LeappFileProcessor.java

Go to the documentation of this file.

/*
 * Autopsy Forensic Browser
 *
 * Copyright 2020 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.modules.leappanalyzers;

import java.io.BufferedReader;
import java.io.File;
import java.io.FileNotFoundException;
import java.io.FileReader;
import java.io.IOException;
import java.io.UncheckedIOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.text.ParseException;
import java.text.SimpleDateFormat;
import java.util.List;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.Date;
import java.util.HashMap;
import static java.util.Locale.US;
import java.util.Map;
import java.util.logging.Level;
import java.util.stream.Collectors;
import java.util.stream.IntStream;
import java.util.stream.Stream;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import org.apache.commons.collections4.MapUtils;
import org.apache.commons.io.FilenameUtils;
import org.openide.util.NbBundle;
import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.PlatformUtil;
import org.sleuthkit.autopsy.ingest.IngestModule.IngestModuleException;
import org.sleuthkit.autopsy.ingest.IngestModule.ProcessResult;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.Blackboard;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskException;
import org.w3c.dom.Document;
import org.w3c.dom.NamedNodeMap;
import org.w3c.dom.NodeList;
import org.xml.sax.SAXException;

public final class LeappFileProcessor {

    private static class TsvColumn {

        private final String attributeName;
        private final String columnName;
        private final boolean required;

        TsvColumn(String attributeName, String columnName, boolean required) {
            this.attributeName = attributeName;
            this.columnName = columnName;
            this.required = required;
        }

        String getAttributeName() {
            return attributeName;
        }

        String getColumnName() {
            return columnName;
        }

        boolean isRequired() {
            return required;
        }
    }

    private static final Logger logger = Logger.getLogger(LeappFileProcessor.class.getName());
    private static final String MODULE_NAME = ILeappAnalyzerModuleFactory.getModuleName();

    private final String xmlFile; //NON-NLS

    private final Map<String, String> tsvFiles;
    private final Map<String, String> tsvFileArtifacts;
    private final Map<String, String> tsvFileArtifactComments;
    private final Map<String, List<TsvColumn>> tsvFileAttributes;

    Blackboard blkBoard;

    public LeappFileProcessor(String xmlFile) throws IOException, IngestModuleException, NoCurrentCaseException {
        this.tsvFiles = new HashMap<>();
        this.tsvFileArtifacts = new HashMap<>();
        this.tsvFileArtifactComments = new HashMap<>();
        this.tsvFileAttributes = new HashMap<>();
        this.xmlFile = xmlFile;

        blkBoard = Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboard();

        configExtractor();
        loadConfigFile();

    }

    @NbBundle.Messages({
        "LeappFileProcessor.error.running.Leapp=Error running Leapp, see log file.",
        "LeappFileProcessor.error.creating.output.dir=Error creating Leapp module output directory.",
        "LeappFileProcessor.starting.Leapp=Starting Leapp",
        "LeappFileProcessor.running.Leapp=Running Leapp",
        "LeappFileProcessor.has.run=Leapp",
        "LeappFileProcessor.Leapp.cancelled=Leapp run was canceled",
        "LeappFileProcessor.completed=Leapp Processing Completed",
        "LeappFileProcessor.error.reading.Leapp.directory=Error reading Leapp Output Directory"})
    public ProcessResult processFiles(Content dataSource, Path moduleOutputPath, AbstractFile LeappFile) {
        try {
            List<String> LeappTsvOutputFiles = findTsvFiles(moduleOutputPath);
            processLeappFiles(LeappTsvOutputFiles, LeappFile);
        } catch (IOException | IngestModuleException ex) {
            logger.log(Level.SEVERE, String.format("Error trying to process Leapp output files in directory %s. ", moduleOutputPath.toString()), ex); //NON-NLS
            return ProcessResult.ERROR;
        }

        return ProcessResult.OK;
    }

    public ProcessResult processFileSystem(Content dataSource, Path moduleOutputPath) {

        try {
            List<String> LeappTsvOutputFiles = findTsvFiles(moduleOutputPath);
            processLeappFiles(LeappTsvOutputFiles, dataSource);
        } catch (IngestModuleException ex) {
            logger.log(Level.SEVERE, String.format("Error trying to process Leapp output files in directory %s. ", moduleOutputPath.toString()), ex); //NON-NLS
            return ProcessResult.ERROR;
        }

        return ProcessResult.OK;
    }

    private List<String> findTsvFiles(Path LeappOutputDir) throws IngestModuleException {
        List<String> allTsvFiles = new ArrayList<>();
        List<String> foundTsvFiles = new ArrayList<>();

        try (Stream<Path> walk = Files.walk(LeappOutputDir)) {

            allTsvFiles = walk.map(x -> x.toString())
                    .filter(f -> f.toLowerCase().endsWith(".tsv")).collect(Collectors.toList());

            for (String tsvFile : allTsvFiles) {
                if (tsvFiles.containsKey(FilenameUtils.getName(tsvFile.toLowerCase()))) {
                    foundTsvFiles.add(tsvFile);
                }
            }

        } catch (IOException | UncheckedIOException e) {
            throw new IngestModuleException(Bundle.LeappFileProcessor_error_reading_Leapp_directory() + LeappOutputDir.toString(), e);
        }

        return foundTsvFiles;

    }

    private void processLeappFiles(List<String> LeappFilesToProcess, AbstractFile LeappImageFile) throws FileNotFoundException, IOException, IngestModuleException {
        List<BlackboardArtifact> bbartifacts = new ArrayList<>();

        for (String LeappFileName : LeappFilesToProcess) {
            String fileName = FilenameUtils.getName(LeappFileName);
            File LeappFile = new File(LeappFileName);
            if (tsvFileAttributes.containsKey(fileName)) {
                List<TsvColumn> attrList = tsvFileAttributes.get(fileName);
                try {
                    BlackboardArtifact.Type artifactType = Case.getCurrentCase().getSleuthkitCase().getArtifactType(tsvFileArtifacts.get(fileName));

                    processFile(LeappFile, attrList, fileName, artifactType, bbartifacts, LeappImageFile);

                } catch (TskCoreException ex) {
                    throw new IngestModuleException(String.format("Error getting Blackboard Artifact Type for %s", tsvFileArtifacts.get(fileName)), ex);
                }
            }

        }

        if (!bbartifacts.isEmpty()) {
            postArtifacts(bbartifacts);
        }

    }

    private void processLeappFiles(List<String> LeappFilesToProcess, Content dataSource) throws IngestModuleException {
        List<BlackboardArtifact> bbartifacts = new ArrayList<>();

        for (String LeappFileName : LeappFilesToProcess) {
            String fileName = FilenameUtils.getName(LeappFileName);
            File LeappFile = new File(LeappFileName);
            if (tsvFileAttributes.containsKey(fileName)) {
                List<TsvColumn> attrList = tsvFileAttributes.get(fileName);
                BlackboardArtifact.Type artifactType = null;
                try {
                    artifactType = Case.getCurrentCase().getSleuthkitCase().getArtifactType(tsvFileArtifacts.get(fileName));
                } catch (TskCoreException ex) {
                    logger.log(Level.SEVERE, String.format("Error getting Blackboard Artifact Type for %s", tsvFileArtifacts.get(fileName)), ex);
                }

                if (artifactType == null) {
                    continue;
                }

                try {
                    processFile(LeappFile, attrList, fileName, artifactType, bbartifacts, dataSource);
                } catch (TskCoreException | IOException ex) {
                    logger.log(Level.SEVERE, String.format("Error processing file at %s", LeappFile.toString()), ex);
                }
            }

        }

        if (!bbartifacts.isEmpty()) {
            postArtifacts(bbartifacts);
        }

    }

    private void processFile(File LeappFile, List<TsvColumn> attrList, String fileName, BlackboardArtifact.Type artifactType,
            List<BlackboardArtifact> bbartifacts, Content dataSource) throws FileNotFoundException, IOException, IngestModuleException,
            TskCoreException {

        if (LeappFile == null || !LeappFile.exists() || fileName == null) {
            logger.log(Level.WARNING, String.format("Leap file: %s is null or does not exist", LeappFile == null ? LeappFile.toString() : "<null>"));
            return;
        } else if (attrList == null || artifactType == null || dataSource == null) {
            logger.log(Level.WARNING, String.format("attribute list, artifact type or dataSource not provided for %s", LeappFile == null ? LeappFile.toString() : "<null>"));
            return;
        }

        try (BufferedReader reader = new BufferedReader(new FileReader(LeappFile))) {
            String header = reader.readLine();
            // Check first line, if it is null then no heading so nothing to match to, close and go to next file.
            if (header != null) {
                Map<Integer, String> columnNumberToProcess = findColumnsToProcess(fileName, header, attrList);
                String line = reader.readLine();
                while (line != null) {
                    Collection<BlackboardAttribute> bbattributes = processReadLine(line, columnNumberToProcess, fileName);

                    if (!bbattributes.isEmpty() && !blkBoard.artifactExists(dataSource, BlackboardArtifact.ARTIFACT_TYPE.fromID(artifactType.getTypeID()), bbattributes)) {
                        BlackboardArtifact bbartifact = createArtifactWithAttributes(artifactType.getTypeID(), dataSource, bbattributes);
                        if (bbartifact != null) {
                            bbartifacts.add(bbartifact);
                        }
                    }

                    line = reader.readLine();
                }
            }
        }

    }

    private Collection<BlackboardAttribute> processReadLine(String line, Map<Integer, String> columnNumberToProcess, String fileName) throws IngestModuleException {
        if (MapUtils.isEmpty(columnNumberToProcess)) {
            return Collections.emptyList();
        } else if (line == null) {
            logger.log(Level.WARNING, "Line is null.  Returning empty list for attributes.");
            return Collections.emptyList();
        }

        String[] columnValues;

        // Check to see if the 2 values are equal, they may not be equal if there is no corresponding data in the line.
        // or if the size of the line to split  is not equal to the column numbers we are looking to process. This
        // can happen when the last value of the tsv line has no data in it.
        // If this happens then adding an empty value(s) for each columnValue where data does not exist
        Integer maxColumnNumber = Collections.max(columnNumberToProcess.keySet());
        if ((maxColumnNumber > line.split("\\t").length) || (columnNumberToProcess.size() > line.split("\\t").length)) {
            columnValues = Arrays.copyOf(line.split("\\t"), maxColumnNumber + 1);
        } else {
            columnValues = line.split("\\t");
        }

        Collection<BlackboardAttribute> bbattributes = new ArrayList<BlackboardAttribute>();

        for (Map.Entry<Integer, String> columnToProcess : columnNumberToProcess.entrySet()) {
            Integer columnNumber = columnToProcess.getKey();
            String attributeName = columnToProcess.getValue();

            if (columnValues[columnNumber] != null) {
                try {
                    BlackboardAttribute.Type attributeType = Case.getCurrentCase().getSleuthkitCase().getAttributeType(attributeName.toUpperCase());
                    if (attributeType == null) {
                        continue;
                    }
                    String attrType = attributeType.getValueType().getLabel().toUpperCase();
                    checkAttributeType(bbattributes, attrType, columnValues, columnNumber, attributeType, fileName);
                } catch (TskCoreException ex) {
                    throw new IngestModuleException(String.format("Error getting Attribute type for Attribute Name %s", attributeName), ex); //NON-NLS
                }
            }
        }

        if (tsvFileArtifactComments.containsKey(fileName)) {
            bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COMMENT, MODULE_NAME, tsvFileArtifactComments.get(fileName)));
        }

        return bbattributes;

    }

    private void checkAttributeType(Collection<BlackboardAttribute> bbattributes, String attrType, String[] columnValues, int columnNumber, BlackboardAttribute.Type attributeType,
            String fileName) {

        if (columnValues == null || columnNumber < 0 || columnNumber > columnValues.length || columnValues[columnNumber] == null) {
            logger.log(Level.WARNING, String.format("Unable to determine column value at index %d in columnValues: %s",
                    columnNumber,
                    columnValues == null ? "<null>" : "[" + String.join(", ", columnValues) + "]"));
            return;
        }

        String columnValue = columnValues[columnNumber];

        if (attrType.matches("STRING")) {
            bbattributes.add(new BlackboardAttribute(attributeType, MODULE_NAME, columnValue));
        } else if (attrType.matches("INTEGER")) {
            try {
                bbattributes.add(new BlackboardAttribute(attributeType, MODULE_NAME, Integer.valueOf(columnValue)));
            } catch (NumberFormatException ex) {
                logger.log(Level.WARNING, String.format("Unable to format %s as an integer.", columnValue), ex);
            }
        } else if (attrType.matches("LONG")) {
            try {
                bbattributes.add(new BlackboardAttribute(attributeType, MODULE_NAME, Long.valueOf(columnValue)));
            } catch (NumberFormatException ex) {
                logger.log(Level.WARNING, String.format("Unable to format %s as an long.", columnValue), ex);
            }
        } else if (attrType.matches("DOUBLE")) {
            try {
                bbattributes.add(new BlackboardAttribute(attributeType, MODULE_NAME, Double.valueOf(columnValue)));
            } catch (NumberFormatException ex) {
                logger.log(Level.WARNING, String.format("Unable to format %s as an double.", columnValue), ex);
            }
        } else if (attrType.matches("BYTE")) {
            try {
                bbattributes.add(new BlackboardAttribute(attributeType, MODULE_NAME, Byte.valueOf(columnValue)));
            } catch (NumberFormatException ex) {
                logger.log(Level.WARNING, String.format("Unable to format %s as an byte.", columnValue), ex);
            }
        } else if (attrType.matches("DATETIME")) {
            // format of data should be the same in all the data and the format is 2020-03-28 01:00:17
            SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-d HH:mm:ss", US);
            Long dateLong = Long.valueOf(0);
            try {
                Date newDate = dateFormat.parse(columnValue);
                dateLong = newDate.getTime() / 1000;
                bbattributes.add(new BlackboardAttribute(attributeType, MODULE_NAME, dateLong));
            } catch (ParseException ex) {
                // catching error and displaying date that could not be parsed
                // we set the timestamp to 0 and continue on processing
                logger.log(Level.WARNING, String.format("Failed to parse date/time %s for attribute type %s in file %s.", columnValue, attributeType.getDisplayName(), fileName)); //NON-NLS
            }
        } else if (attrType.matches("JSON")) {

            bbattributes.add(new BlackboardAttribute(attributeType, MODULE_NAME, columnValue));
        } else {
            // Log this and continue on with processing
            logger.log(Level.WARNING, String.format("Attribute Type %s not defined.", attrType)); //NON-NLS                   
        }

    }

    private Map<Integer, String> findColumnsToProcess(String fileName, String line, List<TsvColumn> attrList) {
        String[] columnNames = line.split("\\t");
        HashMap<Integer, String> columnsToProcess = new HashMap<>();

        Integer columnPosition = 0;
        for (String columnName : columnNames) {
            // for some reason the first column of the line has unprintable characters so removing them
            String cleanColumnName = columnName.trim().replaceAll("[^\\n\\r\\t\\p{Print}]", "");
            for (TsvColumn tsvColumn : attrList) {
                if (cleanColumnName.equalsIgnoreCase(tsvColumn.getColumnName())) {
                    columnsToProcess.put(columnPosition, tsvColumn.getAttributeName());
                    break;
                }
            }
            columnPosition++;
        }

        if (columnsToProcess.size() != attrList.size()) {
            String missingColumns = IntStream.range(0, attrList.size())
                    .filter((idx) -> !columnsToProcess.containsKey(attrList.get(idx).getAttributeName()))
                    .mapToObj((idx) -> String.format("'%s'", attrList.get(idx).getColumnName() == null ? "<null>" : attrList.get(idx).getColumnName()))
                    .collect(Collectors.joining(", "));

            logger.log(Level.WARNING, String.format("Columns size expected not found in file %s based on xml from %s. Column Keys Missing = [%s]; Header Line = '%s'.",
                    this.xmlFile == null ? "<null>" : this.xmlFile,
                    fileName,
                    missingColumns,
                    line));
        }

        return columnsToProcess;
    }

    @NbBundle.Messages({
        "LeappFileProcessor.cannot.load.artifact.xml=Cannor load xml artifact file.",
        "LeappFileProcessor.cannotBuildXmlParser=Cannot buld an XML parser.",
        "LeappFileProcessor_cannotParseXml=Cannot Parse XML file.",
        "LeappFileProcessor.postartifacts_error=Error posting Blackboard Artifact",
        "LeappFileProcessor.error.creating.new.artifacts=Error creating new artifacts."
    })

    private void loadConfigFile() throws IngestModuleException {
        Document xmlinput;
        try {
            String path = PlatformUtil.getUserConfigDirectory() + File.separator + xmlFile;
            File f = new File(path);
            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
            DocumentBuilder db = dbf.newDocumentBuilder();
            xmlinput = db.parse(f);

        } catch (IOException e) {
            throw new IngestModuleException(Bundle.LeappFileProcessor_cannot_load_artifact_xml() + e.getLocalizedMessage(), e); //NON-NLS
        } catch (ParserConfigurationException pce) {
            throw new IngestModuleException(Bundle.LeappFileProcessor_cannotBuildXmlParser() + pce.getLocalizedMessage(), pce); //NON-NLS
        } catch (SAXException sxe) {
            throw new IngestModuleException(Bundle.LeappFileProcessor_cannotParseXml() + sxe.getLocalizedMessage(), sxe); //NON-NLS
        }

        getFileNode(xmlinput);
        getArtifactNode(xmlinput);
        getAttributeNodes(xmlinput);

    }

    private void getFileNode(Document xmlinput) {

        NodeList nlist = xmlinput.getElementsByTagName("FileName"); //NON-NLS

        for (int i = 0; i < nlist.getLength(); i++) {
            NamedNodeMap nnm = nlist.item(i).getAttributes();
            tsvFiles.put(nnm.getNamedItem("filename").getNodeValue().toLowerCase(), nnm.getNamedItem("description").getNodeValue());

        }

    }

    private void getArtifactNode(Document xmlinput) {

        NodeList artifactNlist = xmlinput.getElementsByTagName("ArtifactName"); //NON-NLS
        for (int k = 0; k < artifactNlist.getLength(); k++) {
            NamedNodeMap nnm = artifactNlist.item(k).getAttributes();
            String artifactName = nnm.getNamedItem("artifactname").getNodeValue();
            String comment = nnm.getNamedItem("comment").getNodeValue();
            String parentName = artifactNlist.item(k).getParentNode().getAttributes().getNamedItem("filename").getNodeValue();

            BlackboardArtifact.Type foundArtifactType = null;
            try {
                foundArtifactType = Case.getCurrentCase().getSleuthkitCase().getArtifactType(artifactName);
            } catch (TskCoreException ex) {
                logger.log(Level.SEVERE, String.format("There was an issue that arose while trying to fetch artifact type for %s.", artifactName), ex);
            }

            if (foundArtifactType == null) {
                logger.log(Level.SEVERE, String.format("No known artifact mapping found for [artifact: %s, %s]",
                        artifactName, getXmlFileIdentifier(parentName)));
            }

            tsvFileArtifacts.put(parentName, artifactName);

            if (!comment.toLowerCase().matches("null")) {
                tsvFileArtifactComments.put(parentName, comment);
            }
        }

    }

    private String getXmlFileIdentifier(String fileName) {
        return String.format("file: %s, filename: %s",
                this.xmlFile == null ? "<null>" : this.xmlFile,
                fileName == null ? "<null>" : fileName);
    }

    private String getXmlAttrIdentifier(String fileName, String attributeName) {
        return String.format("attribute: %s %s",
                attributeName == null ? "<null>" : attributeName,
                getXmlFileIdentifier(fileName));
    }

    private void getAttributeNodes(Document xmlinput) {

        NodeList attributeNlist = xmlinput.getElementsByTagName("AttributeName"); //NON-NLS
        for (int k = 0; k < attributeNlist.getLength(); k++) {
            NamedNodeMap nnm = attributeNlist.item(k).getAttributes();
            String attributeName = nnm.getNamedItem("attributename").getNodeValue();

            if (!attributeName.toLowerCase().matches("null")) {
                String columnName = nnm.getNamedItem("columnName").getNodeValue();
                String required = nnm.getNamedItem("required").getNodeValue();
                String parentName = attributeNlist.item(k).getParentNode().getParentNode().getAttributes().getNamedItem("filename").getNodeValue();

                BlackboardAttribute.Type foundAttrType = null;
                try {
                    foundAttrType = Case.getCurrentCase().getSleuthkitCase().getAttributeType(attributeName.toUpperCase());
                } catch (TskCoreException ex) {
                    logger.log(Level.SEVERE, String.format("There was an issue that arose while trying to fetch attribute type for %s.", attributeName), ex);
                }

                if (foundAttrType == null) {
                    logger.log(Level.SEVERE, String.format("No known attribute mapping found for [%s]", getXmlAttrIdentifier(parentName, attributeName)));
                }

                if (required != null && required.compareToIgnoreCase("yes") != 0 && required.compareToIgnoreCase("no") != 0) {
                    logger.log(Level.SEVERE, String.format("Required value %s did not match 'yes' or 'no' for [%s]",
                            required, getXmlAttrIdentifier(parentName, attributeName)));
                }

                if (columnName == null) {
                    logger.log(Level.SEVERE, String.format("No column name provided for [%s]", getXmlAttrIdentifier(parentName, attributeName)));
                } else if (columnName.trim().length() != columnName.length()) {
                    logger.log(Level.SEVERE, String.format("Column name '%s' starts or ends with whitespace for [%s]", columnName, getXmlAttrIdentifier(parentName, attributeName)));
                } else if (columnName.matches("[^ \\S]")) {
                    logger.log(Level.SEVERE, String.format("Column name '%s' contains invalid characters [%s]", columnName, getXmlAttrIdentifier(parentName, attributeName)));
                }

                TsvColumn thisCol = new TsvColumn(
                        attributeName.toLowerCase(),
                        columnName.toLowerCase(),
                        "yes".compareToIgnoreCase(required) == 0);

                if (tsvFileAttributes.containsKey(parentName)) {
                    List<TsvColumn> attrList = tsvFileAttributes.get(parentName);
                    attrList.add(thisCol);
                    tsvFileAttributes.replace(parentName, attrList);
                } else {
                    List<TsvColumn> attrList = new ArrayList<>();
                    attrList.add(thisCol);
                    tsvFileAttributes.put(parentName, attrList);
                }
            }

        }
    }

    private BlackboardArtifact createArtifactWithAttributes(int type, AbstractFile abstractFile, Collection<BlackboardAttribute> bbattributes) {
        try {
            BlackboardArtifact bbart = abstractFile.newArtifact(type);
            bbart.addAttributes(bbattributes);
            return bbart;
        } catch (TskException ex) {
            logger.log(Level.WARNING, Bundle.LeappFileProcessor_error_creating_new_artifacts(), ex); //NON-NLS
        }
        return null;
    }

    private BlackboardArtifact createArtifactWithAttributes(int type, Content dataSource, Collection<BlackboardAttribute> bbattributes) {
        try {
            BlackboardArtifact bbart = dataSource.newArtifact(type);
            bbart.addAttributes(bbattributes);
            return bbart;
        } catch (TskException ex) {
            logger.log(Level.WARNING, Bundle.LeappFileProcessor_error_creating_new_artifacts(), ex); //NON-NLS
        }
        return null;
    }

    void postArtifacts(Collection<BlackboardArtifact> artifacts) {
        if (artifacts == null || artifacts.isEmpty()) {
            return;
        }

        try {
            Case.getCurrentCase().getSleuthkitCase().getBlackboard().postArtifacts(artifacts, MODULE_NAME);
        } catch (Blackboard.BlackboardException ex) {
            logger.log(Level.SEVERE, Bundle.LeappFileProcessor_postartifacts_error(), ex); //NON-NLS
        }
    }

    private void configExtractor() throws IOException {
        PlatformUtil.extractResourceToUserConfigDir(LeappFileProcessor.class,
                xmlFile, true);
    }

}