Autopsy
4.4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
|
Inherits Closeable.
Classes | |
class | TagNameAlreadyExistsException |
Public Member Functions | |
BlackboardArtifactTag | addBlackboardArtifactTag (BlackboardArtifact artifact, TagName tagName) throws TskCoreException |
BlackboardArtifactTag | addBlackboardArtifactTag (BlackboardArtifact artifact, TagName tagName, String comment) throws TskCoreException |
ContentTag | addContentTag (Content content, TagName tagName) throws TskCoreException |
ContentTag | addContentTag (Content content, TagName tagName, String comment) throws TskCoreException |
ContentTag | addContentTag (Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset) throws TskCoreException |
synchronized TagName | addTagName (String displayName) throws TagNameAlreadyExistsException, TskCoreException |
synchronized TagName | addTagName (String displayName, String description) throws TagNameAlreadyExistsException, TskCoreException |
synchronized TagName | addTagName (String displayName, String description, TagName.HTML_COLOR color) throws TagNameAlreadyExistsException, TskCoreException |
void | close () throws IOException |
void | deleteBlackboardArtifactTag (BlackboardArtifactTag tag) throws TskCoreException |
void | deleteContentTag (ContentTag tag) throws TskCoreException |
List< BlackboardArtifactTag > | getAllBlackboardArtifactTags () throws TskCoreException |
List< ContentTag > | getAllContentTags () throws TskCoreException |
List< TagName > | getAllTagNames () throws TskCoreException |
BlackboardArtifactTag | getBlackboardArtifactTagByTagID (long tagId) throws TskCoreException |
List< BlackboardArtifactTag > | getBlackboardArtifactTagsByArtifact (BlackboardArtifact artifact) throws TskCoreException |
List< BlackboardArtifactTag > | getBlackboardArtifactTagsByTagName (TagName tagName) throws TskCoreException |
long | getBlackboardArtifactTagsCountByTagName (TagName tagName) throws TskCoreException |
ContentTag | getContentTagByTagID (long tagId) throws TskCoreException |
List< ContentTag > | getContentTagsByContent (Content content) throws TskCoreException |
List< ContentTag > | getContentTagsByTagName (TagName tagName) throws TskCoreException |
long | getContentTagsCountByTagName (TagName tagName) throws TskCoreException |
Map< String, TagName > | getDisplayNamesToTagNamesMap () throws TskCoreException |
List< TagName > | getTagNamesInUse () throws TskCoreException |
boolean | tagNameExists (String tagDisplayName) |
Static Public Member Functions | |
static boolean | containsIllegalCharacters (String tagDisplayName) |
static Set< String > | getTagDisplayNames () throws TskCoreException |
Private Attributes | |
final SleuthkitCase | caseDb |
Static Private Attributes | |
static final Logger | LOGGER = Logger.getLogger(TagsManager.class.getName()) |
static final Set< String > | STANDARD_TAG_DISPLAY_NAMES = new HashSet<>(Arrays.asList(Bundle.TagsManager_predefTagNames_bookmark_text())) |
A per case Autopsy service that manages the addition of content and artifact tags to the case database.
Definition at line 45 of file TagsManager.java.
BlackboardArtifactTag org.sleuthkit.autopsy.casemodule.services.TagsManager.addBlackboardArtifactTag | ( | BlackboardArtifact | artifact, |
TagName | tagName | ||
) | throws TskCoreException |
Tags an artifact.
artifact | The artifact to tag. |
tagName | The representation of the desired tag type in the case database, which can be obtained by calling getTagNames and/or addTagName. |
TskCoreException | If there is an error adding the tag to the case database. |
Definition at line 410 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.actions.AddBlackboardArtifactTagAction.addTag().
BlackboardArtifactTag org.sleuthkit.autopsy.casemodule.services.TagsManager.addBlackboardArtifactTag | ( | BlackboardArtifact | artifact, |
TagName | tagName, | ||
String | comment | ||
) | throws TskCoreException |
Tags an artifact.
artifact | The artifact to tag. |
tagName | The representation of the desired tag type in the case database, which can be obtained by calling getTagNames and/or addTagName. |
comment | A comment to store with the tag. |
TskCoreException | If there is an error adding the tag to the case database. |
Definition at line 428 of file TagsManager.java.
References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.notifyBlackBoardArtifactTagAdded().
ContentTag org.sleuthkit.autopsy.casemodule.services.TagsManager.addContentTag | ( | Content | content, |
TagName | tagName | ||
) | throws TskCoreException |
Tags a content object.
content | The content to tag. |
tagName | The representation of the desired tag type in the case database, which can be obtained by calling getTagNames and/or addTagName. |
TskCoreException | If there is an error adding the tag to the case database. |
Definition at line 259 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.casemodule.services.TagsManager.addContentTag(), and org.sleuthkit.autopsy.actions.AddContentTagAction.addTag().
ContentTag org.sleuthkit.autopsy.casemodule.services.TagsManager.addContentTag | ( | Content | content, |
TagName | tagName, | ||
String | comment | ||
) | throws TskCoreException |
Tags a content object.
content | The content to tag. |
tagName | The representation of the desired tag type in the case database, which can be obtained by calling getTagNames and/or addTagName. |
comment | A comment to store with the tag. |
TskCoreException | If there is an error adding the tag to the case database. |
Definition at line 277 of file TagsManager.java.
References org.sleuthkit.autopsy.casemodule.services.TagsManager.addContentTag().
ContentTag org.sleuthkit.autopsy.casemodule.services.TagsManager.addContentTag | ( | Content | content, |
TagName | tagName, | ||
String | comment, | ||
long | beginByteOffset, | ||
long | endByteOffset | ||
) | throws TskCoreException |
Tags a content object or a section of a content object.
content | The content to tag. |
tagName | The representation of the desired tag type in the case database, which can be obtained by calling getTagNames and/or addTagName. |
comment | A comment to store with the tag. |
beginByteOffset | Designates the beginning of a tagged section. |
endByteOffset | Designates the end of a tagged section. |
TskCoreException | If there is an error adding the tag to the case database. |
Definition at line 297 of file TagsManager.java.
References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.notifyContentTagAdded().
synchronized TagName org.sleuthkit.autopsy.casemodule.services.TagsManager.addTagName | ( | String | displayName | ) | throws TagNameAlreadyExistsException, TskCoreException |
Adds a tag name entry to the case database and adds a corresponding tag type to the current user's custom tag types.
displayName | The display name for the new tag type. |
TagNameAlreadyExistsException | If the tag name already exists in the case database. |
TskCoreException | If there is an error adding the tag name to the case database. |
Definition at line 188 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.casemodule.services.TagsManager.addTagName(), org.sleuthkit.autopsy.actions.AddTagAction.TagMenu.getAndAddTag(), org.sleuthkit.autopsy.actions.GetTagNameAndCommentDialog.okButtonActionPerformed(), org.sleuthkit.autopsy.actions.GetTagNameDialog.okButtonActionPerformed(), and org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.propertyChange().
synchronized TagName org.sleuthkit.autopsy.casemodule.services.TagsManager.addTagName | ( | String | displayName, |
String | description | ||
) | throws TagNameAlreadyExistsException, TskCoreException |
Adds a tag name entry to the case database and adds a corresponding tag type to the current user's custom tag types.
displayName | The display name for the new tag type. |
description | The description for the new tag type. |
TagNameAlreadyExistsException | If the tag name already exists in the case database. |
TskCoreException | If there is an error adding the tag name to the case database. |
Definition at line 207 of file TagsManager.java.
References org.sleuthkit.autopsy.casemodule.services.TagsManager.addTagName().
synchronized TagName org.sleuthkit.autopsy.casemodule.services.TagsManager.addTagName | ( | String | displayName, |
String | description, | ||
TagName.HTML_COLOR | color | ||
) | throws TagNameAlreadyExistsException, TskCoreException |
Adds a tag name entry to the case database and adds a corresponding tag type to the current user's custom tag types.
displayName | The display name for the new tag type. |
description | The description for the new tag type. |
color | The color to associate with the new tag type. |
TagNameAlreadyExistsException | If the tag name already exists. |
TskCoreException | If there is an error adding the tag name to the case database. |
Definition at line 226 of file TagsManager.java.
void org.sleuthkit.autopsy.casemodule.services.TagsManager.close | ( | ) | throws IOException |
Closes the tags manager.
IOException | If there is a problem closing the tags manager. |
Definition at line 566 of file TagsManager.java.
|
static |
Tests whether or not a given tag display name contains an illegal character.
tagDisplayName | Display name of a tag. |
Definition at line 60 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.actions.GetTagNameDialog.okButtonActionPerformed().
void org.sleuthkit.autopsy.casemodule.services.TagsManager.deleteBlackboardArtifactTag | ( | BlackboardArtifactTag | tag | ) | throws TskCoreException |
Deletes an artifact tag.
tag | The tag to delete. |
TskCoreException | If there is an error deleting the tag from the case database. |
Definition at line 446 of file TagsManager.java.
References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.notifyBlackBoardArtifactTagDeleted().
Referenced by org.sleuthkit.autopsy.actions.DeleteBlackboardArtifactTagAction.actionPerformed(), and org.sleuthkit.autopsy.actions.DeleteFileBlackboardArtifactTagAction.deleteTag().
void org.sleuthkit.autopsy.casemodule.services.TagsManager.deleteContentTag | ( | ContentTag | tag | ) | throws TskCoreException |
Deletes a content tag.
tag | The tag to delete. |
TskCoreException | If there is an error deleting the tag from the case database. |
Definition at line 316 of file TagsManager.java.
References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.notifyContentTagDeleted().
Referenced by org.sleuthkit.autopsy.actions.DeleteContentTagAction.actionPerformed(), and org.sleuthkit.autopsy.actions.DeleteFileContentTagAction.deleteTag().
List<BlackboardArtifactTag> org.sleuthkit.autopsy.casemodule.services.TagsManager.getAllBlackboardArtifactTags | ( | ) | throws TskCoreException |
Gets all artifact tags for the current case.
TskCoreException | If there is an error getting the tags from the case database. |
Definition at line 463 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.timeline.db.EventsRepository.DBPopulationWorker.call().
List<ContentTag> org.sleuthkit.autopsy.casemodule.services.TagsManager.getAllContentTags | ( | ) | throws TskCoreException |
Gets all content tags for the current case.
TskCoreException | If there is an error getting the tags from the case database. |
Definition at line 333 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.timeline.db.EventsRepository.DBPopulationWorker.call().
List<TagName> org.sleuthkit.autopsy.casemodule.services.TagsManager.getAllTagNames | ( | ) | throws TskCoreException |
Gets a list of all tag names currently in the case database.
TskCoreException | If there is an error querying the case database. |
Definition at line 121 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.casemodule.services.TagsManager.getTagDisplayNames(), and org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.propertyChange().
BlackboardArtifactTag org.sleuthkit.autopsy.casemodule.services.TagsManager.getBlackboardArtifactTagByTagID | ( | long | tagId | ) | throws TskCoreException |
Gets an artifact tag by tag id.
tagId | The tag id of interest. |
TskCoreException | If there is an error getting the tag from the case database. |
Definition at line 493 of file TagsManager.java.
List<BlackboardArtifactTag> org.sleuthkit.autopsy.casemodule.services.TagsManager.getBlackboardArtifactTagsByArtifact | ( | BlackboardArtifact | artifact | ) | throws TskCoreException |
Gets artifact tags for a particular artifact.
artifact | The artifact of interest. |
TskCoreException | If there is an error getting the tags from the case database. |
Definition at line 525 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.createSheet(), org.sleuthkit.autopsy.timeline.datamodel.FilteredEventsModel.handleArtifactTagDeleted(), org.sleuthkit.autopsy.timeline.db.EventsRepository.DBPopulationWorker.insertEventForArtifact(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.propertyChange(), and org.sleuthkit.autopsy.timeline.ui.listvew.ListTimeline.TaggedCell.updateItem().
List<BlackboardArtifactTag> org.sleuthkit.autopsy.casemodule.services.TagsManager.getBlackboardArtifactTagsByTagName | ( | TagName | tagName | ) | throws TskCoreException |
Gets artifact tags by tag name.
tagName | The representation of the desired tag type in the case database, which can be obtained by calling getTagNames and/or addTagName. |
TskCoreException | If there is an error getting the tags from the case database. |
Definition at line 510 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.datamodel.Tags.BlackboardArtifactTagNodeFactory.createKeys().
long org.sleuthkit.autopsy.casemodule.services.TagsManager.getBlackboardArtifactTagsCountByTagName | ( | TagName | tagName | ) | throws TskCoreException |
Gets an artifact tags count by tag name.
tagName | The representation of the desired tag type in the case database, which can be obtained by calling getTagNames and/or addTagName. |
TskCoreException | If there is an error getting the tags count from the case database. |
Definition at line 479 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.datamodel.Tags.TagNameNode.updateDisplayName(), and org.sleuthkit.autopsy.datamodel.Tags.BlackboardArtifactTagTypeNode.updateDisplayName().
ContentTag org.sleuthkit.autopsy.casemodule.services.TagsManager.getContentTagByTagID | ( | long | tagId | ) | throws TskCoreException |
Gets a content tag by tag id.
tagId | The tag id of interest. |
TskCoreException | If there is an error getting the tag from the case database. |
Definition at line 363 of file TagsManager.java.
List<ContentTag> org.sleuthkit.autopsy.casemodule.services.TagsManager.getContentTagsByContent | ( | Content | content | ) | throws TskCoreException |
Gets content tags count by content.
content | The content of interest. |
TskCoreException | If there is an error getting the tags from the case database. |
Definition at line 393 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.datamodel.AbstractAbstractFileNode< SpecialDirectory >.addTagProperty(), org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.createSheet(), org.sleuthkit.autopsy.report.TableReportGenerator.ArtifactData.getOrderedRowDataAsStrings(), org.sleuthkit.autopsy.timeline.datamodel.FilteredEventsModel.handleContentTagDeleted(), org.sleuthkit.autopsy.timeline.db.EventsRepository.DBPopulationWorker.insertEventsForFile(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.propertyChange(), and org.sleuthkit.autopsy.timeline.ui.listvew.ListTimeline.TaggedCell.updateItem().
List<ContentTag> org.sleuthkit.autopsy.casemodule.services.TagsManager.getContentTagsByTagName | ( | TagName | tagName | ) | throws TskCoreException |
Gets content tags by tag name.
tagName | The tag name of interest. |
TskCoreException | If there is an error getting the tags from the case database. |
Definition at line 378 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.datamodel.Tags.ContentTagNodeFactory.createKeys(), and org.sleuthkit.autopsy.report.taggedhashes.AddTaggedHashesToHashDb.generateReport().
long org.sleuthkit.autopsy.casemodule.services.TagsManager.getContentTagsCountByTagName | ( | TagName | tagName | ) | throws TskCoreException |
Gets content tags count by tag name.
tagName | The representation of the desired tag type in the case database, which can be obtained by calling getTagNames and/or addTagName. |
TskCoreException | If there is an error getting the tags count from the case database. |
Definition at line 349 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.datamodel.Tags.TagNameNode.updateDisplayName(), and org.sleuthkit.autopsy.datamodel.Tags.ContentTagTypeNode.updateDisplayName().
Map<String, TagName> org.sleuthkit.autopsy.casemodule.services.TagsManager.getDisplayNamesToTagNamesMap | ( | ) | throws TskCoreException |
Gets a map of tag display names to tag name entries in the case database. It has keys for the display names of the standard tag types, the current user's custom tag types, and the tags in the case database. The value for a given key will be null if the corresponding tag type is defined, but a tag name entry has not yet added to the case database. In that case, addTagName may be called to add the tag name entry.
TskCoreException | if there is an error querying the case database. |
Order is important here. The keys (display names) for the current user's custom tag types are added to the map first, with null TagName values. If tag name entries exist for those keys, loading of the tag names from the database supplies the missing values. Standard tag names are added during the initialization of the case database.
Note that creating the map on demand increases the probability that the display names of newly added custom tag types and the display names of tags added to a multi-user case by other users appear in the map.
Definition at line 150 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.actions.AddBookmarkTagAction.actionPerformed(), org.sleuthkit.autopsy.actions.GetTagNameDialog.display(), org.sleuthkit.autopsy.actions.GetTagNameAndCommentDialog.display(), org.sleuthkit.autopsy.actions.AddTagAction.TagMenu.getAndAddTag(), org.sleuthkit.autopsy.actions.GetTagNameAndCommentDialog.okButtonActionPerformed(), org.sleuthkit.autopsy.actions.GetTagNameDialog.okButtonActionPerformed(), and org.sleuthkit.autopsy.casemodule.services.TagsManager.tagNameExists().
|
static |
Gets the set of display names of the currently available tag types. This includes the display names of the standard tag types, the current user's custom tag types, and the tags in the case database of the current case (if there is a current case).
TskCoreException | If there is a current case and there is an error querying the case database for tag types. |
Definition at line 85 of file TagsManager.java.
References org.sleuthkit.autopsy.casemodule.services.TagsManager.getAllTagNames(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), org.sleuthkit.autopsy.casemodule.Case.getServices(), org.sleuthkit.autopsy.casemodule.services.Services.getTagsManager(), and org.sleuthkit.autopsy.casemodule.services.TagsManager.STANDARD_TAG_DISPLAY_NAMES.
List<TagName> org.sleuthkit.autopsy.casemodule.services.TagsManager.getTagNamesInUse | ( | ) | throws TskCoreException |
Gets a list of all tag names currently in use in the case database for tagging content or artifacts.
TskCoreException | If there is an error querying the case database. |
Definition at line 133 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.datamodel.Tags.TagNameNodeFactory.createKeys().
boolean org.sleuthkit.autopsy.casemodule.services.TagsManager.tagNameExists | ( | String | tagDisplayName | ) |
Checks whether a tag name with a given display name exists in the case database.
tagDisplayName | The display name. |
Definition at line 548 of file TagsManager.java.
References org.sleuthkit.autopsy.casemodule.services.TagsManager.getDisplayNamesToTagNamesMap().
|
private |
Definition at line 50 of file TagsManager.java.
|
staticprivate |
Definition at line 47 of file TagsManager.java.
|
staticprivate |
Definition at line 49 of file TagsManager.java.
Referenced by org.sleuthkit.autopsy.casemodule.services.TagsManager.getTagDisplayNames().
Copyright © 2012-2016 Basis Technology. Generated on: Fri Sep 29 2017
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.