19 package org.sleuthkit.autopsy.report.infrastructure;
22 import com.google.common.collect.ListMultimap;
23 import com.google.common.collect.Lists;
24 import com.google.common.collect.Multimaps;
25 import java.sql.ResultSet;
26 import java.sql.SQLException;
27 import java.util.ArrayList;
28 import java.util.Arrays;
29 import java.util.Collection;
30 import java.util.Collections;
31 import java.util.Comparator;
32 import java.util.HashMap;
33 import java.util.HashSet;
34 import java.util.Iterator;
35 import java.util.List;
37 import java.util.Objects;
39 import java.util.TreeSet;
40 import java.util.logging.Level;
41 import org.openide.util.NbBundle;
42 import org.openide.util.NbBundle.Messages;
65 class TableReportGenerator {
67 private List<BlackboardArtifact.Type> artifactTypes =
new ArrayList<>();
68 private HashSet<String> tagNamesFilter =
new HashSet<>();
70 private final Set<Content> images =
new HashSet<>();
71 private final ReportProgressPanel progressPanel;
72 private final TableReportModule tableReport;
73 private final TableReportSettings settings;
74 private final Map<Integer, List<Column>> columnHeaderMap;
75 private static final Logger logger = Logger.getLogger(TableReportGenerator.class.getName());
77 private final List<String> errorList;
79 TableReportGenerator(TableReportSettings settings, ReportProgressPanel progressPanel, TableReportModule tableReport) {
81 this.progressPanel = progressPanel;
82 this.tableReport = tableReport;
83 this.columnHeaderMap =
new HashMap<>();
84 errorList =
new ArrayList<>();
85 this.settings = settings;
88 private void getAllExistingTags() throws NoCurrentCaseException, TskCoreException {
89 List<String> tagNames =
new ArrayList<>();
92 List<TagName> tagNamesInUse = Case.getCurrentCaseThrows().getServices().getTagsManager().getTagNamesInUse();
94 String notableString =
"";
95 for (TagName tagName : tagNamesInUse) {
96 notableString = tagName.getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() :
"";
97 tagNames.add(tagName.getDisplayName() + notableString);
99 tagNamesFilter =
new HashSet<>(tagNames);
102 @SuppressWarnings(
"deprecation")
103 private
void getAllExistingArtiactTypes() throws NoCurrentCaseException, TskCoreException {
105 ArrayList<BlackboardArtifact.Type> doNotReport =
new ArrayList<>();
106 doNotReport.add(
new BlackboardArtifact.Type(BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO));
107 doNotReport.add(
new BlackboardArtifact.Type(BlackboardArtifact.ARTIFACT_TYPE.TSK_TOOL_OUTPUT));
108 doNotReport.add(
new BlackboardArtifact.Type(BlackboardArtifact.ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT));
109 doNotReport.add(
new BlackboardArtifact.Type(BlackboardArtifact.ARTIFACT_TYPE.TSK_TL_EVENT));
111 Case.getCurrentCaseThrows().getSleuthkitCase().getArtifactTypes().forEach(artifactTypes::add);
112 artifactTypes.removeAll(doNotReport);
115 protected void execute() {
117 progressPanel.start();
118 progressPanel.updateStatusLabel(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.readingTagsArtifacts.text"));
120 if (settings.useStoredTagsAndArtifactsLists()) {
122 artifactTypes = settings.getArtifactSelections();
125 tagNamesFilter =
new HashSet<>(settings.getTagSelections());
130 if (settings.getSelectedReportOption() == TableReportSettings.TableReportOption.ALL_TAGGED_RESULTS) {
131 getAllExistingTags();
135 getAllExistingArtiactTypes();
136 }
catch (NoCurrentCaseException | TskCoreException ex) {
137 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAllTagsArtifacts"));
138 logger.log(Level.SEVERE,
"Failed get all possible tag names and artifact types", ex);
144 progressPanel.setIndeterminate(
false);
145 progressPanel.setMaximumProgress(this.artifactTypes.size() + 2);
148 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
149 makeBlackboardArtifactTables();
153 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
154 makeContentTagsTables();
157 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
158 makeBlackboardArtifactTagsTables();
161 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
163 makeThumbnailTable();
170 private void makeBlackboardArtifactTables() {
173 if (!tagNamesFilter.isEmpty()) {
174 comment += NbBundle.getMessage(this.getClass(),
"ReportGenerator.artifactTable.taggedResults.text");
175 comment += makeCommaSeparatedList(tagNamesFilter);
179 for (BlackboardArtifact.Type type : artifactTypes) {
182 if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
186 progressPanel.updateStatusLabel(
187 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
188 type.getDisplayName()));
191 if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
192 writeKeywordHits(tableReport, comment, tagNamesFilter);
194 }
else if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
195 writeHashsetHits(tableReport, comment, tagNamesFilter);
199 List<ArtifactData> artifactList = getFilteredArtifacts(type, tagNamesFilter);
201 if (artifactList.isEmpty()) {
210 if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
212 ListMultimap<String, ArtifactData> groupedArtifacts = Multimaps.index(artifactList,
215 return artifactData.getArtifact().getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE)).getValueString();
216 }
catch (TskCoreException ex) {
217 logger.log(Level.SEVERE,
"Unable to get value of TSK_ACCOUNT_TYPE attribute. Defaulting to \"unknown\"", ex);
221 for (String accountTypeStr : groupedArtifacts.keySet()) {
228 String accountDisplayname = accountTypeStr;
229 if (accountTypeStr != null) {
231 Account.Type acctType = Case.getCurrentCaseThrows().getSleuthkitCase().getCommunicationsManager().getAccountType(accountTypeStr);
232 if (acctType != null) {
233 accountDisplayname = acctType.getDisplayName();
235 }
catch (TskCoreException | NoCurrentCaseException ex) {
236 logger.log(Level.SEVERE,
"Unable to get display name for account type " + accountTypeStr, ex);
240 final String compundDataTypeName = BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getDisplayName() +
": " + accountDisplayname;
241 writeTableForDataType(
new ArrayList<>(groupedArtifacts.get(accountTypeStr)), type, compundDataTypeName, comment);
245 writeTableForDataType(artifactList, type, type.getDisplayName(), comment);
260 private void writeTableForDataType(List<ArtifactData> artifactList, BlackboardArtifact.Type type, String tableName, String comment) {
265 Set<BlackboardAttribute.Type> attrTypeSet =
new TreeSet<>(Comparator.comparing(BlackboardAttribute.Type::getDisplayName));
266 for (ArtifactData data : artifactList) {
267 List<BlackboardAttribute> attributes = data.getAttributes();
268 for (BlackboardAttribute attribute : attributes) {
269 attrTypeSet.add(attribute.getAttributeType());
277 List<Column> columns = getArtifactTableColumns(type.getTypeID(), attrTypeSet);
278 if (columns.isEmpty()) {
281 columnHeaderMap.put(type.getTypeID(), columns);
287 Collections.sort(artifactList);
289 tableReport.startDataType(tableName, comment);
292 for (ArtifactData artifactData : artifactList) {
295 List<String> rowData = artifactData.getRow();
296 if (rowData.isEmpty()) {
300 tableReport.addRow(rowData);
303 progressPanel.increment();
304 tableReport.endTable();
305 tableReport.endDataType();
311 @Messages({
"ReportGenerator.tagTable.header.userName=User Name"})
312 @SuppressWarnings(
"deprecation")
313 private
void makeContentTagsTables() {
316 List<ContentTag> tags;
318 tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getAllContentTags();
319 }
catch (TskCoreException | NoCurrentCaseException ex) {
320 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetContentTags"));
321 logger.log(Level.SEVERE,
"failed to get content tags", ex);
328 progressPanel.updateStatusLabel(
329 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
330 BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName()));
331 ArrayList<String> columnHeaders =
new ArrayList<>(Arrays.asList(
332 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.tag"),
333 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.file"),
334 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.comment"),
335 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.userName"),
336 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeModified"),
337 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeChanged"),
338 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeAccessed"),
339 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeCreated"),
340 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.size"),
341 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.hash")));
343 StringBuilder comment =
new StringBuilder();
344 if (!tagNamesFilter.isEmpty()) {
346 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.makeContTagTab.taggedFiles.msg"));
347 comment.append(makeCommaSeparatedList(tagNamesFilter));
349 if (tableReport instanceof HTMLReport) {
350 HTMLReport htmlReportModule = (HTMLReport) tableReport;
351 htmlReportModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
352 htmlReportModule.startContentTagsTable(columnHeaders);
354 tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
355 tableReport.startTable(columnHeaders);
359 for (ContentTag tag : tags) {
361 if(shouldFilterFromReport(tag.getContent())) {
364 }
catch (TskCoreException ex) {
365 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetContentTags"));
366 logger.log(Level.SEVERE,
"Failed to access content data from the case database.", ex);
371 String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() :
"";
372 if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) ==
false) {
378 fileName = tag.getContent().getUniquePath();
379 }
catch (TskCoreException ex) {
380 fileName = tag.getContent().getName();
383 ArrayList<String> rowData =
new ArrayList<>(Arrays.asList(tag.getName().getDisplayName() + notableString, fileName, tag.getComment(), tag.getUserName()));
384 Content content = tag.getContent();
385 if (content instanceof AbstractFile) {
386 AbstractFile file = (AbstractFile) content;
389 rowData.add(file.getMtimeAsDate());
390 rowData.add(file.getCtimeAsDate());
391 rowData.add(file.getAtimeAsDate());
392 rowData.add(file.getCrtimeAsDate());
393 rowData.add(Long.toString(file.getSize()));
394 rowData.add(file.getMd5Hash());
397 if (tableReport instanceof HTMLReport) {
398 HTMLReport htmlReportModule = (HTMLReport) tableReport;
399 htmlReportModule.addRowWithTaggedContentHyperlink(rowData, tag);
401 tableReport.addRow(rowData);
405 checkIfTagHasImage(tag);
409 progressPanel.increment();
410 tableReport.endTable();
411 tableReport.endDataType();
417 @SuppressWarnings(
"deprecation")
419 "ReportGenerator.errList.failedGetBBArtifactTags=Failed to get result tags."
421 private void makeBlackboardArtifactTagsTables() {
423 List<BlackboardArtifactTag> tags;
425 tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getAllBlackboardArtifactTags();
426 }
catch (TskCoreException | NoCurrentCaseException ex) {
427 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBArtifactTags"));
428 logger.log(Level.SEVERE,
"failed to get blackboard artifact tags", ex);
434 progressPanel.updateStatusLabel(
435 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
436 BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName()));
437 StringBuilder comment =
new StringBuilder();
438 if (!tagNamesFilter.isEmpty()) {
440 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.makeBbArtTagTab.taggedRes.msg"));
441 comment.append(makeCommaSeparatedList(tagNamesFilter));
443 tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName(), comment.toString());
444 tableReport.startTable(
new ArrayList<>(Arrays.asList(
445 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.resultType"),
446 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.tag"),
447 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.comment"),
448 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.srcFile"),
449 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.userName"))));
452 for (BlackboardArtifactTag tag : tags) {
454 if(shouldFilterFromReport(tag.getContent())) {
457 }
catch (TskCoreException ex) {
458 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBArtifactTags"));
459 logger.log(Level.SEVERE,
"Failed to access content data from the case database.", ex);
463 String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() :
"";
464 if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) ==
false) {
469 row =
new ArrayList<>(Arrays.asList(tag.getArtifact().getArtifactTypeName(), tag.getName().getDisplayName() + notableString,
470 tag.getComment(), tag.getContent().getName(), tag.getUserName()));
471 tableReport.addRow(row);
474 checkIfTagHasImage(tag);
478 progressPanel.increment();
479 tableReport.endTable();
480 tableReport.endDataType();
490 private boolean passesTagNamesFilter(String tagName) {
491 return tagNamesFilter.isEmpty() || tagNamesFilter.contains(tagName);
497 private void makeThumbnailTable() {
498 progressPanel.updateStatusLabel(
499 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.createdThumb.text"));
501 if (tableReport instanceof HTMLReport) {
502 HTMLReport htmlModule = (HTMLReport) tableReport;
503 htmlModule.startDataType(
504 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.thumbnailTable.name"),
505 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.thumbnailTable.desc"));
506 List<String> emptyHeaders =
new ArrayList<>();
507 for (
int i = 0; i < HTMLReport.THUMBNAIL_COLUMNS; i++) {
508 emptyHeaders.add(
"");
510 htmlModule.startTable(emptyHeaders);
512 htmlModule.addThumbnailRows(images);
514 htmlModule.endTable();
515 htmlModule.endDataType();
526 private void checkIfTagHasImage(BlackboardArtifactTag artifactTag) {
529 file = Case.getCurrentCaseThrows().getSleuthkitCase().getAbstractFileById(artifactTag.getArtifact().getObjectID());
530 }
catch (TskCoreException | NoCurrentCaseException ex) {
532 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.errGetContentFromBBArtifact"));
533 logger.log(Level.WARNING,
"Error while getting content from a blackboard artifact to report on.", ex);
538 checkIfFileIsImage(file);
549 private void checkIfTagHasImage(ContentTag contentTag) {
550 Content c = contentTag.getContent();
551 if (c instanceof AbstractFile ==
false) {
554 checkIfFileIsImage((AbstractFile) c);
562 private void checkIfFileIsImage(AbstractFile file) {
565 || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS
566 || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS) {
570 if (ImageUtils.thumbnailSupported(file)) {
583 private String makeCommaSeparatedList(Collection<String> items) {
585 for (Iterator<String> iterator = items.iterator(); iterator.hasNext();) {
586 list += iterator.next() + (iterator.hasNext() ?
", " :
"");
596 @SuppressWarnings(
"deprecation")
597 @NbBundle.Messages({
"ReportGenerator.errList.noOpenCase=No open case available."})
598 private void writeKeywordHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
605 String orderByClause;
608 openCase = Case.getCurrentCaseThrows();
609 }
catch (NoCurrentCaseException ex) {
610 errorList.add(Bundle.ReportGenerator_errList_noOpenCase());
611 logger.log(Level.SEVERE,
"Exception while getting open case: ", ex);
616 String tagIDList =
"";
617 if (!tagNamesFilter.isEmpty()) {
619 Map<String, TagName> tagNamesMap = Case.getCurrentCaseThrows().getServices().getTagsManager().getDisplayNamesToTagNamesMap();
620 for (String tagDisplayName : tagNamesFilter) {
621 if (tagNamesMap.containsKey(tagDisplayName)) {
622 if (!tagIDList.isEmpty()) {
625 tagIDList += tagNamesMap.get(tagDisplayName).getId();
628 if (tagDisplayName.endsWith(getNotableTagLabel())) {
629 String editedDisplayName = tagDisplayName.substring(0, tagDisplayName.length() - getNotableTagLabel().length());
630 if (tagNamesMap.containsKey(editedDisplayName)) {
631 if (!tagIDList.isEmpty()) {
634 tagIDList += tagNamesMap.get(editedDisplayName).getId();
639 }
catch (NoCurrentCaseException | TskCoreException ex) {
640 logger.log(Level.SEVERE,
"Exception while getting tag info - proceeding without tag filter: ", ex);
646 String adHocCountQuery =
"SELECT COUNT(*) FROM "
648 "(SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 ";
649 if (!tagIDList.isEmpty()) {
650 adHocCountQuery +=
", blackboard_artifact_tags as tag ";
652 adHocCountQuery +=
"WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") ";
653 if (!tagIDList.isEmpty()) {
654 adHocCountQuery +=
" AND (art.artifact_id = tag.artifact_id) AND (tag.tag_name_id IN (" + tagIDList +
")) ";
656 adHocCountQuery +=
"EXCEPT "
658 "SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
")) AS adHocHits";
661 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(adHocCountQuery)) {
662 ResultSet adHocCountResultSet = dbQuery.getResultSet();
663 if (adHocCountResultSet.next()) {
664 adHocCount = adHocCountResultSet.getInt(1);
666 throw new TskCoreException(
"Error counting ad hoc keywords");
668 }
catch (TskCoreException | SQLException ex) {
669 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryKWLists"));
670 logger.log(Level.SEVERE,
"Failed to count ad hoc searches with query " + adHocCountQuery, ex);
675 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
676 orderByClause =
"ORDER BY convert_to(list, 'SQL_ASCII') ASC NULLS FIRST";
678 orderByClause =
"ORDER BY list ASC";
680 String keywordListQuery
681 =
"SELECT att.value_text AS list "
683 "FROM blackboard_attributes AS att, blackboard_artifacts AS art ";
684 if (!tagIDList.isEmpty()) {
685 keywordListQuery +=
", blackboard_artifact_tags as tag ";
687 keywordListQuery +=
"WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
" "
689 "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
" "
691 "AND att.artifact_id = art.artifact_id ";
692 if (!tagIDList.isEmpty()) {
693 keywordListQuery +=
"AND (art.artifact_id = tag.artifact_id) "
695 "AND (tag.tag_name_id IN (" + tagIDList +
")) ";
697 if (adHocCount > 0) {
698 keywordListQuery +=
" UNION SELECT \'\' AS list ";
700 keywordListQuery =
"SELECT * FROM ( " + keywordListQuery +
" ) kwListNames ";
701 keywordListQuery +=
"GROUP BY list " + orderByClause;
704 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(keywordListQuery)) {
705 ResultSet listsRs = dbQuery.getResultSet();
706 List<String> lists =
new ArrayList<>();
707 while (listsRs.next()) {
708 String list = listsRs.getString(
"list");
709 if (list.isEmpty()) {
710 list = NbBundle.getMessage(this.getClass(),
"ReportGenerator.writeKwHits.userSrchs");
716 tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), comment);
717 tableModule.addSetIndex(lists);
718 progressPanel.updateStatusLabel(
719 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
720 BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName()));
721 }
catch (TskCoreException | SQLException ex) {
722 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryKWLists"));
723 logger.log(Level.SEVERE,
"Failed to query keyword lists with query " + keywordListQuery, ex);
728 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
729 orderByClause =
"ORDER BY convert_to(list, 'SQL_ASCII') ASC NULLS FIRST, "
730 +
"convert_to(keyword, 'SQL_ASCII') ASC NULLS FIRST, "
731 +
"convert_to(parent_path, 'SQL_ASCII') ASC NULLS FIRST, "
732 +
"convert_to(name, 'SQL_ASCII') ASC NULLS FIRST, "
733 +
"convert_to(preview, 'SQL_ASCII') ASC NULLS FIRST";
735 orderByClause =
"ORDER BY list ASC, keyword ASC, parent_path ASC, name ASC, preview ASC";
739 String keywordListsQuery
740 =
"SELECT art.artifact_id AS artifact_id, art.obj_id AS obj_id, att1.value_text AS keyword, att2.value_text AS preview, att3.value_text AS list, f.name AS name, f.parent_path AS parent_path "
742 "FROM blackboard_artifacts AS art, blackboard_attributes AS att1, blackboard_attributes AS att2, blackboard_attributes AS att3, tsk_files AS f "
744 "WHERE (att1.artifact_id = art.artifact_id) "
746 "AND (att2.artifact_id = art.artifact_id) "
748 "AND (att3.artifact_id = art.artifact_id) "
750 "AND (f.obj_id = art.obj_id) "
752 "AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID() +
") "
754 "AND (att2.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID() +
") "
756 "AND (att3.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
") "
758 "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") ";
761 String keywordAdHocQuery
762 =
"SELECT art.artifact_id AS artifact_id, art.obj_id AS obj_id, att1.value_text AS keyword, att2.value_text AS preview, \'\' AS list, f.name AS name, f.parent_path AS parent_path "
764 "FROM blackboard_artifacts AS art, blackboard_attributes AS att1, blackboard_attributes AS att2, tsk_files AS f "
768 " (art.artifact_id IN (SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") "
772 "SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
"))) "
774 "AND (att1.artifact_id = art.artifact_id) "
776 "AND (att2.artifact_id = art.artifact_id) "
778 "AND (f.obj_id = art.obj_id) "
780 "AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID() +
") "
782 "AND (att2.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID() +
") "
784 "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") ";
786 String keywordsQuery =
"SELECT * FROM ( " + keywordListsQuery +
" UNION " + keywordAdHocQuery +
" ) kwHits " + orderByClause;
788 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(keywordsQuery)) {
789 ResultSet resultSet = dbQuery.getResultSet();
791 String currentKeyword =
"";
792 String currentList =
"";
793 while (resultSet.next()) {
795 if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
800 HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong(
"artifact_id"));
801 if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
804 String tagsList = makeCommaSeparatedList(uniqueTagNames);
806 Long objId = resultSet.getLong(
"obj_id");
807 String keyword = resultSet.getString(
"keyword");
808 String preview = resultSet.getString(
"preview");
809 String list = resultSet.getString(
"list");
810 String uniquePath =
"";
813 AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
815 uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
816 if(shouldFilterFromReport(f)) {
820 }
catch (TskCoreException ex) {
822 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAbstractFileByID"));
823 logger.log(Level.WARNING,
"Failed to get Abstract File by ID.", ex);
827 if ((!list.equals(currentList) && !list.isEmpty()) || (list.isEmpty() && !currentList.equals(
828 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.writeKwHits.userSrchs")))) {
829 if (!currentList.isEmpty()) {
830 tableModule.endTable();
831 tableModule.endSet();
833 currentList = list.isEmpty() ? NbBundle
834 .getMessage(this.getClass(),
"ReportGenerator.writeKwHits.userSrchs") : list;
836 tableModule.startSet(currentList);
837 progressPanel.updateStatusLabel(
838 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processingList",
839 BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), currentList));
841 if (!keyword.equals(currentKeyword)) {
843 if (!currentKeyword.equals(
"")) {
844 tableModule.endTable();
848 currentKeyword = keyword;
849 tableModule.addSetElement(currentKeyword);
850 List<String> columnHeaderNames =
new ArrayList<>();
851 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.preview"));
852 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.srcFile"));
853 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags"));
854 tableModule.startTable(columnHeaderNames);
857 tableModule.addRow(Arrays.asList(
new String[]{preview, uniquePath, tagsList}));
861 if (!currentKeyword.isEmpty()) {
862 tableModule.endTable();
866 progressPanel.increment();
867 tableModule.endDataType();
868 }
catch (TskCoreException | SQLException ex) {
869 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryKWs"));
870 logger.log(Level.SEVERE,
"Failed to query keywords with query " + keywordsQuery, ex);
879 @SuppressWarnings(
"deprecation")
880 private
void writeHashsetHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
881 String orderByClause;
884 openCase = Case.getCurrentCaseThrows();
885 }
catch (NoCurrentCaseException ex) {
886 errorList.add(Bundle.ReportGenerator_errList_noOpenCase());
887 logger.log(Level.SEVERE,
"Exception while getting open case: ", ex);
890 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
891 orderByClause =
"ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST";
893 orderByClause =
"ORDER BY att.value_text ASC";
896 =
"SELECT att.value_text AS list "
898 "FROM blackboard_attributes AS att, blackboard_artifacts AS art "
900 "WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
" "
902 "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() +
" "
904 "AND att.artifact_id = art.artifact_id "
906 "GROUP BY list " + orderByClause;
908 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(hashsetsQuery)) {
910 ResultSet listsRs = dbQuery.getResultSet();
911 List<String> lists =
new ArrayList<>();
912 while (listsRs.next()) {
913 lists.add(listsRs.getString(
"list"));
916 tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), comment);
917 tableModule.addSetIndex(lists);
918 progressPanel.updateStatusLabel(
919 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
920 BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName()));
921 }
catch (TskCoreException | SQLException ex) {
922 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryHashsetLists"));
923 logger.log(Level.SEVERE,
"Failed to query hashset lists: ", ex);
927 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
928 orderByClause =
"ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST, "
929 +
"convert_to(f.parent_path, 'SQL_ASCII') ASC NULLS FIRST, "
930 +
"convert_to(f.name, 'SQL_ASCII') ASC NULLS FIRST, "
931 +
"size ASC NULLS FIRST";
933 orderByClause =
"ORDER BY att.value_text ASC, f.parent_path ASC, f.name ASC, size ASC";
935 String hashsetHitsQuery
936 =
"SELECT art.artifact_id, art.obj_id, att.value_text AS setname, f.name AS name, f.size AS size, f.parent_path AS parent_path "
938 "FROM blackboard_artifacts AS art, blackboard_attributes AS att, tsk_files AS f "
940 "WHERE (att.artifact_id = art.artifact_id) "
942 "AND (f.obj_id = art.obj_id) "
944 "AND (att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
") "
946 "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() +
") "
950 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(hashsetHitsQuery)) {
952 ResultSet resultSet = dbQuery.getResultSet();
953 String currentSet =
"";
954 while (resultSet.next()) {
956 if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
961 HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong(
"artifact_id"));
962 if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
965 String tagsList = makeCommaSeparatedList(uniqueTagNames);
967 Long objId = resultSet.getLong(
"obj_id");
968 String set = resultSet.getString(
"setname");
969 String size = resultSet.getString(
"size");
970 String uniquePath =
"";
973 AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
975 uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
976 if(shouldFilterFromReport(f)) {
980 }
catch (TskCoreException ex) {
982 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAbstractFileFromID"));
983 logger.log(Level.WARNING,
"Failed to get Abstract File from ID.", ex);
988 if (!set.equals(currentSet)) {
989 if (!currentSet.isEmpty()) {
990 tableModule.endTable();
991 tableModule.endSet();
994 tableModule.startSet(currentSet);
995 List<String> columnHeaderNames =
new ArrayList<>();
996 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.file"));
997 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.size"));
998 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags"));
999 tableModule.startTable(columnHeaderNames);
1000 progressPanel.updateStatusLabel(
1001 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processingList",
1002 BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), currentSet));
1006 tableModule.addRow(Arrays.asList(
new String[]{uniquePath, size, tagsList}));
1010 progressPanel.increment();
1011 tableModule.endDataType();
1012 }
catch (TskCoreException | SQLException ex) {
1013 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryHashsetHits"));
1014 logger.log(Level.SEVERE,
"Failed to query hashsets hits: ", ex);
1021 List<String> getErrorList() {
1034 private List<String> rowData = null;
1037 ArtifactData(BlackboardArtifact artifact, List<BlackboardAttribute> attrs, HashSet<String> tags) {
1039 this.attributes = attrs;
1043 }
catch (TskCoreException | NoCurrentCaseException ex) {
1044 logger.log(Level.SEVERE,
"Could not get content from database", ex);
1061 return artifact.getArtifactID();
1065 return artifact.getObjectID();
1086 List<String> thisRow =
getRow();
1087 List<String> otherRow = otherArtifactData.
getRow();
1088 for (
int i = 0; i < thisRow.size(); i++) {
1089 int compare = thisRow.get(i).compareTo(otherRow.get(i));
1105 if (rowData == null) {
1110 if (rowData.size() > 0) {
1112 for (
int i = 0; i < rowData.size(); i++) {
1113 if (rowData.get(i) == null) {
1119 return new ArrayList<>();
1121 }
catch (TskCoreException ex) {
1123 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.coreExceptionWhileGenRptRow"));
1124 logger.log(Level.WARNING,
"Core exception while generating row data for artifact report.", ex);
1125 rowData = Collections.<String>emptyList();
1142 List<String> orderedRowData =
new ArrayList<>();
1143 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() ==
getArtifact().getArtifactTypeID()) {
1144 if (content != null && content instanceof AbstractFile) {
1145 AbstractFile file = (AbstractFile) content;
1146 orderedRowData.add(file.getName());
1147 orderedRowData.add(file.getNameExtension());
1148 String mimeType = file.getMIMEType();
1149 if (mimeType == null) {
1150 orderedRowData.add(
"");
1152 orderedRowData.add(mimeType);
1154 orderedRowData.add(file.getUniquePath());
1157 orderedRowData.add(null);
1158 orderedRowData.add(null);
1159 orderedRowData.add(null);
1160 orderedRowData.add(null);
1162 orderedRowData.add(makeCommaSeparatedList(
getTags()));
1164 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() ==
getArtifact().getArtifactTypeID()) {
1165 String[] attributeDataArray =
new String[5];
1167 for (BlackboardAttribute attr : attributes) {
1168 if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME))) {
1169 attributeDataArray[0] = attr.getDisplayString();
1170 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY))) {
1171 attributeDataArray[1] = attr.getDisplayString();
1172 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT))) {
1173 attributeDataArray[3] = attr.getDisplayString();
1174 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION))) {
1175 attributeDataArray[4] = attr.getDisplayString();
1179 attributeDataArray[2] = content.getUniquePath();
1180 orderedRowData.addAll(Arrays.asList(attributeDataArray));
1182 HashSet<String> allTags =
getTags();
1185 for (ContentTag ct : contentTags) {
1187 allTags.add(ct.getName().getDisplayName() + notableString);
1189 }
catch (TskCoreException | NoCurrentCaseException ex) {
1190 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetContentTags"));
1191 logger.log(Level.SEVERE,
"Failed to get content tags", ex);
1193 orderedRowData.add(makeCommaSeparatedList(allTags));
1195 }
else if (columnHeaderMap.containsKey(
this.artifact.getArtifactTypeID())) {
1197 for (
Column currColumn : columnHeaderMap.get(
this.artifact.getArtifactTypeID())) {
1198 String cellData = currColumn.getCellData(
this);
1199 orderedRowData.add(cellData);
1203 return orderedRowData;
1217 private List<ArtifactData> getFilteredArtifacts(BlackboardArtifact.Type type, HashSet<String> tagNamesFilter) {
1218 List<ArtifactData> artifacts =
new ArrayList<>();
1221 if(shouldFilterFromReport(artifact)) {
1225 List<BlackboardArtifactTag> tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getBlackboardArtifactTagsByArtifact(artifact);
1226 HashSet<String> uniqueTagNames =
new HashSet<>();
1227 for (BlackboardArtifactTag tag : tags) {
1228 String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() :
"";
1229 uniqueTagNames.add(tag.getName().getDisplayName() + notableString);
1231 if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
1235 artifacts.add(
new ArtifactData(artifact, Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboardAttributes(artifact), uniqueTagNames));
1236 }
catch (TskCoreException ex) {
1237 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBAttribs"));
1238 logger.log(Level.SEVERE,
"Failed to get Blackboard Attributes when generating report.", ex);
1241 }
catch (TskCoreException | NoCurrentCaseException ex) {
1242 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBArtifacts"));
1243 logger.log(Level.SEVERE,
"Failed to get Blackboard Artifacts when generating report.", ex);
1248 private Boolean failsTagFilter(HashSet<String> tagNames, HashSet<String> tagsNamesFilter) {
1249 if (null == tagsNamesFilter || tagsNamesFilter.isEmpty()) {
1253 HashSet<String> filteredTagNames =
new HashSet<>(tagNames);
1254 filteredTagNames.retainAll(tagsNamesFilter);
1255 return filteredTagNames.isEmpty();
1268 @Messages({
"ReportGenerator.artTableColHdr.comment=Comment"})
1269 @SuppressWarnings(
"deprecation")
1270 private List<Column> getArtifactTableColumns(
int artifactTypeId, Set<BlackboardAttribute.Type> attributeTypeSet) {
1271 ArrayList<Column> columns =
new ArrayList<>();
1275 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID() == artifactTypeId) {
1276 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1277 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1279 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.title"),
1280 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1282 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateCreated"),
1283 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1285 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1286 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1288 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID() == artifactTypeId) {
1289 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1290 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1292 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1293 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1295 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1296 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1298 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.value"),
1299 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE)));
1301 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1302 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1304 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID() == artifactTypeId) {
1305 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1306 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1308 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateAccessed"),
1309 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1311 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.referrer"),
1312 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REFERRER)));
1314 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.title"),
1315 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1317 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1318 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1320 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.urlDomainDecoded"),
1321 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL_DECODED)));
1323 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifactTypeId) {
1324 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dest"),
1325 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1327 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.sourceUrl"),
1328 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1330 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateAccessed"),
1331 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1333 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1334 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1336 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
1337 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == artifactTypeId) {
1338 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.path"),
1339 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1341 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1342 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED )));
1344 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
1345 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID() == artifactTypeId) {
1346 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.progName"),
1347 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1349 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.instDateTime"),
1350 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1352 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() == artifactTypeId) {
1353 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.preview")));
1355 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() == artifactTypeId) {
1356 columns.add(
new SourceFileColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.file")));
1358 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.size")));
1360 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID() == artifactTypeId) {
1361 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devMake"),
1362 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1364 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devModel"),
1365 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1367 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.deviceId"),
1368 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1370 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1371 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1373 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID() == artifactTypeId) {
1374 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.text"),
1375 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1377 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.domain"),
1378 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)));
1380 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateAccessed"),
1381 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1383 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.progName"),
1384 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1386 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID() == artifactTypeId) {
1387 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTaken"),
1388 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1390 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devManufacturer"),
1391 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1393 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devModel"),
1394 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1396 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1397 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1399 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1400 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1402 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1403 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1405 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID() == artifactTypeId) {
1406 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1407 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1409 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumber"),
1410 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1412 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumHome"),
1413 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_HOME)));
1415 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumOffice"),
1416 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_OFFICE)));
1418 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumMobile"),
1419 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_MOBILE)));
1421 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.email"),
1422 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL)));
1424 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() == artifactTypeId) {
1425 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.msgType"),
1426 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)));
1428 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.direction"),
1429 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1431 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.readStatus"),
1432 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_READ_STATUS)));
1434 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1435 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1437 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.fromPhoneNum"),
1438 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1440 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.fromEmail"),
1441 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1443 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.toPhoneNum"),
1444 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1446 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.toEmail"),
1447 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1449 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.subject"),
1450 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1452 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.text"),
1453 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1455 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID() == artifactTypeId) {
1456 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1457 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1459 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.fromPhoneNum"),
1460 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1462 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.toPhoneNum"),
1463 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1465 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1466 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1468 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.direction"),
1469 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1471 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID() == artifactTypeId) {
1472 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.calendarEntryType"),
1473 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CALENDAR_ENTRY_TYPE)));
1475 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1476 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1478 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.startDateTime"),
1479 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1481 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.endDateTime"),
1482 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_END)));
1484 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.location"),
1485 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1487 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID() == artifactTypeId) {
1488 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.shortCut"),
1489 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SHORTCUT)));
1491 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1492 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME_PERSON)));
1494 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumber"),
1495 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1497 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID() == artifactTypeId) {
1498 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.deviceName"),
1499 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_NAME)));
1501 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.deviceAddress"),
1502 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1504 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1505 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1507 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID() == artifactTypeId) {
1508 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1509 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1511 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1512 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1514 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1515 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1517 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID() == artifactTypeId) {
1518 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1519 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1521 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1522 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1524 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1525 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1527 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1528 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1530 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.locationAddress"),
1531 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1533 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1534 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1536 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID() == artifactTypeId) {
1537 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1538 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1540 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1541 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1543 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1544 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1546 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1547 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1549 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.locationAddress"),
1550 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1552 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1553 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1555 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID() == artifactTypeId) {
1556 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1557 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1559 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1560 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1562 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1563 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1565 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1566 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1568 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.locationAddress"),
1569 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1571 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1572 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1574 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID() == artifactTypeId) {
1575 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.category"),
1576 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1578 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.userId"),
1579 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1581 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.password"),
1582 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PASSWORD)));
1584 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1585 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1587 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.appName"),
1588 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1590 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1591 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1593 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.appPath"),
1594 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1596 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1597 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1599 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.replytoAddress"),
1600 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_REPLYTO)));
1602 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.mailServer"),
1603 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SERVER_NAME)));
1605 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID() == artifactTypeId
1606 || BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID() == artifactTypeId) {
1607 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1608 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1610 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() == artifactTypeId) {
1611 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.file")));
1613 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.extension.text")));
1615 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.mimeType.text")));
1617 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.path")));
1619 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID() == artifactTypeId) {
1620 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.processorArchitecture.text"),
1621 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROCESSOR_ARCHITECTURE)));
1623 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.osName.text"),
1624 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1626 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.osInstallDate.text"),
1627 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1629 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == artifactTypeId) {
1630 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailTo"),
1631 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1633 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailFrom"),
1634 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1636 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSubject"),
1637 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1639 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskDateTimeSent"),
1640 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)));
1642 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskDateTimeRcvd"),
1643 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_RCVD)));
1645 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskPath"),
1646 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1648 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailCc"),
1649 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_CC)));
1651 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailBcc"),
1652 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_BCC)));
1654 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskMsgId"),
1655 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MSG_ID)));
1657 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == artifactTypeId) {
1658 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSetName"),
1659 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1661 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskInterestingFilesCategory"),
1662 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1664 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskPath"),
1665 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1667 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.comment"),
1668 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT)));
1670 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1671 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1673 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_ROUTE.getTypeID() == artifactTypeId) {
1674 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskGpsRouteCategory"),
1675 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1677 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1678 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1680 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitudeEnd"),
1681 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END)));
1683 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitudeEnd"),
1684 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END)));
1686 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitudeStart"),
1687 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START)));
1689 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitudeStart"),
1690 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START)));
1692 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1693 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1695 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.location"),
1696 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1698 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1699 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1701 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == artifactTypeId) {
1702 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSetName"),
1703 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1705 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.associatedArtifact"),
1706 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1708 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1709 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1711 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == artifactTypeId) {
1712 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1713 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1715 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.associatedArtifact"),
1716 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1718 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1719 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1721 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.count"),
1722 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COUNT)));
1724 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_ACCOUNT.getTypeID() == artifactTypeId) {
1725 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.userName"),
1726 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME)));
1728 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.userId"),
1729 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1731 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_REMOTE_DRIVE.getTypeID() == artifactTypeId) {
1732 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.localPath"),
1733 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCAL_PATH)));
1735 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.remotePath"),
1736 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REMOTE_PATH)));
1737 }
else if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
1738 columns.add(
new StatusColumn());
1739 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE));
1740 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
1741 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME));
1742 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_SEARCH_DOCUMENT_ID));
1743 }
else if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID()) {
1744 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
1748 for (BlackboardAttribute.Type type : attributeTypeSet) {
1749 columns.add(
new AttributeColumn(type.getDisplayName(), type));
1751 columns.add(
new SourceFileColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.srcFile")));
1752 columns.add(
new TaggedResultsColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags")));
1760 for (Column column : columns) {
1761 attributeTypeSet = column.removeTypeFromSet(attributeTypeSet);
1764 for (BlackboardAttribute.Type type : attributeTypeSet) {
1765 columns.add(
new AttributeColumn(type.getDisplayName(), type));
1768 if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()
1769 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()
1770 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()
1771 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()
1772 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()
1773 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()
1774 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()
1775 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID()
1776 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID()
1777 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID()
1778 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()
1779 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID()
1780 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID()
1781 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID()
1782 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID()
1783 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID()
1784 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID()
1785 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID()
1786 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID()
1787 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_AREA.getTypeID()
1788 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID()
1789 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID()
1790 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID()
1791 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID()) {
1792 columns.add(
new SourceFileColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.srcFile")));
1794 columns.add(
new TaggedResultsColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags")));
1806 private String getFileUniquePath(Content content) {
1808 if (content != null) {
1809 return content.getUniquePath();
1813 }
catch (TskCoreException ex) {
1814 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAbstractFileByID"));
1815 logger.log(Level.WARNING,
"Failed to get Abstract File by ID.", ex);
1824 private boolean shouldFilterFromReport(Content content)
throws TskCoreException {
1825 if(this.settings.getSelectedDataSources() == null) {
1829 long dataSourceId = content.getDataSource().getId();
1830 return !this.settings.getSelectedDataSources().contains(dataSourceId);
1842 @SuppressWarnings(
"deprecation")
1843 private HashSet<String> getUniqueTagNames(
long artifactId) throws TskCoreException {
1844 HashSet<String> uniqueTagNames =
new HashSet<>();
1846 String query =
"SELECT display_name, artifact_id, knownStatus FROM tag_names AS tn, blackboard_artifact_tags AS bat "
1848 "WHERE tn.tag_name_id = bat.tag_name_id AND bat.artifact_id = " + artifactId;
1850 try (SleuthkitCase.CaseDbQuery dbQuery = Case.getCurrentCaseThrows().getSleuthkitCase().executeQuery(query)) {
1851 ResultSet tagNameRows = dbQuery.getResultSet();
1852 while (tagNameRows.next()) {
1853 String notableString = tagNameRows.getInt(
"knownStatus") == TskData.FileKnown.BAD.ordinal() ? getNotableTagLabel() :
"";
1854 uniqueTagNames.add(tagNameRows.getString(
"display_name") + notableString);
1856 }
catch (TskCoreException | SQLException | NoCurrentCaseException ex) {
1857 throw new TskCoreException(
"Error getting tag names for artifact: ", ex);
1860 return uniqueTagNames;
1870 Set<BlackboardAttribute.Type>
removeTypeFromSet(Set<BlackboardAttribute.Type> types);
1875 @NbBundle.Messages(
"TableReportGenerator.StatusColumn.Header=Review Status")
1878 return Bundle.TableReportGenerator_StatusColumn_Header();
1883 return artData.
getArtifact().getReviewStatus().getDisplayName();
1906 this.columnHeader = Objects.requireNonNull(columnHeader);
1917 List<BlackboardAttribute> attributes = artData.
getAttributes();
1918 for (BlackboardAttribute attribute : attributes) {
1919 if (attribute.getAttributeType().equals(this.
attributeType)) {
1920 if (attribute.getAttributeType().getValueType() != BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
1921 return attribute.getDisplayString();
1952 return getFileUniquePath(artData.
getContent());
1977 return makeCommaSeparatedList(artData.
getTags());
2002 throw new UnsupportedOperationException(
"Cannot get cell data of unspecified column");
BlackboardArtifact getArtifact()
final String columnHeader
String getCellData(ArtifactData artData)
List< String > getOrderedRowDataAsStrings()
List< BlackboardAttribute > attributes
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
String getCellData(ArtifactData artData)
int compareTo(ArtifactData otherArtifactData)
final BlackboardAttribute.Type attributeType
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
static String getFormattedTime(long epochTime)
String getCellData(ArtifactData artData)
HashSet< String > getTags()
List< BlackboardAttribute > getAttributes()
String getCellData(ArtifactData artData)
String getCellData(ArtifactData artData)
final String columnHeader
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
BlackboardArtifact artifact
final String columnHeader
TagsManager getTagsManager()
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
SleuthkitCase getSleuthkitCase()
String getCellData(ArtifactData artData)
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
static Case getCurrentCaseThrows()
final String columnHeader