Examples of BlackboardArtifact

org.sleuthkit.datamodel.BlackboardArtifact
Represents an artifact as stored in the Blackboard. Artifacts are a collection of name value pairs and have a type that represents the type of data they are storing. This class is used to create artifacts on the blackboard and is used to represent artifacts queried from the blackboard.

Examples of org.sleuthkit.datamodel.BlackboardArtifact

    @Override
    public KeywordCachedArtifact writeSingleFileHitsToBlackBoard(String termHit, AbstractFile newFsHit, String snippet, String listName) {
        final String MODULE_NAME = KeywordSearchModuleFactory.getModuleName();


        //there is match actually in this file, create artifact only then
        BlackboardArtifact bba;
        KeywordCachedArtifact writeResult;
        Collection<BlackboardAttribute> attributes = new ArrayList<>();
        try {
            bba = newFsHit.newArtifact(ARTIFACT_TYPE.TSK_KEYWORD_HIT);
            writeResult = new KeywordCachedArtifact(bba);
        } catch (Exception e) {
            logger.log(Level.WARNING, "Error adding bb artifact for keyword hit", e); //NON-NLS
            return null;
        }


        //regex match
        attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID(), MODULE_NAME, termHit));
        
        if ((listName != null) && (listName.equals("") == false)) {
            attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), MODULE_NAME, listName));
        }
        
        //preview
        if (snippet != null) {
            attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID(), MODULE_NAME, snippet));
        }
        //regex keyword
        attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP.getTypeID(), MODULE_NAME, keyword.getQuery()));


        try {
            bba.addAttributes(attributes);
            writeResult.add(attributes);
            return writeResult;
        } catch (TskException e) {
            logger.log(Level.WARNING, "Error adding bb attributes for terms search artifact", e); //NON-NLS
        }

View Full Code Here

Examples of org.sleuthkit.datamodel.BlackboardArtifact

                
                read = resultSet.getInt("read");
                subject = resultSet.getString("subject");
                body = resultSet.getString("body");


                BlackboardArtifact bba = f.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE); //create Message artifact and then add attributes from result set.
                if (resultSet.getString("type").equals("1")) {
                    bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION.getTypeID(), moduleName, "Incoming"));
                    bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM.getTypeID(), moduleName, address));
                } else {
                    bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION.getTypeID(), moduleName, "Outgoing"));
                    bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO.getTypeID(), moduleName, address));
                }
                bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME.getTypeID(), moduleName, date));
                
                bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_READ_STATUS.getTypeID(), moduleName, read));
                bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT.getTypeID(), moduleName, subject));
                bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT.getTypeID(), moduleName, body));
                bba.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE.getTypeID(), moduleName, "SMS Message"));
            }


        } catch (Exception e) {
            logger.log(Level.SEVERE, "Error parsing text messages to Blackboard", e);
        } finally {

View Full Code Here

Examples of org.sleuthkit.datamodel.BlackboardArtifact

            if (skCase == null) {
                return null;   
            }
            
            try {
                BlackboardArtifact art = skCase.getBlackboardArtifact(artifactId);
                BlackboardArtifactNode n = new BlackboardArtifactNode(art);
                AbstractFile file;
                try {
                    file = skCase.getAbstractFileById(art.getObjectID());
                } catch (TskCoreException ex) {
                    logger.log(Level.SEVERE, "TskCoreException while constructing BlackboardArtifact Node from KeywordHitsKeywordChildren"); //NON-NLS
                    return n;
                }

View Full Code Here

Examples of org.sleuthkit.datamodel.BlackboardArtifact

     */
    public synchronized String detectAndSave(AbstractFile abstractFile) throws TskCoreException {
        String mimeType = detect(abstractFile);
        if (mimeType != null) {
            // add artifact
            BlackboardArtifact getInfoArt = abstractFile.getGenInfoArtifact();
            BlackboardAttribute batt = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_FILE_TYPE_SIG.getTypeID(), FileTypeIdModuleFactory.getModuleName(), mimeType);
            getInfoArt.addAttribute(batt);


            // we don't fire the event because we just updated TSK_GEN_INFO, which isn't displayed in the tree and is vague.
        }
        return mimeType;
    }

View Full Code Here

Examples of org.sleuthkit.datamodel.BlackboardArtifact


            //merge predefined specific node actions if bban subclasses have their own
            for (Action a : ban.getActions(true)) {
                actions.add(a);
            }
            BlackboardArtifact ba = ban.getLookup().lookup(BlackboardArtifact.class);
            final int artifactTypeID = ba.getArtifactTypeID();


            if (artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()
                    || artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
                actions.add(new ViewContextAction(
                        NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewFileInDir.text"), ban));

View Full Code Here

Examples of org.sleuthkit.datamodel.BlackboardArtifact


            return actions;
        }


        private Content findLinked(BlackboardArtifactNode ba) {
            BlackboardArtifact art = ba.getLookup().lookup(BlackboardArtifact.class);
            Content c = null;
            try {
                for (BlackboardAttribute attr : art.getAttributes()) {
                    if (attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID()) {
                        switch (attr.getValueType()) {
                            case INTEGER:
                                int i = attr.getValueInt();
                                if (i != -1) {
                                    c = art.getSleuthkitCase().getContentById(i);
                                }
                                break;
                            case LONG:
                                long l = attr.getValueLong();
                                if (l != -1) {
                                    c = art.getSleuthkitCase().getContentById(l);
                                }
                                break;
                        }
                    }
                }

View Full Code Here

Examples of org.sleuthkit.datamodel.BlackboardArtifact

        
    private void postHashSetHitToBlackboard(AbstractFile abstractFile, String md5Hash, String hashSetName, String comment, boolean showInboxMessage) {
        try {
            String MODULE_NAME = NbBundle.getMessage(HashDbIngestModule.class, "HashDbIngestModule.moduleName");
            
            BlackboardArtifact badFile = abstractFile.newArtifact(ARTIFACT_TYPE.TSK_HASHSET_HIT);
            //TODO Revisit usage of deprecated constructor as per TSK-583
            //BlackboardAttribute att2 = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), MODULE_NAME, "Known Bad", hashSetName);
            BlackboardAttribute att2 = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), MODULE_NAME, hashSetName);
            badFile.addAttribute(att2);
            BlackboardAttribute att3 = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_HASH_MD5.getTypeID(), MODULE_NAME, md5Hash);
            badFile.addAttribute(att3);
            BlackboardAttribute att4 = new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID(), MODULE_NAME, comment);
            badFile.addAttribute(att4);
            
            if (showInboxMessage) {
                StringBuilder detailsSb = new StringBuilder();
                //details
                detailsSb.append("<table border='0' cellpadding='4' width='280'>"); //NON-NLS

View Full Code Here

Examples of org.sleuthkit.datamodel.BlackboardArtifact

        return false;
    }


    @Override
    public int isPreferred(Node node) {
        BlackboardArtifact artifact = node.getLookup().lookup(BlackboardArtifact.class);
        if(artifact == null) {
            return 3;
        } 
        else {
            return 5;

View Full Code Here

Examples of org.sleuthkit.datamodel.BlackboardArtifact

            }


            // If the node has an underlying blackboard artifact, show it. If not,
            // show the first artifact.
            int index = 0;
            BlackboardArtifact artifact = lookup.lookup(BlackboardArtifact.class);
            if (artifact != null) {
                index = artifacts.indexOf(artifact);
                if (index == -1) {
                    index = 0;
                } else {
                    // if the artifact has an ASSOCIATED ARTIFACT, then we display the associated artifact instead
                    try {
                        for (BlackboardAttribute attr : artifact.getAttributes()) {
                           if (attr.getAttributeTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID()) {
                               long assocArtifactId = attr.getValueLong();
                               int assocArtifactIndex = -1;
                               for (BlackboardArtifact art: artifacts) {
                                   if (assocArtifactId == art.getArtifactID()) {

View Full Code Here

Examples of org.sleuthkit.datamodel.BlackboardArtifact

    private void viewArtifact(java.awt.event.ActionEvent evt) {
        artifactViewerInvoked();
        
        final IngestMessageGroup messageGroup = mainPanel.getMessagePanel().getSelectedMessage();
        if (messageGroup != null) {
            BlackboardArtifact art = messageGroup.getData();
            if (art != null) {
                BlackboardResultViewer v = Lookup.getDefault().lookup(BlackboardResultViewer.class);
                v.viewArtifact(art);
            }
        }

View Full Code Here

0 1 2 3

TOP

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.