19 package org.sleuthkit.autopsy.report;
21 import com.google.common.collect.ListMultimap;
22 import com.google.common.collect.Lists;
23 import com.google.common.collect.Multimaps;
24 import java.sql.ResultSet;
25 import java.sql.SQLException;
26 import java.util.ArrayList;
27 import java.util.Arrays;
28 import java.util.Collection;
29 import java.util.Collections;
30 import java.util.Comparator;
31 import java.util.HashMap;
32 import java.util.HashSet;
33 import java.util.Iterator;
34 import java.util.List;
36 import java.util.Objects;
38 import java.util.TreeSet;
39 import java.util.logging.Level;
40 import org.openide.util.NbBundle;
41 import org.openide.util.NbBundle.Messages;
62 class TableReportGenerator {
64 private final List<BlackboardArtifact.Type> artifactTypes =
new ArrayList<>();
65 private final HashSet<String> tagNamesFilter =
new HashSet<>();
67 private final Set<Content> images =
new HashSet<>();
68 private final ReportProgressPanel progressPanel;
69 private final TableReportModule tableReport;
70 private final Map<Integer, List<Column>> columnHeaderMap;
71 private static final Logger logger = Logger.getLogger(TableReportGenerator.class.getName());
73 private final List<String> errorList;
75 TableReportGenerator(Map<BlackboardArtifact.Type, Boolean> artifactTypeSelections, Map<String, Boolean> tagNameSelections, ReportProgressPanel progressPanel, TableReportModule tableReport) {
77 this.progressPanel = progressPanel;
78 this.tableReport = tableReport;
79 this.columnHeaderMap =
new HashMap<>();
80 errorList =
new ArrayList<>();
82 for (Map.Entry<BlackboardArtifact.Type, Boolean> entry : artifactTypeSelections.entrySet()) {
83 if (entry.getValue()) {
84 artifactTypes.add(entry.getKey());
89 if (null != tagNameSelections) {
90 for (Map.Entry<String, Boolean> entry : tagNameSelections.entrySet()) {
91 if (entry.getValue() ==
true) {
92 tagNamesFilter.add(entry.getKey());
98 protected void execute() {
101 progressPanel.start();
102 progressPanel.setIndeterminate(
false);
103 progressPanel.setMaximumProgress(this.artifactTypes.size() + 2);
105 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
106 makeBlackboardArtifactTables();
110 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
111 makeContentTagsTables();
114 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
115 makeBlackboardArtifactTagsTables();
118 if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
120 makeThumbnailTable();
127 private void makeBlackboardArtifactTables() {
130 if (!tagNamesFilter.isEmpty()) {
131 comment += NbBundle.getMessage(this.getClass(),
"ReportGenerator.artifactTable.taggedResults.text");
132 comment += makeCommaSeparatedList(tagNamesFilter);
136 for (BlackboardArtifact.Type type : artifactTypes) {
139 if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
143 progressPanel.updateStatusLabel(
144 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
145 type.getDisplayName()));
148 if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
149 writeKeywordHits(tableReport, comment, tagNamesFilter);
151 }
else if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
152 writeHashsetHits(tableReport, comment, tagNamesFilter);
156 List<ArtifactData> artifactList = getFilteredArtifacts(type, tagNamesFilter);
158 if (artifactList.isEmpty()) {
167 if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
169 ListMultimap<String, ArtifactData> groupedArtifacts = Multimaps.index(artifactList,
172 return artifactData.getArtifact().getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE)).getValueString();
173 }
catch (TskCoreException ex) {
174 logger.log(Level.SEVERE,
"Unable to get value of TSK_ACCOUNT_TYPE attribute. Defaulting to \"unknown\"", ex);
178 for (String accountTypeStr : groupedArtifacts.keySet()) {
185 String accountDisplayname = accountTypeStr;
186 if (accountTypeStr != null) {
188 Account.Type acctType = Case.getCurrentCaseThrows().getSleuthkitCase().getCommunicationsManager().getAccountType(accountTypeStr);
189 if (acctType != null) {
190 accountDisplayname = acctType.getDisplayName();
192 }
catch (TskCoreException | NoCurrentCaseException ex) {
193 logger.log(Level.SEVERE,
"Unable to get display name for account type " + accountTypeStr, ex);
197 final String compundDataTypeName = BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getDisplayName() +
": " + accountDisplayname;
198 writeTableForDataType(
new ArrayList<>(groupedArtifacts.get(accountTypeStr)), type, compundDataTypeName, comment);
202 writeTableForDataType(artifactList, type, type.getDisplayName(), comment);
217 private void writeTableForDataType(List<ArtifactData> artifactList, BlackboardArtifact.Type type, String tableName, String comment) {
222 Set<BlackboardAttribute.Type> attrTypeSet =
new TreeSet<>(Comparator.comparing(BlackboardAttribute.Type::getDisplayName));
223 for (ArtifactData data : artifactList) {
224 List<BlackboardAttribute> attributes = data.getAttributes();
225 for (BlackboardAttribute attribute : attributes) {
226 attrTypeSet.add(attribute.getAttributeType());
234 List<Column> columns = getArtifactTableColumns(type.getTypeID(), attrTypeSet);
235 if (columns.isEmpty()) {
238 columnHeaderMap.put(type.getTypeID(), columns);
244 Collections.sort(artifactList);
246 tableReport.startDataType(tableName, comment);
249 for (ArtifactData artifactData : artifactList) {
252 List<String> rowData = artifactData.getRow();
253 if (rowData.isEmpty()) {
257 tableReport.addRow(rowData);
260 progressPanel.increment();
261 tableReport.endTable();
262 tableReport.endDataType();
268 @Messages({
"ReportGenerator.tagTable.header.userName=User Name"})
269 @SuppressWarnings(
"deprecation")
270 private
void makeContentTagsTables() {
273 List<ContentTag> tags;
275 tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getAllContentTags();
276 }
catch (TskCoreException | NoCurrentCaseException ex) {
277 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetContentTags"));
278 logger.log(Level.SEVERE,
"failed to get content tags", ex);
285 progressPanel.updateStatusLabel(
286 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
287 BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName()));
288 ArrayList<String> columnHeaders =
new ArrayList<>(Arrays.asList(
289 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.tag"),
290 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.file"),
291 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.comment"),
292 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.userName"),
293 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeModified"),
294 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeChanged"),
295 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeAccessed"),
296 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.timeCreated"),
297 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.size"),
298 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.htmlOutput.header.hash")));
300 StringBuilder comment =
new StringBuilder();
301 if (!tagNamesFilter.isEmpty()) {
303 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.makeContTagTab.taggedFiles.msg"));
304 comment.append(makeCommaSeparatedList(tagNamesFilter));
306 if (tableReport instanceof ReportHTML) {
307 ReportHTML htmlReportModule = (ReportHTML) tableReport;
308 htmlReportModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
309 htmlReportModule.startContentTagsTable(columnHeaders);
311 tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
312 tableReport.startTable(columnHeaders);
316 for (ContentTag tag : tags) {
318 String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() :
"";
319 if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) ==
false) {
325 fileName = tag.getContent().getUniquePath();
326 }
catch (TskCoreException ex) {
327 fileName = tag.getContent().getName();
330 ArrayList<String> rowData =
new ArrayList<>(Arrays.asList(tag.getName().getDisplayName() + notableString, fileName, tag.getComment(), tag.getUserName()));
331 Content content = tag.getContent();
332 if (content instanceof AbstractFile) {
333 AbstractFile file = (AbstractFile) content;
336 rowData.add(file.getMtimeAsDate());
337 rowData.add(file.getCtimeAsDate());
338 rowData.add(file.getAtimeAsDate());
339 rowData.add(file.getCrtimeAsDate());
340 rowData.add(Long.toString(file.getSize()));
341 rowData.add(file.getMd5Hash());
344 if (tableReport instanceof ReportHTML) {
345 ReportHTML htmlReportModule = (ReportHTML) tableReport;
346 htmlReportModule.addRowWithTaggedContentHyperlink(rowData, tag);
348 tableReport.addRow(rowData);
352 checkIfTagHasImage(tag);
356 progressPanel.increment();
357 tableReport.endTable();
358 tableReport.endDataType();
364 @SuppressWarnings(
"deprecation")
365 private
void makeBlackboardArtifactTagsTables() {
367 List<BlackboardArtifactTag> tags;
369 tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getAllBlackboardArtifactTags();
370 }
catch (TskCoreException | NoCurrentCaseException ex) {
371 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBArtifactTags"));
372 logger.log(Level.SEVERE,
"failed to get blackboard artifact tags", ex);
378 progressPanel.updateStatusLabel(
379 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
380 BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName()));
381 StringBuilder comment =
new StringBuilder();
382 if (!tagNamesFilter.isEmpty()) {
384 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.makeBbArtTagTab.taggedRes.msg"));
385 comment.append(makeCommaSeparatedList(tagNamesFilter));
387 tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName(), comment.toString());
388 tableReport.startTable(
new ArrayList<>(Arrays.asList(
389 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.resultType"),
390 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.tag"),
391 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.comment"),
392 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.srcFile"),
393 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.tagTable.header.userName"))));
396 for (BlackboardArtifactTag tag : tags) {
397 String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() :
"";
398 if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) ==
false) {
403 row =
new ArrayList<>(Arrays.asList(tag.getArtifact().getArtifactTypeName(), tag.getName().getDisplayName() + notableString,
404 tag.getComment(), tag.getContent().getName(), tag.getUserName()));
405 tableReport.addRow(row);
408 checkIfTagHasImage(tag);
412 progressPanel.increment();
413 tableReport.endTable();
414 tableReport.endDataType();
424 private boolean passesTagNamesFilter(String tagName) {
425 return tagNamesFilter.isEmpty() || tagNamesFilter.contains(tagName);
431 private void makeThumbnailTable() {
432 progressPanel.updateStatusLabel(
433 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.createdThumb.text"));
435 if (tableReport instanceof ReportHTML) {
436 ReportHTML htmlModule = (ReportHTML) tableReport;
437 htmlModule.startDataType(
438 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.thumbnailTable.name"),
439 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.thumbnailTable.desc"));
440 List<String> emptyHeaders =
new ArrayList<>();
441 for (
int i = 0; i < ReportHTML.THUMBNAIL_COLUMNS; i++) {
442 emptyHeaders.add(
"");
444 htmlModule.startTable(emptyHeaders);
446 htmlModule.addThumbnailRows(images);
448 htmlModule.endTable();
449 htmlModule.endDataType();
460 private void checkIfTagHasImage(BlackboardArtifactTag artifactTag) {
463 file = Case.getCurrentCaseThrows().getSleuthkitCase().getAbstractFileById(artifactTag.getArtifact().getObjectID());
464 }
catch (TskCoreException | NoCurrentCaseException ex) {
466 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.errGetContentFromBBArtifact"));
467 logger.log(Level.WARNING,
"Error while getting content from a blackboard artifact to report on.", ex);
472 checkIfFileIsImage(file);
483 private void checkIfTagHasImage(ContentTag contentTag) {
484 Content c = contentTag.getContent();
485 if (c instanceof AbstractFile ==
false) {
488 checkIfFileIsImage((AbstractFile) c);
496 private void checkIfFileIsImage(AbstractFile file) {
499 || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS
500 || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS) {
504 if (ImageUtils.thumbnailSupported(file)) {
517 private String makeCommaSeparatedList(Collection<String> items) {
519 for (Iterator<String> iterator = items.iterator(); iterator.hasNext();) {
520 list += iterator.next() + (iterator.hasNext() ?
", " :
"");
530 @SuppressWarnings(
"deprecation")
531 @NbBundle.Messages ({
"ReportGenerator.errList.noOpenCase=No open case available."})
532 private void writeKeywordHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
539 String orderByClause;
542 openCase = Case.getCurrentCaseThrows();
543 }
catch (NoCurrentCaseException ex) {
544 errorList.add(Bundle.ReportGenerator_errList_noOpenCase());
545 logger.log(Level.SEVERE,
"Exception while getting open case: ", ex);
550 String tagIDList =
"";
551 if( ! tagNamesFilter.isEmpty()) {
553 Map<String, TagName> tagNamesMap = Case.getCurrentCaseThrows().getServices().getTagsManager().getDisplayNamesToTagNamesMap();
554 for(String tagDisplayName : tagNamesFilter) {
555 if(tagNamesMap.containsKey(tagDisplayName)) {
556 if (! tagIDList.isEmpty()) {
559 tagIDList += tagNamesMap.get(tagDisplayName).getId();
562 if(tagDisplayName.endsWith(getNotableTagLabel())) {
563 String editedDisplayName = tagDisplayName.substring(0, tagDisplayName.length() - getNotableTagLabel().length());
564 if(tagNamesMap.containsKey(editedDisplayName)) {
565 if (! tagIDList.isEmpty()) {
568 tagIDList += tagNamesMap.get(editedDisplayName).getId();
573 }
catch (NoCurrentCaseException | TskCoreException ex) {
574 logger.log(Level.SEVERE,
"Exception while getting tag info - proceeding without tag filter: ", ex);
580 String adHocCountQuery =
"SELECT COUNT(*) FROM " +
581 "(SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 ";
582 if (!tagIDList.isEmpty()) {
583 adHocCountQuery +=
", blackboard_artifact_tags as tag ";
585 adHocCountQuery +=
"WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") ";
586 if (!tagIDList.isEmpty()) {
587 adHocCountQuery +=
" AND (art.artifact_id = tag.artifact_id) AND (tag.tag_name_id IN (" + tagIDList +
")) ";
589 adHocCountQuery +=
"EXCEPT " +
590 "SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
")) AS adHocHits";
593 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(adHocCountQuery)) {
594 ResultSet adHocCountResultSet = dbQuery.getResultSet();
595 if (adHocCountResultSet.next()) {
596 adHocCount = adHocCountResultSet.getInt(1);
598 throw new TskCoreException(
"Error counting ad hoc keywords");
600 }
catch (TskCoreException | SQLException ex) {
601 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryKWLists"));
602 logger.log(Level.SEVERE,
"Failed to count ad hoc searches with query " + adHocCountQuery, ex);
607 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
608 orderByClause =
"ORDER BY convert_to(list, 'SQL_ASCII') ASC NULLS FIRST";
610 orderByClause =
"ORDER BY list ASC";
612 String keywordListQuery
613 =
"SELECT att.value_text AS list "
615 "FROM blackboard_attributes AS att, blackboard_artifacts AS art ";
616 if(! tagIDList.isEmpty()) {
617 keywordListQuery +=
", blackboard_artifact_tags as tag ";
619 keywordListQuery +=
"WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
" "
621 "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
" "
623 "AND att.artifact_id = art.artifact_id ";
624 if (! tagIDList.isEmpty()) {
625 keywordListQuery +=
"AND (art.artifact_id = tag.artifact_id) " +
626 "AND (tag.tag_name_id IN (" + tagIDList +
")) ";
628 if (adHocCount > 0) {
629 keywordListQuery +=
" UNION SELECT \'\' AS list ";
631 keywordListQuery =
"SELECT * FROM ( " + keywordListQuery +
" ) kwListNames ";
632 keywordListQuery +=
"GROUP BY list " + orderByClause;
635 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(keywordListQuery)) {
636 ResultSet listsRs = dbQuery.getResultSet();
637 List<String> lists =
new ArrayList<>();
638 while (listsRs.next()) {
639 String list = listsRs.getString(
"list");
640 if (list.isEmpty()) {
641 list = NbBundle.getMessage(this.getClass(),
"ReportGenerator.writeKwHits.userSrchs");
647 tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), comment);
648 tableModule.addSetIndex(lists);
649 progressPanel.updateStatusLabel(
650 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
651 BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName()));
652 }
catch (TskCoreException | SQLException ex) {
653 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryKWLists"));
654 logger.log(Level.SEVERE,
"Failed to query keyword lists with query " + keywordListQuery, ex);
659 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
660 orderByClause =
"ORDER BY convert_to(list, 'SQL_ASCII') ASC NULLS FIRST, "
661 +
"convert_to(keyword, 'SQL_ASCII') ASC NULLS FIRST, "
662 +
"convert_to(parent_path, 'SQL_ASCII') ASC NULLS FIRST, "
663 +
"convert_to(name, 'SQL_ASCII') ASC NULLS FIRST, "
664 +
"convert_to(preview, 'SQL_ASCII') ASC NULLS FIRST";
666 orderByClause =
"ORDER BY list ASC, keyword ASC, parent_path ASC, name ASC, preview ASC";
670 String keywordListsQuery
671 =
"SELECT art.artifact_id AS artifact_id, art.obj_id AS obj_id, att1.value_text AS keyword, att2.value_text AS preview, att3.value_text AS list, f.name AS name, f.parent_path AS parent_path "
673 "FROM blackboard_artifacts AS art, blackboard_attributes AS att1, blackboard_attributes AS att2, blackboard_attributes AS att3, tsk_files AS f "
675 "WHERE (att1.artifact_id = art.artifact_id) "
677 "AND (att2.artifact_id = art.artifact_id) "
679 "AND (att3.artifact_id = art.artifact_id) "
681 "AND (f.obj_id = art.obj_id) "
683 "AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID() +
") "
685 "AND (att2.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID() +
") "
687 "AND (att3.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
") "
689 "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") ";
692 String keywordAdHocQuery =
693 "SELECT art.artifact_id AS artifact_id, art.obj_id AS obj_id, att1.value_text AS keyword, att2.value_text AS preview, \'\' AS list, f.name AS name, f.parent_path AS parent_path " +
694 "FROM blackboard_artifacts AS art, blackboard_attributes AS att1, blackboard_attributes AS att2, tsk_files AS f " +
696 " (art.artifact_id IN (SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") " +
698 "SELECT art.artifact_id FROM blackboard_artifacts AS art, blackboard_attributes AS att1 WHERE (att1.artifact_id = art.artifact_id) AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
"))) " +
699 "AND (att1.artifact_id = art.artifact_id) " +
700 "AND (att2.artifact_id = art.artifact_id) " +
701 "AND (f.obj_id = art.obj_id) " +
702 "AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID() +
") " +
703 "AND (att2.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID() +
") " +
704 "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
") ";
706 String keywordsQuery =
"SELECT * FROM ( " + keywordListsQuery +
" UNION " + keywordAdHocQuery +
" ) kwHits " + orderByClause;
708 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(keywordsQuery)) {
709 ResultSet resultSet = dbQuery.getResultSet();
711 String currentKeyword =
"";
712 String currentList =
"";
713 while (resultSet.next()) {
715 if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
720 HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong(
"artifact_id"));
721 if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
724 String tagsList = makeCommaSeparatedList(uniqueTagNames);
726 Long objId = resultSet.getLong(
"obj_id");
727 String keyword = resultSet.getString(
"keyword");
728 String preview = resultSet.getString(
"preview");
729 String list = resultSet.getString(
"list");
730 String uniquePath =
"";
733 AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
735 uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
737 }
catch (TskCoreException ex) {
739 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAbstractFileByID"));
740 logger.log(Level.WARNING,
"Failed to get Abstract File by ID.", ex);
744 if ((!list.equals(currentList) && !list.isEmpty()) || (list.isEmpty() && !currentList.equals(
745 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.writeKwHits.userSrchs")))) {
746 if (!currentList.isEmpty()) {
747 tableModule.endTable();
748 tableModule.endSet();
750 currentList = list.isEmpty() ? NbBundle
751 .getMessage(this.getClass(),
"ReportGenerator.writeKwHits.userSrchs") : list;
753 tableModule.startSet(currentList);
754 progressPanel.updateStatusLabel(
755 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processingList",
756 BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), currentList));
758 if (!keyword.equals(currentKeyword)) {
760 if (!currentKeyword.equals(
"")) {
761 tableModule.endTable();
765 currentKeyword = keyword;
766 tableModule.addSetElement(currentKeyword);
767 List<String> columnHeaderNames =
new ArrayList<>();
768 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.preview"));
769 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.srcFile"));
770 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags"));
771 tableModule.startTable(columnHeaderNames);
774 tableModule.addRow(Arrays.asList(
new String[]{preview, uniquePath, tagsList}));
778 if (!currentKeyword.isEmpty()) {
779 tableModule.endTable();
783 progressPanel.increment();
784 tableModule.endDataType();
785 }
catch (TskCoreException | SQLException ex) {
786 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryKWs"));
787 logger.log(Level.SEVERE,
"Failed to query keywords with query " + keywordsQuery, ex);
796 @SuppressWarnings(
"deprecation")
797 private
void writeHashsetHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
798 String orderByClause;
801 openCase = Case.getCurrentCaseThrows();
802 }
catch (NoCurrentCaseException ex) {
803 errorList.add(Bundle.ReportGenerator_errList_noOpenCase());
804 logger.log(Level.SEVERE,
"Exception while getting open case: ", ex);
807 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
808 orderByClause =
"ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST";
810 orderByClause =
"ORDER BY att.value_text ASC";
813 =
"SELECT att.value_text AS list "
815 "FROM blackboard_attributes AS att, blackboard_artifacts AS art "
817 "WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
" "
819 "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() +
" "
821 "AND att.artifact_id = art.artifact_id "
823 "GROUP BY list " + orderByClause;
825 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(hashsetsQuery)) {
827 ResultSet listsRs = dbQuery.getResultSet();
828 List<String> lists =
new ArrayList<>();
829 while (listsRs.next()) {
830 lists.add(listsRs.getString(
"list"));
833 tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), comment);
834 tableModule.addSetIndex(lists);
835 progressPanel.updateStatusLabel(
836 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processing",
837 BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName()));
838 }
catch (TskCoreException | SQLException ex) {
839 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryHashsetLists"));
840 logger.log(Level.SEVERE,
"Failed to query hashset lists: ", ex);
844 if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
845 orderByClause =
"ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST, "
846 +
"convert_to(f.parent_path, 'SQL_ASCII') ASC NULLS FIRST, "
847 +
"convert_to(f.name, 'SQL_ASCII') ASC NULLS FIRST, "
848 +
"size ASC NULLS FIRST";
850 orderByClause =
"ORDER BY att.value_text ASC, f.parent_path ASC, f.name ASC, size ASC";
852 String hashsetHitsQuery
853 =
"SELECT art.artifact_id, art.obj_id, att.value_text AS setname, f.name AS name, f.size AS size, f.parent_path AS parent_path "
855 "FROM blackboard_artifacts AS art, blackboard_attributes AS att, tsk_files AS f "
857 "WHERE (att.artifact_id = art.artifact_id) "
859 "AND (f.obj_id = art.obj_id) "
861 "AND (att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() +
") "
863 "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() +
") "
867 try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(hashsetHitsQuery)) {
869 ResultSet resultSet = dbQuery.getResultSet();
870 String currentSet =
"";
871 while (resultSet.next()) {
873 if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
878 HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong(
"artifact_id"));
879 if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
882 String tagsList = makeCommaSeparatedList(uniqueTagNames);
884 Long objId = resultSet.getLong(
"obj_id");
885 String set = resultSet.getString(
"setname");
886 String size = resultSet.getString(
"size");
887 String uniquePath =
"";
890 AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
892 uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
894 }
catch (TskCoreException ex) {
896 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAbstractFileFromID"));
897 logger.log(Level.WARNING,
"Failed to get Abstract File from ID.", ex);
902 if (!set.equals(currentSet)) {
903 if (!currentSet.isEmpty()) {
904 tableModule.endTable();
905 tableModule.endSet();
908 tableModule.startSet(currentSet);
909 List<String> columnHeaderNames =
new ArrayList<>();
910 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.file"));
911 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.size"));
912 columnHeaderNames.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags"));
913 tableModule.startTable(columnHeaderNames);
914 progressPanel.updateStatusLabel(
915 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.progress.processingList",
916 BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), currentSet));
920 tableModule.addRow(Arrays.asList(
new String[]{uniquePath, size, tagsList}));
924 progressPanel.increment();
925 tableModule.endDataType();
926 }
catch (TskCoreException | SQLException ex) {
927 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedQueryHashsetHits"));
928 logger.log(Level.SEVERE,
"Failed to query hashsets hits: ", ex);
935 List<String> getErrorList() {
948 private List<String> rowData = null;
951 ArtifactData(BlackboardArtifact artifact, List<BlackboardAttribute> attrs, HashSet<String> tags) {
953 this.attributes = attrs;
958 logger.log(Level.SEVERE,
"Could not get content from database", ex);
975 return artifact.getArtifactID();
979 return artifact.getObjectID();
1000 List<String> thisRow =
getRow();
1001 List<String> otherRow = otherArtifactData.
getRow();
1002 for (
int i = 0; i < thisRow.size(); i++) {
1003 int compare = thisRow.get(i).compareTo(otherRow.get(i));
1019 if (rowData == null) {
1024 if (rowData.size() > 0) {
1026 for (
int i = 0; i < rowData.size(); i++) {
1027 if (rowData.get(i) == null) {
1033 return new ArrayList<>();
1035 }
catch (TskCoreException ex) {
1037 NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.coreExceptionWhileGenRptRow"));
1038 logger.log(Level.WARNING,
"Core exception while generating row data for artifact report.", ex);
1039 rowData = Collections.<String>emptyList();
1056 List<String> orderedRowData =
new ArrayList<>();
1057 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() ==
getArtifact().getArtifactTypeID()) {
1058 if (content != null && content instanceof AbstractFile) {
1059 AbstractFile file = (AbstractFile) content;
1060 orderedRowData.add(file.getName());
1061 orderedRowData.add(file.getNameExtension());
1062 String mimeType = file.getMIMEType();
1063 if (mimeType == null) {
1064 orderedRowData.add(
"");
1066 orderedRowData.add(mimeType);
1068 orderedRowData.add(file.getUniquePath());
1071 orderedRowData.add(null);
1072 orderedRowData.add(null);
1073 orderedRowData.add(null);
1074 orderedRowData.add(null);
1076 orderedRowData.add(makeCommaSeparatedList(
getTags()));
1078 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() ==
getArtifact().getArtifactTypeID()) {
1079 String[] attributeDataArray =
new String[5];
1081 for (BlackboardAttribute attr : attributes) {
1082 if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME))) {
1083 attributeDataArray[0] = attr.getDisplayString();
1084 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY))) {
1085 attributeDataArray[1] = attr.getDisplayString();
1086 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT))) {
1087 attributeDataArray[3] = attr.getDisplayString();
1088 }
else if (attr.getAttributeType().equals(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION))) {
1089 attributeDataArray[4] = attr.getDisplayString();
1093 attributeDataArray[2] = content.getUniquePath();
1094 orderedRowData.addAll(Arrays.asList(attributeDataArray));
1096 HashSet<String> allTags =
getTags();
1099 for (ContentTag ct : contentTags) {
1101 allTags.add(ct.getName().getDisplayName() + notableString);
1104 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetContentTags"));
1105 logger.log(Level.SEVERE,
"Failed to get content tags", ex);
1107 orderedRowData.add(makeCommaSeparatedList(allTags));
1109 }
else if (columnHeaderMap.containsKey(
this.artifact.getArtifactTypeID())) {
1111 for (
Column currColumn : columnHeaderMap.get(
this.artifact.getArtifactTypeID())) {
1112 String cellData = currColumn.getCellData(
this);
1113 orderedRowData.add(cellData);
1117 return orderedRowData;
1131 private List<ArtifactData> getFilteredArtifacts(BlackboardArtifact.Type type, HashSet<String> tagNamesFilter) {
1132 List<ArtifactData> artifacts =
new ArrayList<>();
1136 HashSet<String> uniqueTagNames =
new HashSet<>();
1137 for (BlackboardArtifactTag tag : tags) {
1139 uniqueTagNames.add(tag.getName().getDisplayName() + notableString);
1141 if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
1145 artifacts.add(
new ArtifactData(artifact, Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboardAttributes(artifact), uniqueTagNames));
1146 }
catch (TskCoreException ex) {
1147 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBAttribs"));
1148 logger.log(Level.SEVERE,
"Failed to get Blackboard Attributes when generating report.", ex);
1151 }
catch (TskCoreException | NoCurrentCaseException ex) {
1152 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetBBArtifacts"));
1153 logger.log(Level.SEVERE,
"Failed to get Blackboard Artifacts when generating report.", ex);
1158 private Boolean failsTagFilter(HashSet<String> tagNames, HashSet<String> tagsNamesFilter) {
1159 if (null == tagsNamesFilter || tagsNamesFilter.isEmpty()) {
1163 HashSet<String> filteredTagNames =
new HashSet<>(tagNames);
1164 filteredTagNames.retainAll(tagsNamesFilter);
1165 return filteredTagNames.isEmpty();
1178 @Messages({
"ReportGenerator.artTableColHdr.comment=Comment"})
1179 private List<Column> getArtifactTableColumns(
int artifactTypeId, Set<BlackboardAttribute.Type> attributeTypeSet) {
1180 ArrayList<Column> columns =
new ArrayList<>();
1184 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID() == artifactTypeId) {
1185 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1186 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1188 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.title"),
1189 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1191 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateCreated"),
1192 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1194 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1195 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1197 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID() == artifactTypeId) {
1198 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1199 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1201 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1202 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1204 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1205 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1207 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.value"),
1208 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE)));
1210 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1211 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1213 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID() == artifactTypeId) {
1214 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1215 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1217 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateAccessed"),
1218 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1220 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.referrer"),
1221 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REFERRER)));
1223 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.title"),
1224 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1226 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1227 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1229 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.urlDomainDecoded"),
1230 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL_DECODED)));
1232 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifactTypeId) {
1233 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dest"),
1234 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1236 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.sourceUrl"),
1237 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1239 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateAccessed"),
1240 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1242 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1243 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1245 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == artifactTypeId) {
1246 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.path"),
1247 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1249 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1250 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1252 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID() == artifactTypeId) {
1253 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.progName"),
1254 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1256 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.instDateTime"),
1257 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1259 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() == artifactTypeId) {
1260 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.preview")));
1262 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() == artifactTypeId) {
1263 columns.add(
new SourceFileColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.file")));
1265 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.size")));
1267 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID() == artifactTypeId) {
1268 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devMake"),
1269 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1271 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devModel"),
1272 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1274 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.deviceId"),
1275 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1277 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1278 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1280 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID() == artifactTypeId) {
1281 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.text"),
1282 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1284 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.domain"),
1285 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)));
1287 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateAccessed"),
1288 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1290 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.progName"),
1291 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1293 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID() == artifactTypeId) {
1294 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTaken"),
1295 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1297 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devManufacturer"),
1298 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1300 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.devModel"),
1301 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1303 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1304 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1306 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1307 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1309 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1310 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1312 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID() == artifactTypeId) {
1313 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1314 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1316 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumber"),
1317 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1319 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumHome"),
1320 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_HOME)));
1322 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumOffice"),
1323 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_OFFICE)));
1325 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumMobile"),
1326 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_MOBILE)));
1328 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.email"),
1329 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL)));
1331 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() == artifactTypeId) {
1332 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.msgType"),
1333 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)));
1335 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.direction"),
1336 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1338 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.readStatus"),
1339 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_READ_STATUS)));
1341 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1342 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1344 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.fromPhoneNum"),
1345 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1347 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.fromEmail"),
1348 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1350 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.toPhoneNum"),
1351 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1353 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.toEmail"),
1354 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1356 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.subject"),
1357 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1359 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.text"),
1360 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1362 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID() == artifactTypeId) {
1363 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1364 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1366 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.fromPhoneNum"),
1367 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1369 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.toPhoneNum"),
1370 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1372 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1373 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1375 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.direction"),
1376 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1378 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID() == artifactTypeId) {
1379 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.calendarEntryType"),
1380 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CALENDAR_ENTRY_TYPE)));
1382 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1383 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1385 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.startDateTime"),
1386 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1388 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.endDateTime"),
1389 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_END)));
1391 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.location"),
1392 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1394 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID() == artifactTypeId) {
1395 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.shortCut"),
1396 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SHORTCUT)));
1398 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1399 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME_PERSON)));
1401 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.phoneNumber"),
1402 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1404 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID() == artifactTypeId) {
1405 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.deviceName"),
1406 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_NAME)));
1408 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.deviceAddress"),
1409 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1411 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1412 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1414 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID() == artifactTypeId) {
1415 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1416 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1418 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1419 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1421 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1422 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1424 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID() == artifactTypeId) {
1425 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1426 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1428 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1429 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1431 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1432 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1434 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1435 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1437 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.locationAddress"),
1438 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1440 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1441 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1443 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID() == artifactTypeId) {
1444 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1445 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1447 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1448 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1450 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1451 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1453 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1454 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1456 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.locationAddress"),
1457 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1459 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1460 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1462 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID() == artifactTypeId) {
1463 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitude"),
1464 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1466 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitude"),
1467 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1469 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.altitude"),
1470 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1472 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1473 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1475 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.locationAddress"),
1476 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1478 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1479 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1481 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID() == artifactTypeId) {
1482 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.category"),
1483 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1485 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.userId"),
1486 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1488 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.password"),
1489 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PASSWORD)));
1491 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.personName"),
1492 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1494 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.appName"),
1495 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1497 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.url"),
1498 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1500 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.appPath"),
1501 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1503 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1504 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1506 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.replytoAddress"),
1507 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_REPLYTO)));
1509 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.mailServer"),
1510 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SERVER_NAME)));
1512 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID() == artifactTypeId ||
1513 BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID() == artifactTypeId) {
1514 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1515 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1517 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() == artifactTypeId) {
1518 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.file")));
1520 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.extension.text")));
1522 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.mimeType.text")));
1524 columns.add(
new HeaderOnlyColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.path")));
1526 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID() == artifactTypeId) {
1527 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.processorArchitecture.text"),
1528 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROCESSOR_ARCHITECTURE)));
1530 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.osName.text"),
1531 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1533 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.osInstallDate.text"),
1534 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1536 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == artifactTypeId) {
1537 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailTo"),
1538 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1540 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailFrom"),
1541 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1543 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSubject"),
1544 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1546 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskDateTimeSent"),
1547 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)));
1549 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskDateTimeRcvd"),
1550 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_RCVD)));
1552 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskPath"),
1553 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1555 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailCc"),
1556 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_CC)));
1558 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskEmailBcc"),
1559 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_BCC)));
1561 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskMsgId"),
1562 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MSG_ID)));
1564 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == artifactTypeId) {
1565 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSetName"),
1566 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1568 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskInterestingFilesCategory"),
1569 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1571 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskPath"),
1572 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1574 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.comment"),
1575 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT)));
1577 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.description"),
1578 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1580 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_ROUTE.getTypeID() == artifactTypeId) {
1581 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskGpsRouteCategory"),
1582 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1584 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1585 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1587 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitudeEnd"),
1588 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END)));
1590 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitudeEnd"),
1591 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END)));
1593 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.latitudeStart"),
1594 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START)));
1596 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.longitudeStart"),
1597 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START)));
1599 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.name"),
1600 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1602 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.location"),
1603 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1605 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1606 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1608 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == artifactTypeId) {
1609 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tskSetName"),
1610 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1612 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.associatedArtifact"),
1613 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1615 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1616 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1618 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == artifactTypeId) {
1619 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.program"),
1620 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1622 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.associatedArtifact"),
1623 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1625 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.dateTime"),
1626 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1628 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.count"),
1629 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COUNT)));
1631 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_ACCOUNT.getTypeID() == artifactTypeId) {
1632 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.userName"),
1633 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME)));
1635 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.userId"),
1636 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1638 }
else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_REMOTE_DRIVE.getTypeID() == artifactTypeId) {
1639 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.localPath"),
1640 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCAL_PATH)));
1642 columns.add(
new AttributeColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.remotePath"),
1643 new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REMOTE_PATH)));
1644 }
else if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
1645 columns.add(
new StatusColumn());
1646 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE));
1647 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
1648 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME));
1649 attributeTypeSet.remove(
new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_SEARCH_DOCUMENT_ID));
1653 for (BlackboardAttribute.Type type : attributeTypeSet) {
1654 columns.add(
new AttributeColumn(type.getDisplayName(), type));
1656 columns.add(
new SourceFileColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.srcFile")));
1657 columns.add(
new TaggedResultsColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags")));
1665 for (Column column : columns) {
1666 attributeTypeSet = column.removeTypeFromSet(attributeTypeSet);
1669 for (BlackboardAttribute.Type type : attributeTypeSet) {
1670 columns.add(
new AttributeColumn(type.getDisplayName(), type));
1673 if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()
1674 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()
1675 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()
1676 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()
1677 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()
1678 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()
1679 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()
1680 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID()
1681 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID()
1682 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID()
1683 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()
1684 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID()
1685 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID()
1686 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID()
1687 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID()
1688 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID()
1689 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID()
1690 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID()
1691 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID()
1692 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID()
1693 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID()
1694 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID()
1695 || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID()) {
1696 columns.add(
new SourceFileColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.srcFile")));
1698 columns.add(
new TaggedResultsColumn(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.artTableColHdr.tags")));
1710 private String getFileUniquePath(Content content) {
1712 if (content != null) {
1713 return content.getUniquePath();
1717 }
catch (TskCoreException ex) {
1718 errorList.add(NbBundle.getMessage(
this.getClass(),
"ReportGenerator.errList.failedGetAbstractFileByID"));
1719 logger.log(Level.WARNING,
"Failed to get Abstract File by ID.", ex);
1734 @SuppressWarnings(
"deprecation")
1735 private HashSet<String> getUniqueTagNames(
long artifactId) throws TskCoreException {
1736 HashSet<String> uniqueTagNames =
new HashSet<>();
1738 String query =
"SELECT display_name, artifact_id, knownStatus FROM tag_names AS tn, blackboard_artifact_tags AS bat "
1740 "WHERE tn.tag_name_id = bat.tag_name_id AND bat.artifact_id = " + artifactId;
1742 try (SleuthkitCase.CaseDbQuery dbQuery = Case.getCurrentCaseThrows().getSleuthkitCase().executeQuery(query)) {
1743 ResultSet tagNameRows = dbQuery.getResultSet();
1744 while (tagNameRows.next()) {
1745 String notableString = tagNameRows.getInt(
"knownStatus") == TskData.FileKnown.BAD.ordinal() ? getNotableTagLabel() :
"";
1746 uniqueTagNames.add(tagNameRows.getString(
"display_name") + notableString);
1748 }
catch (TskCoreException | SQLException | NoCurrentCaseException ex) {
1749 throw new TskCoreException(
"Error getting tag names for artifact: ", ex);
1752 return uniqueTagNames;
1762 Set<BlackboardAttribute.Type>
removeTypeFromSet(Set<BlackboardAttribute.Type> types);
1767 @NbBundle.Messages(
"TableReportGenerator.StatusColumn.Header=Review Status")
1770 return Bundle.TableReportGenerator_StatusColumn_Header();
1775 return artData.
getArtifact().getReviewStatus().getDisplayName();
1798 this.columnHeader = Objects.requireNonNull(columnHeader);
1809 List<BlackboardAttribute> attributes = artData.
getAttributes();
1810 for (BlackboardAttribute attribute : attributes) {
1811 if (attribute.getAttributeType().equals(this.
attributeType)) {
1812 if (attribute.getAttributeType().getValueType() != BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
1813 return attribute.getDisplayString();
1844 return getFileUniquePath(artData.
getContent());
1869 return makeCommaSeparatedList(artData.
getTags());
1894 throw new UnsupportedOperationException(
"Cannot get cell data of unspecified column");
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
static String getStringTime(long epochSeconds, TimeZone tzone)
final String columnHeader
String getCellData(ArtifactData artData)
BlackboardArtifact getArtifact()
final String columnHeader
final String columnHeader
final String columnHeader
final BlackboardAttribute.Type attributeType
HashSet< String > getTags()
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
String getCellData(ArtifactData artData)
String getCellData(ArtifactData artData)
TagsManager getTagsManager()
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
String getCellData(ArtifactData artData)
SleuthkitCase getSleuthkitCase()
BlackboardArtifact artifact
String getCellData(ArtifactData artData)
List< BlackboardAttribute > getAttributes()
int compareTo(ArtifactData otherArtifactData)
String getCellData(ArtifactData artData)
List< String > getOrderedRowDataAsStrings()
List< BlackboardAttribute > attributes
static Case getCurrentCaseThrows()
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)