Autopsy
4.15.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
|
Inherits JPanel, and org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.
Classes | |
class | ItemEntry |
class | SectionConfig |
Public Member Functions | |
AnnotationsContentViewer () | |
DataContentViewer | createInstance () |
Component | getComponent () |
String | getTitle () |
String | getToolTip () |
int | isPreferred (Node node) |
boolean | isSupported (Node node) |
void | resetComponent () |
void | setNode (Node node) |
Private Member Functions | |
void | initComponents () |
Static Private Member Functions | |
static< T > boolean | appendEntries (Element parent, SectionConfig< T > config, List<?extends T > items, boolean isSubsection) |
static Element | appendMessage (Element parent, String message) |
static Element | appendRow (Element rowParent, List< String > data, int columnNumber, boolean isHeader) |
static Element | appendSection (Element parent, String headerText) |
static Element | appendSubsection (Element parent, String headerText) |
static Element | appendTable (Element parent, int columnNumber, List< List< String >> content, List< String > columnHeaders) |
static< T > Element | appendVerticalEntryTables (Element parent, List<?extends T > items, List< ItemEntry< T >> rowHeaders) |
static List< CorrelationAttributeInstance > | getCentralRepositoryData (BlackboardArtifact artifact) |
static List< CorrelationAttributeInstance > | getCentralRepositoryData (AbstractFile sourceFile) |
static List< CorrelationAttributeInstance > | getCorrelationAttributeComments (List< Pair< CorrelationAttributeInstance.Type, String >> lookupKeys) |
static List< BlackboardArtifact > | getFileSetHits (AbstractFile sourceFile, ARTIFACT_TYPE type) |
static List< ContentTag > | getTags (Content sourceContent) |
static List< BlackboardArtifactTag > | getTags (BlackboardArtifact bba) |
static boolean | hasTskComment (BlackboardArtifact artifact) |
static boolean | renderArtifact (Element parent, BlackboardArtifact bba, Content sourceContent) |
static boolean | renderContent (Element parent, Content sourceContent, boolean isSubheader) |
static String | tryGetAttribute (BlackboardArtifact artifact, BlackboardAttribute.ATTRIBUTE_TYPE attributeType) |
Private Attributes | |
javax.swing.JScrollPane | jScrollPane5 |
javax.swing.JTextPane | jTextPane1 |
Static Private Attributes | |
static final SectionConfig< BlackboardArtifact > | ARTIFACT_COMMENT_CONFIG = new SectionConfig<>(Bundle.AnnotationsContentViewer_fileHitEntry_artifactCommentTitle(), FILESET_HIT_ENTRIES) |
static final int | CELL_SPACING = DEFAULT_FONT_SIZE / 2 |
static final SectionConfig< CorrelationAttributeInstance > | CR_COMMENTS_CONFIG = new SectionConfig<>(Bundle.AnnotationsContentViewer_centralRepositoryEntry_title(), CR_COMMENTS_ENTRIES) |
static final List< ItemEntry< CorrelationAttributeInstance > > | CR_COMMENTS_ENTRIES |
static final int | DEFAULT_FONT_SIZE = new JLabel().getFont().getSize() |
static final int | DEFAULT_SECTION_SPACING = DEFAULT_FONT_SIZE * 2 |
static final int | DEFAULT_SUBSECTION_LEFT_PAD = DEFAULT_FONT_SIZE |
static final int | DEFAULT_SUBSECTION_SPACING = DEFAULT_FONT_SIZE / 2 |
static final int | DEFAULT_TABLE_SPACING = DEFAULT_FONT_SIZE |
static final String | EMPTY_HTML = "<html><head></head><body></body></html>" |
static final List< ItemEntry< BlackboardArtifact > > | FILESET_HIT_ENTRIES |
static final SectionConfig< BlackboardArtifact > | HASHSET_CONFIG = new SectionConfig<>(Bundle.AnnotationsContentViewer_fileHitEntry_hashSetHitTitle(), FILESET_HIT_ENTRIES) |
static final String | HEADER_CLASSNAME = "header" |
static final int | HEADER_FONT_SIZE = DEFAULT_FONT_SIZE * 14 / 11 |
static final SectionConfig< BlackboardArtifact > | INTERESTING_FILE_CONFIG = new SectionConfig<>(Bundle.AnnotationsContentViewer_fileHitEntry_interestingFileHitTitle(), FILESET_HIT_ENTRIES) |
static final Logger | logger = Logger.getLogger(AnnotationsContentViewer.class.getName()) |
static final String | MESSAGE_CLASSNAME = "message" |
static final String | SECTION_CLASSNAME = "section" |
static final String | STYLE_SHEET_RULE |
static final String | SUBHEADER_CLASSNAME = "subheader" |
static final int | SUBHEADER_FONT_SIZE = DEFAULT_FONT_SIZE * 12 / 11 |
static final String | SUBSECTION_CLASSNAME = "subsection" |
static final SectionConfig< Tag > | TAG_CONFIG = new SectionConfig<>(Bundle.AnnotationsContentViewer_tagEntry_title(), TAG_ENTRIES) |
static final List< ItemEntry< Tag > > | TAG_ENTRIES |
static final String | VERTICAL_TABLE_CLASSNAME = "vertical-table" |
Annotations view of file contents.
Definition at line 85 of file AnnotationsContentViewer.java.
org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.AnnotationsContentViewer | ( | ) |
Creates an instance of AnnotationsContentViewer.
Definition at line 230 of file AnnotationsContentViewer.java.
References org.sleuthkit.autopsy.contentviewers.Utilities.configureTextPaneAsHtml().
|
staticprivate |
Append entries to the parent element in the annotations viewer. Entries will be formatted as a table in the format specified in the SectionConfig.
parent | The parent element for which the entries will be attached. |
config | The display configuration for this entry type (i.e. table type, name, if data is not present). |
items | The items to display. |
isSubsection | Whether or not this should be displayed as a subsection. If not displayed as a top-level section. |
Definition at line 567 of file AnnotationsContentViewer.java.
|
staticprivate |
Appends a message to the parent element. This is typically used in the event that no data exists for a certain type.
parent | The parent element that will have this message appended to it. |
message | The message to append. |
Definition at line 703 of file AnnotationsContentViewer.java.
|
staticprivate |
Appends a row to the parent element (should be thead or tbody).
rowParent | The parent table element. |
data | The data to place in columns within the table. |
columnNumber | The number of columns to append. |
isHeader | Whether or not this should have header cells ('th') instead of regular cells ('td'). |
Definition at line 647 of file AnnotationsContentViewer.java.
|
staticprivate |
Appends a new section with a section header to the parent element.
parent | The element to append this section to. |
headerText | The text for the section. |
Definition at line 667 of file AnnotationsContentViewer.java.
|
staticprivate |
Appends a new subsection with a subsection header to the parent element.
parent | The element to append this subsection to. |
headerText | The text for the subsection. |
Definition at line 684 of file AnnotationsContentViewer.java.
|
staticprivate |
Appends a generic table to the parent element.
parent | The parent element that will have a table appended to it. |
columnNumber | The number of columns to append. |
content | The content in content.get(row).get(column) format. |
columnHeaders | The column headers or null if no column headers should be created. |
Definition at line 624 of file AnnotationsContentViewer.java.
|
staticprivate |
Appends a table where items are displayed in rows of key-value pairs.
parent | The parent to append the table. |
items | The items to process into a series of tables. |
rowHeaders | The keys and the means to process items in order to get key-value pairs. |
Definition at line 588 of file AnnotationsContentViewer.java.
DataContentViewer org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.createInstance | ( | ) |
Create and return a new instance of your viewer. The reason that this is needed is because the specific viewer modules will be found via NetBeans Lookup and the type will only be DataContentViewer. This method is used to get an instance of your specific type.
Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.
Definition at line 757 of file AnnotationsContentViewer.java.
|
staticprivate |
Gets the "Central Repository Comments" section with data for the blackboard artifact.
artifact | The selected artifact. |
Definition at line 472 of file AnnotationsContentViewer.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForCorrelation().
|
staticprivate |
Gets the "Central Repository Comments" section with data.
sourceFile | A selected file, or a source file of the selected artifact. |
Definition at line 494 of file AnnotationsContentViewer.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.FILES_TYPE_ID, org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getDefinedCorrelationTypes(), and org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getInstance().
Component org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.getComponent | ( | ) |
Return the Swing Component to display. Implementations of this method that extend JPanel and do a 'return this;'. Otherwise return an internal instance of the JPanel.
Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.
Definition at line 790 of file AnnotationsContentViewer.java.
|
staticprivate |
Given a type and a value for that type, does a lookup in the Central Repository for matching values that have comments.
lookupKeys | The type and value to lookup. |
Definition at line 529 of file AnnotationsContentViewer.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getArtifactInstancesByTypeValue(), and org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getInstance().
|
staticprivate |
Retrieves the blackboard artifacts for a source file matching a certain type that have a non-blank TSK_COMMENT.
sourceFile | The source file for which to fetch artifacts. |
type | The type of blackboard artifact to fetch. |
Definition at line 410 of file AnnotationsContentViewer.java.
References org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().
|
staticprivate |
Retrieves tags associated with a content item.
sourceContent | The content for which to gather content. |
Definition at line 370 of file AnnotationsContentViewer.java.
References org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().
|
staticprivate |
Retrieves tags for blackboard artifact tags.
bba | The blackboard artifact for which to retrieve tags. |
Definition at line 389 of file AnnotationsContentViewer.java.
References org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().
String org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.getTitle | ( | ) |
Returns the title of this viewer to display in the tab.
Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.
Definition at line 747 of file AnnotationsContentViewer.java.
String org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.getToolTip | ( | ) |
Returns a short description of this viewer to use as a tool tip for its tab.
Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.
Definition at line 752 of file AnnotationsContentViewer.java.
|
staticprivate |
Returns true if the artifact contains a non-blank TSK_COMMENT attribute.
artifact | The artifact to check. |
Definition at line 431 of file AnnotationsContentViewer.java.
|
private |
This method is called from within the constructor to initialize the form. WARNING: Do NOT modify this code. The content of this method is always regenerated by the Form Editor.
Definition at line 717 of file AnnotationsContentViewer.java.
int org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.isPreferred | ( | Node | node | ) |
Checks whether the given viewer is preferred for the Node. This is a bit subjective, but the idea is that Autopsy wants to display the most relevant tab. The more generic the viewer, the lower the return value should be. This will only be called on viewers that support the given node (i.e., isSupported() has already returned true).
The following are some examples of the current levels in use. If the selected node is an artifact, the level may be determined by both the artifact and its associated file.
Level 7 - Based on the artifact, if any, in the selected node and specific to an artifact type or types. Current content viewers that can return level 7 are the Messages tab (only supported for email and SMS) and the Text tab when the selected node is a Keyword Search hit.
Level 6 - Based on the artifact, if any, in the selected node but not restricted to particular types. The current content viewer that can return level 6 is the Results tab. It returns this level for most artifact types, unless the associated file is assumed to be of greater interest (for example, a Hash Set Hit will not be level 6 because the file itself is of greater interest).
Level 5 - Based on the file in the selected node and very specific to the file type. The current content viewer that will return level 5 is the Application tab, which supports media files (such as images) and certain types of databases.
Level 4 - Based on the file in the selected node but fairly general. Currently this is the level returned by the Text tab if Keyword Search has been run (unless the node is a Keyword Search hit or a Credit Card account). This is the default tab for most files.
Level 3 - Based on the artifact, if any, in the selected node where the artifact is thought to be of less interest than the associated file. This level is returned by the Results tab for artifacts like Hash Set Hits.
Level 1 - Very general and should always be available. The Hex, Text, and Metadata tabs are all this level
Level 0 - For cases where the content viewer should never be displayed by default.
node | Node to check for preference |
Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.
Definition at line 785 of file AnnotationsContentViewer.java.
boolean org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.isSupported | ( | Node | node | ) |
Checks whether the given node is supported by the viewer. This will be used to enable or disable the tab for the viewer.
node | Node to check for support |
Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.
Definition at line 762 of file AnnotationsContentViewer.java.
|
staticprivate |
Renders annotations for an artifact.
parent | The html element to render content int. |
bba | The blackboard artifact to render. |
sourceContent | The content from which the blackboard artifact comes. |
Definition at line 300 of file AnnotationsContentViewer.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.isEnabled().
|
staticprivate |
Renders annotations for a content item.
parent | The parent within which to render. |
sourceContent | The content for which annotations will be gathered. |
isSubheader | True if this section should be rendered as a subheader as opposed to a top-level header. |
Definition at line 338 of file AnnotationsContentViewer.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.isEnabled().
void org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.resetComponent | ( | ) |
Resets the contents of the viewer / component.
Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.
Definition at line 795 of file AnnotationsContentViewer.java.
void org.sleuthkit.autopsy.contentviewers.AnnotationsContentViewer.setNode | ( | Node | selectedNode | ) |
Autopsy will call this when this panel is focused with the file that should be analyzed. When called with null, must clear all references to previous nodes.
selectedNode | the node which is used to determine what is displayed in this viewer |
Implements org.sleuthkit.autopsy.corecomponentinterfaces.DataContentViewer.
Definition at line 242 of file AnnotationsContentViewer.java.
|
staticprivate |
Attempts to retrieve the attribute of a particular type from a blackboard artifact.
artifact | The artifact from which to retrieve the information. |
attributeType | The attribute type to retrieve from the artifact. |
Definition at line 444 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 214 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 167 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 225 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 217 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 152 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 165 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 161 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 166 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 164 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 150 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 200 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 211 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 174 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 158 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 208 of file AnnotationsContentViewer.java.
|
private |
Definition at line 742 of file AnnotationsContentViewer.java.
|
private |
Definition at line 743 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 148 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 170 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 173 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 179 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 172 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 155 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 171 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 197 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 189 of file AnnotationsContentViewer.java.
|
staticprivate |
Definition at line 175 of file AnnotationsContentViewer.java.
Copyright © 2012-2020 Basis Technology. Generated on: Mon Jul 6 2020
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.