TskDBBlackboard Class Reference

An implementation of TskBlackboard that stores the name / value pairs in the TskImgDB. More...

#include <TskDBBlackboard.h>

Inheritance diagram for TskDBBlackboard:

Public Member Functions
virtual TskBlackboardArtifact	createArtifact (const uint64_t file_id, const int artifactTypeID)
	Create a new blackboard artifact with the given type id and file id. More...
virtual TskBlackboardArtifact	createArtifact (const uint64_t file_id, const TSK_ARTIFACT_TYPE artifactType)
	Create a new blackboard artifact with the given type and file id. More...
virtual TskBlackboardArtifact	createArtifact (const uint64_t file_id, const string &artifactTypeName)
	Add a new artifact type with the given name and file id. More...
virtual void	createGenInfoAttribute (const uint64_t file_id, TskBlackboardAttribute &attr)
	Add a new attribute to the general info artifact for the given file. More...
virtual vector< int >	findAttributeTypes (int artifactTypeId)
	Search the entire blackboard for all attribute types associated with any artifact of the given type. More...
virtual vector < TskBlackboardArtifact >	getArtifacts (const uint64_t file_id, const string &artifactTypeName) const
	Get all artifacts with the given type name and file id. More...
virtual vector < TskBlackboardArtifact >	getArtifacts (const uint64_t file_id, int artifactTypeID) const
	Get all artifacts with the given type id and file id. More...
virtual vector < TskBlackboardArtifact >	getArtifacts (const uint64_t file_id, TSK_ARTIFACT_TYPE artifactType) const
	Get all artifacts with the given type and file id. More...
virtual vector < TskBlackboardArtifact >	getArtifacts (const TSK_ARTIFACT_TYPE artifactType) const
	Get all artifacts with the given type. More...
virtual vector < TskBlackboardAttribute >	getAttributes (const uint64_t file_id, const string &attributeTypeName) const
	Get all attributes with the given type name and file id. More...
virtual vector < TskBlackboardAttribute >	getAttributes (const uint64_t file_id, int attributeTypeID) const
	Get all attributes with the given type and file id. More...
virtual vector < TskBlackboardAttribute >	getAttributes (const uint64_t file_id, TSK_ATTRIBUTE_TYPE attributeType) const
	Get all attributes with the given type and file id. More...
virtual vector < TskBlackboardAttribute >	getAttributes (const TSK_ATTRIBUTE_TYPE attributeType) const
	Get all attributes with the given type. More...
virtual TskBlackboardArtifact	getBlackboardArtifact (const long artifactID)
	Get the artifact with the given id. More...
virtual vector < TskBlackboardArtifact >	getMatchingArtifacts (const string &condition) const
	Get all artifacts that match the given condition. More...
virtual vector < TskBlackboardAttribute >	getMatchingAttributes (const string &condition) const
	Get all attributes that match the given condition. More...

Static Public Member Functions
static int	addArtifactType (const string &artifactTypeName, const string &displayName)
static int	addAttributeType (const string &attributeTypeName, const string &displayName)
static string	artTypeIDToDisplayName (const int artifactTypeID)
static string	artTypeIDToTypeName (const int artifactTypeID)
static int	artTypeNameToTypeID (const string &artifactTypeString)
static string	attrTypeIDToTypeDisplayName (const int attributeTypeID)
static string	attrTypeIDToTypeName (const int attributeTypeID)
static int	attrTypeNameToTypeID (const string &attributeTypeString)
static TskDBBlackboard &	instance ()
Static Public Member Functions inherited from TskBlackboard
static int	addArtifactType (const string &artifactTypeName, const string &displayName)
	Add a new artifact type with the given name and display name. More...
static int	addAttributeType (const string &attributeTypeName, const string &displayName)
	Add a new attribute type with the given name and display name. More...
static string	artTypeIDToDisplayName (const int artifactTypeID)
	Convert artifact type id to display name. More...
static string	artTypeIDToTypeName (const int artifactTypeID)
	Convert artifact type id to name. More...
static int	artTypeNameToTypeID (const string &artifactTypeString)
	Convert artifact type name to id. More...
static string	attrTypeIDToTypeDisplayName (const int attributeTypeID)
	Convert attribute type id to display name. More...
static string	attrTypeIDToTypeName (const int attributeTypeID)
	Convert attribute type id to name. More...
static int	attrTypeNameToTypeID (const string &attributeTypeString)
	Convert attribute type name to id. More...

Protected Member Functions
virtual void	addBlackboardAttribute (TskBlackboardAttribute &attr)
TskDBBlackboard &	operator= (TskDBBlackboard const &)
	TskDBBlackboard (TskDBBlackboard const &)
Protected Member Functions inherited from TskBlackboard
	TskBlackboard ()
	Default Constructor.
	TskBlackboard (TskBlackboard const &)
	Copy Constructor.
virtual	~TskBlackboard ()
	Destructor.

Protected Attributes
TskImgDB *	m_pImgDB

Static Protected Attributes
static TskDBBlackboard *	m_pInstance = NULL

Friends
class	TskBlackboardArtifact

Additional Inherited Members
Static Protected Member Functions inherited from TskBlackboard
static map< int, TskArtifactNames >	getAllArtifactTypes ()
static map< int, TskAttributeNames >	getAllAttributeTypes ()

Detailed Description

An implementation of TskBlackboard that stores the name / value pairs in the TskImgDB.

Member Function Documentation

TskBlackboardArtifact TskDBBlackboard::createArtifact ( const uint64_t  file_id, const int  artifactTypeID  )

virtual

Create a new blackboard artifact with the given type id and file id.

Parameters

artifactTypeID	artifact type id
file_id	associated file id

Returns

the new artifact

Exceptions

error

if the artifact type does not exist

Implements TskBlackboard.

TskBlackboardArtifact TskDBBlackboard::createArtifact ( const uint64_t  file_id, const TSK_ARTIFACT_TYPE  artifactType  )

virtual

Create a new blackboard artifact with the given type and file id.

Parameters

file_id	associated file id
artifactType	artifact type

Returns

the new artifact

Exceptions

error

if the artifact type does not exist

Implements TskBlackboard.

TskBlackboardArtifact TskDBBlackboard::createArtifact ( const uint64_t  file_id, const string &  artifactTypeName  )

virtual

Add a new artifact type with the given name and file id.

Parameters

file_id	associated file id
artifactTypeName	System name of artifact type

Returns

the new artifact

Exceptions

error

if the artifact type does not exist

Implements TskBlackboard.

void TskDBBlackboard::createGenInfoAttribute ( const uint64_t  file_id, TskBlackboardAttribute &  attr  )

virtual

Add a new attribute to the general info artifact for the given file.

Parameters

file_id	file id for the file to add the attribute to
attr	and attribute populated with values. this attribute will have its artifact_id and obj_id set by this method.

Exceptions

error

if no file with the given id exists or if a bad attribute is passed in.

Implements TskBlackboard.

References TskFile::addGenInfoAttribute(), and TskFileManagerImpl::getFile().

vector< int > TskDBBlackboard::findAttributeTypes ( int  artifactTypeId)

virtual

Search the entire blackboard for all attribute types associated with any artifact of the given type.

Parameters

artifactTypeId

artifact type to search

Returns

a vector of attribute ids can return an empty vector if no types are found

Implements TskBlackboard.

vector< TskBlackboardArtifact > TskDBBlackboard::getArtifacts ( const uint64_t  file_id, const string &  artifactTypeName  ) const

virtual

Get all artifacts with the given type name and file id.

Parameters

file_id	associated file id
artifactTypeName	type name

Returns

vector of matching artifacts can return an empty vector if there are no matches

Implements TskBlackboard.

vector< TskBlackboardArtifact > TskDBBlackboard::getArtifacts ( const uint64_t  file_id, int  artifactTypeID  ) const

virtual

Get all artifacts with the given type id and file id.

Parameters

file_id	associated file id
artifactTypeID	type id

Returns

vector of matching artifacts can return an empty vector if there are no matches

Implements TskBlackboard.

vector< TskBlackboardArtifact > TskDBBlackboard::getArtifacts ( const uint64_t  file_id, TSK_ARTIFACT_TYPE  artifactType  ) const

virtual

Get all artifacts with the given type and file id.

Parameters

file_id	associated file id
artifactType	name

Returns

vector of matching artifacts can return an empty vector if there are no matches

Implements TskBlackboard.

vector< TskBlackboardArtifact > TskDBBlackboard::getArtifacts ( const TSK_ARTIFACT_TYPE  artifactType) const

virtual

Get all artifacts with the given type.

Parameters

artifactType

type

Returns

vector of matching artifacts can return an empty vector if there are no matches

Implements TskBlackboard.

vector< TskBlackboardAttribute > TskDBBlackboard::getAttributes ( const uint64_t  file_id, const string &  attributeTypeName  ) const

virtual

Get all attributes with the given type name and file id.

Parameters

file_id	associated file id
attributeTypeName	type name

Returns

vector of matching attributes can return an empty vector if there are no matches

Implements TskBlackboard.

vector< TskBlackboardAttribute > TskDBBlackboard::getAttributes ( const uint64_t  file_id, int  attributeTypeID  ) const

virtual

Get all attributes with the given type and file id.

Parameters

file_id	associated file id
attributeTypeID	Type of attribute to return

Returns

vector of matching attributes can return an empty vector if there are no matches

Implements TskBlackboard.

vector< TskBlackboardAttribute > TskDBBlackboard::getAttributes ( const uint64_t  file_id, TSK_ATTRIBUTE_TYPE  attributeType  ) const

virtual

Get all attributes with the given type and file id.

Parameters

file_id	associated file id
attributeType	name

Returns

vector of matching attributes can return an empty vector if there are no matches

Implements TskBlackboard.

vector< TskBlackboardAttribute > TskDBBlackboard::getAttributes ( const TSK_ATTRIBUTE_TYPE  attributeType) const

virtual

Get all attributes with the given type.

Parameters

attributeType

type

Returns

vector of matching attributes can return an empty vector if there are no matches

Implements TskBlackboard.

TskBlackboardArtifact TskDBBlackboard::getBlackboardArtifact ( const long  artifactID)

virtual

Get the artifact with the given id.

Parameters

artifactID

id

Returns

the artifact throws an error if no artifact matches that id.

Implements TskBlackboard.

vector< TskBlackboardArtifact > TskDBBlackboard::getMatchingArtifacts ( const string &  condition) const

virtual

Get all artifacts that match the given condition.

Parameters

condition

condition (implementation specific) to use for matching

Returns

vector of matching artifacts can return an empty vector if there are no matches

Exceptions

error

if a bad condition string is supplied

Implements TskBlackboard.

vector< TskBlackboardAttribute > TskDBBlackboard::getMatchingAttributes ( const string &  condition) const

virtual

Get all attributes that match the given condition.

Parameters

condition

(implementation specific) to use for matching

Returns

vector of matching attributes can return an empty vector if there are no matches

Exceptions

error

if a bad condition string is supplied

Implements TskBlackboard.

---

The documentation for this class was generated from the following files:

• framework/tsk/framework/services/TskDBBlackboard.h
• framework/tsk/framework/services/TskDBBlackboard.cpp