19 package org.sleuthkit.autopsy.datamodel;
21 import com.google.common.cache.Cache;
22 import com.google.common.cache.CacheBuilder;
23 import java.beans.PropertyChangeEvent;
24 import java.beans.PropertyChangeListener;
25 import java.text.MessageFormat;
26 import java.util.ArrayList;
27 import java.util.Arrays;
28 import java.util.EnumSet;
29 import java.util.LinkedHashMap;
30 import java.util.List;
32 import java.util.MissingResourceException;
34 import java.util.concurrent.ExecutionException;
35 import java.util.concurrent.TimeUnit;
36 import java.util.logging.Level;
37 import java.util.stream.Collectors;
38 import javax.swing.Action;
39 import org.apache.commons.lang3.StringUtils;
40 import org.openide.nodes.Sheet;
41 import org.openide.util.Lookup;
42 import org.openide.util.NbBundle;
43 import org.openide.util.WeakListeners;
44 import org.openide.util.lookup.Lookups;
58 import org.
sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
60 import org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
78 private static Cache<Long, Content>
contentCache = CacheBuilder.newBuilder()
79 .expireAfterWrite(1, TimeUnit.MINUTES).
95 BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID(),
96 BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID(),
97 BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID(),
98 BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID(),};
104 BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID(),};
106 private final PropertyChangeListener
pcl =
new PropertyChangeListener() {
108 public void propertyChange(PropertyChangeEvent evt) {
109 String eventType = evt.getPropertyName();
112 if (event.getAddedTag().getArtifact().equals(artifact)) {
117 if (event.getDeletedTagInfo().getArtifactID() == artifact.getArtifactID()) {
122 if (event.getAddedTag().getContent().equals(associated)) {
127 if (event.getDeletedTagInfo().getContentID() == associated.getId()) {
131 if (evt.getNewValue() == null) {
134 contentCache.invalidateAll();
148 private final PropertyChangeListener
weakPcl = WeakListeners.propertyChange(pcl, null);
164 for (Content lookupContent : this.getLookup().lookupAll(Content.class)) {
165 if ((lookupContent != null) && (!(lookupContent instanceof BlackboardArtifact))) {
166 this.associated = lookupContent;
171 this.
setName(Long.toString(artifact.getArtifactID()));
173 this.setIconBaseWithExtension(iconPath);
212 "BlackboardArtifactNode.getAction.errorTitle=Error getting actions",
213 "BlackboardArtifactNode.getAction.resultErrorMessage=There was a problem getting actions for the selected result."
214 +
" The 'View Result in Timeline' action will not be available.",
215 "BlackboardArtifactNode.getAction.linkedFileMessage=There was a problem getting actions for the selected result. "
216 +
" The 'View File in Timeline' action will not be available."})
218 List<Action> actionsList =
new ArrayList<>();
219 actionsList.addAll(Arrays.asList(super.getActions(context)));
226 }
catch (TskCoreException ex) {
227 LOGGER.log(Level.SEVERE, MessageFormat.format(
"Error getting arttribute(s) from blackboard artifact{0}.", artifact.getArtifactID()), ex);
228 MessageNotifyUtil.
Notify.
error(Bundle.BlackboardArtifactNode_getAction_errorTitle(), Bundle.BlackboardArtifactNode_getAction_resultErrorMessage());
233 AbstractFile c = findLinked(artifact);
237 }
catch (TskCoreException ex) {
238 LOGGER.log(Level.SEVERE, MessageFormat.format(
"Error getting linked file from blackboard artifact{0}.", artifact.getArtifactID()), ex);
239 MessageNotifyUtil.
Notify.
error(Bundle.BlackboardArtifactNode_getAction_errorTitle(), Bundle.BlackboardArtifactNode_getAction_linkedFileMessage());
243 AbstractFile file = getLookup().lookup(AbstractFile.class);
248 return actionsList.toArray(
new Action[actionsList.size()]);
251 @NbBundle.Messages({
"# {0} - artifactDisplayName",
"BlackboardArtifactNode.displayName.artifact={0} Artifact"})
258 String displayName =
"";
264 && (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()
265 || artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID())) {
267 for (BlackboardAttribute attribute : artifact.getAttributes()) {
268 if (attribute.getAttributeType().getTypeID() == ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID()) {
270 if (associatedArtifact != null) {
271 if (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) {
272 artifact.getDisplayName();
274 displayName = NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.displayName.artifact", associatedArtifact.getDisplayName());
284 if (displayName.isEmpty() && artifact != null) {
285 displayName = artifact.getName();
300 if (associated != null) {
301 srcName = associated.getName();
307 "BlackboardArtifactNode.createSheet.artifactType.displayName=Artifact Type",
308 "BlackboardArtifactNode.createSheet.artifactType.name=Artifact Type",
309 "BlackboardArtifactNode.createSheet.artifactDetails.displayName=Artifact Details",
310 "BlackboardArtifactNode.createSheet.artifactDetails.name=Artifact Details",
311 "BlackboardArtifactNode.artifact.displayName=Artifact",
312 "BlackboardArtifactNode.createSheet.artifactMD5.displayName=MD5 Hash",
313 "BlackboardArtifactNode.createSheet.artifactMD5.name=MD5 Hash"})
317 Sheet sheet = super.createSheet();
318 Sheet.Set sheetSet = sheet.get(Sheet.PROPERTIES);
319 if (sheetSet == null) {
320 sheetSet = Sheet.createPropertiesSet();
324 Map<String, Object> map =
new LinkedHashMap<>();
328 NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.createSheet.srcFile.displayName"),
331 if (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) {
333 BlackboardAttribute attribute = artifact.getAttribute(
new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
334 if (attribute != null) {
337 NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.createSheet.artifactType.displayName"),
339 associatedArtifact.getDisplayName() +
" " + NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.artifact.displayName")));
341 NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.createSheet.artifactDetails.displayName"),
343 associatedArtifact.getShortDescription()));
350 for (Map.Entry<String, Object> entry : map.entrySet()) {
358 if (customProperties != null) {
364 final int artifactTypeId = artifact.getArtifactTypeID();
367 if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID()) {
369 String actualMimeType =
"";
370 if (associated instanceof AbstractFile) {
371 AbstractFile af = (AbstractFile) associated;
372 ext = af.getNameExtension();
373 actualMimeType = af.getMIMEType();
374 if (actualMimeType == null) {
384 NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.createSheet.mimeType.displayName"),
389 if (Arrays.asList(SHOW_UNIQUE_PATH).contains(artifactTypeId)) {
390 String sourcePath =
"";
392 sourcePath = associated.getUniquePath();
393 }
catch (TskCoreException ex) {
394 LOGGER.log(Level.WARNING,
"Failed to get unique path from: {0}", associated.getName());
397 if (sourcePath.isEmpty() ==
false) {
400 NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.createSheet.filePath.displayName"),
405 if (Arrays.asList(SHOW_FILE_METADATA).contains(artifactTypeId)) {
406 AbstractFile file = associated instanceof AbstractFile ? (AbstractFile) associated : null;
408 NbBundle.getMessage(
BlackboardArtifactNode.class,
"ContentTagNode.createSheet.fileModifiedTime.displayName"),
412 NbBundle.getMessage(
BlackboardArtifactNode.class,
"ContentTagNode.createSheet.fileChangedTime.displayName"),
416 NbBundle.getMessage(
BlackboardArtifactNode.class,
"ContentTagNode.createSheet.fileAccessedTime.displayName"),
420 NbBundle.getMessage(
BlackboardArtifactNode.class,
"ContentTagNode.createSheet.fileCreatedTime.displayName"),
426 associated.getSize()));
427 sheetSet.put(
new NodeProperty<>(Bundle.BlackboardArtifactNode_createSheet_artifactMD5_name(),
428 Bundle.BlackboardArtifactNode_createSheet_artifactMD5_displayName(),
430 file == null ?
"" : StringUtils.defaultString(file.getMd5Hash())));
433 String dataSourceStr =
"";
435 Content dataSource = associated.getDataSource();
436 if (dataSource != null) {
437 dataSourceStr = dataSource.getName();
441 }
catch (TskCoreException ex) {
442 LOGGER.log(Level.WARNING,
"Failed to get image name from {0}", associated.getName());
445 if (dataSourceStr.isEmpty() ==
false) {
448 NbBundle.getMessage(
BlackboardArtifactNode.class,
"BlackboardArtifactNode.createSheet.dataSrc.displayName"),
467 "BlackboardArtifactNode.createSheet.tags.displayName=Tags"})
468 protected void addTagProperty(Sheet.Set sheetSet)
throws MissingResourceException {
470 List<Tag> tags =
new ArrayList<>();
475 LOGGER.log(Level.SEVERE,
"Failed to get tags for artifact " + artifact.getDisplayName(), ex);
477 sheetSet.put(
new NodeProperty<>(
"Tags", Bundle.BlackboardArtifactNode_createSheet_tags_displayName(),
478 NO_DESCR, tags.stream().map(t -> t.getName().getDisplayName()).collect(Collectors.joining(
", "))));
486 String parentName = associated.getName();
489 while ((parent = parent.getParent()) != null) {
490 parentName = parent.getName();
492 }
catch (TskCoreException ex) {
493 LOGGER.log(Level.WARNING,
"Failed to get parent name from {0}", associated.getName());
506 if (null == customProperties) {
508 customProperties =
new ArrayList<>();
510 customProperties.add(np);
520 @SuppressWarnings(
"deprecation")
523 for (BlackboardAttribute attribute : artifact.getAttributes()) {
524 final int attributeTypeID = attribute.getAttributeType().getTypeID();
526 if (attributeTypeID == ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID()
527 || attributeTypeID == ATTRIBUTE_TYPE.TSK_TAGGED_ARTIFACT.getTypeID()
528 || attributeTypeID == ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT.getTypeID()
529 || attributeTypeID == ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID()
530 || attributeTypeID == ATTRIBUTE_TYPE.TSK_KEYWORD_SEARCH_TYPE.getTypeID()) {
531 }
else if (artifact.getArtifactTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID()) {
533 }
else if (attribute.getAttributeType().getValueType() == BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
535 }
else if (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_TOOL_OUTPUT.getTypeID()
536 && attributeTypeID == ATTRIBUTE_TYPE.TSK_TEXT.getTypeID()) {
544 String value = attribute.getDisplayString();
545 if (value.length() > 512) {
546 value = value.substring(0, 512);
548 map.put(attribute.getAttributeType().getDisplayName(), value);
550 map.put(attribute.getAttributeType().getDisplayName(), attribute.getDisplayString());
553 }
catch (TskCoreException ex) {
554 LOGGER.log(Level.SEVERE,
"Getting attributes failed", ex);
567 final int attributeTypeID = attribute.getAttributeType().getTypeID();
570 if (attributeTypeID == ATTRIBUTE_TYPE.TSK_DATETIME_SENT.getTypeID()
571 || attributeTypeID == ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_HTML.getTypeID()
572 || attributeTypeID == ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_RTF.getTypeID()
573 || attributeTypeID == ATTRIBUTE_TYPE.TSK_EMAIL_BCC.getTypeID()
574 || attributeTypeID == ATTRIBUTE_TYPE.TSK_EMAIL_CC.getTypeID()
575 || attributeTypeID == ATTRIBUTE_TYPE.TSK_HEADERS.getTypeID()) {
578 }
else if (attributeTypeID == ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_PLAIN.getTypeID()) {
580 String value = attribute.getDisplayString();
581 if (value.length() > 160) {
582 value = value.substring(0, 160) +
"...";
584 map.put(attribute.getAttributeType().getDisplayName(), value);
585 }
else if (attribute.getAttributeType().getValueType() == BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
588 map.put(attribute.getAttributeType().getDisplayName(), attribute.getDisplayString());
595 return visitor.
visit(
this);
608 final long objectID = artifact.getObjectID();
610 Content content = contentCache.get(objectID, () -> artifact.getSleuthkitCase().getContentById(objectID));
611 if (content == null) {
612 return Lookups.fixed(artifact);
614 return Lookups.fixed(artifact, content);
616 }
catch (ExecutionException ex) {
617 LOGGER.log(Level.WARNING,
"Getting associated content for artifact failed", ex);
618 return Lookups.fixed(artifact);
629 return getClass().getName();
633 public <T> T accept(ContentNodeVisitor<T> visitor) {
634 return visitor.visit(
this);
void addTagProperty(Sheet.Set sheetSet)
void fillPropertyMap(Map< String, Object > map, BlackboardArtifact artifact)
static String getStringTime(long epochSeconds, TimeZone tzone)
static boolean hasSupportedTimeStamp(BlackboardArtifact artifact)
final PropertyChangeListener weakPcl
static Cache< Long, Content > contentCache
void setName(String name)
final PropertyChangeListener pcl
static Case getOpenCase()
BlackboardArtifactNode(BlackboardArtifact artifact, String iconPath)
static Lookup createLookup(BlackboardArtifact artifact)
static final String NO_DESCR
static final Integer[] SHOW_FILE_METADATA
T visit(DataSourcesNode in)
Action[] getActions(boolean context)
static ViewFileInTimelineAction createViewSourceFileAction(AbstractFile file)
static final Set< Case.Events > CASE_EVENTS_OF_INTEREST
TagsManager getTagsManager()
List< NodeProperty<?extends Object > > customProperties
static final Logger LOGGER
String getRootParentName()
final BlackboardArtifact artifact
void addEmailMsgProperty(Map< String, Object > map, BlackboardAttribute attribute)
SleuthkitCase getSleuthkitCase()
BLACKBOARD_ARTIFACT_TAG_ADDED
static void error(String title, String message)
BlackboardArtifact getArtifact()
synchronized static Logger getLogger(String name)
static void addEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
void addNodeProperty(NodeProperty<?> np)
static void removeEventTypeSubscriber(Set< Events > eventTypes, PropertyChangeListener subscriber)
BlackboardArtifactNode(BlackboardArtifact artifact)
static final Integer[] SHOW_UNIQUE_PATH
static ViewFileInTimelineAction createViewFileAction(AbstractFile file)
BLACKBOARD_ARTIFACT_TAG_DELETED