME, moduleName, programName));
            }
            
            // Add other specified attributes
            for (BlackboardAttribute otherAttribute: otherAttributesList) {
                cookieArtifact.addAttribute(otherAttribute);
            }
            
            // post artifact 
            Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifact(cookieArtifact, this.moduleName);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Unable to add bookmark artifact", ex); //NON-NLS
            return null;
        } 
        catch (Blackboard.BlackboardException ex) {
            logger.log(Level.SEVERE, String.format("Unable to post artifact %s", ((cookieArtifact != null)? cookieArtifact.getArtifactID() : "")), ex);  //NON-NLS
        }
        
        // return the artifact
        return cookieArtifact;  
    }
    
    public BlackboardArtifact addWebHistory(String url, long accessTime, 
            String referrer, String title, String programName) {
        return addWebHistory(url, accessTime, referrer, title, programName,
                Collections.<BlackboardAttribute>emptyList());
    }
    
    public BlackboardArtifact addWebHistory(String url, long accessTime, 
            String referrer, String title, String programName, 
            Collection<BlackboardAttribute> otherAttributesList) {
        
        BlackboardArtifact webHistoryArtifact = null;
        try {
            // Create artifact
            webHistoryArtifact = dbAbstractFile.newArtifact(ARTIFACT_TYPE.TSK_WEB_HISTORY);
            
            // Add basic attributes 
            webHistoryArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL, moduleName, url));
            if (accessTime > 0) {
                webHistoryArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED, moduleName, accessTime));
            }
            
            if (!StringUtils.isEmpty(title)) {
                webHistoryArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_TITLE, moduleName, title));
            }
            if (!StringUtils.isEmpty(referrer)) {
                webHistoryArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_REFERRER, moduleName, referrer));
            }
   
            if (!StringUtils.isEmpty(programName)) {
                webHistoryArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME, moduleName, programName));
            }
             if (!StringUtils.isEmpty(url)) {
                webHistoryArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DOMAIN, moduleName, NetworkUtils.extractDomain(url)));
            }
            
            // Add other specified attributes
            for (BlackboardAttribute otherAttribute: otherAttributesList) {
                webHistoryArtifact.addAttribute(otherAttribute);
            }
            
            // post artifact 
            Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifact(webHistoryArtifact, this.moduleName);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Unable to add bookmark artifact", ex); //NON-NLS
            return null;
        } 
        catch (Blackboard.BlackboardException ex) {
            logger.log(Level.SEVERE, String.format("Unable to post artifact %s", ((webHistoryArtifact != null)? webHistoryArtifact.getArtifactID() : "")), ex);  //NON-NLS
        }
        
        // return the artifact
        return webHistoryArtifact;  
    }
    
    public BlackboardArtifact addWebDownload(String path, long startTime, String url, String progName) {
        return addWebDownload(path, startTime, url, progName, Collections.<BlackboardAttribute>emptyList() );
    }
    
     public BlackboardArtifact addWebDownload(String path, long startTime, String url, String programName, 
             Collection<BlackboardAttribute> otherAttributesList ) {
         
        BlackboardArtifact webDownloadArtifact = null;
        try {
            // Create artifact
            webDownloadArtifact = dbAbstractFile.newArtifact(ARTIFACT_TYPE.TSK_WEB_DOWNLOAD);
            
            // Add basic attributes 
            webDownloadArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_URL, moduleName, url));
            if (startTime > 0) {
                webDownloadArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED, moduleName, startTime));
            }
            webDownloadArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH, moduleName, path));
            
//            long pathID = Util.findID(dataSource, downloadedFilePath);
//            if (pathID != -1) {
//                bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PATH_ID, moduleName, pathID));
//            }
                        
            if (!StringUtils.isEmpty(programName)) {
                webDownloadArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME, moduleName, programName));
            }
            if (!StringUtils.isEmpty(url)) {
                webDownloadArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DOMAIN, moduleName, NetworkUtils.extractDomain(url)));
            }
            
            // Add other specified attributes
            for (BlackboardAttribute otherAttribute: otherAttributesList) {
                webDownloadArtifact.addAttribute(otherAttribute);
            }
            
            // post artifact 
            Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifact(webDownloadArtifact, this.moduleName);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Unable to add web download artifact", ex); //NON-NLS
            return null;
        } 
        catch (Blackboard.BlackboardException ex) {
            logger.log(Level.SEVERE, String.format("Unable to post artifact %s", ((webDownloadArtifact != null)? webDownloadArtifact.getArtifactID() : "")), ex);  //NON-NLS
        }
        
        // return the artifact
        return webDownloadArtifact;  
    }
    
     
    public BlackboardArtifact addWebFormAutofill(String name, String value, 
            long creationTime, long accessTime, int count) {
        return addWebFormAutofill(name, value, creationTime, accessTime, count, 
                    Collections.<BlackboardAttribute>emptyList() );
    }
    
    public BlackboardArtifact addWebFormAutofill(String name, String value, 
            long creationTime, long accessTime, int count,  
            Collection<BlackboardAttribute> otherAttributesList ) {
        BlackboardArtifact webFormAutofillArtifact = null;
        try {
            // Create artifact
            webFormAutofillArtifact = dbAbstractFile.newArtifact(ARTIFACT_TYPE.TSK_WEB_FORM_AUTOFILL);
            
            // Add basic attributes 
            webFormAutofillArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME, moduleName, name));
            webFormAutofillArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_VALUE, moduleName, value));
            if (creationTime > 0) {
                webFormAutofillArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, moduleName, creationTime));
            }
            if (accessTime > 0) {
                webFormAutofillArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED, moduleName, accessTime));
            }
            if (count > 0) {
                webFormAutofillArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COUNT, moduleName, count));
            }
                            
            // Add other specified attributes
            for (BlackboardAttribute otherAttribute: otherAttributesList) {
                webFormAutofillArtifact.addAttribute(otherAttribute);
            }
            
            // post artifact 
            Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifact(webFormAutofillArtifact, this.moduleName);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Unable to add web form autofill artifact", ex); //NON-NLS
            return null;
        } 
        catch (Blackboard.BlackboardException ex) {
            logger.log(Level.SEVERE, String.format("Unable to post artifact %s", ((webFormAutofillArtifact != null)? webFormAutofillArtifact.getArtifactID() : "")), ex);  //NON-NLS
        }
        
        // return the artifact
        return webFormAutofillArtifact;  
    }
     
    
    public BlackboardArtifact addWebFormAddress(String personName, String email, 
                                String phoneNumber, String mailingAddress, 
                                long creationTime, long accessTime, int count ) {
       return addWebFormAddress(personName, email, phoneNumber, 
                    mailingAddress, creationTime, accessTime, count, 
                    Collections.<BlackboardAttribute>emptyList() );
    }
    
    public BlackboardArtifact addWebFormAddress(String personName, String email, 
            String phoneNumber, String mailingAddress, 
            long creationTime, long accessTime, int count,
            Collection<BlackboardAttribute> otherAttributesList ) {
        
        BlackboardArtifact webFormAddressArtifact = null;
        try {
            // Create artifact
            webFormAddressArtifact = dbAbstractFile.newArtifact(ARTIFACT_TYPE.TSK_WEB_FORM_AUTOFILL);
            
            // Add basic attributes 
            webFormAddressArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME, moduleName, personName));
            if (creationTime > 0) {
                webFormAddressArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, moduleName, creationTime));
            }
            if (accessTime > 0) {
                webFormAddressArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED, moduleName, accessTime));
            }
            if (count > 0) {
                webFormAddressArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COUNT, moduleName, count));
            }
            
            if (!StringUtils.isEmpty(email)) {
                webFormAddressArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_EMAIL, moduleName, email));
            }
            if (!StringUtils.isEmpty(phoneNumber)) {
                webFormAddressArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER, moduleName, phoneNumber));
            }
            if (!StringUtils.isEmpty(mailingAddress)) {
                webFormAddressArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_LOCATION, moduleName, mailingAddress));
            }
                            
            // Add other specified attributes
            for (BlackboardAttribute otherAttribute: otherAttributesList) {
                webFormAddressArtifact.addAttribute(otherAttribute);
            }
            
            // post artifact 
            Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifact(webFormAddressArtifact, this.moduleName);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Unable to add web form address artifact", ex); //NON-NLS
            return null;
        } 
        catch (Blackboard.BlackboardException ex) {
            logger.log(Level.SEVERE, String.format("Unable to post artifact %s", ((webFormAddressArtifact != null)? webFormAddressArtifact.getArtifactID() : "")), ex);  //NON-NLS
        }
        
        // return the artifact
        return webFormAddressArtifact;
    }
    
    public BlackboardArtifact addInstalledProgram(String programName, long dateInstalled) {
        return addInstalledProgram(programName, dateInstalled,
                Collections.<BlackboardAttribute>emptyList() );
    }
    
    public BlackboardArtifact addInstalledProgram(String programName, long dateInstalled, 
            Collection<BlackboardAttribute> otherAttributesList ) {
        
        BlackboardArtifact installedProgramArtifact = null;
        try {
            // Create artifact
            installedProgramArtifact = dbAbstractFile.newArtifact(ARTIFACT_TYPE.TSK_INSTALLED_PROG);
            
            // Add basic attributes 
            installedProgramArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME, moduleName, programName));
            if (dateInstalled > 0) {
                installedProgramArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME, moduleName, dateInstalled));
            }
                            
            // Add other specified attributes
            for (BlackboardAttribute otherAttribute: otherAttributesList) {
                installedProgramArtifact.addAttribute(otherAttribute);
            }
            
            // post artifact 
            Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifact(installedProgramArtifact, this.moduleName);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Unable to add installed program artifact", ex); //NON-NLS
            return null;
        } 
        catch (Blackboard.BlackboardException ex) {
            logger.log(Level.SEVERE, String.format("Unable to post artifact %s", ((installedProgramArtifact != null)? installedProgramArtifact.getArtifactID() : "")), ex);  //NON-NLS
        }
        
        // return the artifact
        return installedProgramArtifact;
    }
    
    
    public BlackboardArtifact addGPSLocation(double latitude, double longitude, 
            long timeStamp, String poiName, String programName) {
        
        return addGPSLocation(latitude, longitude, timeStamp, poiName, programName,
                Collections.<BlackboardAttribute>emptyList());
    }
    
    public BlackboardArtifact addGPSLocation(double latitude, double longitude, long timeStamp, String name, String programName, 
            Collection<BlackboardAttribute> otherAttributesList) {
       
        BlackboardArtifact gpsTrackpointArtifact = null;
        try {
            // Create artifact
            gpsTrackpointArtifact = dbAbstractFile.newArtifact(ARTIFACT_TYPE.TSK_GPS_TRACKPOINT);
            
            // Add basic attributes 
            gpsTrackpointArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE, moduleName, latitude));
            gpsTrackpointArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE, moduleName, longitude));
            if (timeStamp > 0) {
                gpsTrackpointArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME, moduleName, timeStamp));
            }
            
            if (!StringUtils.isEmpty(name)) {
                gpsTrackpointArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_NAME, moduleName, name));
            }
            
            if (!StringUtils.isEmpty(programName)) {
                gpsTrackpointArtifact.addAttribute(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME, moduleName, programName));
            }
                            
            // Add other specified attributes
            for (BlackboardAttribute otherAttribute: otherAttributesList) {
                gpsTrackpointArtifact.addAttribute(otherAttribute);
            }
            
            // post artifact 
            Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifact(gpsTrackpointArtifact, this.moduleName);
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, "Unable to add GPS trackpoint artifact", ex); //NON-NLS
            return null;
        } 
        catch (Blackboard.BlackboardException ex) {
            logger.log(Level.SEVERE, String.format("Unable to post artifact %s", ((gpsTrackpointArtifact != null)? gpsTrackpointArtifact.getArtifactID() : "")), ex);  //NON-NLS
        }
        
        // return the artifact
        return gpsTrackpointArtifact;              
    }
    
    private String addressListToString(Collection<Account.Address> addressList) {
        
        String toAddresses =  "";
        if (addressList != null && (!addressList.isEmpty())) {
            StringBuilder toAddressesSb = new StringBuilder();
            for(Account.Address address : addressList) {
                String displayAddress = !StringUtils.isEmpty(address.getDisplayName()) ? address.getDisplayName() : address.getUniqueID();
                toAddressesSb = toAddressesSb.length() > 0 ? toAddressesSb.append(",").append(displayAddress) : toAddressesSb.append(displayAddress);
            }
            toAddresses =  toAddressesSb.toString();
        }
        
        return toAddresses;
    }
}