Autopsy  4.18.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Private Member Functions | Static Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule Class Reference

Inherits org.sleuthkit.autopsy.report.ReportModule.

Classes

class  GetImageTagCallback
 
class  GetInterestingItemSetNamesCallback
 
class  StoreMaxIdCallback
 

Public Member Functions

 PortableCaseReportModule ()
 
void generateReport (String reportPath, PortableCaseReportModuleSettings options, ReportProgressPanel progressPanel)
 
default ReportModuleSettings getConfiguration ()
 
default JPanel getConfigurationPanel ()
 
default ReportModuleSettings getDefaultConfiguration ()
 
String getDescription ()
 
String getName ()
 
String getRelativeFilePath ()
 
default void setConfiguration (ReportModuleSettings settings)
 

Private Member Functions

void addArtifactsToPortableCase (TagName oldTagName, ReportProgressPanel progressPanel) throws TskCoreException
 
void addFilesToPortableCase (TagName oldTagName, ReportProgressPanel progressPanel) throws TskCoreException
 
void addImageTagToPortableCase (ContentTag newContentTag, String appData) throws TskCoreException
 
boolean addUniqueFile (Content content, DataSource dataSource, Path tmpDir, Gson gson, CaseUcoExporter exporter, JsonWriter reportWriter, boolean dataSourceHasBeenIncluded) throws IOException, TskCoreException
 
void cleanup ()
 
void closePortableCaseDatabase ()
 
boolean compressCase (ReportProgressPanel progressPanel, String folderToCompress)
 
void copyApplication (Path sourceFolder, String destBaseFolder) throws IOException
 
BlackboardArtifact copyArtifact (long newContentId, BlackboardArtifact artifactToCopy) throws TskCoreException
 
void copyAttachments (BlackboardArtifact newArtifact, BlackboardArtifact oldArtifact, AbstractFile newFile) throws TskCoreException
 
long copyContent (Content content) throws TskCoreException
 
long copyContentToPortableCase (Content content, ReportProgressPanel progressPanel) throws TskCoreException
 
void copyOsAccount (Long oldOsAccountId) throws TskCoreException
 
void copyPathID (BlackboardArtifact newArtifact, BlackboardArtifact oldArtifact) throws TskCoreException
 
void createAppLaunchBatFile (String destBaseFolder) throws IOException
 
void createCase (File outputDir, ReportProgressPanel progressPanel)
 
void generateCaseUcoReport (List< TagName > tagNames, List< String > setNames, ReportProgressPanel progressPanel)
 
List< String > getAllInterestingItemsSets () throws NoCurrentCaseException, TskCoreException
 
Path getApplicationBasePath ()
 
String getAutopsyExeName ()
 
Path getAutopsyExePath ()
 
String getExportSubfolder (AbstractFile abstractFile)
 
String getImageTagDataForContentTag (ContentTag tag) throws TskCoreException
 
Multimap< Long, BlackboardArtifact > getInterestingArtifactsBySetName (SleuthkitCase skCase, List< String > setNames) throws TskCoreException
 
int getNewArtifactTypeId (BlackboardArtifact oldArtifact) throws TskCoreException
 
BlackboardAttribute.Type getNewAttributeType (BlackboardAttribute oldAttribute) throws TskCoreException
 
void handleCancellation (ReportProgressPanel progressPanel)
 
void handleError (String logWarning, String dialogWarning, Exception ex, ReportProgressPanel progressPanel)
 
void initializeImageTags (ReportProgressPanel progressPanel) throws TskCoreException
 
void saveHighestIds () throws TskCoreException
 

Static Private Member Functions

static File locate7ZipExecutable ()
 

Private Attributes

File caseFolder = null
 
String caseName = ""
 
File copiedFilesFolder = null
 
Case currentCase = null
 
final Map< Long, Content > newIdToContent = new HashMap<>()
 
final Map< Long, BlackboardArtifact > oldArtifactIdToNewArtifact = new HashMap<>()
 
final Map< Integer, Integer > oldArtTypeIdToNewArtTypeId = new HashMap<>()
 
final Map< Integer, BlackboardAttribute.Type > oldAttrTypeIdToNewAttrType = new HashMap<>()
 
final Map< Long, Content > oldIdToNewContent = new HashMap<>()
 
final Map< Long, Long > oldOsAccountIdToNewOsAccountId = new HashMap<>()
 
final Map< Long, OsAccountRealm > oldRealmIdToNewRealm = new HashMap<>()
 
final Map< TagName, TagName > oldTagNameToNewTagName = new HashMap<>()
 
SleuthkitCase portableSkCase = null
 
PortableCaseReportModuleSettings settings
 

Static Private Attributes

static final String CASE_UCO_FILE_NAME = "portable_CASE_UCO_output"
 
static final String CASE_UCO_TMP_DIR = "case_uco_tmp"
 
static final String FILE_FOLDER_NAME = "PortableCaseFiles"
 
static final List< FileTypeCategoryFILE_TYPE_CATEGORIES
 
static final Logger logger = Logger.getLogger(PortableCaseReportModule.class.getName())
 
static final String MAX_ID_TABLE_NAME = "portable_case_max_ids"
 
static final List< Integer > SPECIALLY_HANDLED_ATTRS
 
static final String UNKNOWN_FILE_TYPE_FOLDER = "Other"
 

Detailed Description

Creates a portable case from tagged files

Definition at line 101 of file PortableCaseReportModule.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.PortableCaseReportModule ( )

Definition at line 150 of file PortableCaseReportModule.java.

Member Function Documentation

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addArtifactsToPortableCase ( TagName  oldTagName,
ReportProgressPanel  progressPanel 
) throws TskCoreException
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addFilesToPortableCase ( TagName  oldTagName,
ReportProgressPanel  progressPanel 
) throws TskCoreException
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addImageTagToPortableCase ( ContentTag  newContentTag,
String  appData 
) throws TskCoreException
private

Add an image tag to the portable case.

Parameters
newContentTagThe content tag in the portable case
appDataThe string to copy into app_data
Exceptions
TskCoreException

Definition at line 879 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.casemodule.services.contentviewertags.ContentViewerTagManager.TABLE_NAME.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addFilesToPortableCase().

boolean org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addUniqueFile ( Content  content,
DataSource  dataSource,
Path  tmpDir,
Gson  gson,
CaseUcoExporter  exporter,
JsonWriter  reportWriter,
boolean  dataSourceHasBeenIncluded 
) throws IOException, TskCoreException
private

Adds the content if and only if it has not already been seen.

Parameters
contentContent to add to the report.
dataSourceParent dataSource of the content instance.
tmpDirPath to the tmpDir to enforce uniqueness
gson
exporter
reportWriterReport generator instance to add the content to
dataSourceHasBeenIncludedFlag determining if the data source should be written to the report (false indicates that it should be written).
Exceptions
IOExceptionIf an I/O error occurs.
TskCoreExceptionIf an internal database error occurs.

return True if the file was written during this operation.

Definition at line 626 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.coreutils.FileUtil.escapeFileName(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getExportSubfolder().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateCaseUcoReport().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.cleanup ( )
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.closePortableCaseDatabase ( )
private
boolean org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.compressCase ( ReportProgressPanel  progressPanel,
String  folderToCompress 
)
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyApplication ( Path  sourceFolder,
String  destBaseFolder 
) throws IOException
private

Copy the sorceFolder to destBaseFolder/appName.

Parameters
sourceFolderAutopsy installation directory.
destBaseFolderReport base direction.
Exceptions
IOException

Definition at line 1453 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.core.UserPreferences.getAppName().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport().

BlackboardArtifact org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyArtifact ( long  newContentId,
BlackboardArtifact  artifactToCopy 
) throws TskCoreException
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyAttachments ( BlackboardArtifact  newArtifact,
BlackboardArtifact  oldArtifact,
AbstractFile  newFile 
) throws TskCoreException
private

Copy attachments to the portable case.

Parameters
newArtifactThe new artifact in the portable case. Should not have a TSK_ATTACHMENTS attribute.
oldArtifactThe old artifact.
newFileThe new file in the portable case associated with the artifact.
Exceptions
TskCoreException

Definition at line 1347 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContent(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addArtifactsToPortableCase().

long org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContent ( Content  content) throws TskCoreException
private
long org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContentToPortableCase ( Content  content,
ReportProgressPanel  progressPanel 
) throws TskCoreException
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyOsAccount ( Long  oldOsAccountId) throws TskCoreException
private

Copy an OS Account to the new case and add it to the oldOsAccountIdToNewOsAccountId map. Will also copy the associated realm.

Parameters
oldOsAccountIdThe OS account id in the current case.

Definition at line 1255 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyArtifact(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContent().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyPathID ( BlackboardArtifact  newArtifact,
BlackboardArtifact  oldArtifact 
) throws TskCoreException
private

Copy path ID attribute to new case along with the referenced file.

Parameters
newArtifactThe new artifact in the portable case. Should not have a TSK_PATH_ID attribute.
oldArtifactThe old artifact.
Exceptions
TskCoreException

Definition at line 1323 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContent(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addArtifactsToPortableCase().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createAppLaunchBatFile ( String  destBaseFolder) throws IOException
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createCase ( File  outputDir,
ReportProgressPanel  progressPanel 
)
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateCaseUcoReport ( List< TagName >  tagNames,
List< String >  setNames,
ReportProgressPanel  progressPanel 
)
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport ( String  reportPath,
PortableCaseReportModuleSettings  options,
ReportProgressPanel  progressPanel 
)

Definition at line 243 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addArtifactsToPortableCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addFilesToPortableCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.areAllSetsSelected(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.areAllTagsSelected(), org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.CANCELED, org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.caseName, org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.cleanup(), org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.COMPLETE, org.sleuthkit.autopsy.report.ReportProgressPanel.complete(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.compressCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyApplication(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContentToPortableCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createAppLaunchBatFile(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateCaseUcoReport(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getAllInterestingItemsSets(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getApplicationBasePath(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.casemodule.Case.getDisplayName(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.getSelectedSetNames(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.getSelectedTagNames(), org.sleuthkit.autopsy.casemodule.Case.getServices(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.report.ReportProgressPanel.getStatus(), org.sleuthkit.autopsy.casemodule.services.TagsManager.getTagNamesInUse(), org.sleuthkit.autopsy.casemodule.services.Services.getTagsManager(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleCancellation(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleError(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.includeApplication(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.initializeImageTags(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldAttrTypeIdToNewAttrType, org.sleuthkit.autopsy.report.ReportProgressPanel.setIndeterminate(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.shouldCompress(), org.sleuthkit.autopsy.report.ReportProgressPanel.start(), and org.sleuthkit.autopsy.report.ReportProgressPanel.updateStatusLabel().

List<String> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getAllInterestingItemsSets ( ) throws NoCurrentCaseException, TskCoreException
private
Path org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getApplicationBasePath ( )
private

Returns base path of the users autopsy installation.

Returns
Path of autopsy installation.

Definition at line 1418 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getAutopsyExePath().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport().

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getAutopsyExeName ( )
private
Path org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getAutopsyExePath ( )
private
default ReportModuleSettings org.sleuthkit.autopsy.report.ReportModule.getConfiguration ( )
inherited

Get current configuration for this report module.

Returns
Object which contains current report module settings.

Implemented in org.sleuthkit.autopsy.report.modules.stix.STIXReportModule, org.sleuthkit.autopsy.report.modules.html.HTMLReport, and org.sleuthkit.autopsy.report.modules.taggedhashes.SaveTaggedHashesToHashDb.

Definition at line 79 of file ReportModule.java.

default JPanel org.sleuthkit.autopsy.report.ReportModule.getConfigurationPanel ( )
inherited
default ReportModuleSettings org.sleuthkit.autopsy.report.ReportModule.getDefaultConfiguration ( )
inherited
String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getDescription ( )

Gets a one-line, user friendly description of the type of report this module generates.

Implements org.sleuthkit.autopsy.report.ReportModule.

Definition at line 165 of file PortableCaseReportModule.java.

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getExportSubfolder ( AbstractFile  abstractFile)
private

Return the subfolder name for this file based on MIME type

Parameters
abstractFilethe file
Returns
the name of the appropriate subfolder for this file type

Definition at line 1400 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.UNKNOWN_FILE_TYPE_FOLDER.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addUniqueFile(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContent().

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getImageTagDataForContentTag ( ContentTag  tag) throws TskCoreException
private

Gets the image tag data for a given content tag

Parameters
tagThe ContentTag in the current case
Returns
The app_data string for this content tag or an empty string if there was none
Exceptions
TskCoreException

Definition at line 830 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.casemodule.services.contentviewertags.ContentViewerTagManager.TABLE_NAME.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addFilesToPortableCase().

Multimap<Long, BlackboardArtifact> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getInterestingArtifactsBySetName ( SleuthkitCase  skCase,
List< String >  setNames 
) throws TskCoreException
private

Load all interesting BlackboardArtifacts that belong to the selected SET_NAME. This operation would be duplicated for every data source, since the Sleuthkit API does not have a notion of searching by data source id.

Definition at line 587 of file PortableCaseReportModule.java.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateCaseUcoReport().

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getName ( )
int org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getNewArtifactTypeId ( BlackboardArtifact  oldArtifact) throws TskCoreException
private

Get the artifact type ID in the portable case and create new artifact type if needed. For built-in artifacts this will be the same as the original.

Parameters
oldArtifactThe artifact in the current case
Returns
The corresponding artifact type ID in the portable case

Definition at line 1061 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyArtifact().

BlackboardAttribute.Type org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getNewAttributeType ( BlackboardAttribute  oldAttribute) throws TskCoreException
private

Get the attribute type ID in the portable case and create new attribute type if needed. For built-in attributes this will be the same as the original.

Parameters
oldAttributeThe attribute in the current case
Returns
The corresponding attribute type in the portable case

Definition at line 1085 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldAttrTypeIdToNewAttrType.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyArtifact().

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getRelativeFilePath ( )

Gets the relative path of the report file, if any, generated by this module. The path should be relative to the location that gets passed in to generateReport() (or similar).

Returns
Relative path to where report will be stored. Return an empty string if the location passed to generateReport() is the output location. Return null to indicate that there is no report file.

Implements org.sleuthkit.autopsy.report.ReportModule.

Definition at line 170 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.caseName, org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), and org.sleuthkit.autopsy.casemodule.Case.getDisplayName().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleCancellation ( ReportProgressPanel  progressPanel)
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleError ( String  logWarning,
String  dialogWarning,
Exception  ex,
ReportProgressPanel  progressPanel 
)
private

Convenience method to avoid code duplication. Assumes that if an exception is supplied then the error is SEVERE. Otherwise it is logged as a WARNING.

Parameters
logWarningWarning to write to the log
dialogWarningWarning to write to a pop-up window
exThe exception (can be null)
progressPanelThe report progress panel

Definition at line 202 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.cleanup(), org.sleuthkit.autopsy.report.ReportProgressPanel.complete(), org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.ERROR, and org.sleuthkit.autopsy.report.ReportProgressPanel.setIndeterminate().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.compressCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createCase(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.initializeImageTags ( ReportProgressPanel  progressPanel) throws TskCoreException
private
static File org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.locate7ZipExecutable ( )
staticprivate
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.saveHighestIds ( ) throws TskCoreException
private

Save the current highest IDs to the portable case.

Exceptions
TskCoreException

Definition at line 747 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createCase().

default void org.sleuthkit.autopsy.report.ReportModule.setConfiguration ( ReportModuleSettings  settings)
inherited

Member Data Documentation

final String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.CASE_UCO_FILE_NAME = "portable_CASE_UCO_output"
staticprivate

Definition at line 107 of file PortableCaseReportModule.java.

final String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.CASE_UCO_TMP_DIR = "case_uco_tmp"
staticprivate

Definition at line 108 of file PortableCaseReportModule.java.

File org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.caseFolder = null
private

Definition at line 123 of file PortableCaseReportModule.java.

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.caseName = ""
private
File org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copiedFilesFolder = null
private

Definition at line 124 of file PortableCaseReportModule.java.

Case org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.currentCase = null
private

Definition at line 120 of file PortableCaseReportModule.java.

final String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.FILE_FOLDER_NAME = "PortableCaseFiles"
staticprivate
final List<FileTypeCategory> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.FILE_TYPE_CATEGORIES
staticprivate
Initial value:
= Arrays.asList(FileTypeCategory.AUDIO, FileTypeCategory.DOCUMENTS,
FileTypeCategory.EXECUTABLE, FileTypeCategory.IMAGE, FileTypeCategory.VIDEO)

Definition at line 112 of file PortableCaseReportModule.java.

final Logger org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.logger = Logger.getLogger(PortableCaseReportModule.class.getName())
staticprivate

Definition at line 103 of file PortableCaseReportModule.java.

final String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.MAX_ID_TABLE_NAME = "portable_case_max_ids"
staticprivate

Definition at line 106 of file PortableCaseReportModule.java.

final Map<Long, Content> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.newIdToContent = new HashMap<>()
private

Definition at line 130 of file PortableCaseReportModule.java.

final Map<Long, BlackboardArtifact> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldArtifactIdToNewArtifact = new HashMap<>()
private

Definition at line 142 of file PortableCaseReportModule.java.

final Map<Integer, Integer> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldArtTypeIdToNewArtTypeId = new HashMap<>()
private

Definition at line 136 of file PortableCaseReportModule.java.

final Map<Integer, BlackboardAttribute.Type> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldAttrTypeIdToNewAttrType = new HashMap<>()
private
final Map<Long, Content> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldIdToNewContent = new HashMap<>()
private

Definition at line 127 of file PortableCaseReportModule.java.

final Map<Long, Long> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldOsAccountIdToNewOsAccountId = new HashMap<>()
private

Definition at line 145 of file PortableCaseReportModule.java.

final Map<Long, OsAccountRealm> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldRealmIdToNewRealm = new HashMap<>()
private

Definition at line 148 of file PortableCaseReportModule.java.

final Map<TagName, TagName> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldTagNameToNewTagName = new HashMap<>()
private

Definition at line 133 of file PortableCaseReportModule.java.

SleuthkitCase org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.portableSkCase = null
private

Definition at line 121 of file PortableCaseReportModule.java.

PortableCaseReportModuleSettings org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.settings
private

Definition at line 109 of file PortableCaseReportModule.java.

final List<Integer> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.SPECIALLY_HANDLED_ATTRS
staticprivate
Initial value:
= Arrays.asList(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID(),
BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ATTACHMENTS.getTypeID(), BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID())

Definition at line 117 of file PortableCaseReportModule.java.

final String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.UNKNOWN_FILE_TYPE_FOLDER = "Other"
staticprivate

The documentation for this class was generated from the following file:

Copyright © 2012-2021 Basis Technology. Generated on: Thu Jul 8 2021
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.