19 package org.sleuthkit.autopsy.datamodel;
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.text.MessageFormat;
24 import java.util.ArrayList;
25 import java.util.Arrays;
26 import java.util.LinkedHashMap;
27 import java.util.List;
29 import java.util.logging.Level;
30 import java.util.stream.Collectors;
31 import javax.swing.Action;
32 import org.apache.commons.lang3.StringUtils;
33 import org.openide.nodes.Children;
34 import org.openide.nodes.Sheet;
35 import org.openide.util.Lookup;
36 import org.openide.util.NbBundle;
37 import org.openide.util.lookup.Lookups;
50 import org.
sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
52 import org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
72 BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID(),
73 BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID(),
74 BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID(),
75 BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID(),};
81 BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID(),};
83 private final PropertyChangeListener
pcl =
new PropertyChangeListener() {
85 public void propertyChange(PropertyChangeEvent evt) {
86 String eventType = evt.getPropertyName();
89 if (event.getAddedTag().getArtifact().equals(artifact)) {
94 if (event.getDeletedTagInfo().getArtifactID() == artifact.getArtifactID()) {
99 if (event.getAddedTag().getContent().equals(associated)) {
104 if (event.getDeletedTagInfo().getContentID() == associated.getId()) {
108 if (evt.getNewValue() == null) {
128 this.associated = this.getLookup().lookup(Content.class);
129 this.setName(Long.toString(artifact.getArtifactID()));
131 this.setIconBaseWithExtension(iconPath);
146 this.associated = this.getLookup().lookup(Content.class);
147 this.setName(Long.toString(artifact.getArtifactID()));
149 this.setIconBaseWithExtension(
ExtractedContent.getIconFilePath(artifact.getArtifactTypeID()));
159 "BlackboardArtifactNode.getAction.errorTitle=Error getting actions",
160 "BlackboardArtifactNode.getAction.resultErrorMessage=There was a problem getting actions for the selected result."
161 +
" The 'View Result in Timeline' action will not be available.",
162 "BlackboardArtifactNode.getAction.linkedFileMessage=There was a problem getting actions for the selected result. "
163 +
" The 'View File in Timeline' action will not be available."})
165 List<Action> actionsList =
new ArrayList<>();
166 actionsList.addAll(Arrays.asList(super.getActions(context)));
173 }
catch (TskCoreException ex) {
174 LOGGER.log(Level.SEVERE, MessageFormat.format(
"Error getting arttribute(s) from blackboard artifact{0}.", artifact.getArtifactID()), ex);
175 MessageNotifyUtil.
Notify.
error(Bundle.BlackboardArtifactNode_getAction_errorTitle(), Bundle.BlackboardArtifactNode_getAction_resultErrorMessage());
180 AbstractFile c = findLinked(artifact);
184 }
catch (TskCoreException ex) {
185 LOGGER.log(Level.SEVERE, MessageFormat.format(
"Error getting linked file from blackboard artifact{0}.", artifact.getArtifactID()), ex);
186 MessageNotifyUtil.
Notify.
error(Bundle.BlackboardArtifactNode_getAction_errorTitle(), Bundle.BlackboardArtifactNode_getAction_linkedFileMessage());
190 AbstractFile file = getLookup().lookup(AbstractFile.class);
195 return actionsList.toArray(
new Action[actionsList.size()]);
198 @NbBundle.Messages({
"# {0} - artifactDisplayName",
"BlackboardArtifactNode.displayName.artifact={0} Artifact"})
205 String displayName =
"";
206 if (associated != null) {
207 displayName = associated.getName();
214 && (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()
215 || artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID())) {
217 for (BlackboardAttribute attribute : artifact.getAttributes()) {
218 if (attribute.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID()) {
220 if (associatedArtifact != null) {
221 if (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) {
222 artifact.getDisplayName();
224 displayName = NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.displayName.artifact", associatedArtifact.getDisplayName());
229 }
catch (TskCoreException ex) {
237 "BlackboardArtifactNode.createSheet.artifactType.displayName=Artifact Type",
238 "BlackboardArtifactNode.createSheet.artifactType.name=Artifact Type",
239 "BlackboardArtifactNode.createSheet.artifactDetails.displayName=Artifact Details",
240 "BlackboardArtifactNode.createSheet.artifactDetails.name=Artifact Details",
241 "BlackboardArtifactNode.artifact.displayName=Artifact"})
245 Sheet s = super.createSheet();
246 Sheet.Set ss = s.get(Sheet.PROPERTIES);
248 ss = Sheet.createPropertiesSet();
251 final String NO_DESCR = NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.noDesc.text");
253 Map<String, Object> map =
new LinkedHashMap<>();
257 NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.createSheet.srcFile.displayName"),
259 this.getDisplayName()));
260 if (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) {
262 BlackboardAttribute attribute = artifact.getAttribute(
new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
263 if (attribute != null) {
266 NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.createSheet.artifactType.displayName"),
268 associatedArtifact.getDisplayName() +
" " + NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.artifact.displayName")));
270 NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.createSheet.artifactDetails.displayName"),
272 associatedArtifact.getShortDescription()));
274 }
catch (TskCoreException ex) {
279 for (Map.Entry<String, Object> entry : map.entrySet()) {
287 if (customProperties != null) {
293 final int artifactTypeId = artifact.getArtifactTypeID();
296 if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID()) {
298 String actualMimeType =
"";
299 if (associated instanceof AbstractFile) {
300 AbstractFile af = (AbstractFile) associated;
301 ext = af.getNameExtension();
302 actualMimeType = af.getMIMEType();
303 if (actualMimeType == null) {
313 NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.createSheet.mimeType.displayName"),
318 if (Arrays.asList(SHOW_UNIQUE_PATH).contains(artifactTypeId)) {
319 String sourcePath =
"";
321 sourcePath = associated.getUniquePath();
322 }
catch (TskCoreException ex) {
323 LOGGER.log(Level.WARNING,
"Failed to get unique path from: {0}", associated.getName());
326 if (sourcePath.isEmpty() ==
false) {
329 NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.createSheet.filePath.displayName"),
334 if (Arrays.asList(SHOW_FILE_METADATA).contains(artifactTypeId)) {
335 AbstractFile file = associated instanceof AbstractFile ? (AbstractFile) associated : null;
337 NbBundle.getMessage(
BlackboardArtifactNode.class,
"ContentTagNode.createSheet.fileModifiedTime.displayName"),
341 NbBundle.getMessage(
BlackboardArtifactNode.class,
"ContentTagNode.createSheet.fileChangedTime.displayName"),
345 NbBundle.getMessage(
BlackboardArtifactNode.class,
"ContentTagNode.createSheet.fileAccessedTime.displayName"),
349 NbBundle.getMessage(
BlackboardArtifactNode.class,
"ContentTagNode.createSheet.fileCreatedTime.displayName"),
355 associated.getSize()));
358 String dataSourceStr =
"";
360 Content dataSource = associated.getDataSource();
361 if (dataSource != null) {
362 dataSourceStr = dataSource.getName();
366 }
catch (TskCoreException ex) {
367 LOGGER.log(Level.WARNING,
"Failed to get image name from {0}", associated.getName());
370 if (dataSourceStr.isEmpty() ==
false) {
373 NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.createSheet.dataSrc.displayName"),
380 List<Tag> tags =
new ArrayList<>();
384 }
catch (TskCoreException ex) {
385 LOGGER.log(Level.SEVERE,
"Failed to get tags for artifact " + artifact.getDisplayName(), ex);
388 NO_DESCR, tags.stream().map(t -> t.getName().getDisplayName()).collect(Collectors.joining(
", "))));
398 String parentName = associated.getName();
401 while ((parent = parent.getParent()) != null) {
402 parentName = parent.getName();
404 }
catch (TskCoreException ex) {
405 LOGGER.log(Level.WARNING,
"Failed to get parent name from {0}", associated.getName());
418 if (null == customProperties) {
420 customProperties =
new ArrayList<>();
422 customProperties.add(np);
432 @SuppressWarnings(
"deprecation")
435 for (BlackboardAttribute attribute : artifact.getAttributes()) {
436 final int attributeTypeID = attribute.getAttributeType().getTypeID();
438 if (attributeTypeID == ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID()
439 || attributeTypeID == ATTRIBUTE_TYPE.TSK_TAGGED_ARTIFACT.getTypeID()
440 || attributeTypeID == ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID()
441 || attributeTypeID == ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID()
442 || attributeTypeID == ATTRIBUTE_TYPE.TSK_KEYWORD_SEARCH_TYPE.getTypeID()) {
444 else if (artifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID()) {
447 else if (attribute.getAttributeType().getValueType() == BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
449 }
else if (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_TOOL_OUTPUT.getTypeID()
450 && attributeTypeID == ATTRIBUTE_TYPE.TSK_TEXT.getTypeID()) {
458 String value = attribute.getDisplayString();
459 if (value.length() > 512) {
460 value = value.substring(0, 512);
462 map.put(attribute.getAttributeType().getDisplayName(), value);
465 map.put(attribute.getAttributeType().getDisplayName(), attribute.getDisplayString());
468 }
catch (TskCoreException ex) {
469 LOGGER.log(Level.SEVERE,
"Getting attributes failed", ex);
482 final int attributeTypeID = attribute.getAttributeType().getTypeID();
485 if (attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME_SENT.getTypeID()
486 || attributeTypeID == ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_HTML.getTypeID()
487 || attributeTypeID == ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_RTF.getTypeID()
488 || attributeTypeID == ATTRIBUTE_TYPE.TSK_EMAIL_BCC.getTypeID()
489 || attributeTypeID == ATTRIBUTE_TYPE.TSK_EMAIL_CC.getTypeID()
490 || attributeTypeID == ATTRIBUTE_TYPE.TSK_HEADERS.getTypeID()
495 else if (attributeTypeID == ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_PLAIN.getTypeID()) {
497 String value = attribute.getDisplayString();
498 if (value.length() > 160) {
499 value = value.substring(0, 160) +
"...";
501 map.put(attribute.getAttributeType().getDisplayName(), value);
503 else if (attribute.getAttributeType().getValueType() == BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
507 map.put(attribute.getAttributeType().getDisplayName(), attribute.getDisplayString());
514 return v.
visit(
this);
525 List<Object> forLookup =
new ArrayList<>();
526 forLookup.add(artifact);
530 if (content != null) {
531 forLookup.add(content);
534 return Lookups.fixed(forLookup.toArray(
new Object[forLookup.size()]));
539 return artifact.getSleuthkitCase().getContentById(artifact.getObjectID());
540 }
catch (TskCoreException ex) {
541 LOGGER.log(Level.WARNING,
"Getting file failed", ex);
543 throw new IllegalArgumentException(
554 return getClass().getName();
void fillPropertyMap(Map< String, Object > map, BlackboardArtifact artifact)
static String getStringTime(long epochSeconds, TimeZone tzone)
static boolean hasSupportedTimeStamp(BlackboardArtifact artifact)
final PropertyChangeListener pcl
static void removePropertyChangeListener(PropertyChangeListener listener)
BlackboardArtifactNode(BlackboardArtifact artifact, String iconPath)
static Lookup createLookup(BlackboardArtifact artifact)
static final Integer[] SHOW_FILE_METADATA
T visit(DataSourcesNode in)
Action[] getActions(boolean context)
static Content getAssociatedContent(BlackboardArtifact artifact)
static ViewFileInTimelineAction createViewSourceFileAction(AbstractFile file)
TagsManager getTagsManager()
List< NodeProperty<?extends Object > > customProperties
static final Logger LOGGER
String getRootParentName()
final BlackboardArtifact artifact
void addEmailMsgProperty(Map< String, Object > map, BlackboardAttribute attribute)
SleuthkitCase getSleuthkitCase()
static void addPropertyChangeListener(PropertyChangeListener listener)
BLACKBOARD_ARTIFACT_TAG_ADDED
static void error(String title, String message)
static Case getCurrentCase()
synchronized static Logger getLogger(String name)
void addNodeProperty(NodeProperty<?> np)
BlackboardArtifactNode(BlackboardArtifact artifact)
static final Integer[] SHOW_UNIQUE_PATH
static ViewFileInTimelineAction createViewFileAction(AbstractFile file)
BLACKBOARD_ARTIFACT_TAG_DELETED