The Sleuth Kit Framework  4.1
Public Member Functions | Static Public Member Functions | Protected Member Functions | Static Protected Member Functions | Friends | List of all members
TskBlackboard Class Referenceabstract

An interface for setting and retrieving name/value pairs to the blackboard. More...

#include <TskBlackboard.h>

Inheritance diagram for TskBlackboard:
TskDBBlackboard

Public Member Functions

virtual TskBlackboardArtifact createArtifact (const uint64_t file_id, const int artifactTypeID)=0
 Create a new blackboard artifact with the given type id and file id. More...
 
virtual TskBlackboardArtifact createArtifact (const uint64_t file_id, const TSK_ARTIFACT_TYPE artifactType)=0
 Create a new blackboard artifact with the given type and file id. More...
 
virtual TskBlackboardArtifact createArtifact (const uint64_t file_id, const string &artifactTypeName)=0
 Add a new artifact type with the given name and file id. More...
 
virtual void createGenInfoAttribute (const uint64_t file_id, TskBlackboardAttribute &attr)=0
 Add a new attribute to the general info artifact for the given file. More...
 
virtual vector< int > findAttributeTypes (int artifactTypeId)=0
 Search the entire blackboard for all attribute types associated with any artifact of the given type. More...
 
virtual vector
< TskBlackboardArtifact
getArtifacts (const uint64_t file_id, const string &artifactTypeName) const =0
 Get all artifacts with the given type name and file id. More...
 
virtual vector
< TskBlackboardArtifact
getArtifacts (const uint64_t file_id, int artifactTypeID) const =0
 Get all artifacts with the given type id and file id. More...
 
virtual vector
< TskBlackboardArtifact
getArtifacts (const uint64_t file_id, TSK_ARTIFACT_TYPE artifactType) const =0
 Get all artifacts with the given type and file id. More...
 
virtual vector
< TskBlackboardArtifact
getArtifacts (const TSK_ARTIFACT_TYPE artifactType) const =0
 Get all artifacts with the given type. More...
 
virtual vector
< TskBlackboardAttribute
getAttributes (const uint64_t file_id, const string &attributeTypeName) const =0
 Get all attributes with the given type name and file id. More...
 
virtual vector
< TskBlackboardAttribute
getAttributes (const uint64_t file_id, int attributeTypeID) const =0
 Get all attributes with the given type and file id. More...
 
virtual vector
< TskBlackboardAttribute
getAttributes (const uint64_t file_id, TSK_ATTRIBUTE_TYPE attributeType) const =0
 Get all attributes with the given type and file id. More...
 
virtual vector
< TskBlackboardAttribute
getAttributes (const TSK_ATTRIBUTE_TYPE attributeType) const =0
 Get all attributes with the given type. More...
 
virtual TskBlackboardArtifact getBlackboardArtifact (const long artifactID)=0
 Get the artifact with the given id. More...
 
virtual vector
< TskBlackboardArtifact
getMatchingArtifacts (const string &condition) const =0
 Get all artifacts that match the given condition. More...
 
virtual vector
< TskBlackboardAttribute
getMatchingAttributes (const string &condition) const =0
 Get all attributes that match the given condition. More...
 

Static Public Member Functions

static int addArtifactType (const string &artifactTypeName, const string &displayName)
 Add a new artifact type with the given name and display name. More...
 
static int addAttributeType (const string &attributeTypeName, const string &displayName)
 Add a new attribute type with the given name and display name. More...
 
static string artTypeIDToDisplayName (const int artifactTypeID)
 Convert artifact type id to display name. More...
 
static string artTypeIDToTypeName (const int artifactTypeID)
 Convert artifact type id to name. More...
 
static int artTypeNameToTypeID (const string &artifactTypeString)
 Convert artifact type name to id. More...
 
static string attrTypeIDToTypeDisplayName (const int attributeTypeID)
 Convert attribute type id to display name. More...
 
static string attrTypeIDToTypeName (const int attributeTypeID)
 Convert attribute type id to name. More...
 
static int attrTypeNameToTypeID (const string &attributeTypeString)
 Convert attribute type name to id. More...
 

Protected Member Functions

virtual void addBlackboardAttribute (TskBlackboardAttribute &attr)=0
 
 TskBlackboard ()
 Default Constructor.
 
 TskBlackboard (TskBlackboard const &)
 Copy Constructor.
 
virtual ~TskBlackboard ()
 Destructor.
 

Static Protected Member Functions

static map< int, TskArtifactNamesgetAllArtifactTypes ()
 
static map< int,
TskAttributeNames
getAllAttributeTypes ()
 

Friends

class TskBlackboardArtifact
 
class TskImgDB
 

Detailed Description

An interface for setting and retrieving name/value pairs to the blackboard.

The blackboard is used to store data for use by later modules in the pipeline. Can be registered with and retrieved from TskServices.

Member Function Documentation

int TskBlackboard::addArtifactType ( const string &  artifactTypeName,
const string &  displayName 
)
static

Add a new artifact type with the given name and display name.

Parameters
artifactTypeNamename for the new attribute type. should be unique
displayNamename to display for this type. need not be unique
Returns
the new artifact type id generated for the type.
Exceptions
errorif a type with that name already exists
int TskBlackboard::addAttributeType ( const string &  attributeTypeName,
const string &  displayName 
)
static

Add a new attribute type with the given name and display name.

Parameters
attributeTypeNamename for the new attribute type. should be unique
displayNamename to display for this type. need not be unique
Returns
the new attribute type id generated for the type.
Exceptions
errorif a type with that name already exists
string TskBlackboard::artTypeIDToDisplayName ( const int  artifactTypeID)
static

Convert artifact type id to display name.

Parameters
artifactTypeIDartifact type id
Returns
display name
Exceptions
errorif no type exists with that id
string TskBlackboard::artTypeIDToTypeName ( const int  artifactTypeID)
static

Convert artifact type id to name.

Parameters
artifactTypeIDid
Returns
artifact type name
Exceptions
errorif no type exists with that id
int TskBlackboard::artTypeNameToTypeID ( const string &  artifactTypeString)
static

Convert artifact type name to id.

Parameters
artifactTypeStringartifact type name
Returns
artifact type id
Exceptions
errorif no type exists with that name
string TskBlackboard::attrTypeIDToTypeDisplayName ( const int  attributeTypeID)
static

Convert attribute type id to display name.

Parameters
attributeTypeIDattribute type id
Returns
display name
Exceptions
errorif no type exists for that id
string TskBlackboard::attrTypeIDToTypeName ( const int  attributeTypeID)
static

Convert attribute type id to name.

Parameters
attributeTypeIDid
Returns
attribute type name
Exceptions
errorif no type exists with that name
int TskBlackboard::attrTypeNameToTypeID ( const string &  attributeTypeString)
static

Convert attribute type name to id.

Parameters
attributeTypeStringattribute type name
Returns
attribute type id
Exceptions
errorif no type exists with that name
virtual TskBlackboardArtifact TskBlackboard::createArtifact ( const uint64_t  file_id,
const int  artifactTypeID 
)
pure virtual

Create a new blackboard artifact with the given type id and file id.

Parameters
artifactTypeIDartifact type id
file_idassociated file id
Returns
the new artifact
Exceptions
errorif the artifact type does not exist

Implemented in TskDBBlackboard.

Referenced by TskFile::createArtifact().

virtual TskBlackboardArtifact TskBlackboard::createArtifact ( const uint64_t  file_id,
const TSK_ARTIFACT_TYPE  artifactType 
)
pure virtual

Create a new blackboard artifact with the given type and file id.

Parameters
file_idassociated file id
artifactTypeartifact type
Returns
the new artifact
Exceptions
errorif the artifact type does not exist

Implemented in TskDBBlackboard.

virtual TskBlackboardArtifact TskBlackboard::createArtifact ( const uint64_t  file_id,
const string &  artifactTypeName 
)
pure virtual

Add a new artifact type with the given name and file id.

Parameters
file_idassociated file id
artifactTypeNameSystem name of artifact type
Returns
the new artifact
Exceptions
errorif the artifact type does not exist

Implemented in TskDBBlackboard.

virtual void TskBlackboard::createGenInfoAttribute ( const uint64_t  file_id,
TskBlackboardAttribute attr 
)
pure virtual

Add a new attribute to the general info artifact for the given file.

Parameters
file_idfile id for the file to add the attribute to
attrand attribute populated with values. this attribute will have its artifact_id and obj_id set by this method.
Exceptions
errorif no file with the given id exists or if a bad attribute is passed in.

Implemented in TskDBBlackboard.

virtual vector<int> TskBlackboard::findAttributeTypes ( int  artifactTypeId)
pure virtual

Search the entire blackboard for all attribute types associated with any artifact of the given type.

Parameters
artifactTypeIdartifact type to search
Returns
a vector of attribute ids can return an empty vector if no types are found

Implemented in TskDBBlackboard.

virtual vector<TskBlackboardArtifact> TskBlackboard::getArtifacts ( const uint64_t  file_id,
const string &  artifactTypeName 
) const
pure virtual

Get all artifacts with the given type name and file id.

Parameters
file_idassociated file id
artifactTypeNametype name
Returns
vector of matching artifacts can return an empty vector if there are no matches

Implemented in TskDBBlackboard.

Referenced by TskFile::getArtifacts().

virtual vector<TskBlackboardArtifact> TskBlackboard::getArtifacts ( const uint64_t  file_id,
int  artifactTypeID 
) const
pure virtual

Get all artifacts with the given type id and file id.

Parameters
file_idassociated file id
artifactTypeIDtype id
Returns
vector of matching artifacts can return an empty vector if there are no matches

Implemented in TskDBBlackboard.

virtual vector<TskBlackboardArtifact> TskBlackboard::getArtifacts ( const uint64_t  file_id,
TSK_ARTIFACT_TYPE  artifactType 
) const
pure virtual

Get all artifacts with the given type and file id.

Parameters
file_idassociated file id
artifactTypename
Returns
vector of matching artifacts can return an empty vector if there are no matches

Implemented in TskDBBlackboard.

virtual vector<TskBlackboardArtifact> TskBlackboard::getArtifacts ( const TSK_ARTIFACT_TYPE  artifactType) const
pure virtual

Get all artifacts with the given type.

Parameters
artifactTypetype
Returns
vector of matching artifacts can return an empty vector if there are no matches

Implemented in TskDBBlackboard.

virtual vector<TskBlackboardAttribute> TskBlackboard::getAttributes ( const uint64_t  file_id,
const string &  attributeTypeName 
) const
pure virtual

Get all attributes with the given type name and file id.

Parameters
file_idassociated file id
attributeTypeNametype name
Returns
vector of matching attributes can return an empty vector if there are no matches

Implemented in TskDBBlackboard.

virtual vector<TskBlackboardAttribute> TskBlackboard::getAttributes ( const uint64_t  file_id,
int  attributeTypeID 
) const
pure virtual

Get all attributes with the given type and file id.

Parameters
file_idassociated file id
attributeTypeIDType of attribute to return
Returns
vector of matching attributes can return an empty vector if there are no matches

Implemented in TskDBBlackboard.

virtual vector<TskBlackboardAttribute> TskBlackboard::getAttributes ( const uint64_t  file_id,
TSK_ATTRIBUTE_TYPE  attributeType 
) const
pure virtual

Get all attributes with the given type and file id.

Parameters
file_idassociated file id
attributeTypename
Returns
vector of matching attributes can return an empty vector if there are no matches

Implemented in TskDBBlackboard.

virtual vector<TskBlackboardAttribute> TskBlackboard::getAttributes ( const TSK_ATTRIBUTE_TYPE  attributeType) const
pure virtual

Get all attributes with the given type.

Parameters
attributeTypetype
Returns
vector of matching attributes can return an empty vector if there are no matches

Implemented in TskDBBlackboard.

virtual TskBlackboardArtifact TskBlackboard::getBlackboardArtifact ( const long  artifactID)
pure virtual

Get the artifact with the given id.

Parameters
artifactIDid
Returns
the artifact throws an error if no artifact matches that id.

Implemented in TskDBBlackboard.

Referenced by TskBlackboardAttribute::getParentArtifact().

virtual vector<TskBlackboardArtifact> TskBlackboard::getMatchingArtifacts ( const string &  condition) const
pure virtual

Get all artifacts that match the given condition.

Parameters
conditioncondition (implementation specific) to use for matching
Returns
vector of matching artifacts can return an empty vector if there are no matches
Exceptions
errorif a bad condition string is supplied

Implemented in TskDBBlackboard.

Referenced by TskFile::getAllArtifacts().

virtual vector<TskBlackboardAttribute> TskBlackboard::getMatchingAttributes ( const string &  condition) const
pure virtual

Get all attributes that match the given condition.

Parameters
condition(implementation specific) to use for matching
Returns
vector of matching attributes can return an empty vector if there are no matches
Exceptions
errorif a bad condition string is supplied

Implemented in TskDBBlackboard.


The documentation for this class was generated from the following files:

Copyright © 2011-2013 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.