19 package org.sleuthkit.autopsy.report;
21 import com.google.common.collect.ListMultimap;
22 import com.google.common.collect.Lists;
23 import com.google.common.collect.Multimaps;
24 import java.sql.ResultSet;
25 import java.sql.SQLException;
26 import java.util.ArrayList;
27 import java.util.Arrays;
28 import java.util.Collection;
29 import java.util.Collections;
30 import java.util.Comparator;
31 import java.util.HashMap;
32 import java.util.HashSet;
33 import java.util.Iterator;
34 import java.util.List;
36 import java.util.Objects;
38 import java.util.TreeSet;
39 import java.util.logging.Level;
40 import org.openide.util.NbBundle;
41 import org.openide.util.NbBundle.Messages;
62 class TableReportGenerator {
64 private final List<BlackboardArtifact.Type> artifactTypes =
new ArrayList<>();
65 private final HashSet<String> tagNamesFilter =
new HashSet<>();
67 private final Set<Content> images =
new HashSet<>();
68 private final ReportProgressPanel progressPanel;
69 private final TableReportModule tableReport;
70 private final Map<Integer, List<Column>> columnHeaderMap;
71 private static final Logger logger = Logger.getLogger(TableReportGenerator.class.getName());
73 private final List<String> errorList;
75 TableReportGenerator(Map<BlackboardArtifact.Type, Boolean> artifactTypeSelections, Map<String, Boolean> tagNameSelections, ReportProgressPanel progressPanel, TableReportModule tableReport) {
77 this.progressPanel = progressPanel;
78 this.tableReport = tableReport;
79 this.columnHeaderMap =
new HashMap<>();
80 errorList =
new ArrayList<>();
82 for (Map.Entry<BlackboardArtifact.Type, Boolean> entry : artifactTypeSelections.entrySet()) {
83 if (entry.getValue()) {
84 artifactTypes.add(entry.getKey());
89 if (null != tagNameSelections) {
90 for (Map.Entry<String, Boolean> entry : tagNameSelections.entrySet()) {
91 if (entry.getValue() ==
true) {
92 tagNamesFilter.add(entry.getKey());
98 protected void execute() {
101 progressPanel.start();
102 progressPanel.setIndeterminate(
false);
103 progressPanel.setMaximumProgress(this.artifactTypes.size() + 2);
105 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
106 makeBlackboardArtifactTables();
110 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
111 makeContentTagsTables();
114 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
115 makeBlackboardArtifactTagsTables();
118 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
120 makeThumbnailTable();
127 private void makeBlackboardArtifactTables() {
130 if (!tagNamesFilter.isEmpty()) {
131 comment += NbBundle.getMessage(this.getClass(),
"ReportGenerator.artifactTable.taggedResults.text");
132 comment += makeCommaSeparatedList(tagNamesFilter);
136 for (BlackboardArtifact.Type type : artifactTypes) {
139 if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
143 progressPanel.updateStatusLabel(
144 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
145 type.getDisplayName()));
148 if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
149 writeKeywordHits(tableReport, comment, tagNamesFilter);
151 }
else if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
152 writeHashsetHits(tableReport, comment, tagNamesFilter);
156 List<ArtifactData> artifactList = getFilteredArtifacts(type, tagNamesFilter);
158 if (artifactList.isEmpty()) {
167 if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
169 ListMultimap<String, ArtifactData> groupedArtifacts = Multimaps.index(artifactList,
172 return artifactData.getArtifact().getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE)).getValueString();
173 }
catch (TskCoreException ex) {
174 logger.log(Level.SEVERE,
"Unable to get value of TSK_ACCOUNT_TYPE attribute. Defaulting to \"unknown\"", ex);
178 for (String accountTypeStr : groupedArtifacts.keySet()) {
185 String accountDisplayname = accountTypeStr;
186 if (accountTypeStr != null) {
188 Account.Type acctType = Case.getCurrentCaseThrows().getSleuthkitCase().getCommunicationsManager().getAccountType(accountTypeStr);
189 if (acctType != null) {
190 accountDisplayname = acctType.getDisplayName();
192 }
catch (TskCoreException | NoCurrentCaseException ex) {
193 logger.log(Level.SEVERE,
"Unable to get display name for account type " + accountTypeStr, ex);
197 final String compundDataTypeName = BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getDisplayName() +
": " + accountDisplayname;
198 writeTableForDataType(
new ArrayList<>(groupedArtifacts.get(accountTypeStr)), type, compundDataTypeName, comment);
202 writeTableForDataType(artifactList, type, type.getDisplayName(), comment);
217 private void writeTableForDataType(List<ArtifactData> artifactList, BlackboardArtifact.Type type, String tableName, String comment) {
222 Set<BlackboardAttribute.Type> attrTypeSet =
new TreeSet<>(Comparator.comparing(BlackboardAttribute.Type::getDisplayName));
223 for (ArtifactData data : artifactList) {
224 List<BlackboardAttribute> attributes = data.getAttributes();
225 for (BlackboardAttribute attribute : attributes) {
226 attrTypeSet.add(attribute.getAttributeType());
234 List<Column> columns = getArtifactTableColumns(type.getTypeID(), attrTypeSet);
235 if (columns.isEmpty()) {
238 columnHeaderMap.put(type.getTypeID(), columns);
244 Collections.sort(artifactList);
246 tableReport.startDataType(tableName, comment);
249 for (ArtifactData artifactData : artifactList) {
252 List<String> rowData = artifactData.getRow();
253 if (rowData.isEmpty()) {
257 tableReport.addRow(rowData);
260 progressPanel.increment();
261 tableReport.endTable();
262 tableReport.endDataType();
268 @Messages({
"ReportGenerator.tagTable.header.userName=User Name"})
269 @SuppressWarnings(
"deprecation")
270 private
void makeContentTagsTables() {
273 List<ContentTag> tags;
275 tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getAllContentTags();
276 }
catch (TskCoreException | NoCurrentCaseException ex) {
277 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetContentTags"));
278 logger.log(Level.SEVERE,
"failed to get content tags", ex);
285 progressPanel.updateStatusLabel(
286 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
287 BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName()));
288 ArrayList<String> columnHeaders =
new ArrayList<>(Arrays.asList(
289 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.tag"),
290 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.file"),
291 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.comment"),
292 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.userName"),
293 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeModified"),
294 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeChanged"),
295 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeAccessed"),
296 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeCreated"),
297 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.size"),
298 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.hash")));
300 StringBuilder comment =
new StringBuilder();
301 if (!tagNamesFilter.isEmpty()) {
303 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.makeContTagTab.taggedFiles.msg"));
304 comment.append(makeCommaSeparatedList(tagNamesFilter));
306 if (tableReport instanceof ReportHTML) {
307 ReportHTML htmlReportModule = (ReportHTML) tableReport;
308 htmlReportModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
309 htmlReportModule.startContentTagsTable(columnHeaders);
311 tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
312 tableReport.startTable(columnHeaders);
316 for (ContentTag tag : tags) {
318 String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() :
"";
319 if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) ==
false) {
325 fileName = tag.getContent().getUniquePath();
326 }
catch (TskCoreException ex) {
327 fileName = tag.getContent().getName();
330 ArrayList<String> rowData =
new ArrayList<>(Arrays.asList(tag.getName().getDisplayName() + notableString, fileName, tag.getComment(), tag.getUserName()));
331 Content content = tag.getContent();
332 if (content instanceof AbstractFile) {
333 AbstractFile file = (AbstractFile) content;
336 rowData.add(file.getMtimeAsDate());
337 rowData.add(file.getCtimeAsDate());
338 rowData.add(file.getAtimeAsDate());
339 rowData.add(file.getCrtimeAsDate());
340 rowData.add(Long.toString(file.getSize()));
341 rowData.add(file.getMd5Hash());
344 if (tableReport instanceof ReportHTML) {
345 ReportHTML htmlReportModule = (ReportHTML) tableReport;
346 htmlReportModule.addRowWithTaggedContentHyperlink(rowData, tag);
348 tableReport.addRow(rowData);
352 checkIfTagHasImage(tag);
356 progressPanel.increment();
357 tableReport.endTable();
358 tableReport.endDataType();
364 @SuppressWarnings(
"deprecation")
365 private
void makeBlackboardArtifactTagsTables() {
367 List<BlackboardArtifactTag> tags;
369 tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getAllBlackboardArtifactTags();
370 }
catch (TskCoreException | NoCurrentCaseException ex) {
371 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBArtifactTags"));
372 logger.log(Level.SEVERE,
"failed to get blackboard artifact tags", ex);
378 progressPanel.updateStatusLabel(
379 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
380 BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName()));
381 StringBuilder comment =
new StringBuilder();
382 if (!tagNamesFilter.isEmpty()) {
384 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.makeBbArtTagTab.taggedRes.msg"));
385 comment.append(makeCommaSeparatedList(tagNamesFilter));
387 tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName(), comment.toString());
388 tableReport.startTable(
new ArrayList<>(Arrays.asList(
389 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.resultType"),
390 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.tag"),
391 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.comment"),
392 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.srcFile"),
393 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.userName"))));
396 for (BlackboardArtifactTag tag : tags) {
397 String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() :
"";
398 if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) ==
false) {
403 row =
new ArrayList<>(Arrays.asList(tag.getArtifact().getArtifactTypeName(), tag.getName().getDisplayName() + notableString,
404 tag.getComment(), tag.getContent().getName(), tag.getUserName()));
405 tableReport.addRow(row);
408 checkIfTagHasImage(tag);
412 progressPanel.increment();
413 tableReport.endTable();
414 tableReport.endDataType();
424 private boolean passesTagNamesFilter(String tagName) {
425 return tagNamesFilter.isEmpty() || tagNamesFilter.contains(tagName);
431 private void makeThumbnailTable() {
432 progressPanel.updateStatusLabel(
433 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.createdThumb.text"));
435 if (tableReport instanceof ReportHTML) {
436 ReportHTML htmlModule = (ReportHTML) tableReport;
437 htmlModule.startDataType(
438 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.thumbnailTable.name"),
439 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.thumbnailTable.desc"));
440 List<String> emptyHeaders =
new ArrayList<>();
441 for (
int i = 0; i < ReportHTML.THUMBNAIL_COLUMNS; i++) {
442 emptyHeaders.add(
"");
444 htmlModule.startTable(emptyHeaders);
446 htmlModule.addThumbnailRows(images);
448 htmlModule.endTable();
449 htmlModule.endDataType();
460 private void checkIfTagHasImage(BlackboardArtifactTag artifactTag) {
463 file = Case.getCurrentCaseThrows().getSleuthkitCase().getAbstractFileById(artifactTag.getArtifact().getObjectID());
464 }
catch (TskCoreException | NoCurrentCaseException ex) {
466 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.errGetContentFromBBArtifact"));
467 logger.log(Level.WARNING,
"Error while getting content from a blackboard artifact to report on.", ex);
472 checkIfFileIsImage(file);
483 private void checkIfTagHasImage(ContentTag contentTag) {
484 Content c = contentTag.getContent();
485 if (c instanceof AbstractFile ==
false) {
488 checkIfFileIsImage((AbstractFile) c);
496 private void checkIfFileIsImage(AbstractFile file) {
499 || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS
500 || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS) {
504 if (ImageUtils.thumbnailSupported(file)) {
517 private String makeCommaSeparatedList(Collection<String> items) {
519 for (Iterator<String> iterator = items.iterator(); iterator.hasNext();) {
520 list += iterator.next() + (iterator.hasNext() ?
", " :
"");
530 @SuppressWarnings(
"deprecation")
531 @NbBundle.Messages({
"ReportGenerator.errList.noOpenCase=No open case available."})
532 private void writeKeywordHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
539 String orderByClause;
542 openCase = Case.getCurrentCaseThrows();
543 }
catch (NoCurrentCaseException ex) {
544 errorList.add(Bundle.ReportGenerator_errList_noOpenCase());
545 logger.log(Level.SEVERE,
"Exception while getting open case: ", ex);
550 String tagIDList =
"";
551 if (!tagNamesFilter.isEmpty()) {
553 Map<String, TagName> tagNamesMap = Case.getCurrentCaseThrows().getServices().getTagsManager().getDisplayNamesToTagNamesMap();
554 for (String tagDisplayName : tagNamesFilter) {
555 if (tagNamesMap.containsKey(tagDisplayName)) {
556 if (!tagIDList.isEmpty()) {
559 tagIDList += tagNamesMap.get(tagDisplayName).getId();
562 if (tagDisplayName.endsWith(getNotableTagLabel())) {
563 String editedDisplayName = tagDisplayName.substring(0, tagDisplayName.length() - getNotableTagLabel().length());
564 if (tagNamesMap.containsKey(editedDisplayName)) {
565 if (!tagIDList.isEmpty()) {
568 tagIDList += tagNamesMap.get(editedDisplayName).getId();
573 }
catch (NoCurrentCaseException | TskCoreException ex) {
574 logger.log(Level.SEVERE,
"Exception while getting tag info - proceeding without tag filter: ", ex);
580 String adHocCountQuery =
"SELECT COUNT(*) FROM "
582 "(SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 ";
583 if (!tagIDList.isEmpty()) {
584 adHocCountQuery +=
", blackboard_artifact_tags as tag ";
586 adHocCountQuery +=
"WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") ";
587 if (!tagIDList.isEmpty()) {
588 adHocCountQuery +=
" AND (art.artifact_id = tag.artifact_id) AND (tag.tag_name_id IN (" + tagIDList +
")) ";
590 adHocCountQuery +=
"EXCEPT "
592 "SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
")) AS adHocHits";
595 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(adHocCountQuery)) {
596 ResultSet adHocCountResultSet = dbQuery.getResultSet();
597 if (adHocCountResultSet.next()) {
598 adHocCount = adHocCountResultSet.getInt(1);
600 throw new TskCoreException(
"Error counting ad hoc keywords");
602 }
catch (TskCoreException | SQLException ex) {
603 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryKWLists"));
604 logger.log(Level.SEVERE,
"Failed to count ad hoc searches with query " + adHocCountQuery, ex);
609 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
610 orderByClause =
"ORDER BY convert_to(list, 'SQL_ASCII') ASC NULLS FIRST";
612 orderByClause =
"ORDER BY list ASC";
614 String keywordListQuery
615 =
"SELECT att.value_text AS list "
617 "FROM blackboard_attributes AS att, blackboard_artifacts AS art ";
618 if (!tagIDList.isEmpty()) {
619 keywordListQuery +=
", blackboard_artifact_tags as tag ";
621 keywordListQuery +=
"WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
" "
623 "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
" "
625 "AND att.artifact_id = art.artifact_id ";
626 if (!tagIDList.isEmpty()) {
627 keywordListQuery +=
"AND (art.artifact_id = tag.artifact_id) "
629 "AND (tag.tag_name_id IN (" + tagIDList +
")) ";
631 if (adHocCount > 0) {
632 keywordListQuery +=
" UNION SELECT \'\' AS list ";
634 keywordListQuery =
"SELECT * FROM ( " + keywordListQuery +
" ) kwListNames ";
635 keywordListQuery +=
"GROUP BY list " + orderByClause;
638 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(keywordListQuery)) {
639 ResultSet listsRs = dbQuery.getResultSet();
640 List<String> lists =
new ArrayList<>();
641 while (listsRs.next()) {
642 String list = listsRs.getString(
"list");
643 if (list.isEmpty()) {
644 list = NbBundle.getMessage(this.getClass(),
"ReportGenerator.writeKwHits.userSrchs");
650 tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), comment);
651 tableModule.addSetIndex(lists);
652 progressPanel.updateStatusLabel(
653 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
654 BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName()));
655 }
catch (TskCoreException | SQLException ex) {
656 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryKWLists"));
657 logger.log(Level.SEVERE,
"Failed to query keyword lists with query " + keywordListQuery, ex);
662 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
663 orderByClause =
"ORDER BY convert_to(list, 'SQL_ASCII') ASC NULLS FIRST, "
664 +
"convert_to(keyword, 'SQL_ASCII') ASC NULLS FIRST, "
665 +
"convert_to(parent_path, 'SQL_ASCII') ASC NULLS FIRST, "
666 +
"convert_to(name, 'SQL_ASCII') ASC NULLS FIRST, "
667 +
"convert_to(preview, 'SQL_ASCII') ASC NULLS FIRST";
669 orderByClause =
"ORDER BY list ASC, keyword ASC, parent_path ASC, name ASC, preview ASC";
673 String keywordListsQuery
674 =
"SELECT art.artifact_id AS artifact_id, art.obj_id AS obj_id, att1.value_text AS keyword, att2.value_text AS preview, att3.value_text AS list, f.name AS name, f.parent_path AS parent_path "
676 "FROM blackboard_artifacts AS art, blackboard_attributes AS att1, blackboard_attributes AS att2, blackboard_attributes AS att3, tsk_files AS f "
678 "WHERE (att1.artifact_id = art.artifact_id) "
680 "AND (att2.artifact_id = art.artifact_id) "
682 "AND (att3.artifact_id = art.artifact_id) "
684 "AND (f.obj_id = art.obj_id) "
686 "AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID() +
") "
688 "AND (att2.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID() +
") "
690 "AND (att3.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
") "
692 "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") ";
695 String keywordAdHocQuery
696 =
"SELECT art.artifact_id AS artifact_id, art.obj_id AS obj_id, att1.value_text AS keyword, att2.value_text AS preview, \'\' AS list, f.name AS name, f.parent_path AS parent_path "
698 "FROM blackboard_artifacts AS art, blackboard_attributes AS att1, blackboard_attributes AS att2, tsk_files AS f "
702 " (art.artifact_id IN (SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") "
706 "SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
"))) "
708 "AND (att1.artifact_id = art.artifact_id) "
710 "AND (att2.artifact_id = art.artifact_id) "
712 "AND (f.obj_id = art.obj_id) "
714 "AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID() +
") "
716 "AND (att2.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID() +
") "
718 "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") ";
720 String keywordsQuery =
"SELECT * FROM ( " + keywordListsQuery +
" UNION " + keywordAdHocQuery +
" ) kwHits " + orderByClause;
722 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(keywordsQuery)) {
723 ResultSet resultSet = dbQuery.getResultSet();
725 String currentKeyword =
"";
726 String currentList =
"";
727 while (resultSet.next()) {
729 if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
734 HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong(
"artifact_id"));
735 if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
738 String tagsList = makeCommaSeparatedList(uniqueTagNames);
740 Long objId = resultSet.getLong(
"obj_id");
741 String keyword = resultSet.getString(
"keyword");
742 String preview = resultSet.getString(
"preview");
743 String list = resultSet.getString(
"list");
744 String uniquePath =
"";
747 AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
749 uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
751 }
catch (TskCoreException ex) {
753 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAbstractFileByID"));
754 logger.log(Level.WARNING,
"Failed to get Abstract File by ID.", ex);
758 if ((!list.equals(currentList) && !list.isEmpty()) || (list.isEmpty() && !currentList.equals(
759 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.writeKwHits.userSrchs")))) {
760 if (!currentList.isEmpty()) {
761 tableModule.endTable();
762 tableModule.endSet();
764 currentList = list.isEmpty() ? NbBundle
765 .getMessage(this.getClass(),
"ReportGenerator.writeKwHits.userSrchs") : list;
767 tableModule.startSet(currentList);
768 progressPanel.updateStatusLabel(
769 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processingList",
770 BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), currentList));
772 if (!keyword.equals(currentKeyword)) {
774 if (!currentKeyword.equals(
"")) {
775 tableModule.endTable();
779 currentKeyword = keyword;
780 tableModule.addSetElement(currentKeyword);
781 List<String> columnHeaderNames =
new ArrayList<>();
782 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.preview"));
783 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.srcFile"));
784 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags"));
785 tableModule.startTable(columnHeaderNames);
788 tableModule.addRow(Arrays.asList(
new String[]{preview, uniquePath, tagsList}));
792 if (!currentKeyword.isEmpty()) {
793 tableModule.endTable();
797 progressPanel.increment();
798 tableModule.endDataType();
799 }
catch (TskCoreException | SQLException ex) {
800 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryKWs"));
801 logger.log(Level.SEVERE,
"Failed to query keywords with query " + keywordsQuery, ex);
810 @SuppressWarnings(
"deprecation")
811 private
void writeHashsetHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
812 String orderByClause;
815 openCase = Case.getCurrentCaseThrows();
816 }
catch (NoCurrentCaseException ex) {
817 errorList.add(Bundle.ReportGenerator_errList_noOpenCase());
818 logger.log(Level.SEVERE,
"Exception while getting open case: ", ex);
821 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
822 orderByClause =
"ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST";
824 orderByClause =
"ORDER BY att.value_text ASC";
827 =
"SELECT att.value_text AS list "
829 "FROM blackboard_attributes AS att, blackboard_artifacts AS art "
831 "WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
" "
833 "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() +
" "
835 "AND att.artifact_id = art.artifact_id "
837 "GROUP BY list " + orderByClause;
839 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(hashsetsQuery)) {
841 ResultSet listsRs = dbQuery.getResultSet();
842 List<String> lists =
new ArrayList<>();
843 while (listsRs.next()) {
844 lists.add(listsRs.getString(
"list"));
847 tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), comment);
848 tableModule.addSetIndex(lists);
849 progressPanel.updateStatusLabel(
850 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
851 BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName()));
852 }
catch (TskCoreException | SQLException ex) {
853 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryHashsetLists"));
854 logger.log(Level.SEVERE,
"Failed to query hashset lists: ", ex);
858 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
859 orderByClause =
"ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST, "
860 +
"convert_to(f.parent_path, 'SQL_ASCII') ASC NULLS FIRST, "
861 +
"convert_to(f.name, 'SQL_ASCII') ASC NULLS FIRST, "
862 +
"size ASC NULLS FIRST";
864 orderByClause =
"ORDER BY att.value_text ASC, f.parent_path ASC, f.name ASC, size ASC";
866 String hashsetHitsQuery
867 =
"SELECT art.artifact_id, art.obj_id, att.value_text AS setname, f.name AS name, f.size AS size, f.parent_path AS parent_path "
869 "FROM blackboard_artifacts AS art, blackboard_attributes AS att, tsk_files AS f "
871 "WHERE (att.artifact_id = art.artifact_id) "
873 "AND (f.obj_id = art.obj_id) "
875 "AND (att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
") "
877 "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() +
") "
881 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(hashsetHitsQuery)) {
883 ResultSet resultSet = dbQuery.getResultSet();
884 String currentSet =
"";
885 while (resultSet.next()) {
887 if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
892 HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong(
"artifact_id"));
893 if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
896 String tagsList = makeCommaSeparatedList(uniqueTagNames);
898 Long objId = resultSet.getLong(
"obj_id");
899 String set = resultSet.getString(
"setname");
900 String size = resultSet.getString(
"size");
901 String uniquePath =
"";
904 AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
906 uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
908 }
catch (TskCoreException ex) {
910 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAbstractFileFromID"));
911 logger.log(Level.WARNING,
"Failed to get Abstract File from ID.", ex);
916 if (!set.equals(currentSet)) {
917 if (!currentSet.isEmpty()) {
918 tableModule.endTable();
919 tableModule.endSet();
922 tableModule.startSet(currentSet);
923 List<String> columnHeaderNames =
new ArrayList<>();
924 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.file"));
925 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.size"));
926 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags"));
927 tableModule.startTable(columnHeaderNames);
928 progressPanel.updateStatusLabel(
929 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processingList",
930 BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), currentSet));
934 tableModule.addRow(Arrays.asList(
new String[]{uniquePath, size, tagsList}));
938 progressPanel.increment();
939 tableModule.endDataType();
940 }
catch (TskCoreException | SQLException ex) {
941 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryHashsetHits"));
942 logger.log(Level.SEVERE,
"Failed to query hashsets hits: ", ex);
949 List<String> getErrorList() {
962 private List<String> rowData = null;
965 ArtifactData(BlackboardArtifact artifact, List<BlackboardAttribute> attrs, HashSet<String> tags) {
967 this.attributes = attrs;
972 logger.log(Level.SEVERE,
"Could not get content from database", ex);
989 return artifact.getArtifactID();
993 return artifact.getObjectID();
1014 List<String> thisRow =
getRow();
1015 List<String> otherRow = otherArtifactData.
getRow();
1016 for (
int i = 0; i < thisRow.size(); i++) {
1017 int compare = thisRow.get(i).compareTo(otherRow.get(i));
1033 if (rowData == null) {
1038 if (rowData.size() > 0) {
1040 for (
int i = 0; i < rowData.size(); i++) {
1041 if (rowData.get(i) == null) {
1047 return new ArrayList<>();
1049 }
catch (TskCoreException ex) {
1051 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.coreExceptionWhileGenRptRow"));
1052 logger.log(Level.WARNING,
"Core exception while generating row data for artifact report.", ex);
1053 rowData = Collections.<String>emptyList();
1070 List<String> orderedRowData =
new ArrayList<>();
1071 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() ==
getArtifact().getArtifactTypeID()) {
1072 if (content != null && content instanceof AbstractFile) {
1073 AbstractFile file = (AbstractFile) content;
1074 orderedRowData.add(file.getName());
1075 orderedRowData.add(file.getNameExtension());
1076 String mimeType = file.getMIMEType();
1077 if (mimeType == null) {
1078 orderedRowData.add(
"");
1080 orderedRowData.add(mimeType);
1082 orderedRowData.add(file.getUniquePath());
1085 orderedRowData.add(null);
1086 orderedRowData.add(null);
1087 orderedRowData.add(null);
1088 orderedRowData.add(null);
1090 orderedRowData.add(makeCommaSeparatedList(
getTags()));
1092 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() ==
getArtifact().getArtifactTypeID()) {
1093 String[] attributeDataArray =
new String[5];
1095 for (BlackboardAttribute attr : attributes) {
1096 if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME))) {
1097 attributeDataArray[0] = attr.getDisplayString();
1098 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY))) {
1099 attributeDataArray[1] = attr.getDisplayString();
1100 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT))) {
1101 attributeDataArray[3] = attr.getDisplayString();
1102 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION))) {
1103 attributeDataArray[4] = attr.getDisplayString();
1107 attributeDataArray[2] = content.getUniquePath();
1108 orderedRowData.addAll(Arrays.asList(attributeDataArray));
1110 HashSet<String> allTags =
getTags();
1113 for (ContentTag ct : contentTags) {
1115 allTags.add(ct.getName().getDisplayName() + notableString);
1118 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetContentTags"));
1119 logger.log(Level.SEVERE,
"Failed to get content tags", ex);
1121 orderedRowData.add(makeCommaSeparatedList(allTags));
1123 }
else if (columnHeaderMap.containsKey(
this.artifact.getArtifactTypeID())) {
1125 for (
Column currColumn : columnHeaderMap.get(
this.artifact.getArtifactTypeID())) {
1126 String cellData = currColumn.getCellData(
this);
1127 orderedRowData.add(cellData);
1131 return orderedRowData;
1145 private List<ArtifactData> getFilteredArtifacts(BlackboardArtifact.Type type, HashSet<String> tagNamesFilter) {
1146 List<ArtifactData> artifacts =
new ArrayList<>();
1150 HashSet<String> uniqueTagNames =
new HashSet<>();
1151 for (BlackboardArtifactTag tag : tags) {
1153 uniqueTagNames.add(tag.getName().getDisplayName() + notableString);
1155 if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
1159 artifacts.add(
new ArtifactData(artifact, Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboardAttributes(artifact), uniqueTagNames));
1160 }
catch (TskCoreException ex) {
1161 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBAttribs"));
1162 logger.log(Level.SEVERE,
"Failed to get Blackboard Attributes when generating report.", ex);
1165 }
catch (TskCoreException | NoCurrentCaseException ex) {
1166 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBArtifacts"));
1167 logger.log(Level.SEVERE,
"Failed to get Blackboard Artifacts when generating report.", ex);
1172 private Boolean failsTagFilter(HashSet<String> tagNames, HashSet<String> tagsNamesFilter) {
1173 if (null == tagsNamesFilter || tagsNamesFilter.isEmpty()) {
1177 HashSet<String> filteredTagNames =
new HashSet<>(tagNames);
1178 filteredTagNames.retainAll(tagsNamesFilter);
1179 return filteredTagNames.isEmpty();
1192 @Messages({
"ReportGenerator.artTableColHdr.comment=Comment"})
1193 private List<Column> getArtifactTableColumns(
int artifactTypeId, Set<BlackboardAttribute.Type> attributeTypeSet) {
1194 ArrayList<Column> columns =
new ArrayList<>();
1198 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID() == artifactTypeId) {
1199 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1200 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1202 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.title"),
1203 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1205 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateCreated"),
1206 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1208 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1209 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1211 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID() == artifactTypeId) {
1212 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1213 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1215 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1216 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1218 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1219 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1221 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.value"),
1222 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE)));
1224 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1225 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1227 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID() == artifactTypeId) {
1228 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1229 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1231 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateAccessed"),
1232 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1234 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.referrer"),
1235 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REFERRER)));
1237 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.title"),
1238 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1240 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1241 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1243 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.urlDomainDecoded"),
1244 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL_DECODED)));
1246 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifactTypeId) {
1247 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dest"),
1248 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1250 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.sourceUrl"),
1251 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1253 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateAccessed"),
1254 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1256 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1257 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1259 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
1260 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == artifactTypeId) {
1261 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.path"),
1262 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1264 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1265 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1267 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
1268 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID() == artifactTypeId) {
1269 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.progName"),
1270 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1272 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.instDateTime"),
1273 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1275 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() == artifactTypeId) {
1276 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.preview")));
1278 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() == artifactTypeId) {
1279 columns.add(
new SourceFileColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.file")));
1281 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.size")));
1283 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID() == artifactTypeId) {
1284 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devMake"),
1285 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1287 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devModel"),
1288 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1290 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.deviceId"),
1291 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1293 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1294 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1296 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID() == artifactTypeId) {
1297 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.text"),
1298 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1300 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.domain"),
1301 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)));
1303 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateAccessed"),
1304 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1306 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.progName"),
1307 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1309 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID() == artifactTypeId) {
1310 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTaken"),
1311 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1313 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devManufacturer"),
1314 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1316 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devModel"),
1317 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1319 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1320 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1322 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1323 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1325 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1326 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1328 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID() == artifactTypeId) {
1329 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1330 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1332 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumber"),
1333 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1335 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumHome"),
1336 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_HOME)));
1338 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumOffice"),
1339 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_OFFICE)));
1341 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumMobile"),
1342 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_MOBILE)));
1344 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.email"),
1345 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL)));
1347 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() == artifactTypeId) {
1348 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.msgType"),
1349 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)));
1351 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.direction"),
1352 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1354 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.readStatus"),
1355 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_READ_STATUS)));
1357 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1358 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1360 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.fromPhoneNum"),
1361 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1363 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.fromEmail"),
1364 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1366 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.toPhoneNum"),
1367 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1369 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.toEmail"),
1370 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1372 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.subject"),
1373 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1375 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.text"),
1376 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1378 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID() == artifactTypeId) {
1379 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1380 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1382 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.fromPhoneNum"),
1383 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1385 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.toPhoneNum"),
1386 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1388 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1389 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1391 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.direction"),
1392 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1394 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID() == artifactTypeId) {
1395 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.calendarEntryType"),
1396 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CALENDAR_ENTRY_TYPE)));
1398 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1399 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1401 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.startDateTime"),
1402 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1404 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.endDateTime"),
1405 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_END)));
1407 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.location"),
1408 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1410 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID() == artifactTypeId) {
1411 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.shortCut"),
1412 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SHORTCUT)));
1414 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1415 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME_PERSON)));
1417 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumber"),
1418 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1420 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID() == artifactTypeId) {
1421 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.deviceName"),
1422 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_NAME)));
1424 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.deviceAddress"),
1425 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1427 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1428 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1430 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID() == artifactTypeId) {
1431 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1432 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1434 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1435 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1437 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1438 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1440 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID() == artifactTypeId) {
1441 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1442 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1444 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1445 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1447 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1448 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1450 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1451 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1453 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.locationAddress"),
1454 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1456 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1457 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1459 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID() == artifactTypeId) {
1460 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1461 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1463 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1464 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1466 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1467 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1469 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1470 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1472 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.locationAddress"),
1473 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1475 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1476 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1478 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID() == artifactTypeId) {
1479 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1480 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1482 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1483 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1485 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1486 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1488 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1489 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1491 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.locationAddress"),
1492 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1494 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1495 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1497 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID() == artifactTypeId) {
1498 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.category"),
1499 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1501 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.userId"),
1502 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1504 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.password"),
1505 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PASSWORD)));
1507 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1508 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1510 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.appName"),
1511 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1513 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1514 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1516 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.appPath"),
1517 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1519 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1520 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1522 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.replytoAddress"),
1523 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_REPLYTO)));
1525 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.mailServer"),
1526 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SERVER_NAME)));
1528 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID() == artifactTypeId
1529 || BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID() == artifactTypeId) {
1530 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1531 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1533 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() == artifactTypeId) {
1534 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.file")));
1536 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.extension.text")));
1538 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.mimeType.text")));
1540 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.path")));
1542 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID() == artifactTypeId) {
1543 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.processorArchitecture.text"),
1544 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROCESSOR_ARCHITECTURE)));
1546 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.osName.text"),
1547 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1549 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.osInstallDate.text"),
1550 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1552 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == artifactTypeId) {
1553 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailTo"),
1554 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1556 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailFrom"),
1557 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1559 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSubject"),
1560 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1562 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskDateTimeSent"),
1563 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)));
1565 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskDateTimeRcvd"),
1566 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_RCVD)));
1568 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskPath"),
1569 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1571 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailCc"),
1572 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_CC)));
1574 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailBcc"),
1575 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_BCC)));
1577 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskMsgId"),
1578 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MSG_ID)));
1580 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == artifactTypeId) {
1581 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSetName"),
1582 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1584 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskInterestingFilesCategory"),
1585 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1587 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskPath"),
1588 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1590 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.comment"),
1591 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT)));
1593 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1594 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1596 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_ROUTE.getTypeID() == artifactTypeId) {
1597 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskGpsRouteCategory"),
1598 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1600 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1601 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1603 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitudeEnd"),
1604 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END)));
1606 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitudeEnd"),
1607 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END)));
1609 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitudeStart"),
1610 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START)));
1612 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitudeStart"),
1613 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START)));
1615 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1616 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1618 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.location"),
1619 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1621 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1622 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1624 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == artifactTypeId) {
1625 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSetName"),
1626 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1628 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.associatedArtifact"),
1629 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1631 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1632 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1634 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == artifactTypeId) {
1635 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1636 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1638 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.associatedArtifact"),
1639 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1641 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1642 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1644 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.count"),
1645 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COUNT)));
1647 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_ACCOUNT.getTypeID() == artifactTypeId) {
1648 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.userName"),
1649 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME)));
1651 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.userId"),
1652 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1654 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_REMOTE_DRIVE.getTypeID() == artifactTypeId) {
1655 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.localPath"),
1656 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCAL_PATH)));
1658 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.remotePath"),
1659 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REMOTE_PATH)));
1660 }
else if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
1661 columns.add(
new StatusColumn());
1662 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE));
1663 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
1664 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME));
1665 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_SEARCH_DOCUMENT_ID));
1666 }
else if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID()) {
1667 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
1671 for (BlackboardAttribute.Type type : attributeTypeSet) {
1672 columns.add(
new AttributeColumn(type.getDisplayName(), type));
1674 columns.add(
new SourceFileColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.srcFile")));
1675 columns.add(
new TaggedResultsColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags")));
1683 for (Column column : columns) {
1684 attributeTypeSet = column.removeTypeFromSet(attributeTypeSet);
1687 for (BlackboardAttribute.Type type : attributeTypeSet) {
1688 columns.add(
new AttributeColumn(type.getDisplayName(), type));
1691 if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()
1692 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()
1693 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()
1694 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()
1695 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()
1696 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()
1697 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()
1698 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID()
1699 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID()
1700 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID()
1701 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()
1702 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID()
1703 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID()
1704 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID()
1705 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID()
1706 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID()
1707 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID()
1708 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID()
1709 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID()
1710 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID()
1711 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID()
1712 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID()
1713 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID()) {
1714 columns.add(
new SourceFileColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.srcFile")));
1716 columns.add(
new TaggedResultsColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags")));
1728 private String getFileUniquePath(Content content) {
1730 if (content != null) {
1731 return content.getUniquePath();
1735 }
catch (TskCoreException ex) {
1736 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAbstractFileByID"));
1737 logger.log(Level.WARNING,
"Failed to get Abstract File by ID.", ex);
1752 @SuppressWarnings(
"deprecation")
1753 private HashSet<String> getUniqueTagNames(
long artifactId) throws TskCoreException {
1754 HashSet<String> uniqueTagNames =
new HashSet<>();
1756 String query =
"SELECT display_name, artifact_id, knownStatus FROM tag_names AS tn, blackboard_artifact_tags AS bat "
1758 "WHERE tn.tag_name_id = bat.tag_name_id AND bat.artifact_id = " + artifactId;
1760 try (SleuthkitCase.CaseDbQuery dbQuery = Case.getCurrentCaseThrows().getSleuthkitCase().executeQuery(query)) {
1761 ResultSet tagNameRows = dbQuery.getResultSet();
1762 while (tagNameRows.next()) {
1763 String notableString = tagNameRows.getInt(
"knownStatus") == TskData.FileKnown.BAD.ordinal() ? getNotableTagLabel() :
"";
1764 uniqueTagNames.add(tagNameRows.getString(
"display_name") + notableString);
1766 }
catch (TskCoreException | SQLException | NoCurrentCaseException ex) {
1767 throw new TskCoreException(
"Error getting tag names for artifact: ", ex);
1770 return uniqueTagNames;
1780 Set<BlackboardAttribute.Type>
removeTypeFromSet(Set<BlackboardAttribute.Type> types);
1785 @NbBundle.Messages(
"TableReportGenerator.StatusColumn.Header=Review Status")
1788 return Bundle.TableReportGenerator_StatusColumn_Header();
1793 return artData.
getArtifact().getReviewStatus().getDisplayName();
1816 this.columnHeader = Objects.requireNonNull(columnHeader);
1827 List<BlackboardAttribute> attributes = artData.
getAttributes();
1828 for (BlackboardAttribute attribute : attributes) {
1829 if (attribute.getAttributeType().equals(this.
attributeType)) {
1830 if (attribute.getAttributeType().getValueType() != BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
1831 return attribute.getDisplayString();
1862 return getFileUniquePath(artData.
getContent());
1887 return makeCommaSeparatedList(artData.
getTags());
1912 throw new UnsupportedOperationException(
"Cannot get cell data of unspecified column");
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
static String getStringTime(long epochSeconds, TimeZone tzone)
final String columnHeader
String getCellData(ArtifactData artData)
BlackboardArtifact getArtifact()
final String columnHeader
final String columnHeader
final String columnHeader
final BlackboardAttribute.Type attributeType
HashSet< String > getTags()
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
String getCellData(ArtifactData artData)
String getCellData(ArtifactData artData)
TagsManager getTagsManager()
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
String getCellData(ArtifactData artData)
SleuthkitCase getSleuthkitCase()
BlackboardArtifact artifact
String getCellData(ArtifactData artData)
List< BlackboardAttribute > getAttributes()
int compareTo(ArtifactData otherArtifactData)
String getCellData(ArtifactData artData)
List< String > getOrderedRowDataAsStrings()
List< BlackboardAttribute > attributes
static Case getCurrentCaseThrows()
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)