Autopsy
4.8.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
|
Public Member Functions | |
EamArtifactUtil () | |
Static Public Member Functions | |
static String | getEmailAddressAttrString () |
static CorrelationAttributeInstance | getInstanceFromContent (Content content) |
static boolean | isSupportedAbstractFileType (AbstractFile file) |
static CorrelationAttributeInstance | makeInstanceFromContent (Content content) |
static List< CorrelationAttributeInstance > | makeInstancesFromBlackboardArtifact (BlackboardArtifact bbArtifact, boolean checkEnabled) |
Static Private Member Functions | |
static CorrelationAttributeInstance | makeCorrelationAttributeInstanceUsingTypeValue (BlackboardArtifact bbArtifact, CorrelationAttributeInstance.Type correlationType, String value) |
static CorrelationAttributeInstance | makeInstanceFromBlackboardArtifact (CorrelationAttributeInstance.Type correlationType, BlackboardArtifact bbArtifact) throws EamDbException |
Static Private Attributes | |
static final Logger | logger = Logger.getLogger(EamArtifactUtil.class.getName()) |
Definition at line 39 of file EamArtifactUtil.java.
org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.EamArtifactUtil | ( | ) |
Definition at line 43 of file EamArtifactUtil.java.
|
static |
Definition at line 47 of file EamArtifactUtil.java.
Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeInstanceFromBlackboardArtifact().
|
static |
Retrieve CorrelationAttribute from the given Content.
content | The content object |
Definition at line 230 of file EamArtifactUtil.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.FILES_TYPE_ID, org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.fromTSKDataSource(), org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCase(), org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCorrelationAttributeInstance(), org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCorrelationTypeById(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getInstance(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.isSupportedAbstractFileType().
Referenced by org.sleuthkit.autopsy.centralrepository.AddEditCentralRepoCommentAction.AddEditCentralRepoCommentAction(), org.sleuthkit.autopsy.datamodel.AbstractAbstractFileNode< SpecialDirectory >.getCorrelationAttributeInstance(), and org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.getCorrelationAttributeInstance().
|
static |
Check whether the given abstract file should be processed for the central repository.
file | The file to test |
Definition at line 342 of file EamArtifactUtil.java.
Referenced by org.sleuthkit.autopsy.centralrepository.CentralRepoContextMenuActionsProvider.getActions(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.getInstanceFromContent(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeInstanceFromContent().
|
staticprivate |
Uses the determined type and vallue, then looks up instance details to create proper CorrelationAttributeInstance.
bbArtifact | the blackboard artifatc |
correlationType | the given type |
value | the artifact value |
Definition at line 190 of file EamArtifactUtil.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.fromTSKDataSource(), org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCase(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getInstance(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.getName(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newCase().
Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeInstanceFromBlackboardArtifact().
|
staticprivate |
Create an EamArtifact of type correlationType if one can be generated based on the data in the blackboard artifact.
correlationType | The Central Repository artifact type to create |
bbArtifact | The blackboard artifact to pull data from |
Definition at line 101 of file EamArtifactUtil.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.DOMAIN_TYPE_ID, org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.EMAIL_TYPE_ID, org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.getEmailAddressAttrString(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeCorrelationAttributeInstanceUsingTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeInstanceFromBlackboardArtifact(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.PHONE_TYPE_ID, and org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.USBID_TYPE_ID.
Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeInstanceFromBlackboardArtifact(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeInstancesFromBlackboardArtifact().
|
static |
Create an EamArtifact from the given Content. Will return null if an artifact can not be created - this is not necessarily an error case, it just means an artifact can't be made. If creation fails due to an error (and not that the file is the wrong type or it has no hash), the error will be logged before returning.
Does not add the artifact to the database.
content | The content object |
Definition at line 292 of file EamArtifactUtil.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.FILES_TYPE_ID, org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.fromTSKDataSource(), org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCase(), org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getCorrelationTypeById(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getInstance(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.getName(), org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.isSupportedAbstractFileType(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.newCase().
Referenced by org.sleuthkit.autopsy.centralrepository.AddEditCentralRepoCommentAction.AddEditCentralRepoCommentAction(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.ContentTagTask.run(), and org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.TagDefinitionChangeTask.run().
|
static |
Static factory method to examine a BlackboardArtifact to determine if it has contents that can be used for Correlation. If so, return a EamArtifact with a single EamArtifactInstance within. If not, return null.
bbArtifact | BlackboardArtifact to examine |
checkEnabled | If true, only create a CorrelationAttribute if it is enabled |
Definition at line 63 of file EamArtifactUtil.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getDefinedCorrelationTypes(), org.sleuthkit.autopsy.centralrepository.datamodel.EamDb.getInstance(), and org.sleuthkit.autopsy.centralrepository.datamodel.EamArtifactUtil.makeInstanceFromBlackboardArtifact().
Referenced by org.sleuthkit.autopsy.centralrepository.contentviewer.DataContentViewerOtherCases.getCorrelationAttributesFromNode(), org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.populateCentralRepositoryData(), org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.BlackboardTagTask.run(), org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.DataAddedTask.run(), and org.sleuthkit.autopsy.centralrepository.eventlisteners.CaseEventListener.TagDefinitionChangeTask.run().
|
staticprivate |
Definition at line 41 of file EamArtifactUtil.java.
Copyright © 2012-2018 Basis Technology. Generated on: Thu Oct 4 2018
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.