19 package org.sleuthkit.autopsy.contentviewers.contextviewer;
21 import java.awt.Component;
22 import java.util.ArrayList;
23 import java.util.HashMap;
24 import java.util.List;
26 import java.util.logging.Level;
27 import javax.swing.BoxLayout;
28 import static javax.swing.ScrollPaneConstants.HORIZONTAL_SCROLLBAR_AS_NEEDED;
29 import org.apache.commons.lang.StringUtils;
30 import org.openide.nodes.Node;
31 import org.openide.util.NbBundle;
32 import org.openide.util.lookup.ServiceProvider;
39 import static org.
sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT;
49 @ServiceProvider(service = DataContentViewer.class, position = 7)
52 private static final long serialVersionUID = 1L;
54 private static final int ARTIFACT_STR_MAX_LEN = 1024;
55 private static final int ATTRIBUTE_STR_MAX_LEN = 200;
58 private static final List<BlackboardArtifact.ARTIFACT_TYPE> CONTEXT_ARTIFACTS =
new ArrayList<>();
59 private final List<javax.swing.JPanel> contextSourcePanels =
new ArrayList<>();
60 private final List<javax.swing.JPanel> contextUsagePanels =
new ArrayList<>();
63 CONTEXT_ARTIFACTS.add(TSK_ASSOCIATED_OBJECT);
72 jScrollPane.setHorizontalScrollBarPolicy(HORIZONTAL_SCROLLBAR_AS_NEEDED);
80 @SuppressWarnings(
"unchecked")
82 private
void initComponents() {
84 jSourcePanel =
new javax.swing.JPanel();
85 javax.swing.JLabel jSourceLabel =
new javax.swing.JLabel();
86 jUsagePanel =
new javax.swing.JPanel();
87 javax.swing.JLabel jUsageLabel =
new javax.swing.JLabel();
88 jUnknownPanel =
new javax.swing.JPanel();
89 javax.swing.JLabel jUnknownLabel =
new javax.swing.JLabel();
90 jScrollPane =
new javax.swing.JScrollPane();
92 jSourcePanel.setBackground(javax.swing.UIManager.getDefaults().getColor(
"window"));
94 jSourceLabel.setFont(jSourceLabel.getFont().deriveFont(jSourceLabel.getFont().getStyle() | java.awt.Font.BOLD, jSourceLabel.getFont().getSize()+1));
95 org.openide.awt.Mnemonics.setLocalizedText(jSourceLabel,
org.openide.util.NbBundle.getMessage(
ContextViewer.class,
"ContextViewer.jSourceLabel.text"));
97 javax.swing.GroupLayout jSourcePanelLayout =
new javax.swing.GroupLayout(jSourcePanel);
98 jSourcePanel.setLayout(jSourcePanelLayout);
99 jSourcePanelLayout.setHorizontalGroup(
100 jSourcePanelLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
101 .addGroup(jSourcePanelLayout.createSequentialGroup()
103 .addComponent(jSourceLabel)
104 .addContainerGap(304, Short.MAX_VALUE))
106 jSourcePanelLayout.setVerticalGroup(
107 jSourcePanelLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
108 .addGroup(jSourcePanelLayout.createSequentialGroup()
110 .addComponent(jSourceLabel)
114 jUsagePanel.setBackground(javax.swing.UIManager.getDefaults().getColor(
"window"));
116 jUsageLabel.setFont(jUsageLabel.getFont().deriveFont(jUsageLabel.getFont().getStyle() | java.awt.Font.BOLD, jUsageLabel.getFont().getSize()+1));
117 org.openide.awt.Mnemonics.setLocalizedText(jUsageLabel,
org.openide.util.NbBundle.getMessage(
ContextViewer.class,
"ContextViewer.jUsageLabel.text"));
119 javax.swing.GroupLayout jUsagePanelLayout =
new javax.swing.GroupLayout(jUsagePanel);
120 jUsagePanel.setLayout(jUsagePanelLayout);
121 jUsagePanelLayout.setHorizontalGroup(
122 jUsagePanelLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
123 .addGroup(jUsagePanelLayout.createSequentialGroup()
125 .addComponent(jUsageLabel)
126 .addContainerGap(298, Short.MAX_VALUE))
128 jUsagePanelLayout.setVerticalGroup(
129 jUsagePanelLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
130 .addGroup(jUsagePanelLayout.createSequentialGroup()
132 .addComponent(jUsageLabel)
136 jUnknownPanel.setBackground(
new java.awt.Color(255, 255, 255));
138 org.openide.awt.Mnemonics.setLocalizedText(jUnknownLabel,
org.openide.util.NbBundle.getMessage(
ContextViewer.class,
"ContextViewer.jUnknownLabel.text"));
140 javax.swing.GroupLayout jUnknownPanelLayout =
new javax.swing.GroupLayout(jUnknownPanel);
141 jUnknownPanel.setLayout(jUnknownPanelLayout);
142 jUnknownPanelLayout.setHorizontalGroup(
143 jUnknownPanelLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
144 .addGroup(jUnknownPanelLayout.createSequentialGroup()
146 .addComponent(jUnknownLabel)
147 .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
149 jUnknownPanelLayout.setVerticalGroup(
150 jUnknownPanelLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
151 .addGroup(jUnknownPanelLayout.createSequentialGroup()
153 .addComponent(jUnknownLabel)
157 setBackground(
new java.awt.Color(255, 255, 255));
158 setPreferredSize(
new java.awt.Dimension(495, 358));
160 jScrollPane.setBackground(
new java.awt.Color(255, 255, 255));
162 javax.swing.GroupLayout layout =
new javax.swing.GroupLayout(
this);
163 this.setLayout(layout);
164 layout.setHorizontalGroup(
165 layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
166 .addComponent(jScrollPane, javax.swing.GroupLayout.DEFAULT_SIZE, 509, Short.MAX_VALUE)
168 layout.setVerticalGroup(
169 layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
170 .addComponent(jScrollPane, javax.swing.GroupLayout.DEFAULT_SIZE, 335, Short.MAX_VALUE)
176 if ((selectedNode == null) || (!isSupported(selectedNode))) {
181 AbstractFile file = selectedNode.getLookup().lookup(AbstractFile.class);
183 populatePanels(file);
185 logger.log(Level.SEVERE, String.format(
"Exception displaying context for file %s", file.getName()), ex);
190 "ContextViewer.title=Context",
191 "ContextViewer.toolTip=Displays context for selected file."
196 return Bundle.ContextViewer_title();
201 return Bundle.ContextViewer_toolTip();
216 contextSourcePanels.clear();
217 contextUsagePanels.clear();
224 if (node.getLookup().lookup(AbstractFile.class) != null) {
225 AbstractFile abstractFile = node.getLookup().lookup(AbstractFile.class);
226 for (BlackboardArtifact.ARTIFACT_TYPE artifactType : CONTEXT_ARTIFACTS) {
227 List<BlackboardArtifact> artifactsList;
229 artifactsList = abstractFile.getArtifacts(artifactType);
230 if (!artifactsList.isEmpty()) {
233 }
catch (TskCoreException ex) {
234 logger.log(Level.SEVERE, String.format(
"Exception while looking up context artifacts for file %s", abstractFile), ex);
250 "ContextViewer.unknownSource=Unknown ",
266 boolean foundASource =
false;
267 for (BlackboardArtifact.ARTIFACT_TYPE artifactType : CONTEXT_ARTIFACTS) {
268 List<BlackboardArtifact> artifactsList = tskCase.getBlackboardArtifacts(artifactType, sourceFile.getId());
270 foundASource = !artifactsList.isEmpty();
271 for (BlackboardArtifact contextArtifact : artifactsList) {
272 addAssociatedArtifactToPanel(contextArtifact);
275 javax.swing.JPanel contextContainer =
new javax.swing.JPanel();
276 contextContainer.add(jSourcePanel);
277 contextContainer.setLayout(
new BoxLayout(contextContainer, BoxLayout.Y_AXIS));
278 if (contextSourcePanels.isEmpty()) {
279 contextContainer.add(jUnknownPanel);
281 for (javax.swing.JPanel sourcePanel : contextSourcePanels) {
282 contextContainer.add(sourcePanel);
285 contextContainer.add(jUsagePanel);
286 if (contextUsagePanels.isEmpty()) {
287 contextContainer.add(jUnknownPanel);
289 for (javax.swing.JPanel usagePanel : contextUsagePanels) {
290 contextContainer.add(usagePanel);
294 contextContainer.setBackground(javax.swing.UIManager.getDefaults().getColor(
"window"));
295 contextContainer.setEnabled(foundASource);
296 contextContainer.setVisible(foundASource);
297 jScrollPane.getViewport().setView(contextContainer);
298 jScrollPane.setEnabled(foundASource);
299 jScrollPane.setVisible(foundASource);
300 jScrollPane.repaint();
301 jScrollPane.revalidate();
316 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT.getTypeID() == artifact.getArtifactTypeID()) {
317 BlackboardAttribute associatedArtifactAttribute = artifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
318 if (associatedArtifactAttribute != null) {
319 long artifactId = associatedArtifactAttribute.getValueLong();
320 BlackboardArtifact associatedArtifact = artifact.getSleuthkitCase().getBlackboardArtifact(artifactId);
322 addArtifactToPanels(associatedArtifact);
335 "ContextViewer.attachmentSource=Attached to: ",
336 "ContextViewer.downloadSource=Downloaded from: ",
337 "ContextViewer.recentDocs=Recent Documents: ",
338 "ContextViewer.programExecution=Program Execution: "
341 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() == associatedArtifact.getArtifactTypeID()
342 || BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == associatedArtifact.getArtifactTypeID()) {
343 String sourceName = Bundle.ContextViewer_attachmentSource();
344 String sourceText = msgArtifactToAbbreviatedString(associatedArtifact);
345 javax.swing.JPanel sourcePanel =
new ContextSourcePanel(sourceName, sourceText, associatedArtifact);
346 contextSourcePanels.add(sourcePanel);
348 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == associatedArtifact.getArtifactTypeID()
349 || BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID() == associatedArtifact.getArtifactTypeID()) {
350 String sourceName = Bundle.ContextViewer_downloadSource();
351 String sourceText = webDownloadArtifactToString(associatedArtifact);
352 javax.swing.JPanel sourcePanel =
new ContextSourcePanel(sourceName, sourceText, associatedArtifact);
353 contextSourcePanels.add(sourcePanel);
355 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == associatedArtifact.getArtifactTypeID()) {
356 String sourceName = Bundle.ContextViewer_recentDocs();
357 String sourceText = recentDocArtifactToString(associatedArtifact);
358 javax.swing.JPanel usagePanel =
new ContextUsagePanel(sourceName, sourceText, associatedArtifact);
359 contextUsagePanels.add(usagePanel);
361 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == associatedArtifact.getArtifactTypeID()) {
362 String sourceName = Bundle.ContextViewer_programExecution();
363 String sourceText = programExecArtifactToString(associatedArtifact);
364 javax.swing.JPanel usagePanel =
new ContextUsagePanel(sourceName, sourceText, associatedArtifact);
365 contextUsagePanels.add(usagePanel);
380 "ContextViewer.downloadURL=URL",
381 "ContextViewer.downloadedOn=On"
384 StringBuilder sb =
new StringBuilder(ARTIFACT_STR_MAX_LEN);
385 Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap = getAttributesMap(artifact);
387 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifact.getArtifactTypeID()
388 || BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID() == artifact.getArtifactTypeID()) {
389 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL, attributesMap, Bundle.ContextViewer_downloadURL());
390 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, attributesMap, Bundle.ContextViewer_downloadedOn());
392 return sb.toString();
406 "ContextViewer.on=Opened at",
407 "ContextViewer.unknown=Opened at unknown time"
410 StringBuilder sb =
new StringBuilder(ARTIFACT_STR_MAX_LEN);
411 Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap = getAttributesMap(artifact);
413 BlackboardAttribute attribute = attributesMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME);
415 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == artifact.getArtifactTypeID()) {
416 if (attribute != null && attribute.getValueLong() > 0) {
417 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, attributesMap, Bundle.ContextViewer_on());
419 sb.append(Bundle.ContextViewer_unknown());
422 return sb.toString();
436 "ContextViewer.runOn=Program Run On",
437 "ContextViewer.runUnknown= Program Run at unknown time"
440 StringBuilder sb =
new StringBuilder(ARTIFACT_STR_MAX_LEN);
441 Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap = getAttributesMap(artifact);
443 BlackboardAttribute attribute = attributesMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME);
445 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == artifact.getArtifactTypeID()) {
446 if (attribute != null && attribute.getValueLong() > 0) {
447 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, attributesMap, Bundle.ContextViewer_runOn());
449 sb.append(Bundle.ContextViewer_runUnknown());
452 return sb.toString();
465 "ContextViewer.message=Message",
466 "ContextViewer.email=Email",
467 "ContextViewer.messageFrom=From",
468 "ContextViewer.messageTo=To",
469 "ContextViewer.messageOn=On",})
472 StringBuilder sb =
new StringBuilder(ARTIFACT_STR_MAX_LEN);
473 Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap = getAttributesMap(artifact);
475 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() == artifact.getArtifactTypeID()) {
476 sb.append(Bundle.ContextViewer_message()).append(
' ');
477 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM, attributesMap, Bundle.ContextViewer_messageFrom());
478 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO, attributesMap, Bundle.ContextViewer_messageTo());
479 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, attributesMap, Bundle.ContextViewer_messageOn());
480 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == artifact.getArtifactTypeID()) {
481 sb.append(Bundle.ContextViewer_email()).append(
' ');
482 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM, attributesMap, Bundle.ContextViewer_messageFrom());
483 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO, attributesMap, Bundle.ContextViewer_messageTo());
484 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT, attributesMap, Bundle.ContextViewer_messageOn());
486 return sb.toString();
500 Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap, String prependStr) {
502 BlackboardAttribute attribute = attributesMap.get(attribType);
503 if (attribute != null) {
504 String attrVal = attribute.getDisplayString();
505 if (!StringUtils.isEmpty(attrVal)) {
506 if (!StringUtils.isEmpty(prependStr)) {
507 sb.append(prependStr).append(
' ');
509 sb.append(StringUtils.abbreviate(attrVal, ATTRIBUTE_STR_MAX_LEN)).append(
' ');
524 private Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>
getAttributesMap(BlackboardArtifact artifact)
throws TskCoreException {
525 Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributeMap =
new HashMap<>();
527 List<BlackboardAttribute> attributeList = artifact.getAttributes();
528 for (BlackboardAttribute attribute : attributeList) {
529 BlackboardAttribute.ATTRIBUTE_TYPE type = BlackboardAttribute.ATTRIBUTE_TYPE.fromID(attribute.getAttributeType().getTypeID());
530 attributeMap.put(type, attribute);
javax.swing.JPanel jSourcePanel
void addAssociatedArtifactToPanel(BlackboardArtifact artifact)
String webDownloadArtifactToString(BlackboardArtifact artifact)
javax.swing.JPanel jUnknownPanel
String recentDocArtifactToString(BlackboardArtifact artifact)
Map< BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute > getAttributesMap(BlackboardArtifact artifact)
void appendAttributeString(StringBuilder sb, BlackboardAttribute.ATTRIBUTE_TYPE attribType, Map< BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute > attributesMap, String prependStr)
void setNode(Node selectedNode)
javax.swing.JPanel jUsagePanel
int isPreferred(Node node)
SleuthkitCase getSleuthkitCase()
String programExecArtifactToString(BlackboardArtifact artifact)
boolean isSupported(Node node)
void populatePanels(AbstractFile sourceFile)
void addArtifactToPanels(BlackboardArtifact associatedArtifact)
synchronized static Logger getLogger(String name)
static Case getCurrentCaseThrows()
String msgArtifactToAbbreviatedString(BlackboardArtifact artifact)
DataContentViewer createInstance()
javax.swing.JScrollPane jScrollPane