Autopsy  4.9.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
ArtifactTextExtractor.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2018 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.textreaders;
20 
21 import java.io.InputStreamReader;
22 import java.io.Reader;
23 import java.nio.charset.StandardCharsets;
24 import org.apache.commons.io.IOUtils;
26 import org.sleuthkit.datamodel.BlackboardArtifact;
27 import org.sleuthkit.datamodel.BlackboardAttribute;
28 import org.sleuthkit.datamodel.Content;
29 import org.sleuthkit.datamodel.TskCoreException;
30 
35 class ArtifactTextExtractor extends TextExtractor {
36 
37  private final BlackboardArtifact artifact;
38 
39  public ArtifactTextExtractor(Content artifact) {
40  this.artifact = (BlackboardArtifact) artifact;
41  }
42 
43  @Override
44  public Reader getReader() throws ExtractionException {
45  // Concatenate the string values of all attributes into a single
46  // "content" string to be indexed.
47  StringBuilder artifactContents = new StringBuilder();
48 
49  Content dataSource = null;
50  try {
51  dataSource = artifact.getDataSource();
52  } catch (TskCoreException tskCoreException) {
53  throw new ExtractionException("Unable to get datasource for artifact: " + artifact.toString(), tskCoreException);
54  }
55  if (dataSource == null) {
56  throw new ExtractionException("Datasource was null for artifact: " + artifact.toString());
57  }
58 
59  try {
60  for (BlackboardAttribute attribute : artifact.getAttributes()) {
61  artifactContents.append(attribute.getAttributeType().getDisplayName());
62  artifactContents.append(" : ");
63  // We have also discussed modifying BlackboardAttribute.getDisplayString()
64  // to magically format datetime attributes but that is complicated by
65  // the fact that BlackboardAttribute exists in Sleuthkit data model
66  // while the utility to determine the timezone to use is in ContentUtils
67  // in the Autopsy datamodel.
68  switch (attribute.getValueType()) {
69  case DATETIME:
70  artifactContents.append(ContentUtils.getStringTime(attribute.getValueLong(), dataSource));
71  break;
72  default:
73  artifactContents.append(attribute.getDisplayString());
74  }
75  artifactContents.append(System.lineSeparator());
76  }
77  } catch (TskCoreException tskCoreException) {
78  throw new ExtractionException("Unable to get attributes for artifact: " + artifact.toString(), tskCoreException);
79  }
80 
81  return new InputStreamReader(IOUtils.toInputStream(artifactContents,
82  StandardCharsets.UTF_8), StandardCharsets.UTF_8);
83  }
84 
85  @Override
86  public boolean isSupported(Content file, String detectedFormat) {
87  return true;
88  }
89 }
static String getStringTime(long epochSeconds, TimeZone tzone)

Copyright © 2012-2018 Basis Technology. Generated on: Tue Dec 18 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.