TskBlackboardAttribute Class Reference

Class that represents a blackboard attribute object. More...

#include <TskBlackboardAttribute.h>

Public Member Functions
uint64_t	getArtifactID () const
	Get artifact id for the parent of this attribute. More...
int	getAttributeTypeID () const
	Get attribute type id for this attribute. More...
string	getContext () const
	Get context for this attribute. More...
string	getModuleName () const
	Get nameof the module that created this attribute. More...
uint64_t	getObjectID () const
	Get object id this attribute is associated with. More...
TskBlackboardArtifact	getParentArtifact () const
	Get parent artifact for this attribute. More...
vector< unsigned char >	getValueBytes () const
	Get value bytes (if this attribute stores bytes) More...
double	getValueDouble () const
	Get value double (if the attribute stores a double) More...
int	getValueInt () const
	Get value int (if the attribute stores an int) More...
uint64_t	getValueLong () const
	Get value long (if the attribute stores a long0. More...
string	getValueString () const
	Get value string (if this attribute stores a string) More...
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE	getValueType () const
	Get typeof value this attribute stores. More...
	TskBlackboardAttribute (const int attributeTypeID, const string &moduleName, const string &context, const int valueInt)
	Constructor for an attribute storing an int. More...
	TskBlackboardAttribute (const int attributeTypeID, const string &moduleName, const string &context, const uint64_t valueLong)
	Constructor for an attribute storing a 64 bit integer. More...
	TskBlackboardAttribute (const int attributeTypeID, const string &moduleName, const string &context, const double valueDouble)
	Constructor for an attribute storing a double. More...
	TskBlackboardAttribute (const int attributeTypeID, const string &moduleName, const string &context, const string &valueString)
	Constructor for an attribute storing a string. More...
	TskBlackboardAttribute (const int attributeTypeID, const string &moduleName, const string &context, const vector< unsigned char > &valueBytes)
	Constructor for an attribute storing a byte array. More...
	~TskBlackboardAttribute ()
	Default destructor.

Protected Member Functions
void	setArtifactID (uint64_t artifactID)
	Set artifact id. More...
void	setObjectID (uint64_t objectID)
	Set object id. More...
	TskBlackboardAttribute (const uint64_t artifactID, const int attributeTypeID, const uint64_t objectID, const string &moduleName, const string &context, const TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, const int valueInt, const uint64_t valueLong, const double valueDouble, const string &valueString, const vector< unsigned char > &valueBytes)
	Constructor. More...

Friends
class	TskBlackboardArtifact
class	TskDBBlackboard
class	TskFile
class	TskImgDB

Detailed Description

Class that represents a blackboard attribute object.

Constructor & Destructor Documentation

TskBlackboardAttribute::TskBlackboardAttribute	(	const int	attributeTypeID,
		const string &	moduleName,
		const string &	context,
		const int	valueInt
	)

Constructor for an attribute storing an int.

Constructor.

Parameters

attributeTypeID	attribute type id
moduleName	module that created this attribute
context	additional context
valueInt	integer value

TskBlackboardAttribute::TskBlackboardAttribute	(	const int	attributeTypeID,
		const string &	moduleName,
		const string &	context,
		const uint64_t	valueLong
	)

Constructor for an attribute storing a 64 bit integer.

Constructor.

Parameters

attributeTypeID	attribute type id
moduleName	module that created this attribute
context	additional context
valueLong	64 bit integer value

TskBlackboardAttribute::TskBlackboardAttribute	(	const int	attributeTypeID,
		const string &	moduleName,
		const string &	context,
		const double	valueDouble
	)

Constructor for an attribute storing a double.

Constructor.

Parameters

attributeTypeID	attribute type id
moduleName	module that created this attribute
context	additional context
valueDouble	double value

TskBlackboardAttribute::TskBlackboardAttribute	(	const int	attributeTypeID,
		const string &	moduleName,
		const string &	context,
		const string &	valueString
	)

Constructor for an attribute storing a string.

Constructor.

Parameters

attributeTypeID	attribute type id
moduleName	module that created this attribute
context	additional context
valueString	string value

TskBlackboardAttribute::TskBlackboardAttribute	(	const int	attributeTypeID,
		const string &	moduleName,
		const string &	context,
		const vector< unsigned char > &	valueBytes
	)

Constructor for an attribute storing a byte array.

Constructor.

Parameters

attributeTypeID	attribute type id
moduleName	module that created this attribute
context	additional context
valueBytes	byte array value

TskBlackboardAttribute::TskBlackboardAttribute ( const uint64_t  artifactID, const int  attributeTypeID, const uint64_t  objectID, const string &  moduleName, const string &  context, const TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE  valueType, const int  valueInt, const uint64_t  valueLong, const double  valueDouble, const string &  valueString, const vector< unsigned char > &  valueBytes  )

protected

Constructor.

Parameters

artifactID	if of the artifact this is associated with
attributeTypeID	attribute type id
moduleName	module that created this attribute
context	additional context
valueType	Type of value being set (only the corresponding value from the next parameters will be used)
valueInt	integer value
valueLong	64 bit integer value
valueDouble	double value
valueString	string value
valueBytes	byte array value
objectID	object the attribute is associated with

Member Function Documentation

uint64_t TskBlackboardAttribute::getArtifactID

(

)

const

Get artifact id for the parent of this attribute.

Get artifact id.

Returns

artifact id

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

int TskBlackboardAttribute::getAttributeTypeID

(

)

const

Get attribute type id for this attribute.

Get attribute type id.

Returns

attribute type id

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

string TskBlackboardAttribute::getContext

(

)

const

Get context for this attribute.

Get context.

Returns

context

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

string TskBlackboardAttribute::getModuleName

(

)

const

Get nameof the module that created this attribute.

Get module name.

Returns

module name

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

uint64_t TskBlackboardAttribute::getObjectID

(

)

const

Get object id this attribute is associated with.

Get object id.

Returns

object id

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

TskBlackboardArtifact TskBlackboardAttribute::getParentArtifact

(

)

const

Get parent artifact for this attribute.

Get parent artifact.

Returns

parent artifact

References TskServices::getBlackboard(), TskBlackboard::getBlackboardArtifact(), and TskServices::Instance().

vector< unsigned char > TskBlackboardAttribute::getValueBytes

(

)

const

Get value bytes (if this attribute stores bytes)

Get value bytes.

Returns

value bytes

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

double TskBlackboardAttribute::getValueDouble

(

)

const

Get value double (if the attribute stores a double)

Get value double.

Returns

value double

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

int TskBlackboardAttribute::getValueInt

(

)

const

Get value int (if the attribute stores an int)

Get value int.

Returns

value int

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

uint64_t TskBlackboardAttribute::getValueLong

(

)

const

Get value long (if the attribute stores a long0.

Get value long.

Returns

value long

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

string TskBlackboardAttribute::getValueString

(

)

const

Get value string (if this attribute stores a string)

Get value string.

Returns

value string

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE TskBlackboardAttribute::getValueType

(

)

const

Get typeof value this attribute stores.

Get value type.

Returns

value type

Referenced by TskImgDBPostgreSQL::addBlackboardAttribute(), and TskImgDBSqlite::addBlackboardAttribute().

void TskBlackboardAttribute::setArtifactID ( uint64_t  artifactID)

protected

Set artifact id.

Parameters

artifactID

artifact id

Referenced by TskBlackboardArtifact::addAttribute().

void TskBlackboardAttribute::setObjectID ( uint64_t  objectID)

protected

Set object id.

Parameters

objectID

object id

Referenced by TskBlackboardArtifact::addAttribute().

---

The documentation for this class was generated from the following files:

• framework/tsk/framework/services/TskBlackboardAttribute.h
• framework/tsk/framework/services/TskBlackboardAttribute.cpp