19 package org.sleuthkit.datamodel;
21 import java.io.Serializable;
22 import java.util.Arrays;
23 import java.util.Collections;
24 import java.util.List;
25 import java.util.Objects;
26 import java.util.ResourceBundle;
27 import java.util.TimeZone;
28 import java.util.logging.Level;
29 import java.util.logging.Logger;
47 private static final char[] HEX_ARRAY =
"0123456789ABCDEF".toCharArray();
50 private static final ResourceBundle bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
52 private final int valueInt;
53 private final long valueLong;
54 private final double valueDouble;
55 private final String valueString;
56 private final byte[] valueBytes;
57 private String context;
58 private long artifactID;
60 private String sources;
76 throw new IllegalArgumentException(
"Value types do not match");
80 this.sources = replaceNulls(source);
81 this.valueInt = valueInt;
84 this.valueString =
"";
85 this.valueBytes =
new byte[0];
103 throw new IllegalArgumentException(
"Type mismatched with value type");
106 this.attributeType = attributeType;
107 this.sources = replaceNulls(source);
108 this.valueInt = valueInt;
110 this.valueDouble = 0;
111 this.valueString =
"";
112 this.valueBytes =
new byte[0];
134 throw new IllegalArgumentException(
"Value types do not match");
138 this.sources = replaceNulls(source);
140 this.valueLong = valueLong;
141 this.valueDouble = 0;
142 this.valueString =
"";
143 this.valueBytes =
new byte[0];
164 throw new IllegalArgumentException(
"Type mismatched with value type");
167 this.attributeType = attributeType;
168 this.sources = replaceNulls(source);
170 this.valueLong = valueLong;
171 this.valueDouble = 0;
172 this.valueString =
"";
173 this.valueBytes =
new byte[0];
191 throw new IllegalArgumentException(
"Value types do not match");
195 this.sources = replaceNulls(source);
198 this.valueDouble = valueDouble;
199 this.valueString =
"";
200 this.valueBytes =
new byte[0];
219 throw new IllegalArgumentException(
"Type mismatched with value type");
222 this.attributeType = attributeType;
223 this.sources = replaceNulls(source);
226 this.valueDouble = valueDouble;
227 this.valueString =
"";
228 this.valueBytes =
new byte[0];
249 throw new IllegalArgumentException(
"Value types do not match");
253 this.sources = replaceNulls(source);
256 this.valueDouble = 0;
257 if (valueString == null) {
258 this.valueString =
"";
260 this.valueString = replaceNulls(valueString).trim();
262 this.valueBytes =
new byte[0];
281 throw new IllegalArgumentException(
"Type mismatched with value type");
284 this.attributeType = attributeType;
285 this.sources = replaceNulls(source);
288 this.valueDouble = 0;
289 if (valueString == null) {
290 this.valueString =
"";
292 this.valueString = replaceNulls(valueString).trim();
294 this.valueBytes =
new byte[0];
312 throw new IllegalArgumentException(
"Value types do not match");
316 this.sources = replaceNulls(source);
320 this.valueDouble = 0;
321 this.valueString =
"";
322 if (valueBytes == null) {
323 this.valueBytes =
new byte[0];
325 this.valueBytes = valueBytes;
343 throw new IllegalArgumentException(
"Type mismatched with value type");
346 this.attributeType = attributeType;
347 this.sources = replaceNulls(source);
351 this.valueDouble = 0;
352 this.valueString =
"";
353 if (valueBytes == null) {
354 this.valueBytes =
new byte[0];
356 this.valueBytes = valueBytes;
377 return this.attributeType;
437 return Arrays.copyOf(valueBytes, valueBytes.length);
446 if (null != sources && !this.sources.isEmpty()) {
447 List<String> modules = Arrays.asList(sources.split(
","));
450 return Collections.emptyList();
462 this.sources = sleuthkitCase.addSourceToArtifactAttribute(
this, source);
483 hash = 97 * hash + (int) (this.artifactID ^ (this.artifactID >>> 32));
492 if (getClass() != obj.getClass()) {
501 return "BlackboardAttribute{" +
"artifactID=" + artifactID +
", attributeType=" + attributeType.
toString() +
", moduleName=" + sources +
", context=" + context +
", valueInt=" + valueInt +
", valueLong=" + valueLong +
", valueDouble=" + valueDouble +
", valueString=" + valueString +
", valueBytes=" + Arrays.toString(valueBytes) +
", Case=" + sleuthkitCase +
'}';
535 if ((dataSource != null) && (dataSource instanceof
Image)) {
537 Image image = (Image) dataSource;
538 TimeZone tzone = TimeZone.getTimeZone(image.
getTimeZone());
542 LOGGER.log(Level.WARNING,
"Could not get timezone for image", ex);
574 int valueInt,
long valueLong,
double valueDouble, String valueString, byte[] valueBytes,
577 this.artifactID = artifactID;
578 this.attributeType = attributeType;
579 this.sources = replaceNulls(source);
580 this.context = replaceNulls(context);
581 this.valueInt = valueInt;
582 this.valueLong = valueLong;
583 this.valueDouble = valueDouble;
584 if (valueString == null) {
585 this.valueString =
"";
587 this.valueString = replaceNulls(valueString).trim();
589 if (valueBytes == null) {
590 this.valueBytes =
new byte[0];
592 this.valueBytes = valueBytes;
594 this.sleuthkitCase = sleuthkitCase;
603 void setCaseDatabase(SleuthkitCase sleuthkitCase) {
604 this.sleuthkitCase = sleuthkitCase;
612 void setArtifactId(
long artifactID) {
613 this.artifactID = artifactID;
624 String getSourcesCSV() {
635 static String bytesToHexString(byte[] bytes) {
637 char[] hexChars =
new char[bytes.length * 2];
638 for (
int j = 0; j < bytes.length; j++) {
639 int v = bytes[j] & 0xFF;
640 hexChars[j * 2] = HEX_ARRAY[v >>> 4];
641 hexChars[j * 2 + 1] = HEX_ARRAY[v & 0x0F];
643 return new String(hexChars);
653 private String replaceNulls(String text) {
654 return text.replace((
char) 0x00, (
char) 0x1A);
660 public static final class Type implements Serializable {
662 private static final long serialVersionUID = 1L;
663 private final String typeName;
664 private final int typeID;
665 private final String displayName;
677 this.typeID = typeID;
678 this.typeName = typeName;
679 this.displayName = displayName;
680 this.valueType = valueType;
690 this.typeID = type.getTypeID();
691 this.typeName = type.getLabel();
692 this.displayName = type.getDisplayName();
693 this.valueType = type.getValueType();
702 return this.valueType;
711 return this.typeName;
729 return this.displayName;
752 return this.typeName.equals(that.getTypeName())
753 && this.displayName.equals(that.getDisplayName())
754 && this.typeID == that.getTypeID()
755 && this.valueType == that.getValueType();
761 hash = 63 * hash + Objects.hashCode(this.typeID);
762 hash = 63 * hash + Objects.hashCode(this.displayName);
763 hash = 63 * hash + Objects.hashCode(this.typeName);
764 hash = 63 * hash + Objects.hashCode(this.valueType);
770 return "(typeID= " + this.typeID
771 +
", displayName=" + this.displayName
772 +
", typeName=" + this.typeName
773 +
", valueType=" + this.valueType +
")";
813 private final long typeId;
814 private final String typeName;
828 this.typeName = typeName;
852 return this.typeName;
871 if (valueType.
getType() == typeId) {
875 throw new IllegalArgumentException(
"No TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE matching type: " + typeId);
894 if (valueType.
getLabel().equals(typeName)) {
898 throw new IllegalArgumentException(
"No TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE matching type: " + typeName);
911 TSK_URL(1,
"TSK_URL",
912 bundle.getString(
"BlackboardAttribute.tskUrl.text"),
914 TSK_DATETIME(2,
"TSK_DATETIME",
915 bundle.getString(
"BlackboardAttribute.tskDatetime.text"),
917 TSK_NAME(3,
"TSK_NAME",
918 bundle.getString(
"BlackboardAttribute.tskName.text"),
920 TSK_PROG_NAME(4,
"TSK_PROG_NAME",
921 bundle.getString(
"BlackboardAttribute.tskProgName.text"),
923 TSK_VALUE(6,
"TSK_VALUE",
924 bundle.getString(
"BlackboardAttribute.tskValue.text"),
926 TSK_FLAG(7,
"TSK_FLAG",
927 bundle.getString(
"BlackboardAttribute.tskFlag.text"),
929 TSK_PATH(8,
"TSK_PATH",
930 bundle.getString(
"BlackboardAttribute.tskPath.text"),
932 TSK_KEYWORD(10,
"TSK_KEYWORD",
933 bundle.getString(
"BlackboardAttribute.tskKeyword.text"),
935 TSK_KEYWORD_REGEXP(11,
"TSK_KEYWORD_REGEXP",
936 bundle.getString(
"BlackboardAttribute.tskKeywordRegexp.text"),
938 TSK_KEYWORD_PREVIEW(12,
"TSK_KEYWORD_PREVIEW",
939 bundle.getString(
"BlackboardAttribute.tskKeywordPreview.text"),
945 TSK_KEYWORD_SET(13,
"TSK_KEYWORD_SET",
946 bundle.getString(
"BlackboardAttribute.tskKeywordSet.text"),
948 TSK_USER_NAME(14,
"TSK_USER_NAME",
949 bundle.getString(
"BlackboardAttribute.tskUserName.text"),
951 TSK_DOMAIN(15,
"TSK_DOMAIN",
952 bundle.getString(
"BlackboardAttribute.tskDomain.text"),
954 TSK_PASSWORD(16,
"TSK_PASSWORD",
955 bundle.getString(
"BlackboardAttribute.tskPassword.text"),
957 TSK_NAME_PERSON(17,
"TSK_NAME_PERSON",
958 bundle.getString(
"BlackboardAttribute.tskNamePerson.text"),
960 TSK_DEVICE_MODEL(18,
"TSK_DEVICE_MODEL",
961 bundle.getString(
"BlackboardAttribute.tskDeviceModel.text"),
963 TSK_DEVICE_MAKE(19,
"TSK_DEVICE_MAKE",
964 bundle.getString(
"BlackboardAttribute.tskDeviceMake.text"),
966 TSK_DEVICE_ID(20,
"TSK_DEVICE_ID",
967 bundle.getString(
"BlackboardAttribute.tskDeviceId.text"),
969 TSK_EMAIL(21,
"TSK_EMAIL",
970 bundle.getString(
"BlackboardAttribute.tskEmail.text"),
972 TSK_HASH_MD5(22,
"TSK_HASH_MD5",
973 bundle.getString(
"BlackboardAttribute.tskHashMd5.text"),
975 TSK_HASH_SHA1(23,
"TSK_HASH_SHA1",
976 bundle.getString(
"BlackboardAttribute.tskHashSha1.text"),
978 TSK_HASH_SHA2_256(24,
"TSK_HASH_SHA2_256",
979 bundle.getString(
"BlackboardAttribute.tskHashSha225.text"),
981 TSK_HASH_SHA2_512(25,
"TSK_HASH_SHA2_512",
982 bundle.getString(
"BlackboardAttribute.tskHashSha2512.text"),
984 TSK_TEXT(26,
"TSK_TEXT",
985 bundle.getString(
"BlackboardAttribute.tskText.text"),
987 TSK_TEXT_FILE(27,
"TSK_TEXT_FILE",
988 bundle.getString(
"BlackboardAttribute.tskTextFile.text"),
990 TSK_TEXT_LANGUAGE(28,
"TSK_TEXT_LANGUAGE",
991 bundle.getString(
"BlackboardAttribute.tskTextLanguage.text"),
993 TSK_ENTROPY(29,
"TSK_ENTROPY",
994 bundle.getString(
"BlackboardAttribute.tskEntropy.text"),
1000 TSK_HASHSET_NAME(30,
"TSK_HASHSET_NAME",
1001 bundle.getString(
"BlackboardAttribute.tskHashsetName.text"),
1007 TSK_INTERESTING_FILE(31,
"TSK_INTERESTING_FILE",
1008 bundle.getString(
"BlackboardAttribute.tskInterestingFile.text"),
1010 TSK_REFERRER(32,
"TSK_REFERRER",
1011 bundle.getString(
"BlackboardAttribute.tskReferrer.text"),
1013 TSK_DATETIME_ACCESSED(33,
"TSK_DATETIME_ACCESSED",
1014 bundle.getString(
"BlackboardAttribute.tskDateTimeAccessed.text"),
1016 TSK_IP_ADDRESS(34,
"TSK_IP_ADDRESS",
1017 bundle.getString(
"BlackboardAttribute.tskIpAddress.text"),
1019 TSK_PHONE_NUMBER(35,
"TSK_PHONE_NUMBER",
1020 bundle.getString(
"BlackboardAttribute.tskPhoneNumber.text"),
1022 TSK_PATH_ID(36,
"TSK_PATH_ID",
1023 bundle.getString(
"BlackboardAttribute.tskPathId.text"),
1025 TSK_SET_NAME(37,
"TSK_SET_NAME",
1026 bundle.getString(
"BlackboardAttribute.tskSetName.text"),
1032 TSK_ENCRYPTION_DETECTED(38,
"TSK_ENCRYPTION_DETECTED",
1033 bundle.getString(
"BlackboardAttribute.tskEncryptionDetected.text"),
1035 TSK_MALWARE_DETECTED(39,
"TSK_MALWARE_DETECTED",
1036 bundle.getString(
"BlackboardAttribute.tskMalwareDetected.text"),
1038 TSK_STEG_DETECTED(40,
"TSK_STEG_DETECTED",
1039 bundle.getString(
"BlackboardAttribute.tskStegDetected.text"),
1041 TSK_EMAIL_TO(41,
"TSK_EMAIL_TO",
1042 bundle.getString(
"BlackboardAttribute.tskEmailTo.text"),
1044 TSK_EMAIL_CC(42,
"TSK_EMAIL_CC",
1045 bundle.getString(
"BlackboardAttribute.tskEmailCc.text"),
1047 TSK_EMAIL_BCC(43,
"TSK_EMAIL_BCC",
1048 bundle.getString(
"BlackboardAttribute.tskEmailBcc.text"),
1050 TSK_EMAIL_FROM(44,
"TSK_EMAIL_FROM",
1051 bundle.getString(
"BlackboardAttribute.tskEmailFrom.text"),
1053 TSK_EMAIL_CONTENT_PLAIN(45,
"TSK_EMAIL_CONTENT_PLAIN",
1054 bundle.getString(
"BlackboardAttribute.tskEmailContentPlain.text"),
1056 TSK_EMAIL_CONTENT_HTML(46,
"TSK_EMAIL_CONTENT_HTML",
1057 bundle.getString(
"BlackboardAttribute.tskEmailContentHtml.text"),
1059 TSK_EMAIL_CONTENT_RTF(47,
"TSK_EMAIL_CONTENT_RTF",
1060 bundle.getString(
"BlackboardAttribute.tskEmailContentRtf.text"),
1062 TSK_MSG_ID(48,
"TSK_MSG_ID",
1063 bundle.getString(
"BlackboardAttribute.tskMsgId.text"),
1065 TSK_MSG_REPLY_ID(49,
"TSK_MSG_REPLY_ID",
1066 bundle.getString(
"BlackboardAttribute.tskMsgReplyId.text"),
1068 TSK_DATETIME_RCVD(50,
"TSK_DATETIME_RCVD",
1069 bundle.getString(
"BlackboardAttribute.tskDateTimeRcvd.text"),
1071 TSK_DATETIME_SENT(51,
"TSK_DATETIME_SENT",
1072 bundle.getString(
"BlackboardAttribute.tskDateTimeSent.text"),
1074 TSK_SUBJECT(52,
"TSK_SUBJECT",
1075 bundle.getString(
"BlackboardAttribute.tskSubject.text"),
1077 TSK_TITLE(53,
"TSK_TITLE",
1078 bundle.getString(
"BlackboardAttribute.tskTitle.text"),
1080 TSK_GEO_LATITUDE(54,
"TSK_GEO_LATITUDE",
1081 bundle.getString(
"BlackboardAttribute.tskGeoLatitude.text"),
1083 TSK_GEO_LONGITUDE(55,
"TSK_GEO_LONGITUDE",
1084 bundle.getString(
"BlackboardAttribute.tskGeoLongitude.text"),
1086 TSK_GEO_VELOCITY(56,
"TSK_GEO_VELOCITY",
1087 bundle.getString(
"BlackboardAttribute.tskGeoVelocity.text"),
1089 TSK_GEO_ALTITUDE(57,
"TSK_GEO_ALTITUDE",
1090 bundle.getString(
"BlackboardAttribute.tskGeoAltitude.text"),
1092 TSK_GEO_BEARING(58,
"TSK_GEO_BEARING",
1093 bundle.getString(
"BlackboardAttribute.tskGeoBearing.text"),
1095 TSK_GEO_HPRECISION(59,
"TSK_GEO_HPRECISION",
1096 bundle.getString(
"BlackboardAttribute.tskGeoHPrecision.text"),
1098 TSK_GEO_VPRECISION(60,
"TSK_GEO_VPRECISION",
1099 bundle.getString(
"BlackboardAttribute.tskGeoVPrecision.text"),
1101 TSK_GEO_MAPDATUM(61,
"TSK_GEO_MAPDATUM",
1102 bundle.getString(
"BlackboardAttribute.tskGeoMapDatum.text"),
1109 TSK_FILE_TYPE_SIG(62,
"TSK_FILE_TYPE_SIG",
1110 bundle.getString(
"BlackboardAttribute.tskFileTypeSig.text"),
1112 TSK_FILE_TYPE_EXT(63,
"TSK_FILE_TYPE_EXT",
1113 bundle.getString(
"BlackboardAttribute.tskFileTypeExt.text"),
1120 TSK_TAGGED_ARTIFACT(64,
"TSK_TAGGED_ARTIFACT",
1121 bundle.getString(
"BlackboardAttribute.tskTaggedArtifact.text"),
1128 TSK_TAG_NAME(65,
"TSK_TAG_NAME",
1129 bundle.getString(
"BlackboardAttribute.tskTagName.text"),
1131 TSK_COMMENT(66,
"TSK_COMMENT",
1132 bundle.getString(
"BlackboardAttribute.tskComment.text"),
1134 TSK_URL_DECODED(67,
"TSK_URL_DECODED",
1135 bundle.getString(
"BlackboardAttribute.tskUrlDecoded.text"),
1137 TSK_DATETIME_CREATED(68,
"TSK_DATETIME_CREATED",
1138 bundle.getString(
"BlackboardAttribute.tskDateTimeCreated.text"),
1140 TSK_DATETIME_MODIFIED(69,
"TSK_DATETIME_MODIFIED",
1141 bundle.getString(
"BlackboardAttribute.tskDateTimeModified.text"),
1143 TSK_PROCESSOR_ARCHITECTURE(70,
"TSK_PROCESSOR_ARCHITECTURE",
1144 bundle.getString(
"BlackboardAttribute.tskProcessorArchitecture.text"),
1146 TSK_VERSION(71,
"TSK_VERSION",
1147 bundle.getString(
"BlackboardAttribute.tskVersion.text"),
1149 TSK_USER_ID(72,
"TSK_USER_ID",
1150 bundle.getString(
"BlackboardAttribute.tskUserId.text"),
1152 TSK_DESCRIPTION(73,
"TSK_DESCRIPTION",
1153 bundle.getString(
"BlackboardAttribute.tskDescription.text"),
1155 TSK_MESSAGE_TYPE(74,
"TSK_MESSAGE_TYPE",
1156 bundle.getString(
"BlackboardAttribute.tskMessageType.text"),
1158 TSK_PHONE_NUMBER_HOME(75,
"TSK_PHONE_NUMBER_HOME",
1159 bundle.getString(
"BlackboardAttribute.tskPhoneNumberHome.text"),
1161 TSK_PHONE_NUMBER_OFFICE(76,
"TSK_PHONE_NUMBER_OFFICE",
1162 bundle.getString(
"BlackboardAttribute.tskPhoneNumberOffice.text"),
1164 TSK_PHONE_NUMBER_MOBILE(77,
"TSK_PHONE_NUMBER_MOBILE",
1165 bundle.getString(
"BlackboardAttribute.tskPhoneNumberMobile.text"),
1167 TSK_PHONE_NUMBER_FROM(78,
"TSK_PHONE_NUMBER_FROM",
1168 bundle.getString(
"BlackboardAttribute.tskPhoneNumberFrom.text"),
1170 TSK_PHONE_NUMBER_TO(79,
"TSK_PHONE_NUMBER_TO",
1171 bundle.getString(
"BlackboardAttribute.tskPhoneNumberTo.text"),
1173 TSK_DIRECTION(80,
"TSK_DIRECTION",
1174 bundle.getString(
"BlackboardAttribute.tskDirection.text"),
1176 TSK_EMAIL_HOME(81,
"TSK_EMAIL_HOME",
1177 bundle.getString(
"BlackboardAttribute.tskEmailHome.text"),
1179 TSK_EMAIL_OFFICE(82,
"TSK_EMAIL_OFFICE",
1180 bundle.getString(
"BlackboardAttribute.tskEmailOffice.text"),
1182 TSK_DATETIME_START(83,
"TSK_DATETIME_START",
1183 bundle.getString(
"BlackboardAttribute.tskDateTimeStart.text"),
1185 TSK_DATETIME_END(84,
"TSK_DATETIME_END",
1186 bundle.getString(
"BlackboardAttribute.tskDateTimeEnd.text"),
1188 TSK_CALENDAR_ENTRY_TYPE(85,
"TSK_CALENDAR_ENTRY_TYPE",
1189 bundle.getString(
"BlackboardAttribute.tskCalendarEntryType.text"),
1191 TSK_LOCATION(86,
"TSK_LOCATION",
1192 bundle.getString(
"BlackboardAttribute.tskLocation.text"),
1194 TSK_SHORTCUT(87,
"TSK_SHORTCUT",
1195 bundle.getString(
"BlackboardAttribute.tskShortcut.text"),
1197 TSK_DEVICE_NAME(88,
"TSK_DEVICE_NAME",
1198 bundle.getString(
"BlackboardAttribute.tskDeviceName.text"),
1200 TSK_CATEGORY(89,
"TSK_CATEGORY",
1201 bundle.getString(
"BlackboardAttribute.tskCategory.text"),
1203 TSK_EMAIL_REPLYTO(90,
"TSK_EMAIL_REPLYTO",
1204 bundle.getString(
"BlackboardAttribute.tskEmailReplyTo.text"),
1206 TSK_SERVER_NAME(91,
"TSK_SERVER_NAME",
1207 bundle.getString(
"BlackboardAttribute.tskServerName.text"),
1209 TSK_COUNT(92,
"TSK_COUNT",
1210 bundle.getString(
"BlackboardAttribute.tskCount.text"),
1212 TSK_MIN_COUNT(93,
"TSK_MIN_COUNT",
1213 bundle.getString(
"BlackboardAttribute.tskMinCount.text"),
1215 TSK_PATH_SOURCE(94,
"TSK_PATH_SOURCE",
1216 bundle.getString(
"BlackboardAttribute.tskPathSource.text"),
1218 TSK_PERMISSIONS(95,
"TSK_PERMISSIONS",
1219 bundle.getString(
"BlackboardAttribute.tskPermissions.text"),
1221 TSK_ASSOCIATED_ARTIFACT(96,
"TSK_ASSOCIATED_ARTIFACT",
1222 bundle.getString(
"BlackboardAttribute.tskAssociatedArtifact.text"),
1224 TSK_ISDELETED(97,
"TSK_ISDELETED",
1225 bundle.getString(
"BlackboardAttribute.tskIsDeleted.text"),
1227 TSK_GEO_LATITUDE_START(98,
"TSK_GEO_LATITUDE_START",
1228 bundle.getString(
"BlackboardAttribute.tskGeoLatitudeStart.text"),
1230 TSK_GEO_LATITUDE_END(99,
"TSK_GEO_LATITUDE_END",
1231 bundle.getString(
"BlackboardAttribute.tskGeoLatitudeEnd.text"),
1233 TSK_GEO_LONGITUDE_START(100,
"TSK_GEO_LONGITUDE_START",
1234 bundle.getString(
"BlackboardAttribute.tskGeoLongitudeStart.text"),
1236 TSK_GEO_LONGITUDE_END(101,
"TSK_GEO_LONGITUDE_END",
1237 bundle.getString(
"BlackboardAttribute.tskGeoLongitudeEnd.text"),
1239 TSK_READ_STATUS(102,
"TSK_READ_STATUS",
1240 bundle.getString(
"BlackboardAttribute.tskReadStatus.text"),
1242 TSK_LOCAL_PATH(103,
"TSK_LOCAL_PATH",
1243 bundle.getString(
"BlackboardAttribute.tskLocalPath.text"),
1245 TSK_REMOTE_PATH(104,
"TSK_REMOTE_PATH",
1246 bundle.getString(
"BlackboardAttribute.tskRemotePath.text"),
1248 TSK_TEMP_DIR(105,
"TSK_TEMP_DIR",
1249 bundle.getString(
"BlackboardAttribute.tskTempDir.text"),
1251 TSK_PRODUCT_ID(106,
"TSK_PRODUCT_ID",
1252 bundle.getString(
"BlackboardAttribute.tskProductId.text"),
1254 TSK_OWNER(107,
"TSK_OWNER",
1255 bundle.getString(
"BlackboardAttribute.tskOwner.text"),
1257 TSK_ORGANIZATION(108,
"TSK_ORGANIZATION",
1258 bundle.getString(
"BlackboardAttribute.tskOrganization.text"),
1260 TSK_CARD_NUMBER(109,
"TSK_CARD_NUMBER",
1261 bundle.getString(
"BlackboardAttribute.tskCardNumber.text"),
1263 TSK_CARD_EXPIRATION(110,
"TSK_CARD_EXPIRATION",
1264 bundle.getString(
"BlackboardAttribute.tskCardExpiration.text"),
1266 TSK_CARD_SERVICE_CODE(111,
"TSK_CARD_SERVICE_CODE",
1267 bundle.getString(
"BlackboardAttribute.tskCardServiceCode.text"),
1269 TSK_CARD_DISCRETIONARY(112,
"TSK_CARD_DISCRETIONARY",
1270 bundle.getString(
"BlackboardAttribute.tskCardDiscretionary.text"),
1272 TSK_CARD_LRC(113,
"TSK_CARD_LRC",
1273 bundle.getString(
"BlackboardAttribute.tskCardLRC.text"),
1275 TSK_KEYWORD_SEARCH_DOCUMENT_ID(114,
"TSK_KEYWORD_SEARCH_DOCUMENT_ID",
1276 bundle.getString(
"BlackboardAttribute.tskKeywordSearchDocumentID.text"),
1278 TSK_CARD_SCHEME(115,
"TSK_CARD_SCHEME",
1279 bundle.getString(
"BlackboardAttribute.tskCardScheme.text"),
1281 TSK_CARD_TYPE(116,
"TSK_CARD_TYPE",
1282 bundle.getString(
"BlackboardAttribute.tskCardType.text"),
1284 TSK_BRAND_NAME(117,
"TSK_BRAND_NAME",
1285 bundle.getString(
"BlackboardAttribute.tskBrandName.text"),
1287 TSK_BANK_NAME(118,
"TSK_BANK_NAME",
1288 bundle.getString(
"BlackboardAttribute.tskBankName.text"),
1290 TSK_COUNTRY(119,
"TSK_COUNTRY",
1291 bundle.getString(
"BlackboardAttribute.tskCountry.text"),
1293 TSK_CITY(120,
"TSK_CITY",
1294 bundle.getString(
"BlackboardAttribute.tskCity.text"),
1296 TSK_ACCOUNT_TYPE(121,
"TSK_ACCOUNT_TYPE",
1297 bundle.getString(
"BlackboardAttribute.tskAccountType.text"),
1302 TSK_KEYWORD_SEARCH_TYPE(122,
"TSK_KEYWORD_SEARCH_TYPE",
1303 bundle.getString(
"BlackboardAttribute.tskKeywordSearchType.text"),
1305 TSK_HEADERS(123,
"TSK_HEADERS",
1306 bundle.getString(
"BlackboardAttribute.tskHeaders.text"),
1308 TSK_ID(124,
"TSK_ID",
1309 bundle.getString(
"BlackboardAttribute.tskId.text"),
1311 TSK_SSID(125,
"TSK_SSID",
1312 bundle.getString(
"BlackboardAttribute.tskSsid.text"),
1314 TSK_BSSID(126,
"TSK_BSSID",
1315 bundle.getString(
"BlackboardAttribute.tskBssid.text"),
1317 TSK_MAC_ADDRESS(127,
"TSK_MAC_ADDRESS",
1318 bundle.getString(
"BlackboardAttribute.tskMacAddress.text"),
1320 TSK_IMEI(128,
"TSK_IMEI",
1321 bundle.getString(
"BlackboardAttribute.tskImei.text"),
1323 TSK_IMSI(129,
"TSK_IMSI",
1324 bundle.getString(
"BlackboardAttribute.tskImsi.text"),
1326 TSK_ICCID(130,
"TSK_ICCID",
1327 bundle.getString(
"BlackboardAttribute.tskIccid.text"),
1329 TSK_THREAD_ID(131,
"TSK_THREAD_ID",
1330 bundle.getString(
"BlackboardAttribute.tskthreadid.text"),
1336 TSK_TL_EVENT_TYPE(132,
"TSK_TL_EVENT_TYPE",
1337 bundle.getString(
"BlackboardAttribute.tskTLEventType.text"),
1340 TSK_DATETIME_DELETED(133,
"TSK_DATETIME_DELETED",
1341 bundle.getString(
"BlackboardAttribute.tskdatetimedeleted.text"),
1344 TSK_DATETIME_PASSWORD_RESET(134,
"TSK_DATETIME_PASSWORD_RESET",
1345 bundle.getString(
"BlackboardAttribute.tskdatetimepwdreset.text"),
1348 TSK_DATETIME_PASSWORD_FAIL(135,
"TSK_DATETIME_PWD_FAIL",
1349 bundle.getString(
"BlackboardAttribute.tskdatetimepwdfail.text"),
1352 TSK_DISPLAY_NAME(136,
"TSK_DISPLAY_NAME",
1353 bundle.getString(
"BlackboardAttribute.tskdisplayname.text"),
1356 TSK_PASSWORD_SETTINGS(137,
"TSK_PASSWORD_SETTINGS",
1357 bundle.getString(
"BlackboardAttribute.tskpasswordsettings.text"),
1360 TSK_ACCOUNT_SETTINGS(138,
"TSK_ACCOUNT_SETTINGS",
1361 bundle.getString(
"BlackboardAttribute.tskaccountsettings.text"),
1364 TSK_PASSWORD_HINT(139,
"TSK_PASSWORD_HINT",
1365 bundle.getString(
"BlackboardAttribute.tskpasswordhint.text"),
1368 TSK_GROUPS (140,
"TSK_GROUPS",
1369 bundle.getString(
"BlackboardAttribute.tskgroups.text"),
1376 TSK_ATTACHMENTS (141,
"TSK_ATTACHMENTS",
1377 bundle.getString(
"BlackboardAttribute.tskattachments.text"),
1384 TSK_GEO_TRACKPOINTS(142,
"TSK_GEO_TRACKPOINTS",
1385 bundle.getString(
"BlackboardAttribute.tskgeopath.text"),
1392 TSK_GEO_WAYPOINTS(143,
"TSK_GEO_WAYPOINTS",
1393 bundle.getString(
"BlackboardAttribute.tskgeowaypoints.text"),
1396 TSK_DISTANCE_TRAVELED(144,
"TSK_DISTANCE_TRAVELED",
1397 bundle.getString(
"BlackboardAttribute.tskdistancetraveled.text"),
1400 TSK_DISTANCE_FROM_HOMEPOINT(145,
"TSK_DISTANCE_FROM_HOMEPOINT",
1401 bundle.getString(
"BlackboardAttribute.tskdistancefromhome.text"),
1404 TSK_HASH_PHOTODNA(146,
"TSK_HASH_PHOTODNA",
1405 bundle.getString(
"BlackboardAttribute.tskhashphotodna.text"),
1408 TSK_BYTES_SENT(147,
"TSK_BYTES_SENT",
1409 bundle.getString(
"BlackboardAttribute.tskbytessent.text"),
1412 TSK_BYTES_RECEIVED(148,
"TSK_BYTES_RECEIVED",
1413 bundle.getString(
"BlackboardAttribute.tskbytesreceived.text"),
1416 TSK_LAST_PRINTED_DATETIME(149,
"TSK_LAST_PRINTED_DATETIME",
1417 bundle.getString(
"BlackboardAttribute.tsklastprinteddatetime.text"),
1423 private final int typeID;
1424 private final String typeName;
1425 private final String displayName;
1437 this.typeID = typeID;
1438 this.typeName = typeName;
1439 this.displayName = displayName;
1440 this.valueType = valueType;
1461 return this.typeName;
1470 return this.displayName;
1479 return this.valueType;
1497 if (attrType.getTypeID() == typeID) {
1501 throw new IllegalArgumentException(
"No ATTRIBUTE_TYPE matching type: " + typeID);
1519 if (attrType.getLabel().equals(typeName)) {
1523 throw new IllegalArgumentException(
"No ATTRIBUTE_TYPE matching type: " + typeName);
1545 public BlackboardAttribute(
int attributeTypeID, String moduleName,
int valueInt)
throws IllegalArgumentException {
1569 this(attributeTypeID, moduleName, valueInt);
1570 this.context = replaceNulls(context);
1593 long valueLong)
throws IllegalArgumentException {
1619 this(attributeTypeID, moduleName, valueLong);
1620 this.context = replaceNulls(context);
1641 double valueDouble)
throws IllegalArgumentException {
1664 double valueDouble) {
1665 this(attributeTypeID, moduleName, valueDouble);
1666 this.context = replaceNulls(context);
1686 public BlackboardAttribute(
int attributeTypeID, String moduleName, String valueString)
throws IllegalArgumentException {
1709 String valueString) {
1710 this(attributeTypeID, moduleName, valueString);
1711 this.context = replaceNulls(context);
1731 public BlackboardAttribute(
int attributeTypeID, String moduleName, byte[] valueBytes)
throws IllegalArgumentException {
1754 byte[] valueBytes) {
1755 this(attributeTypeID, moduleName, valueBytes);
1756 this.context = replaceNulls(context);
1771 setArtifactId(artifactID);
1787 setCaseDatabase(sleuthkitCase);
1810 String getContextString() {
1823 return attributeType.getTypeID();
1837 return attributeType.getTypeName();
1852 return attributeType.getDisplayName();
BlackboardAttribute(int attributeTypeID, String moduleName, String context, byte[] valueBytes)
void setCase(SleuthkitCase sleuthkitCase)
Type(int typeID, String typeName, String displayName, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType)
String getAttributeTypeDisplayName()
static String epochToTime(long epoch)
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType()
static ATTRIBUTE_TYPE fromID(int typeID)
void setArtifactID(long artifactID)
String getAttributeTypeName()
BlackboardAttribute(Type attributeType, String source, long valueLong)
BlackboardAttribute(Type attributeType, String source, int valueInt)
BlackboardAttribute(int attributeTypeID, String moduleName, String context, int valueInt)
BlackboardArtifact getBlackboardArtifact(long artifactID)
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromLabel(String typeName)
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType()
BlackboardAttribute(int attributeTypeID, String moduleName, int valueInt)
BlackboardAttribute(int attributeTypeID, String moduleName, String valueString)
String getDisplayString()
BlackboardAttribute(int attributeTypeID, String moduleName, double valueDouble)
boolean equals(Object obj)
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, String valueString)
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE getValueType()
BlackboardAttribute(Type attributeType, String source, byte[] valueBytes)
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromType(long typeId)
BlackboardAttribute(int attributeTypeID, String moduleName, String context, double valueDouble)
BlackboardAttribute.Type getAttributeType()
boolean equals(Object that)
static ATTRIBUTE_TYPE fromLabel(String typeName)
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, long valueLong)
BlackboardArtifact getParentArtifact()
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, int valueInt)
BlackboardAttribute(Type attributeType, String source, double valueDouble)
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, double valueDouble)
BlackboardAttribute(int attributeTypeID, String moduleName, String context, long valueLong)
BlackboardAttribute(int attributeTypeID, String moduleName, String context, String valueString)
BlackboardAttribute(int attributeTypeID, String moduleName, long valueLong)
Type(BlackboardAttribute.ATTRIBUTE_TYPE type)
BlackboardAttribute(int attributeTypeID, String moduleName, byte[] valueBytes)
BlackboardAttribute(ATTRIBUTE_TYPE attributeType, String source, byte[] valueBytes)
void addSource(String source)
List< String > getSources()
BlackboardAttribute(Type attributeType, String source, String valueString)