Sleuth Kit Java Bindings (JNI)  4.12.1
Java bindings for using The Sleuth Kit
OsAccountInstance.java
Go to the documentation of this file.
1 /*
2  * Sleuth Kit Data Model
3  *
4  * Copyright 2021 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.util.Arrays;
22 import java.util.Objects;
23 import java.util.ResourceBundle;
24 
29 public class OsAccountInstance implements Comparable<OsAccountInstance> {
30 
31  private static final ResourceBundle bundle = ResourceBundle.getBundle("org.sleuthkit.datamodel.Bundle");
32 
33  private final SleuthkitCase skCase;
34  private final long instanceId;
35  private final long accountId;
36  private final long dataSourceId;
37  private final OsAccountInstanceType instanceType;
38 
39  private OsAccount account;
40  private DataSource dataSource;
41 
54  OsAccountInstance(SleuthkitCase skCase, long instanceId, OsAccount account, long dataSourceId, OsAccountInstanceType instanceType) {
55  this(skCase, instanceId, account.getId(), dataSourceId, instanceType);
56  this.account = account;
57  }
58 
70  OsAccountInstance(SleuthkitCase skCase, long instanceId, long accountObjId, long dataSourceObjId, OsAccountInstanceType instanceType) {
71  this.skCase = skCase;
72  this.instanceId = instanceId;
73  this.accountId = accountObjId;
74  this.dataSourceId = dataSourceObjId;
75  this.instanceType = instanceType;
76  }
77 
83  public long getInstanceId() {
84  return instanceId;
85  }
86 
96  if (account == null) {
97  try {
98  account = skCase.getOsAccountManager().getOsAccountByObjectId(accountId);
99  } catch (TskCoreException ex) {
100  throw new TskCoreException(String.format("Failed to get OsAccount for id %d", accountId), ex);
101  }
102  }
103 
104  return account;
105  }
106 
115  if (dataSource == null) {
116  try {
117  dataSource = skCase.getDataSource(dataSourceId);
118  } catch (TskDataException ex) {
119  throw new TskCoreException(String.format("Failed to get DataSource for id %d", dataSourceId), ex);
120  }
121  }
122 
123  return dataSource;
124  }
125 
132  return instanceType;
133  }
134 
140  private long getDataSourceId() {
141  return dataSourceId;
142  }
143 
144  @Override
145  public int compareTo(OsAccountInstance other) {
146  if (equals(other)) {
147  return 0;
148  }
149 
150  if (dataSourceId != other.getDataSourceId()) {
151  return Long.compare(dataSourceId, other.getDataSourceId());
152  }
153 
154  return Long.compare(accountId, other.accountId);
155  }
156 
157  @Override
158  public boolean equals(Object obj) {
159  if (this == obj) {
160  return true;
161  }
162  if (obj == null) {
163  return false;
164  }
165  if (getClass() != obj.getClass()) {
166  return false;
167  }
168  final OsAccountInstance other = (OsAccountInstance) obj;
169 
170  if(this.instanceId != other.instanceId) {
171  return false;
172  }
173 
174  if (this.accountId != other.accountId) {
175  return false;
176  }
177 
178  if(this.instanceType != other.instanceType) {
179  return false;
180  }
181 
182  return this.dataSourceId == other.getDataSourceId();
183  }
184 
185  @Override
186  public int hashCode() {
187  int hash = 7;
188  hash = 67 * hash + Objects.hashCode(this.instanceId);
189  hash = 67 * hash + Objects.hashCode(this.dataSourceId);
190  hash = 67 * hash + Objects.hashCode(this.accountId);
191  hash = 67 * hash + Objects.hashCode(this.instanceType);
192  return hash;
193  }
194 
201  public enum OsAccountInstanceType {
202  LAUNCHED(0, bundle.getString("OsAccountInstanceType.Launched.text"), bundle.getString("OsAccountInstanceType.Launched.descr.text")), // user had an interactive session or launched a program on the host
203  ACCESSED(1, bundle.getString("OsAccountInstanceType.Accessed.text"), bundle.getString("OsAccountInstanceType.Accessed.descr.text")), // user accesed a resource/file for read/write. Could have been via a service (such as a file share) or a SID on a random file from an unknown location. NOTE: Because Windows event logs do not show if an authentication was for an interactive login or accessing a service, we mark a user as ACCESSED based on authentication. They become LAUNCHED if we have proof of them starting a program or getting an interactive login.
204  REFERENCED(2, bundle.getString("OsAccountInstanceType.Referenced.text"), bundle.getString("OsAccountInstanceType.Referenced.descr.text")); // user was referenced in a log file (e.g. in a event log) or registry, but there was no evidence of activity or ownership on the host. Examples include an account that was never used and entries on a log server.
205 
206 
207  private final int id;
208  private final String name;
209  private final String description;
210 
211  OsAccountInstanceType(int id, String name, String description) {
212  this.id = id;
213  this.name = name;
214  this.description = description;
215  }
216 
222  public int getId() {
223  return id;
224  }
225 
231  public String getName() {
232  return name;
233  }
234 
240  public String getDescription() {
241  return description;
242  }
243 
251  public static OsAccountInstanceType fromID(int typeId) {
252  for (OsAccountInstanceType statusType : OsAccountInstanceType.values()) {
253  if (statusType.ordinal() == typeId) {
254  return statusType;
255  }
256  }
257  return null;
258  }
259 
267  public static OsAccountInstanceType fromString(String name) {
268  return Arrays.stream(values())
269  .filter(val -> val.getName().equals(name))
270  .findFirst().orElse(null);
271  }
272  }
273 }
OsAccount getOsAccountByObjectId(long osAccountObjId)
DataSource getDataSource(long objectId)
OsAccountInstanceType(int id, String name, String description)

Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.