Autopsy  4.12.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
InterestingArtifactCreatorIngestModule.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2019 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.test;
20 
21 import java.util.ArrayList;
22 import java.util.Collection;
23 import java.util.logging.Level;
24 import org.openide.util.NbBundle;
30 import org.sleuthkit.datamodel.AbstractFile;
31 import org.sleuthkit.datamodel.Blackboard;
32 import org.sleuthkit.datamodel.BlackboardArtifact;
33 import org.sleuthkit.datamodel.BlackboardAttribute;
34 import org.sleuthkit.datamodel.TskCoreException;
35 
40 @NbBundle.Messages({
41  "InterestingArtifactCreatorIngestModule.exceptionMessage.errorCreatingCustomType=Error creating custom artifact type."
42 })
43 final class InterestingArtifactCreatorIngestModule extends FileIngestModuleAdapter {
44 
45  private static final Logger logger = Logger.getLogger(InterestingArtifactCreatorIngestModule.class.getName());
46  private static final String MODULE_NAME = InterestingArtifactCreatorIngestModuleFactory.getModuleName();
47  private static final String[] ARTIFACT_TYPE_NAMES = {"TSK_WEB_BOOKMARK", "TSK_KEYWORD_HIT", "TSK_CALLLOG"};
48  private static final String[] ARTIFACT_DISPLAY_NAMES = {"Web Bookmarks", "Keyword Hits", "Call Logs"};
49  private static final String INT_ARTIFACT_TYPE_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getLabel();
50  private static final String INT_ARTIFACT_DISPLAY_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName();
51  private BlackboardArtifact.Type artifactType;
52 
53  @Override
54  public void startUp(IngestJobContext context) throws IngestModuleException {
55  try {
56  Blackboard blackboard = Case.getCurrentCaseThrows().getServices().getArtifactsBlackboard();
57  artifactType = blackboard.getOrAddArtifactType(INT_ARTIFACT_TYPE_NAME, INT_ARTIFACT_DISPLAY_NAME);
58  } catch (Blackboard.BlackboardException | NoCurrentCaseException ex) {
59  throw new IngestModuleException(Bundle.InterestingArtifactCreatorIngestModule_exceptionMessage_errorCreatingCustomType(), ex);
60  }
61  }
62 
63  @Override
64  public ProcessResult process(AbstractFile file) {
65  /*
66  * Skip directories and virtual files.
67  */
68  if (file.isDir() || file.isVirtual()) {
69  return ProcessResult.OK;
70  }
71 
72  try {
73  /*
74  * Add a custom artifact with one custom attribute of each value
75  * type.
76  */
77  int randomArtIndex = (int) (Math.random() * 3);
78  Blackboard blackboard = Case.getCurrentCaseThrows().getServices().getArtifactsBlackboard();
79  BlackboardArtifact.Type artifactTypeBase = blackboard.getOrAddArtifactType(ARTIFACT_TYPE_NAMES[randomArtIndex], ARTIFACT_DISPLAY_NAMES[randomArtIndex]);
80  BlackboardArtifact artifactBase = file.newArtifact(artifactTypeBase.getTypeID());
81  Collection<BlackboardAttribute> baseAttributes = new ArrayList<>();
82  String commentTxt;
83  BlackboardAttribute baseAttr;
84  switch (artifactBase.getArtifactTypeID()) {
85  case 2:
86  commentTxt = "www.placeholderWebsiteDOTCOM";
87  baseAttr = new BlackboardAttribute(
88  BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL, "Fake Web BookMark", "www.thisWebsiteIsStillFake.com");
89  baseAttributes.add(baseAttr);
90  break;
91  case 9:
92  commentTxt = "fakeKeyword";
93  baseAttr = new BlackboardAttribute(
94  BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW, "Fake Keyword Search", "Fake Keyword Preview Text");
95  BlackboardAttribute set = new BlackboardAttribute(
96  BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, "Fake Keyword Search", "Fake");
97  BlackboardAttribute keyword = new BlackboardAttribute(
98  BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD, "Fake Keyword Search", "FakeKeyword");
99  baseAttributes.add(baseAttr);
100  baseAttributes.add(set);
101  baseAttributes.add(keyword);
102  break;
103  case 25:
104  commentTxt = "fake phone number from";
105  baseAttr = new BlackboardAttribute(
106  BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM, "Fake Call Log Whatever", "555-555-5555");
107  baseAttributes.add(baseAttr);
108  break;
109  default:
110  commentTxt = "DEPENDENT ON ARTIFACT TYPE";
111  break;
112  }
113  artifactBase.addAttributes(baseAttributes);
114  BlackboardArtifact artifact = file.newArtifact(artifactType.getTypeID());
115  Collection<BlackboardAttribute> attributes = new ArrayList<>();
116  BlackboardAttribute att = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, MODULE_NAME, "ArtifactsAndTxt");
117 
118  BlackboardAttribute att2 = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT, MODULE_NAME, commentTxt);
119  BlackboardAttribute att3 = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY, MODULE_NAME, "");
120  attributes.add(att);
121  attributes.add(att2);
122  attributes.add(att3);
123  attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT, MODULE_NAME, artifactBase.getArtifactID()));
124  artifact.addAttributes(attributes);
125  } catch (TskCoreException | NoCurrentCaseException ex) {
126  logger.log(Level.SEVERE, String.format("Failed to process file (obj_id = %d)", file.getId()), ex);
127  return ProcessResult.ERROR;
128  } catch (Blackboard.BlackboardException ex) {
129  logger.log(Level.WARNING, "Blackboard Exception processing file with obj_id = " + file.getId(), ex);
130  }
131  return ProcessResult.OK;
132  }
133 
134 }

Copyright © 2012-2018 Basis Technology. Generated on: Wed Sep 18 2019
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.