19 package org.sleuthkit.autopsy.contentviewers.contextviewer;
21 import java.awt.Component;
22 import java.util.ArrayList;
23 import java.util.Collections;
24 import java.util.Comparator;
25 import java.util.HashMap;
26 import java.util.List;
28 import java.util.logging.Level;
29 import javax.swing.BoxLayout;
30 import static javax.swing.ScrollPaneConstants.HORIZONTAL_SCROLLBAR_AS_NEEDED;
31 import org.apache.commons.lang.StringUtils;
32 import org.openide.nodes.Node;
33 import org.openide.util.NbBundle;
34 import org.openide.util.lookup.ServiceProvider;
41 import static org.
sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT;
51 @ServiceProvider(service = DataContentViewer.class, position = 7)
54 private static final long serialVersionUID = 1L;
56 private static final int ARTIFACT_STR_MAX_LEN = 1024;
57 private static final int ATTRIBUTE_STR_MAX_LEN = 200;
60 private static final List<BlackboardArtifact.ARTIFACT_TYPE> CONTEXT_ARTIFACTS =
new ArrayList<>();
61 private final List<ContextSourcePanel> contextSourcePanels =
new ArrayList<>();
62 private final List<ContextUsagePanel> contextUsagePanels =
new ArrayList<>();
65 CONTEXT_ARTIFACTS.add(TSK_ASSOCIATED_OBJECT);
74 jScrollPane.setHorizontalScrollBarPolicy(HORIZONTAL_SCROLLBAR_AS_NEEDED);
82 @SuppressWarnings(
"unchecked")
84 private
void initComponents() {
86 jSourcePanel =
new javax.swing.JPanel();
87 javax.swing.JLabel jSourceLabel =
new javax.swing.JLabel();
88 jUsagePanel =
new javax.swing.JPanel();
89 javax.swing.JLabel jUsageLabel =
new javax.swing.JLabel();
90 jUnknownPanel =
new javax.swing.JPanel();
91 javax.swing.JLabel jUnknownLabel =
new javax.swing.JLabel();
92 jScrollPane =
new javax.swing.JScrollPane();
94 jSourcePanel.setBackground(javax.swing.UIManager.getDefaults().getColor(
"window"));
96 jSourceLabel.setFont(jSourceLabel.getFont().deriveFont(jSourceLabel.getFont().getStyle() | java.awt.Font.BOLD, jSourceLabel.getFont().getSize()+1));
97 org.openide.awt.Mnemonics.setLocalizedText(jSourceLabel,
org.openide.util.NbBundle.getMessage(
ContextViewer.class,
"ContextViewer.jSourceLabel.text"));
99 javax.swing.GroupLayout jSourcePanelLayout =
new javax.swing.GroupLayout(jSourcePanel);
100 jSourcePanel.setLayout(jSourcePanelLayout);
101 jSourcePanelLayout.setHorizontalGroup(
102 jSourcePanelLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
103 .addGroup(jSourcePanelLayout.createSequentialGroup()
105 .addComponent(jSourceLabel)
106 .addContainerGap(304, Short.MAX_VALUE))
108 jSourcePanelLayout.setVerticalGroup(
109 jSourcePanelLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
110 .addGroup(jSourcePanelLayout.createSequentialGroup()
112 .addComponent(jSourceLabel)
116 jUsagePanel.setBackground(javax.swing.UIManager.getDefaults().getColor(
"window"));
118 jUsageLabel.setFont(jUsageLabel.getFont().deriveFont(jUsageLabel.getFont().getStyle() | java.awt.Font.BOLD, jUsageLabel.getFont().getSize()+1));
119 org.openide.awt.Mnemonics.setLocalizedText(jUsageLabel,
org.openide.util.NbBundle.getMessage(
ContextViewer.class,
"ContextViewer.jUsageLabel.text"));
121 javax.swing.GroupLayout jUsagePanelLayout =
new javax.swing.GroupLayout(jUsagePanel);
122 jUsagePanel.setLayout(jUsagePanelLayout);
123 jUsagePanelLayout.setHorizontalGroup(
124 jUsagePanelLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
125 .addGroup(jUsagePanelLayout.createSequentialGroup()
127 .addComponent(jUsageLabel)
128 .addContainerGap(298, Short.MAX_VALUE))
130 jUsagePanelLayout.setVerticalGroup(
131 jUsagePanelLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
132 .addGroup(jUsagePanelLayout.createSequentialGroup()
134 .addComponent(jUsageLabel)
138 jUnknownPanel.setBackground(
new java.awt.Color(255, 255, 255));
140 org.openide.awt.Mnemonics.setLocalizedText(jUnknownLabel,
org.openide.util.NbBundle.getMessage(
ContextViewer.class,
"ContextViewer.jUnknownLabel.text"));
142 javax.swing.GroupLayout jUnknownPanelLayout =
new javax.swing.GroupLayout(jUnknownPanel);
143 jUnknownPanel.setLayout(jUnknownPanelLayout);
144 jUnknownPanelLayout.setHorizontalGroup(
145 jUnknownPanelLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
146 .addGroup(jUnknownPanelLayout.createSequentialGroup()
148 .addComponent(jUnknownLabel)
149 .addContainerGap(javax.swing.GroupLayout.DEFAULT_SIZE, Short.MAX_VALUE))
151 jUnknownPanelLayout.setVerticalGroup(
152 jUnknownPanelLayout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
153 .addGroup(jUnknownPanelLayout.createSequentialGroup()
155 .addComponent(jUnknownLabel)
159 setBackground(
new java.awt.Color(255, 255, 255));
160 setPreferredSize(
new java.awt.Dimension(495, 358));
162 jScrollPane.setBackground(
new java.awt.Color(255, 255, 255));
164 javax.swing.GroupLayout layout =
new javax.swing.GroupLayout(
this);
165 this.setLayout(layout);
166 layout.setHorizontalGroup(
167 layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
168 .addComponent(jScrollPane, javax.swing.GroupLayout.DEFAULT_SIZE, 509, Short.MAX_VALUE)
170 layout.setVerticalGroup(
171 layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING)
172 .addComponent(jScrollPane, javax.swing.GroupLayout.DEFAULT_SIZE, 335, Short.MAX_VALUE)
178 if ((selectedNode == null) || (!isSupported(selectedNode))) {
183 AbstractFile file = selectedNode.getLookup().lookup(AbstractFile.class);
185 populatePanels(file);
187 logger.log(Level.SEVERE, String.format(
"Exception displaying context for file %s", file.getName()), ex);
192 "ContextViewer.title=Context",
193 "ContextViewer.toolTip=Displays context for selected file."
198 return Bundle.ContextViewer_title();
203 return Bundle.ContextViewer_toolTip();
218 contextSourcePanels.clear();
219 contextUsagePanels.clear();
226 if (node.getLookup().lookup(AbstractFile.class) != null) {
227 AbstractFile abstractFile = node.getLookup().lookup(AbstractFile.class);
228 for (BlackboardArtifact.ARTIFACT_TYPE artifactType : CONTEXT_ARTIFACTS) {
229 List<BlackboardArtifact> artifactsList;
231 artifactsList = abstractFile.getArtifacts(artifactType);
232 if (!artifactsList.isEmpty()) {
235 }
catch (TskCoreException ex) {
236 logger.log(Level.SEVERE, String.format(
"Exception while looking up context artifacts for file %s", abstractFile), ex);
252 "ContextViewer.unknownSource=Unknown ",
268 boolean foundASource =
false;
269 for (BlackboardArtifact.ARTIFACT_TYPE artifactType : CONTEXT_ARTIFACTS) {
270 List<BlackboardArtifact> artifactsList = tskCase.getBlackboardArtifacts(artifactType, sourceFile.getId());
272 foundASource = !artifactsList.isEmpty();
273 for (BlackboardArtifact contextArtifact : artifactsList) {
274 addAssociatedArtifactToPanel(contextArtifact);
277 javax.swing.JPanel contextContainer =
new javax.swing.JPanel();
278 contextContainer.add(jSourcePanel);
279 contextContainer.setLayout(
new BoxLayout(contextContainer, BoxLayout.Y_AXIS));
280 if (contextSourcePanels.isEmpty()) {
281 contextContainer.add(jUnknownPanel);
283 for (javax.swing.JPanel sourcePanel : contextSourcePanels) {
284 contextContainer.add(sourcePanel);
287 contextContainer.add(jUsagePanel);
288 if (contextUsagePanels.isEmpty()) {
289 contextContainer.add(jUnknownPanel);
291 for (javax.swing.JPanel usagePanel : contextUsagePanels) {
292 contextContainer.add(usagePanel);
296 contextContainer.setBackground(javax.swing.UIManager.getDefaults().getColor(
"window"));
297 contextContainer.setEnabled(foundASource);
298 contextContainer.setVisible(foundASource);
299 jScrollPane.getViewport().setView(contextContainer);
300 jScrollPane.setEnabled(foundASource);
301 jScrollPane.setVisible(foundASource);
302 jScrollPane.repaint();
303 jScrollPane.revalidate();
318 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT.getTypeID() == artifact.getArtifactTypeID()) {
319 BlackboardAttribute associatedArtifactAttribute = artifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
320 if (associatedArtifactAttribute != null) {
321 long artifactId = associatedArtifactAttribute.getValueLong();
322 BlackboardArtifact associatedArtifact = artifact.getSleuthkitCase().getBlackboardArtifact(artifactId);
324 addArtifactToPanels(associatedArtifact);
337 "ContextViewer.attachmentSource=Attached to: ",
338 "ContextViewer.downloadSource=Downloaded from: ",
339 "ContextViewer.recentDocs=Recent Documents: ",
340 "ContextViewer.programExecution=Program Execution: "
343 Long dateTime = getArtifactDateTime(associatedArtifact);
344 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() == associatedArtifact.getArtifactTypeID()
345 || BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == associatedArtifact.getArtifactTypeID()) {
346 String sourceName = Bundle.ContextViewer_attachmentSource();
347 String sourceText = msgArtifactToAbbreviatedString(associatedArtifact);
349 contextSourcePanels.add(sourcePanel);
351 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == associatedArtifact.getArtifactTypeID()
352 || BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID() == associatedArtifact.getArtifactTypeID()) {
353 String sourceName = Bundle.ContextViewer_downloadSource();
354 String sourceText = webDownloadArtifactToString(associatedArtifact);
356 contextSourcePanels.add(sourcePanel);
358 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == associatedArtifact.getArtifactTypeID()) {
359 String sourceName = Bundle.ContextViewer_recentDocs();
360 String sourceText = recentDocArtifactToString(associatedArtifact);
362 contextUsagePanels.add(usagePanel);
364 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == associatedArtifact.getArtifactTypeID()) {
365 String sourceName = Bundle.ContextViewer_programExecution();
366 String sourceText = programExecArtifactToString(associatedArtifact);
368 contextUsagePanels.add(usagePanel);
371 Collections.sort(contextSourcePanels,
new SortByDateTime());
372 Collections.sort(contextUsagePanels,
new SortByDateTime());
386 "ContextViewer.downloadURL=URL",
387 "ContextViewer.downloadedOn=On"
390 StringBuilder sb =
new StringBuilder(ARTIFACT_STR_MAX_LEN);
391 Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap = getAttributesMap(artifact);
393 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifact.getArtifactTypeID()
394 || BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID() == artifact.getArtifactTypeID()) {
395 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL, attributesMap, Bundle.ContextViewer_downloadURL());
396 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED, attributesMap, Bundle.ContextViewer_downloadedOn());
398 return sb.toString();
412 "ContextViewer.on=Opened at",
413 "ContextViewer.unknown=Opened at unknown time"
416 StringBuilder sb =
new StringBuilder(ARTIFACT_STR_MAX_LEN);
417 Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap = getAttributesMap(artifact);
419 BlackboardAttribute attribute = attributesMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME);
421 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == artifact.getArtifactTypeID()) {
422 if (attribute != null && attribute.getValueLong() > 0) {
423 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, attributesMap, Bundle.ContextViewer_on());
425 sb.append(Bundle.ContextViewer_unknown());
428 return sb.toString();
442 "ContextViewer.runOn=Program Run On",
443 "ContextViewer.runUnknown= Program Run at unknown time"
446 StringBuilder sb =
new StringBuilder(ARTIFACT_STR_MAX_LEN);
447 Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap = getAttributesMap(artifact);
449 BlackboardAttribute attribute = attributesMap.get(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME);
451 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == artifact.getArtifactTypeID()) {
452 if (attribute != null && attribute.getValueLong() > 0) {
453 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, attributesMap, Bundle.ContextViewer_runOn());
455 sb.append(Bundle.ContextViewer_runUnknown());
458 return sb.toString();
471 "ContextViewer.message=Message",
472 "ContextViewer.email=Email",
473 "ContextViewer.messageFrom=From",
474 "ContextViewer.messageTo=To",
475 "ContextViewer.messageOn=On",})
478 StringBuilder sb =
new StringBuilder(ARTIFACT_STR_MAX_LEN);
479 Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap = getAttributesMap(artifact);
481 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() == artifact.getArtifactTypeID()) {
482 sb.append(Bundle.ContextViewer_message()).append(
' ');
483 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM, attributesMap, Bundle.ContextViewer_messageFrom());
484 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO, attributesMap, Bundle.ContextViewer_messageTo());
485 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME, attributesMap, Bundle.ContextViewer_messageOn());
486 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == artifact.getArtifactTypeID()) {
487 sb.append(Bundle.ContextViewer_email()).append(
' ');
488 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM, attributesMap, Bundle.ContextViewer_messageFrom());
489 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO, attributesMap, Bundle.ContextViewer_messageTo());
490 appendAttributeString(sb, BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT, attributesMap, Bundle.ContextViewer_messageOn());
492 return sb.toString();
506 Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributesMap, String prependStr) {
508 BlackboardAttribute attribute = attributesMap.get(attribType);
509 if (attribute != null) {
510 String attrVal = attribute.getDisplayString();
511 if (!StringUtils.isEmpty(attrVal)) {
512 if (!StringUtils.isEmpty(prependStr)) {
513 sb.append(prependStr).append(
' ');
515 sb.append(StringUtils.abbreviate(attrVal, ATTRIBUTE_STR_MAX_LEN)).append(
' ');
530 private Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute>
getAttributesMap(BlackboardArtifact artifact)
throws TskCoreException {
531 Map<BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute> attributeMap =
new HashMap<>();
533 List<BlackboardAttribute> attributeList = artifact.getAttributes();
534 for (BlackboardAttribute attribute : attributeList) {
535 BlackboardAttribute.ATTRIBUTE_TYPE type = BlackboardAttribute.ATTRIBUTE_TYPE.fromID(attribute.getAttributeType().getTypeID());
536 attributeMap.put(type, attribute);
542 interface DateTimePanel {
561 BlackboardAttribute attribute = artifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME));
563 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == artifact.getArtifactTypeID()) {
564 attribute = artifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT));
565 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifact.getArtifactTypeID()
566 || BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID() == artifact.getArtifactTypeID()) {
567 attribute = artifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED));
569 return (attribute != null ? attribute.getValueLong() : null);
575 class SortByDateTime
implements Comparator<DateTimePanel> {
578 public int compare(DateTimePanel panel1, DateTimePanel panel2) {
579 Long dateTime1 = panel1.getDateTime();
580 Long dateTime2 = panel2.getDateTime();
582 if(dateTime1 == null && dateTime2 == null) {
584 }
else if(dateTime1 == null) {
586 }
else if(dateTime2 == null) {
590 return dateTime1.compareTo(dateTime2);
javax.swing.JPanel jSourcePanel
void addAssociatedArtifactToPanel(BlackboardArtifact artifact)
String webDownloadArtifactToString(BlackboardArtifact artifact)
javax.swing.JPanel jUnknownPanel
String recentDocArtifactToString(BlackboardArtifact artifact)
Map< BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute > getAttributesMap(BlackboardArtifact artifact)
void appendAttributeString(StringBuilder sb, BlackboardAttribute.ATTRIBUTE_TYPE attribType, Map< BlackboardAttribute.ATTRIBUTE_TYPE, BlackboardAttribute > attributesMap, String prependStr)
void setNode(Node selectedNode)
javax.swing.JPanel jUsagePanel
int isPreferred(Node node)
SleuthkitCase getSleuthkitCase()
String programExecArtifactToString(BlackboardArtifact artifact)
boolean isSupported(Node node)
void populatePanels(AbstractFile sourceFile)
void addArtifactToPanels(BlackboardArtifact associatedArtifact)
synchronized static Logger getLogger(String name)
Long getArtifactDateTime(BlackboardArtifact artifact)
static Case getCurrentCaseThrows()
String msgArtifactToAbbreviatedString(BlackboardArtifact artifact)
DataContentViewer createInstance()
javax.swing.JScrollPane jScrollPane