Autopsy  4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
ArtifactStringContent.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2017 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 import java.text.SimpleDateFormat;
22 import java.util.Arrays;
23 import java.util.logging.Level;
24 import org.apache.commons.lang.StringUtils;
25 import org.openide.util.NbBundle;
26 import org.openide.util.NbBundle.Messages;
27 import org.sleuthkit.autopsy.coreutils.Logger;
28 import org.sleuthkit.datamodel.BlackboardArtifact;
29 import org.sleuthkit.datamodel.BlackboardAttribute;
30 import org.sleuthkit.datamodel.Content;
31 import org.sleuthkit.datamodel.TskCoreException;
32 
39 public class ArtifactStringContent implements StringContent {
40 
41  private final static SimpleDateFormat dateFormatter = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
42  private final static Logger logger = Logger.getLogger(ArtifactStringContent.class.getName());
43  private final BlackboardArtifact artifact;
44  private String stringContent = "";
45 
54  public ArtifactStringContent(BlackboardArtifact artifact) {
55  this.artifact = artifact;
56  }
57 
63  @Messages({
64  "ArtifactStringContent.attrsTableHeader.type=Type",
65  "ArtifactStringContent.attrsTableHeader.value=Value",
66  "ArtifactStringContent.attrsTableHeader.sources=Source(s)",
67  "ArtifactStringContent.failedToGetSourcePath.message=Failed to get source file path from case database",
68  "ArtifactStringContent.failedToGetAttributes.message=Failed to get some or all attributes from case database"
69  })
70  @Override
71  public String getString() {
72  if (stringContent.isEmpty()) {
73  /*
74  * Start the document.
75  */
76  StringBuilder buffer = new StringBuilder(1024);
77  buffer.append("<html>\n"); //NON-NLS
78  buffer.append("<body>\n"); //NON-NLS
79 
80  /*
81  * Use the artifact display name as a header.
82  */
83  buffer.append("<h3>"); //NON-NLS
84  buffer.append(artifact.getDisplayName());
85  buffer.append("</h3>\n"); //NON-NLS
86 
87  /*
88  * Put the attributes, source content path and artifact id in a
89  * table.
90  */
91  buffer.append("<table border='1'>"); //NON-NLS
92 
93  // header row
94  buffer.append("<tr>"); //NON-NLS
95  buffer.append("<th><b>"); //NON-NLS
96  buffer.append(Bundle.ArtifactStringContent_attrsTableHeader_type());
97  buffer.append("</b></th>"); //NON-NLS
98  buffer.append("<th><b>"); //NON-NLS
99  buffer.append(Bundle.ArtifactStringContent_attrsTableHeader_value());
100  buffer.append("</b></th>"); //NON-NLS
101  buffer.append("<th><b>"); //NON-NLS
102  buffer.append(Bundle.ArtifactStringContent_attrsTableHeader_sources());
103  buffer.append("</b></th>"); //NON-NLS
104  buffer.append("</tr>\n"); //NON-NLS
105  try {
106  Content content = artifact.getSleuthkitCase().getContentById(artifact.getObjectID());
107 
108  /*
109  * Add rows for each attribute.
110  */
111  for (BlackboardAttribute attr : artifact.getAttributes()) {
112 
113  /*
114  * Attribute value column.
115  */
116  String value = "";
117  switch (attr.getAttributeType().getValueType()) {
118  case STRING:
119  case INTEGER:
120  case LONG:
121  case DOUBLE:
122  case BYTE:
123  default:
124  value = attr.getDisplayString();
125  break;
126 
127  // Use Autopsy date formatting settings, not TSK defaults
128  case DATETIME:
129  long epoch = attr.getValueLong();
130  value = "0000-00-00 00:00:00";
131  if (null != content && 0 != epoch) {
132  dateFormatter.setTimeZone(ContentUtils.getTimeZone(content));
133  value = dateFormatter.format(new java.util.Date(epoch * 1000));
134  }
135  break;
136  }
137 
138  /*
139  * Attribute sources column.
140  */
141  String sources = StringUtils.join(attr.getSources(), ", ");
142  buffer.append(makeTableRow(attr.getAttributeType().getDisplayName(), value, sources));
143  }
144 
145  /*
146  * Add a row for the source content path.
147  */
148 
149  String path = "";
150  try {
151  if (null != content) {
152  path = content.getUniquePath();
153  }
154  } catch (TskCoreException ex) {
155  logger.log(Level.SEVERE, String.format("Error getting source content path for artifact (artifact_id=%d, obj_id=%d)", artifact.getArtifactID(), artifact.getObjectID()), ex);
156  path = Bundle.ArtifactStringContent_failedToGetSourcePath_message();
157  }
158 
159  buffer.append(makeTableRow(NbBundle.getMessage(this.getClass(), "ArtifactStringContent.getStr.srcFilePath.text"),
160  path, ""));
161 
162 
163  /*
164  * Add a row for the artifact id.
165  */
166  buffer.append(makeTableRow(NbBundle.getMessage(this.getClass(), "ArtifactStringContent.getStr.artifactId.text"),
167  Long.toString(artifact.getArtifactID()), ""));
168 
169  } catch (TskCoreException ex) {
170  logger.log(Level.SEVERE, String.format("Error getting data for artifact (artifact_id=%d)", artifact.getArtifactID()), ex);
171  buffer.append(makeTableRow(Bundle.ArtifactStringContent_failedToGetAttributes_message(), "", ""));
172  } finally {
173  /*
174  * Finish the document
175  */
176  buffer.append("</table>"); //NON-NLS
177  buffer.append("</html>\n"); //NON-NLS
178  stringContent = buffer.toString();
179  }
180  }
181 
182  return stringContent;
183  }
184 
185  // escape special HTML characters
186  private String escapeHtmlString(String str) {
187  str = str.replaceAll(" ", "&nbsp;"); //NON-NLS
188  str = str.replaceAll("<", "&lt;"); //NON-NLS
189  str = str.replaceAll(">", "&gt;"); //NON-NLS
190  str = str.replaceAll("(\r\n|\n)", "<br />"); //NON-NLS
191  return str;
192  }
193 
201  private String makeTableRow(String type, String value, String source) {
202  String row = "<tr><td>" + escapeHtmlString(type) + "</td><td>" + escapeHtmlString(value) + "</td><td>" + escapeHtmlString(source) + "</td></tr>";
203  return row;
204  }
205 
206 }
org::sleuthkit.autopsy.datamodel.ArtifactStringContent.dateFormatter
static final SimpleDateFormat dateFormatter
Definition: ArtifactStringContent.java:41
org::sleuthkit.autopsy.datamodel.ContentUtils
Definition: ContentUtils.java:53
org::sleuthkit.autopsy.datamodel.StringContent
Definition: StringContent.java:13
org::sleuthkit.autopsy.datamodel.ArtifactStringContent.ArtifactStringContent
ArtifactStringContent(BlackboardArtifact artifact)
Definition: ArtifactStringContent.java:54
org::sleuthkit.autopsy.datamodel.ArtifactStringContent.getString
String getString()
Definition: ArtifactStringContent.java:71
org::sleuthkit.autopsy.datamodel.ArtifactStringContent
Definition: ArtifactStringContent.java:39
org::sleuthkit.autopsy.datamodel.ArtifactStringContent.makeTableRow
String makeTableRow(String type, String value, String source)
Definition: ArtifactStringContent.java:201
org::sleuthkit::datamodel::Content
org::sleuthkit.autopsy.datamodel.ArtifactStringContent.stringContent
String stringContent
Definition: ArtifactStringContent.java:44
org::sleuthkit.autopsy.datamodel.ArtifactStringContent.logger
static final Logger logger
Definition: ArtifactStringContent.java:42
org::sleuthkit.autopsy.datamodel.ArtifactStringContent.escapeHtmlString
String escapeHtmlString(String str)
Definition: ArtifactStringContent.java:186
org::sleuthkit::datamodel::BlackboardArtifact::getAttributes
List< BlackboardAttribute > getAttributes()
org::sleuthkit.autopsy.coreutils.Logger.getLogger
synchronized static Logger getLogger(String name)
Definition: Logger.java:161
org::sleuthkit.autopsy.datamodel.ContentUtils.getTimeZone
static TimeZone getTimeZone(Content c)
Definition: ContentUtils.java:132
org::sleuthkit.autopsy.datamodel.ArtifactStringContent.artifact
final BlackboardArtifact artifact
Definition: ArtifactStringContent.java:43
org::sleuthkit::datamodel::Content::getUniquePath
String getUniquePath()

Copyright © 2012-2016 Basis Technology. Generated on: Mon Apr 24 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.