Autopsy  4.5.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
TableReportGenerator.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2013-2018 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.report;
20 
21 import com.google.common.collect.ListMultimap;
22 import com.google.common.collect.Lists;
23 import com.google.common.collect.Multimaps;
24 import java.sql.ResultSet;
25 import java.sql.SQLException;
26 import java.util.ArrayList;
27 import java.util.Arrays;
28 import java.util.Collection;
29 import java.util.Collections;
30 import java.util.Comparator;
31 import java.util.HashMap;
32 import java.util.HashSet;
33 import java.util.Iterator;
34 import java.util.List;
35 import java.util.Map;
36 import java.util.Objects;
37 import java.util.Set;
38 import java.util.TreeSet;
39 import java.util.logging.Level;
40 import org.openide.util.NbBundle;
41 import org.sleuthkit.autopsy.casemodule.Case;
42 import org.sleuthkit.autopsy.casemodule.services.TagsManager;
43 import org.sleuthkit.autopsy.coreutils.ImageUtils;
44 import org.sleuthkit.autopsy.coreutils.Logger;
45 import org.sleuthkit.autopsy.datamodel.ContentUtils;
46 import org.sleuthkit.datamodel.AbstractFile;
47 import org.sleuthkit.datamodel.Account;
48 import org.sleuthkit.datamodel.BlackboardArtifact;
49 import org.sleuthkit.datamodel.BlackboardArtifactTag;
50 import org.sleuthkit.datamodel.BlackboardAttribute;
51 import org.sleuthkit.datamodel.BlackboardAttribute.Type;
52 import org.sleuthkit.datamodel.Content;
53 import org.sleuthkit.datamodel.ContentTag;
54 import org.sleuthkit.datamodel.SleuthkitCase;
55 import org.sleuthkit.datamodel.TskCoreException;
56 import org.sleuthkit.datamodel.TskData;
57 
58 class TableReportGenerator {
59 
60  private final List<BlackboardArtifact.Type> artifactTypes = new ArrayList<>();
61  private final HashSet<String> tagNamesFilter = new HashSet<>();
62 
63  private final Set<Content> images = new HashSet<>();
64  private final ReportProgressPanel progressPanel;
65  private final TableReportModule tableReport;
66  private final Map<Integer, List<Column>> columnHeaderMap;
67  private static final Logger logger = Logger.getLogger(TableReportGenerator.class.getName());
68 
69  private final List<String> errorList;
70 
71  TableReportGenerator(Map<BlackboardArtifact.Type, Boolean> artifactTypeSelections, Map<String, Boolean> tagNameSelections, ReportProgressPanel progressPanel, TableReportModule tableReport) {
72 
73  this.progressPanel = progressPanel;
74  this.tableReport = tableReport;
75  this.columnHeaderMap = new HashMap<>();
76  errorList = new ArrayList<>();
77  // Get the artifact types selected by the user.
78  for (Map.Entry<BlackboardArtifact.Type, Boolean> entry : artifactTypeSelections.entrySet()) {
79  if (entry.getValue()) {
80  artifactTypes.add(entry.getKey());
81  }
82  }
83 
84  // Get the tag names selected by the user and make a tag names filter.
85  if (null != tagNameSelections) {
86  for (Map.Entry<String, Boolean> entry : tagNameSelections.entrySet()) {
87  if (entry.getValue() == true) {
88  tagNamesFilter.add(entry.getKey());
89  }
90  }
91  }
92  }
93 
94  protected void execute() {
95  // Start the progress indicators for each active TableReportModule.
96 
97  progressPanel.start();
98  progressPanel.setIndeterminate(false);
99  progressPanel.setMaximumProgress(this.artifactTypes.size() + 2); // +2 for content and blackboard artifact tags
100  // report on the blackboard results
101  if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
102  makeBlackboardArtifactTables();
103  }
104 
105  // report on the tagged files and artifacts
106  if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
107  makeContentTagsTables();
108  }
109 
110  if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
111  makeBlackboardArtifactTagsTables();
112  }
113 
114  if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
115  // report on the tagged images
116  makeThumbnailTable();
117  }
118  }
119 
123  private void makeBlackboardArtifactTables() {
124  // Make a comment string describing the tag names filter in effect.
125  String comment = "";
126  if (!tagNamesFilter.isEmpty()) {
127  comment += NbBundle.getMessage(this.getClass(), "ReportGenerator.artifactTable.taggedResults.text");
128  comment += makeCommaSeparatedList(tagNamesFilter);
129  }
130 
131  // Add a table to the report for every enabled blackboard artifact type.
132  for (BlackboardArtifact.Type type : artifactTypes) {
133  // Check for cancellaton.
134 
135  if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
136  return;
137  }
138 
139  progressPanel.updateStatusLabel(
140  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
141  type.getDisplayName()));
142 
143  // Keyword hits and hashset hit artifacts get special handling.
144  if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
145  writeKeywordHits(tableReport, comment, tagNamesFilter);
146  continue;
147  } else if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
148  writeHashsetHits(tableReport, comment, tagNamesFilter);
149  continue;
150  }
151 
152  List<ArtifactData> artifactList = getFilteredArtifacts(type, tagNamesFilter);
153 
154  if (artifactList.isEmpty()) {
155  continue;
156  }
157 
158  /*
159  * TSK_ACCOUNT artifacts get grouped by their TSK_ACCOUNT_TYPE
160  * attribute, and then handed off to the standard method for writing
161  * tables.
162  */
163  if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
164  //Group account artifacts by their account type
165  ListMultimap<String, ArtifactData> groupedArtifacts = Multimaps.index(artifactList,
166  artifactData -> {
167  try {
168  return artifactData.getArtifact().getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE)).getValueString();
169  } catch (TskCoreException ex) {
170  logger.log(Level.SEVERE, "Unable to get value of TSK_ACCOUNT_TYPE attribute. Defaulting to \"unknown\"", ex);
171  return "unknown";
172  }
173  });
174  for (String accountTypeStr : groupedArtifacts.keySet()) {
175  /*
176  * If the report is a ReportHTML, the data type name
177  * eventualy makes it to useDataTypeIcon which expects but
178  * does not require a artifact name, so we make a synthetic
179  * compund name by appending a ":" and the account type.
180  */
181  String accountDisplayname = accountTypeStr;
182  if (accountTypeStr != null) {
183  try {
184  Account.Type acctType = Case.getCurrentCase().getSleuthkitCase().getCommunicationsManager().getAccountType(accountTypeStr);
185  if (acctType != null) {
186  accountDisplayname = acctType.getDisplayName();
187  }
188  } catch (TskCoreException ex) {
189  logger.log(Level.SEVERE, "Unable to get display name for account type " + accountTypeStr, ex);
190  }
191  }
192 
193  final String compundDataTypeName = BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getDisplayName() + ": " + accountDisplayname;
194  writeTableForDataType(new ArrayList<>(groupedArtifacts.get(accountTypeStr)), type, compundDataTypeName, comment);
195  }
196  } else {
197  //all other artifact types are sent to writeTableForDataType directly
198  writeTableForDataType(artifactList, type, type.getDisplayName(), comment);
199  }
200  }
201  }
202 
213  private void writeTableForDataType(List<ArtifactData> artifactList, BlackboardArtifact.Type type, String tableName, String comment) {
214  /*
215  * Make a sorted set of all of the attribute types that are on any of
216  * the given artifacts.
217  */
218  Set<BlackboardAttribute.Type> attrTypeSet = new TreeSet<>(Comparator.comparing(BlackboardAttribute.Type::getDisplayName));
219  for (ArtifactData data : artifactList) {
220  List<BlackboardAttribute> attributes = data.getAttributes();
221  for (BlackboardAttribute attribute : attributes) {
222  attrTypeSet.add(attribute.getAttributeType());
223  }
224  }
225  /*
226  * Get the columns appropriate for the artifact type. This is used to
227  * get the data that will be in the cells below based on type, and
228  * display the column headers.
229  */
230  List<Column> columns = getArtifactTableColumns(type.getTypeID(), attrTypeSet);
231  if (columns.isEmpty()) {
232  return;
233  }
234  columnHeaderMap.put(type.getTypeID(), columns);
235 
236  /*
237  * The artifact list is sorted now, as getting the row data is dependent
238  * on having the columns, which is necessary for sorting.
239  */
240  Collections.sort(artifactList);
241 
242  tableReport.startDataType(tableName, comment);
243  tableReport.startTable(Lists.transform(columns, Column::getColumnHeader));
244 
245  for (ArtifactData artifactData : artifactList) {
246  // Get the row data for this artifact, and has the
247  // module add it.
248  List<String> rowData = artifactData.getRow();
249  if (rowData.isEmpty()) {
250  return;
251  }
252 
253  tableReport.addRow(rowData);
254  }
255  // Finish up this data type
256  progressPanel.increment();
257  tableReport.endTable();
258  tableReport.endDataType();
259  }
260 
264  @SuppressWarnings("deprecation")
265  private void makeContentTagsTables() {
266 
267  // Get the content tags.
268  List<ContentTag> tags;
269  try {
270  tags = Case.getCurrentCase().getServices().getTagsManager().getAllContentTags();
271  } catch (TskCoreException ex) {
272  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetContentTags"));
273  logger.log(Level.SEVERE, "failed to get content tags", ex); //NON-NLS
274  return;
275  }
276 
277  // Tell the modules reporting on content tags is beginning.
278  // @@@ This casting is a tricky little workaround to allow the HTML report module to slip in a content hyperlink.
279  // @@@ Alos Using the obsolete ARTIFACT_TYPE.TSK_TAG_FILE is also an expedient hack.
280  progressPanel.updateStatusLabel(
281  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
282  BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName()));
283  ArrayList<String> columnHeaders = new ArrayList<>(Arrays.asList(
284  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.tag"),
285  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.file"),
286  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.comment"),
287  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.timeModified"),
288  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.timeChanged"),
289  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.timeAccessed"),
290  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.timeCreated"),
291  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.size"),
292  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.hash")));
293 
294  StringBuilder comment = new StringBuilder();
295  if (!tagNamesFilter.isEmpty()) {
296  comment.append(
297  NbBundle.getMessage(this.getClass(), "ReportGenerator.makeContTagTab.taggedFiles.msg"));
298  comment.append(makeCommaSeparatedList(tagNamesFilter));
299  }
300  if (tableReport instanceof ReportHTML) {
301  ReportHTML htmlReportModule = (ReportHTML) tableReport;
302  htmlReportModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
303  htmlReportModule.startContentTagsTable(columnHeaders);
304  } else {
305  tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
306  tableReport.startTable(columnHeaders);
307  }
308 
309  // Give the modules the rows for the content tags.
310  for (ContentTag tag : tags) {
311  // skip tags that we are not reporting on
312  String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : "";
313  if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) == false) {
314  continue;
315  }
316 
317  String fileName;
318  try {
319  fileName = tag.getContent().getUniquePath();
320  } catch (TskCoreException ex) {
321  fileName = tag.getContent().getName();
322  }
323 
324  ArrayList<String> rowData = new ArrayList<>(Arrays.asList(tag.getName().getDisplayName() + notableString, fileName, tag.getComment()));
325  Content content = tag.getContent();
326  if (content instanceof AbstractFile) {
327  AbstractFile file = (AbstractFile) content;
328 
329  // Add metadata about the file to HTML output
330  rowData.add(file.getMtimeAsDate());
331  rowData.add(file.getCtimeAsDate());
332  rowData.add(file.getAtimeAsDate());
333  rowData.add(file.getCrtimeAsDate());
334  rowData.add(Long.toString(file.getSize()));
335  rowData.add(file.getMd5Hash());
336  }
337  // @@@ This casting is a tricky little workaround to allow the HTML report module to slip in a content hyperlink.
338  if (tableReport instanceof ReportHTML) {
339  ReportHTML htmlReportModule = (ReportHTML) tableReport;
340  htmlReportModule.addRowWithTaggedContentHyperlink(rowData, tag);
341  } else {
342  tableReport.addRow(rowData);
343  }
344 
345  // see if it is for an image so that we later report on it
346  checkIfTagHasImage(tag);
347  }
348 
349  // The the modules content tags reporting is ended.
350  progressPanel.increment();
351  tableReport.endTable();
352  tableReport.endDataType();
353  }
354 
358  @SuppressWarnings("deprecation")
359  private void makeBlackboardArtifactTagsTables() {
360 
361  List<BlackboardArtifactTag> tags;
362  try {
363  tags = Case.getCurrentCase().getServices().getTagsManager().getAllBlackboardArtifactTags();
364  } catch (TskCoreException ex) {
365  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetBBArtifactTags"));
366  logger.log(Level.SEVERE, "failed to get blackboard artifact tags", ex); //NON-NLS
367  return;
368  }
369 
370  // Tell the modules reporting on blackboard artifact tags data type is beginning.
371  // @@@ Using the obsolete ARTIFACT_TYPE.TSK_TAG_ARTIFACT is an expedient hack.
372  progressPanel.updateStatusLabel(
373  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
374  BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName()));
375  StringBuilder comment = new StringBuilder();
376  if (!tagNamesFilter.isEmpty()) {
377  comment.append(
378  NbBundle.getMessage(this.getClass(), "ReportGenerator.makeBbArtTagTab.taggedRes.msg"));
379  comment.append(makeCommaSeparatedList(tagNamesFilter));
380  }
381  tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName(), comment.toString());
382  tableReport.startTable(new ArrayList<>(Arrays.asList(
383  NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.resultType"),
384  NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.tag"),
385  NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.comment"),
386  NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.srcFile"))));
387 
388  // Give the modules the rows for the content tags.
389  for (BlackboardArtifactTag tag : tags) {
390  String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : "";
391  if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) == false) {
392  continue;
393  }
394 
395  List<String> row;
396  row = new ArrayList<>(Arrays.asList(tag.getArtifact().getArtifactTypeName(), tag.getName().getDisplayName() + notableString, tag.getComment(), tag.getContent().getName()));
397  tableReport.addRow(row);
398 
399  // check if the tag is an image that we should later make a thumbnail for
400  checkIfTagHasImage(tag);
401  }
402 
403  // The the modules blackboard artifact tags reporting is ended.
404  progressPanel.increment();
405  tableReport.endTable();
406  tableReport.endDataType();
407  }
408 
416  private boolean passesTagNamesFilter(String tagName) {
417  return tagNamesFilter.isEmpty() || tagNamesFilter.contains(tagName);
418  }
419 
423  private void makeThumbnailTable() {
424  progressPanel.updateStatusLabel(
425  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.createdThumb.text"));
426 
427  if (tableReport instanceof ReportHTML) {
428  ReportHTML htmlModule = (ReportHTML) tableReport;
429  htmlModule.startDataType(
430  NbBundle.getMessage(this.getClass(), "ReportGenerator.thumbnailTable.name"),
431  NbBundle.getMessage(this.getClass(), "ReportGenerator.thumbnailTable.desc"));
432  List<String> emptyHeaders = new ArrayList<>();
433  for (int i = 0; i < ReportHTML.THUMBNAIL_COLUMNS; i++) {
434  emptyHeaders.add("");
435  }
436  htmlModule.startTable(emptyHeaders);
437 
438  htmlModule.addThumbnailRows(images);
439 
440  htmlModule.endTable();
441  htmlModule.endDataType();
442  }
443 
444  }
445 
452  private void checkIfTagHasImage(BlackboardArtifactTag artifactTag) {
453  AbstractFile file;
454  try {
455  file = Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(artifactTag.getArtifact().getObjectID());
456  } catch (TskCoreException ex) {
457  errorList.add(
458  NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.errGetContentFromBBArtifact"));
459  logger.log(Level.WARNING, "Error while getting content from a blackboard artifact to report on.", ex); //NON-NLS
460  return;
461  }
462 
463  if (file != null) {
464  checkIfFileIsImage(file);
465  }
466  }
467 
475  private void checkIfTagHasImage(ContentTag contentTag) {
476  Content c = contentTag.getContent();
477  if (c instanceof AbstractFile == false) {
478  return;
479  }
480  checkIfFileIsImage((AbstractFile) c);
481  }
482 
488  private void checkIfFileIsImage(AbstractFile file) {
489 
490  if (file.isDir()
491  || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS
492  || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS) {
493  return;
494  }
495 
496  if (ImageUtils.thumbnailSupported(file)) {
497  images.add(file);
498  }
499  }
500 
509  private String makeCommaSeparatedList(Collection<String> items) {
510  String list = "";
511  for (Iterator<String> iterator = items.iterator(); iterator.hasNext();) {
512  list += iterator.next() + (iterator.hasNext() ? ", " : "");
513  }
514  return list;
515  }
516 
522  @SuppressWarnings("deprecation")
523  private void writeKeywordHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
524 
525  // Query for keyword lists-only so that we can tell modules what lists
526  // will exist for their index.
527  // @@@ There is a bug in here. We should use the tags in the below code
528  // so that we only report the lists that we will later provide with real
529  // hits. If no keyord hits are tagged, then we make the page for nothing.
530  String orderByClause;
531  if (Case.getCurrentCase().getCaseType() == Case.CaseType.MULTI_USER_CASE) {
532  orderByClause = "ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST"; //NON-NLS
533  } else {
534  orderByClause = "ORDER BY list ASC"; //NON-NLS
535  }
536  String keywordListQuery
537  = "SELECT att.value_text AS list "
538  + //NON-NLS
539  "FROM blackboard_attributes AS att, blackboard_artifacts AS art "
540  + //NON-NLS
541  "WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + " "
542  + //NON-NLS
543  "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() + " "
544  + //NON-NLS
545  "AND att.artifact_id = art.artifact_id "
546  + //NON-NLS
547  "GROUP BY list " + orderByClause; //NON-NLS
548 
549  try (SleuthkitCase.CaseDbQuery dbQuery = Case.getCurrentCase().getSleuthkitCase().executeQuery(keywordListQuery)) {
550  ResultSet listsRs = dbQuery.getResultSet();
551  List<String> lists = new ArrayList<>();
552  while (listsRs.next()) {
553  String list = listsRs.getString("list"); //NON-NLS
554  if (list.isEmpty()) {
555  list = NbBundle.getMessage(this.getClass(), "ReportGenerator.writeKwHits.userSrchs");
556  }
557  lists.add(list);
558  }
559 
560  // Make keyword data type and give them set index
561  tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), comment);
562  tableModule.addSetIndex(lists);
563  progressPanel.updateStatusLabel(
564  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
565  BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName()));
566  } catch (TskCoreException | SQLException ex) {
567  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryKWLists"));
568  logger.log(Level.SEVERE, "Failed to query keyword lists: ", ex); //NON-NLS
569  return;
570  }
571 
572  if (Case.getCurrentCase().getCaseType() == Case.CaseType.MULTI_USER_CASE) {
573  orderByClause = "ORDER BY convert_to(att3.value_text, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
574  + "convert_to(att1.value_text, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
575  + "convert_to(f.parent_path, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
576  + "convert_to(f.name, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
577  + "convert_to(att2.value_text, 'SQL_ASCII') ASC NULLS FIRST"; //NON-NLS
578  } else {
579  orderByClause = "ORDER BY list ASC, keyword ASC, parent_path ASC, name ASC, preview ASC"; //NON-NLS
580  }
581  // Query for keywords, grouped by list
582  String keywordsQuery
583  = "SELECT art.artifact_id, art.obj_id, att1.value_text AS keyword, att2.value_text AS preview, att3.value_text AS list, f.name AS name, f.parent_path AS parent_path "
584  + //NON-NLS
585  "FROM blackboard_artifacts AS art, blackboard_attributes AS att1, blackboard_attributes AS att2, blackboard_attributes AS att3, tsk_files AS f "
586  + //NON-NLS
587  "WHERE (att1.artifact_id = art.artifact_id) "
588  + //NON-NLS
589  "AND (att2.artifact_id = art.artifact_id) "
590  + //NON-NLS
591  "AND (att3.artifact_id = art.artifact_id) "
592  + //NON-NLS
593  "AND (f.obj_id = art.obj_id) "
594  + //NON-NLS
595  "AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID() + ") "
596  + //NON-NLS
597  "AND (att2.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID() + ") "
598  + //NON-NLS
599  "AND (att3.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + ") "
600  + //NON-NLS
601  "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() + ") "
602  + //NON-NLS
603  orderByClause; //NON-NLS
604 
605  try (SleuthkitCase.CaseDbQuery dbQuery = Case.getCurrentCase().getSleuthkitCase().executeQuery(keywordsQuery)) {
606  ResultSet resultSet = dbQuery.getResultSet();
607 
608  String currentKeyword = "";
609  String currentList = "";
610  while (resultSet.next()) {
611  // Check to see if all the TableReportModules have been canceled
612  if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
613  break;
614  }
615 
616  // Get any tags that associated with this artifact and apply the tag filter.
617  HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong("artifact_id")); //NON-NLS
618  if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
619  continue;
620  }
621  String tagsList = makeCommaSeparatedList(uniqueTagNames);
622 
623  Long objId = resultSet.getLong("obj_id"); //NON-NLS
624  String keyword = resultSet.getString("keyword"); //NON-NLS
625  String preview = resultSet.getString("preview"); //NON-NLS
626  String list = resultSet.getString("list"); //NON-NLS
627  String uniquePath = "";
628 
629  try {
630  AbstractFile f = Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(objId);
631  if (f != null) {
632  uniquePath = Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
633  }
634  } catch (TskCoreException ex) {
635  errorList.add(
636  NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileByID"));
637  logger.log(Level.WARNING, "Failed to get Abstract File by ID.", ex); //NON-NLS
638  }
639 
640  // If the lists aren't the same, we've started a new list
641  if ((!list.equals(currentList) && !list.isEmpty()) || (list.isEmpty() && !currentList.equals(
642  NbBundle.getMessage(this.getClass(), "ReportGenerator.writeKwHits.userSrchs")))) {
643  if (!currentList.isEmpty()) {
644  tableModule.endTable();
645  tableModule.endSet();
646  }
647  currentList = list.isEmpty() ? NbBundle
648  .getMessage(this.getClass(), "ReportGenerator.writeKwHits.userSrchs") : list;
649  currentKeyword = ""; // reset the current keyword because it's a new list
650  tableModule.startSet(currentList);
651  progressPanel.updateStatusLabel(
652  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processingList",
653  BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), currentList));
654  }
655  if (!keyword.equals(currentKeyword)) {
656  if (!currentKeyword.equals("")) {
657  tableModule.endTable();
658  }
659  currentKeyword = keyword;
660  tableModule.addSetElement(currentKeyword);
661  List<String> columnHeaderNames = new ArrayList<>();
662  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.preview"));
663  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.srcFile"));
664  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags"));
665  tableModule.startTable(columnHeaderNames);
666  }
667 
668  tableModule.addRow(Arrays.asList(new String[]{preview, uniquePath, tagsList}));
669  }
670 
671  // Finish the current data type
672  progressPanel.increment();
673  tableModule.endDataType();
674  } catch (TskCoreException | SQLException ex) {
675  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryKWs"));
676  logger.log(Level.SEVERE, "Failed to query keywords: ", ex); //NON-NLS
677  }
678  }
679 
685  @SuppressWarnings("deprecation")
686  private void writeHashsetHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
687  String orderByClause;
688  if (Case.getCurrentCase().getCaseType() == Case.CaseType.MULTI_USER_CASE) {
689  orderByClause = "ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST"; //NON-NLS
690  } else {
691  orderByClause = "ORDER BY att.value_text ASC"; //NON-NLS
692  }
693  String hashsetsQuery
694  = "SELECT att.value_text AS list "
695  + //NON-NLS
696  "FROM blackboard_attributes AS att, blackboard_artifacts AS art "
697  + //NON-NLS
698  "WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + " "
699  + //NON-NLS
700  "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() + " "
701  + //NON-NLS
702  "AND att.artifact_id = art.artifact_id "
703  + //NON-NLS
704  "GROUP BY list " + orderByClause; //NON-NLS
705 
706  try (SleuthkitCase.CaseDbQuery dbQuery = Case.getCurrentCase().getSleuthkitCase().executeQuery(hashsetsQuery)) {
707  // Query for hashsets
708  ResultSet listsRs = dbQuery.getResultSet();
709  List<String> lists = new ArrayList<>();
710  while (listsRs.next()) {
711  lists.add(listsRs.getString("list")); //NON-NLS
712  }
713 
714  tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), comment);
715  tableModule.addSetIndex(lists);
716  progressPanel.updateStatusLabel(
717  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
718  BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName()));
719  } catch (TskCoreException | SQLException ex) {
720  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryHashsetLists"));
721  logger.log(Level.SEVERE, "Failed to query hashset lists: ", ex); //NON-NLS
722  return;
723  }
724 
725  if (Case.getCurrentCase().getCaseType() == Case.CaseType.MULTI_USER_CASE) {
726  orderByClause = "ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
727  + "convert_to(f.parent_path, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
728  + "convert_to(f.name, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
729  + "size ASC NULLS FIRST"; //NON-NLS
730  } else {
731  orderByClause = "ORDER BY att.value_text ASC, f.parent_path ASC, f.name ASC, size ASC"; //NON-NLS
732  }
733  String hashsetHitsQuery
734  = "SELECT art.artifact_id, art.obj_id, att.value_text AS setname, f.name AS name, f.size AS size, f.parent_path AS parent_path "
735  + //NON-NLS
736  "FROM blackboard_artifacts AS art, blackboard_attributes AS att, tsk_files AS f "
737  + //NON-NLS
738  "WHERE (att.artifact_id = art.artifact_id) "
739  + //NON-NLS
740  "AND (f.obj_id = art.obj_id) "
741  + //NON-NLS
742  "AND (att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + ") "
743  + //NON-NLS
744  "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() + ") "
745  + //NON-NLS
746  orderByClause; //NON-NLS
747 
748  try (SleuthkitCase.CaseDbQuery dbQuery = Case.getCurrentCase().getSleuthkitCase().executeQuery(hashsetHitsQuery)) {
749  // Query for hashset hits
750  ResultSet resultSet = dbQuery.getResultSet();
751  String currentSet = "";
752  while (resultSet.next()) {
753  // Check to see if all the TableReportModules have been canceled
754  if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
755  break;
756  }
757 
758  // Get any tags that associated with this artifact and apply the tag filter.
759  HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong("artifact_id")); //NON-NLS
760  if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
761  continue;
762  }
763  String tagsList = makeCommaSeparatedList(uniqueTagNames);
764 
765  Long objId = resultSet.getLong("obj_id"); //NON-NLS
766  String set = resultSet.getString("setname"); //NON-NLS
767  String size = resultSet.getString("size"); //NON-NLS
768  String uniquePath = "";
769 
770  try {
771  AbstractFile f = Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(objId);
772  if (f != null) {
773  uniquePath = Case.getCurrentCase().getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
774  }
775  } catch (TskCoreException ex) {
776  errorList.add(
777  NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileFromID"));
778  logger.log(Level.WARNING, "Failed to get Abstract File from ID.", ex); //NON-NLS
779  return;
780  }
781 
782  // If the sets aren't the same, we've started a new set
783  if (!set.equals(currentSet)) {
784  if (!currentSet.isEmpty()) {
785  tableModule.endTable();
786  tableModule.endSet();
787  }
788  currentSet = set;
789  tableModule.startSet(currentSet);
790  List<String> columnHeaderNames = new ArrayList<>();
791  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.file"));
792  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.size"));
793  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags"));
794  tableModule.startTable(columnHeaderNames);
795  progressPanel.updateStatusLabel(
796  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processingList",
797  BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), currentSet));
798  }
799 
800  // Add a row for this hit to every module
801  tableModule.addRow(Arrays.asList(new String[]{uniquePath, size, tagsList}));
802  }
803 
804  // Finish the current data type
805  progressPanel.increment();
806  tableModule.endDataType();
807  } catch (TskCoreException | SQLException ex) {
808  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryHashsetHits"));
809  logger.log(Level.SEVERE, "Failed to query hashsets hits: ", ex); //NON-NLS
810  }
811  }
812 
816  List<String> getErrorList() {
817  return errorList;
818  }
819 
824  private class ArtifactData implements Comparable<ArtifactData> {
825 
826  private BlackboardArtifact artifact;
827  private List<BlackboardAttribute> attributes;
828  private HashSet<String> tags;
829  private List<String> rowData = null;
830  private Content content;
831 
832  ArtifactData(BlackboardArtifact artifact, List<BlackboardAttribute> attrs, HashSet<String> tags) {
833  this.artifact = artifact;
834  this.attributes = attrs;
835  this.tags = tags;
836  try {
837  this.content = Case.getCurrentCase().getSleuthkitCase().getContentById(artifact.getObjectID());
838  } catch (TskCoreException ex) {
839  logger.log(Level.SEVERE, "Could not get content from database");
840  }
841  }
842 
843  public BlackboardArtifact getArtifact() {
844  return artifact;
845  }
846 
847  public List<BlackboardAttribute> getAttributes() {
848  return attributes;
849  }
850 
851  public HashSet<String> getTags() {
852  return tags;
853  }
854 
855  public long getArtifactID() {
856  return artifact.getArtifactID();
857  }
858 
859  public long getObjectID() {
860  return artifact.getObjectID();
861  }
862 
866  public Content getContent() {
867  return content;
868  }
869 
879  @Override
880  public int compareTo(ArtifactData otherArtifactData) {
881  List<String> thisRow = getRow();
882  List<String> otherRow = otherArtifactData.getRow();
883  for (int i = 0; i < thisRow.size(); i++) {
884  int compare = thisRow.get(i).compareTo(otherRow.get(i));
885  if (compare != 0) {
886  return compare;
887  }
888  }
889  return ((Long) this.getArtifactID()).compareTo(otherArtifactData.getArtifactID());
890  }
891 
899  public List<String> getRow() {
900  if (rowData == null) {
901  try {
902  rowData = getOrderedRowDataAsStrings();
903  // If else is done so that row data is not set before
904  // columns are added to the hash map.
905  if (rowData.size() > 0) {
906  // replace null values if attribute was not defined
907  for (int i = 0; i < rowData.size(); i++) {
908  if (rowData.get(i) == null) {
909  rowData.set(i, "");
910  }
911  }
912  } else {
913  rowData = null;
914  return new ArrayList<>();
915  }
916  } catch (TskCoreException ex) {
917  errorList.add(
918  NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.coreExceptionWhileGenRptRow"));
919  logger.log(Level.WARNING, "Core exception while generating row data for artifact report.", ex); //NON-NLS
920  rowData = Collections.<String>emptyList();
921  }
922  }
923  return rowData;
924  }
925 
935  private List<String> getOrderedRowDataAsStrings() throws TskCoreException {
936 
937  List<String> orderedRowData = new ArrayList<>();
938  if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() == getArtifact().getArtifactTypeID()) {
939  if (content != null && content instanceof AbstractFile) {
940  AbstractFile file = (AbstractFile) content;
941  orderedRowData.add(file.getName());
942  orderedRowData.add(file.getNameExtension());
943  String mimeType = file.getMIMEType();
944  if (mimeType == null) {
945  orderedRowData.add("");
946  } else {
947  orderedRowData.add(mimeType);
948  }
949  orderedRowData.add(file.getUniquePath());
950  } else {
951  // Make empty rows to make sure the formatting is correct
952  orderedRowData.add(null);
953  orderedRowData.add(null);
954  orderedRowData.add(null);
955  orderedRowData.add(null);
956  }
957  orderedRowData.add(makeCommaSeparatedList(getTags()));
958 
959  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == getArtifact().getArtifactTypeID()) {
960  String[] attributeDataArray = new String[3];
961  // Array is used so that order of the attributes is maintained.
962  for (BlackboardAttribute attr : attributes) {
963  if (attr.getAttributeType().equals(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME))) {
964  attributeDataArray[0] = attr.getDisplayString();
965  } else if (attr.getAttributeType().equals(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY))) {
966  attributeDataArray[1] = attr.getDisplayString();
967  }
968  }
969 
970  attributeDataArray[2] = content.getUniquePath();
971  orderedRowData.addAll(Arrays.asList(attributeDataArray));
972 
973  HashSet<String> allTags = getTags();
974  try {
975  List<ContentTag> contentTags = Case.getCurrentCase().getServices().getTagsManager().getContentTagsByContent(content);
976  for (ContentTag ct : contentTags) {
977  String notableString = ct.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : "";
978  allTags.add(ct.getName().getDisplayName() + notableString);
979  }
980  } catch (TskCoreException ex) {
981  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetContentTags"));
982  logger.log(Level.SEVERE, "Failed to get content tags", ex); //NON-NLS
983  }
984  orderedRowData.add(makeCommaSeparatedList(allTags));
985 
986  } else if (columnHeaderMap.containsKey(this.artifact.getArtifactTypeID())) {
987 
988  for (Column currColumn : columnHeaderMap.get(this.artifact.getArtifactTypeID())) {
989  String cellData = currColumn.getCellData(this);
990  orderedRowData.add(cellData);
991  }
992  }
993 
994  return orderedRowData;
995  }
996 
997  }
998 
1008  private List<ArtifactData> getFilteredArtifacts(BlackboardArtifact.Type type, HashSet<String> tagNamesFilter) {
1009  List<ArtifactData> artifacts = new ArrayList<>();
1010  try {
1011  for (BlackboardArtifact artifact : Case.getCurrentCase().getSleuthkitCase().getBlackboardArtifacts(type.getTypeID())) {
1012  List<BlackboardArtifactTag> tags = Case.getCurrentCase().getServices().getTagsManager().getBlackboardArtifactTagsByArtifact(artifact);
1013  HashSet<String> uniqueTagNames = new HashSet<>();
1014  for (BlackboardArtifactTag tag : tags) {
1015  String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : "";
1016  uniqueTagNames.add(tag.getName().getDisplayName() + notableString);
1017  }
1018  if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
1019  continue;
1020  }
1021  try {
1022  artifacts.add(new ArtifactData(artifact, Case.getCurrentCase().getSleuthkitCase().getBlackboardAttributes(artifact), uniqueTagNames));
1023  } catch (TskCoreException ex) {
1024  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetBBAttribs"));
1025  logger.log(Level.SEVERE, "Failed to get Blackboard Attributes when generating report.", ex); //NON-NLS
1026  }
1027  }
1028  } catch (TskCoreException ex) {
1029  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetBBArtifacts"));
1030  logger.log(Level.SEVERE, "Failed to get Blackboard Artifacts when generating report.", ex); //NON-NLS
1031  }
1032  return artifacts;
1033  }
1034 
1035  private Boolean failsTagFilter(HashSet<String> tagNames, HashSet<String> tagsNamesFilter) {
1036  if (null == tagsNamesFilter || tagsNamesFilter.isEmpty()) {
1037  return false;
1038  }
1039 
1040  HashSet<String> filteredTagNames = new HashSet<>(tagNames);
1041  filteredTagNames.retainAll(tagsNamesFilter);
1042  return filteredTagNames.isEmpty();
1043  }
1044 
1055  private List<Column> getArtifactTableColumns(int artifactTypeId, Set<BlackboardAttribute.Type> attributeTypeSet) {
1056  ArrayList<Column> columns = new ArrayList<>();
1057 
1058  // Long switch statement to retain ordering of attribute types that are
1059  // attached to pre-defined artifact types.
1060  if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID() == artifactTypeId) {
1061  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.url"),
1062  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1063 
1064  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.title"),
1065  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1066 
1067  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateCreated"),
1068  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1069 
1070  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1071  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1072 
1073  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID() == artifactTypeId) {
1074  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.url"),
1075  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1076 
1077  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1078  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1079 
1080  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1081  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1082 
1083  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.value"),
1084  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE)));
1085 
1086  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1087  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1088 
1089  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID() == artifactTypeId) {
1090  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.url"),
1091  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1092 
1093  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateAccessed"),
1094  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1095 
1096  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.referrer"),
1097  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REFERRER)));
1098 
1099  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.title"),
1100  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1101 
1102  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1103  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1104 
1105  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.urlDomainDecoded"),
1106  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL_DECODED)));
1107 
1108  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifactTypeId) {
1109  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dest"),
1110  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1111 
1112  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.sourceUrl"),
1113  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1114 
1115  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateAccessed"),
1116  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1117 
1118  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1119  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1120 
1121  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == artifactTypeId) {
1122  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.path"),
1123  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1124 
1125  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1126  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1127 
1128  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID() == artifactTypeId) {
1129  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.progName"),
1130  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1131 
1132  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.instDateTime"),
1133  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1134 
1135  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() == artifactTypeId) {
1136  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.preview")));
1137 
1138  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() == artifactTypeId) {
1139  columns.add(new SourceFileColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.file")));
1140 
1141  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.size")));
1142 
1143  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID() == artifactTypeId) {
1144  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.devMake"),
1145  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1146 
1147  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.devModel"),
1148  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1149 
1150  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.deviceId"),
1151  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1152 
1153  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1154  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1155 
1156  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID() == artifactTypeId) {
1157  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.text"),
1158  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1159 
1160  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.domain"),
1161  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)));
1162 
1163  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateAccessed"),
1164  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1165 
1166  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.progName"),
1167  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1168 
1169  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID() == artifactTypeId) {
1170  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTaken"),
1171  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1172 
1173  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.devManufacturer"),
1174  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1175 
1176  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.devModel"),
1177  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1178 
1179  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitude"),
1180  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1181 
1182  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitude"),
1183  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1184 
1185  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.altitude"),
1186  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1187 
1188  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID() == artifactTypeId) {
1189  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.personName"),
1190  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1191 
1192  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.phoneNumber"),
1193  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1194 
1195  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.phoneNumHome"),
1196  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_HOME)));
1197 
1198  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.phoneNumOffice"),
1199  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_OFFICE)));
1200 
1201  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.phoneNumMobile"),
1202  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_MOBILE)));
1203 
1204  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.email"),
1205  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL)));
1206 
1207  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() == artifactTypeId) {
1208  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.msgType"),
1209  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)));
1210 
1211  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.direction"),
1212  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1213 
1214  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.readStatus"),
1215  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_READ_STATUS)));
1216 
1217  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1218  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1219 
1220  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.fromPhoneNum"),
1221  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1222 
1223  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.fromEmail"),
1224  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1225 
1226  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.toPhoneNum"),
1227  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1228 
1229  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.toEmail"),
1230  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1231 
1232  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.subject"),
1233  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1234 
1235  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.text"),
1236  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1237 
1238  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID() == artifactTypeId) {
1239  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.personName"),
1240  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1241 
1242  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.fromPhoneNum"),
1243  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1244 
1245  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.toPhoneNum"),
1246  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1247 
1248  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1249  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1250 
1251  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.direction"),
1252  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1253 
1254  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID() == artifactTypeId) {
1255  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.calendarEntryType"),
1256  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CALENDAR_ENTRY_TYPE)));
1257 
1258  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.description"),
1259  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1260 
1261  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.startDateTime"),
1262  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1263 
1264  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.endDateTime"),
1265  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_END)));
1266 
1267  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.location"),
1268  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1269 
1270  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID() == artifactTypeId) {
1271  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.shortCut"),
1272  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SHORTCUT)));
1273 
1274  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.personName"),
1275  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME_PERSON)));
1276 
1277  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.phoneNumber"),
1278  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1279 
1280  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID() == artifactTypeId) {
1281  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.deviceName"),
1282  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_NAME)));
1283 
1284  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.deviceAddress"),
1285  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1286 
1287  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1288  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1289 
1290  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID() == artifactTypeId) {
1291  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitude"),
1292  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1293 
1294  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitude"),
1295  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1296 
1297  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1298  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1299 
1300  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID() == artifactTypeId) {
1301  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitude"),
1302  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1303 
1304  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitude"),
1305  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1306 
1307  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.altitude"),
1308  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1309 
1310  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1311  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1312 
1313  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.locationAddress"),
1314  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1315 
1316  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1317  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1318 
1319  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID() == artifactTypeId) {
1320  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitude"),
1321  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1322 
1323  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitude"),
1324  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1325 
1326  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.altitude"),
1327  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1328 
1329  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1330  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1331 
1332  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.locationAddress"),
1333  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1334 
1335  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1336  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1337 
1338  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID() == artifactTypeId) {
1339  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitude"),
1340  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1341 
1342  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitude"),
1343  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1344 
1345  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.altitude"),
1346  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1347 
1348  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1349  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1350 
1351  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.locationAddress"),
1352  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1353 
1354  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1355  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1356 
1357  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID() == artifactTypeId) {
1358  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.category"),
1359  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1360 
1361  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.userId"),
1362  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1363 
1364  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.password"),
1365  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PASSWORD)));
1366 
1367  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.personName"),
1368  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1369 
1370  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.appName"),
1371  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1372 
1373  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.url"),
1374  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1375 
1376  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.appPath"),
1377  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1378 
1379  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.description"),
1380  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1381 
1382  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.replytoAddress"),
1383  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_REPLYTO)));
1384 
1385  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.mailServer"),
1386  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SERVER_NAME)));
1387 
1388  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID() == artifactTypeId ||
1389  BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID() == artifactTypeId) {
1390  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1391  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1392 
1393  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() == artifactTypeId) {
1394  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.file")));
1395 
1396  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.extension.text")));
1397 
1398  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.mimeType.text")));
1399 
1400  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.path")));
1401 
1402  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID() == artifactTypeId) {
1403  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.processorArchitecture.text"),
1404  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROCESSOR_ARCHITECTURE)));
1405 
1406  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.osName.text"),
1407  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1408 
1409  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.osInstallDate.text"),
1410  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1411 
1412  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == artifactTypeId) {
1413  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskEmailTo"),
1414  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1415 
1416  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskEmailFrom"),
1417  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1418 
1419  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskSubject"),
1420  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1421 
1422  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskDateTimeSent"),
1423  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)));
1424 
1425  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskDateTimeRcvd"),
1426  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_RCVD)));
1427 
1428  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskPath"),
1429  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1430 
1431  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskEmailCc"),
1432  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_CC)));
1433 
1434  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskEmailBcc"),
1435  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_BCC)));
1436 
1437  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskMsgId"),
1438  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MSG_ID)));
1439 
1440  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == artifactTypeId) {
1441  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskSetName"),
1442  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1443 
1444  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskInterestingFilesCategory"),
1445  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1446 
1447  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskPath"),
1448  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1449 
1450  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_ROUTE.getTypeID() == artifactTypeId) {
1451  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskGpsRouteCategory"),
1452  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1453 
1454  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1455  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1456 
1457  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitudeEnd"),
1458  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END)));
1459 
1460  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitudeEnd"),
1461  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END)));
1462 
1463  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitudeStart"),
1464  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START)));
1465 
1466  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitudeStart"),
1467  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START)));
1468 
1469  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1470  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1471 
1472  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.location"),
1473  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1474 
1475  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1476  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1477 
1478  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == artifactTypeId) {
1479  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskSetName"),
1480  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1481 
1482  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.associatedArtifact"),
1483  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1484 
1485  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1486  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1487 
1488  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == artifactTypeId) {
1489  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1490  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1491 
1492  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.associatedArtifact"),
1493  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1494 
1495  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1496  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1497 
1498  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.count"),
1499  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COUNT)));
1500 
1501  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_ACCOUNT.getTypeID() == artifactTypeId) {
1502  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.userName"),
1503  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME)));
1504 
1505  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.userId"),
1506  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1507 
1508  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_REMOTE_DRIVE.getTypeID() == artifactTypeId) {
1509  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.localPath"),
1510  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCAL_PATH)));
1511 
1512  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.remotePath"),
1513  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REMOTE_PATH)));
1514  } else if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
1515  columns.add(new StatusColumn());
1516  attributeTypeSet.remove(new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE));
1517  attributeTypeSet.remove(new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
1518  attributeTypeSet.remove(new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME));
1519  attributeTypeSet.remove(new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_SEARCH_DOCUMENT_ID));
1520  } else {
1521  // This is the case that it is a custom type. The reason an else is
1522  // necessary is to make sure that the source file column is added
1523  for (BlackboardAttribute.Type type : attributeTypeSet) {
1524  columns.add(new AttributeColumn(type.getDisplayName(), type));
1525  }
1526  columns.add(new SourceFileColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.srcFile")));
1527  columns.add(new TaggedResultsColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags")));
1528 
1529  // Short circuits to guarantee that the attribute types aren't added
1530  // twice.
1531  return columns;
1532  }
1533  // If it is an attribute column, it removes the attribute type of that
1534  // column from the set, so types are not reported more than once.
1535  for (Column column : columns) {
1536  attributeTypeSet = column.removeTypeFromSet(attributeTypeSet);
1537  }
1538  // Now uses the remaining types in the set to construct columns
1539  for (BlackboardAttribute.Type type : attributeTypeSet) {
1540  columns.add(new AttributeColumn(type.getDisplayName(), type));
1541  }
1542  // Source file column is added here for ordering purposes.
1543  if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()
1544  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()
1545  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()
1546  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()
1547  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()
1548  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()
1549  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()
1550  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID()
1551  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID()
1552  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID()
1553  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()
1554  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID()
1555  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID()
1556  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID()
1557  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID()
1558  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID()
1559  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID()
1560  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID()
1561  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID()
1562  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID()
1563  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID()
1564  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID()
1565  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID()) {
1566  columns.add(new SourceFileColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.srcFile")));
1567  }
1568  columns.add(new TaggedResultsColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags")));
1569 
1570  return columns;
1571  }
1572 
1580  private String getFileUniquePath(Content content) {
1581  try {
1582  if (content != null) {
1583  return content.getUniquePath();
1584  } else {
1585  return "";
1586  }
1587  } catch (TskCoreException ex) {
1588  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileByID"));
1589  logger.log(Level.WARNING, "Failed to get Abstract File by ID.", ex); //NON-NLS
1590  }
1591  return "";
1592 
1593  }
1594 
1604  @SuppressWarnings("deprecation")
1605  private HashSet<String> getUniqueTagNames(long artifactId) throws TskCoreException {
1606  HashSet<String> uniqueTagNames = new HashSet<>();
1607 
1608  String query = "SELECT display_name, artifact_id FROM tag_names AS tn, blackboard_artifact_tags AS bat "
1609  + //NON-NLS
1610  "WHERE tn.tag_name_id = bat.tag_name_id AND bat.artifact_id = " + artifactId; //NON-NLS
1611 
1612  try (SleuthkitCase.CaseDbQuery dbQuery = Case.getCurrentCase().getSleuthkitCase().executeQuery(query)) {
1613  ResultSet tagNameRows = dbQuery.getResultSet();
1614  while (tagNameRows.next()) {
1615  uniqueTagNames.add(tagNameRows.getString("display_name")); //NON-NLS
1616  }
1617  } catch (TskCoreException | SQLException ex) {
1618  throw new TskCoreException("Error getting tag names for artifact: ", ex);
1619  }
1620 
1621  return uniqueTagNames;
1622 
1623  }
1624 
1625  private interface Column {
1626 
1627  String getColumnHeader();
1628 
1629  String getCellData(ArtifactData artData);
1630 
1631  Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types);
1632  }
1633 
1634  private class StatusColumn implements Column {
1635 
1636  @NbBundle.Messages("TableReportGenerator.StatusColumn.Header=Review Status")
1637  @Override
1638  public String getColumnHeader() {
1639  return Bundle.TableReportGenerator_StatusColumn_Header();
1640  }
1641 
1642  @Override
1643  public String getCellData(ArtifactData artData) {
1644  return artData.getArtifact().getReviewStatus().getDisplayName();
1645  }
1646 
1647  @Override
1648  public Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types) {
1649  // This column doesn't have a type, so nothing to remove
1650  return types;
1651  }
1652 
1653  }
1654 
1655  private class AttributeColumn implements Column {
1656 
1657  private final String columnHeader;
1658  private final BlackboardAttribute.Type attributeType;
1659 
1666  AttributeColumn(String columnHeader, BlackboardAttribute.Type attributeType) {
1667  this.columnHeader = Objects.requireNonNull(columnHeader);
1668  this.attributeType = attributeType;
1669  }
1670 
1671  @Override
1672  public String getColumnHeader() {
1673  return this.columnHeader;
1674  }
1675 
1676  @Override
1677  public String getCellData(ArtifactData artData) {
1678  List<BlackboardAttribute> attributes = artData.getAttributes();
1679  for (BlackboardAttribute attribute : attributes) {
1680  if (attribute.getAttributeType().equals(this.attributeType)) {
1681  if (attribute.getAttributeType().getValueType() != BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
1682  return attribute.getDisplayString();
1683  } else {
1684  return ContentUtils.getStringTime(attribute.getValueLong(), artData.getContent());
1685  }
1686  }
1687  }
1688  return "";
1689  }
1690 
1691  @Override
1692  public Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types) {
1693  types.remove(this.attributeType);
1694  return types;
1695  }
1696  }
1697 
1698  private class SourceFileColumn implements Column {
1699 
1700  private final String columnHeader;
1701 
1702  SourceFileColumn(String columnHeader) {
1703  this.columnHeader = columnHeader;
1704  }
1705 
1706  @Override
1707  public String getColumnHeader() {
1708  return this.columnHeader;
1709  }
1710 
1711  @Override
1712  public String getCellData(ArtifactData artData) {
1713  return getFileUniquePath(artData.getContent());
1714  }
1715 
1716  @Override
1717  public Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types) {
1718  // This column doesn't have a type, so nothing to remove
1719  return types;
1720  }
1721  }
1722 
1723  private class TaggedResultsColumn implements Column {
1724 
1725  private final String columnHeader;
1726 
1727  TaggedResultsColumn(String columnHeader) {
1728  this.columnHeader = columnHeader;
1729  }
1730 
1731  @Override
1732  public String getColumnHeader() {
1733  return this.columnHeader;
1734  }
1735 
1736  @Override
1737  public String getCellData(ArtifactData artData) {
1738  return makeCommaSeparatedList(artData.getTags());
1739  }
1740 
1741  @Override
1742  public Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types) {
1743  // This column doesn't have a type, so nothing to remove
1744  return types;
1745  }
1746  }
1747 
1748  private class HeaderOnlyColumn implements Column {
1749 
1750  private final String columnHeader;
1751 
1752  HeaderOnlyColumn(String columnHeader) {
1753  this.columnHeader = columnHeader;
1754  }
1755 
1756  @Override
1757  public String getColumnHeader() {
1758  return columnHeader;
1759  }
1760 
1761  @Override
1762  public String getCellData(ArtifactData artData) {
1763  throw new UnsupportedOperationException("Cannot get cell data of unspecified column");
1764  }
1765 
1766  @Override
1767  public Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types) {
1768  // This column doesn't have a type, so nothing to remove
1769  return types;
1770  }
1771  }
1772 }
org.sleuthkit.autopsy.report.TableReportGenerator.SourceFileColumn.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Definition: TableReportGenerator.java:1717
org.sleuthkit.autopsy.datamodel.ContentUtils.getStringTime
static String getStringTime(long epochSeconds, TimeZone tzone)
Definition: ContentUtils.java:85
org.sleuthkit.autopsy.datamodel.ContentUtils
Definition: ContentUtils.java:54
org.sleuthkit.autopsy.casemodule.services.TagsManager.getContentTagsByContent
List< ContentTag > getContentTagsByContent(Content content)
Definition: TagsManager.java:434
org.sleuthkit.autopsy.report.TableReportGenerator.Column.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
org.sleuthkit.autopsy.report.TableReportGenerator.StatusColumn.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Definition: TableReportGenerator.java:1648
org.sleuthkit.autopsy.report.TableReportGenerator.AttributeColumn.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Definition: TableReportGenerator.java:1692
org.sleuthkit.autopsy.report.TableReportGenerator.HeaderOnlyColumn.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Definition: TableReportGenerator.java:1767
org.sleuthkit.autopsy.casemodule.services.TagsManager.getBlackboardArtifactTagsByArtifact
List< BlackboardArtifactTag > getBlackboardArtifactTagsByArtifact(BlackboardArtifact artifact)
Definition: TagsManager.java:566
org.sleuthkit.autopsy.report.TableReportGenerator.TaggedResultsColumn.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Definition: TableReportGenerator.java:1742

Copyright © 2012-2016 Basis Technology. Generated on: Tue Feb 20 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.