Classes
enum	CallMediaType

enum	CommunicationDirection

enum	MessageReadStatusEnum

Public Member Functions
	AppDBParserHelper (String moduleName, AbstractFile dbFile, Account.Type accountsType) throws TskCoreException

	AppDBParserHelper (String moduleName, AbstractFile dbFile, Account.Type accountsType, Account.Type selfAccountType, Account.Address selfAccountAddress) throws TskCoreException

	AppDBParserHelper (String moduleName, AbstractFile dbFile)

BlackboardArtifact	addCalllog (CommunicationDirection direction, Account.Address fromAddress, Account.Address toAddress, long startDateTime, long endDateTime)

BlackboardArtifact	addCalllog (CommunicationDirection direction, Account.Address fromAddress, Account.Address toAddress, long startDateTime, long endDateTime, CallMediaType mediaType)

BlackboardArtifact	addCalllog (CommunicationDirection direction, Account.Address fromAddress, Account.Address toAddress, long startDateTime, long endDateTime, CallMediaType mediaType, Collection< BlackboardAttribute > otherAttributesList)

BlackboardArtifact	addCalllog (CommunicationDirection direction, Account.Address fromAddress, Collection< Account.Address > toAddressList, long startDateTime, long endDateTime)

BlackboardArtifact	addCalllog (CommunicationDirection direction, Account.Address fromAddress, Collection< Account.Address > toAddressList, long startDateTime, long endDateTime, CallMediaType mediaType)

BlackboardArtifact	addCalllog (CommunicationDirection direction, Account.Address fromAddress, Collection< Account.Address > toAddressList, long startDateTime, long endDateTime, CallMediaType mediaType, Collection< BlackboardAttribute > otherAttributesList)

BlackboardArtifact	addContact (String contactAccountUniqueID, String contactName, String phoneNumber, String homePhoneNumber, String mobilePhoneNumber, String emailAddr)

BlackboardArtifact	addContact (String contactAccountUniqueID, String contactName, String phoneNumber, String homePhoneNumber, String mobilePhoneNumber, String emailAddr, Collection< BlackboardAttribute > additionalAttributes)

BlackboardArtifact	addGPSLocation (double latitude, double longitude, long timeStamp, String poiName, String programName)

BlackboardArtifact	addGPSLocation (double latitude, double longitude, long timeStamp, String name, String programName, Collection< BlackboardAttribute > otherAttributesList)

BlackboardArtifact	addInstalledProgram (String programName, long dateInstalled)

BlackboardArtifact	addInstalledProgram (String programName, long dateInstalled, Collection< BlackboardAttribute > otherAttributesList)

BlackboardArtifact	addMessage (String messageType, CommunicationDirection direction, Account.Address fromAddress, Account.Address toAddress, long dateTime, MessageReadStatusEnum readStatus, String subject, String messageText, String threadId)

BlackboardArtifact	addMessage (String messageType, CommunicationDirection direction, Account.Address fromAddress, Account.Address toAddress, long dateTime, MessageReadStatusEnum readStatus, String subject, String messageText, String threadId, Collection< BlackboardAttribute > otherAttributesList)

BlackboardArtifact	addMessage (String messageType, CommunicationDirection direction, Account.Address fromAddress, List< Account.Address > recipientsList, long dateTime, MessageReadStatusEnum readStatus, String subject, String messageText, String threadId)

BlackboardArtifact	addMessage (String messageType, CommunicationDirection direction, Account.Address fromAddress, List< Account.Address > recipientsList, long dateTime, MessageReadStatusEnum readStatus, String subject, String messageText, String threadId, Collection< BlackboardAttribute > otherAttributesList)

BlackboardArtifact	addWebBookmark (String url, String title, long creationTime, String progName)

BlackboardArtifact	addWebBookmark (String url, String title, long creationTime, String progName, Collection< BlackboardAttribute > otherAttributesList)

BlackboardArtifact	addWebCookie (String url, long creationTime, String name, String value, String programName)

BlackboardArtifact	addWebCookie (String url, long creationTime, String name, String value, String programName, Collection< BlackboardAttribute > otherAttributesList)

BlackboardArtifact	addWebDownload (String path, long startTime, String url, String progName)

BlackboardArtifact	addWebDownload (String path, long startTime, String url, String programName, Collection< BlackboardAttribute > otherAttributesList)

BlackboardArtifact	addWebFormAddress (String personName, String email, String phoneNumber, String mailingAddress, long creationTime, long accessTime, int count)

BlackboardArtifact	addWebFormAddress (String personName, String email, String phoneNumber, String mailingAddress, long creationTime, long accessTime, int count, Collection< BlackboardAttribute > otherAttributesList)

BlackboardArtifact	addWebFormAutofill (String name, String value, long creationTime, long accessTime, int count)

BlackboardArtifact	addWebFormAutofill (String name, String value, long creationTime, long accessTime, int count, Collection< BlackboardAttribute > otherAttributesList)

BlackboardArtifact	addWebHistory (String url, long accessTime, String referrer, String title, String programName)

BlackboardArtifact	addWebHistory (String url, long accessTime, String referrer, String title, String programName, Collection< BlackboardAttribute > otherAttributesList)

Private Member Functions
void	addRelationship (AccountFileInstance selfAccountInstance, AccountFileInstance otherAccountInstance, BlackboardArtifact sourceArtifact, Relationship.Type relationshipType, long dateTime)

String	addressListToString (Collection< Account.Address > addressList)

AccountFileInstance	createAccountInstance (Account.Type accountType, String accountUniqueID) throws TskCoreException

Private Attributes
final Account.Type	accountsType

final AbstractFile	dbAbstractFile

final String	moduleName

final AccountFileInstance	selfAccountInstance

Static Private Attributes
static final Logger	logger = Logger.getLogger(AppDBParserHelper.class.getName())

Detailed Description

A helper class to support modules that parse SQLite databases from mobile apps and create artifacts.

Definition at line 46 of file AppDBParserHelper.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.coreutils.AppDBParserHelper.AppDBParserHelper	(	String	moduleName,
		AbstractFile	dbFile,
		Account.Type	accountsType
	)		throws TskCoreException

Constructs a AppDB parser helper for the given DB file.

This is a constructor for Apps that that do not have any app specific account information for device owner and will use a 'Device' account in lieu.

It creates a DeviceAccount instance to use as a self account.

Parameters

moduleName	name module using the helper
dbFile	database file being parsed by the module
accountsType	account types created by this module

Exceptions

TskCoreException

Definition at line 124 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.coreutils.AppDBParserHelper.accountsType, org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.coreutils.AppDBParserHelper.moduleName.

org.sleuthkit.autopsy.coreutils.AppDBParserHelper.AppDBParserHelper	(	String	moduleName,
		AbstractFile	dbFile,
		Account.Type	accountsType,
		Account.Type	selfAccountType,
		Account.Address	selfAccountAddress
	)		throws TskCoreException

Constructs a AppDB parser helper for the given DB file.

This constructor is for Apps that do have app specific account information for the device owner to create a 'self' account.

It creates a an account instance with specified type & id and uses it as a self account.

Parameters

moduleName	name module using the helper
dbFile	database file being parsed by the module
accountsType	account types created by this module
selfAccountType	self account type to be created for this module
selfAccountAddress	account unique id for the self account

Exceptions

TskCoreException

Definition at line 149 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.coreutils.AppDBParserHelper.accountsType, org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.coreutils.AppDBParserHelper.moduleName.

org.sleuthkit.autopsy.coreutils.AppDBParserHelper.AppDBParserHelper	(	String	moduleName,
		AbstractFile	dbFile
	)

Constructs a AppDB parser helper for the given DB file.

This is a constructor for Apps that do not need to create any accounts/relationships.

Parameters

moduleName	name of module parsing the DB
dbFile	db file

Definition at line 168 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.coreutils.AppDBParserHelper.accountsType, and org.sleuthkit.autopsy.coreutils.AppDBParserHelper.moduleName.

Member Function Documentation

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addCalllog	(	CommunicationDirection	direction,
		Account.Address	fromAddress,
		Account.Address	toAddress,
		long	startDateTime,
		long	endDateTime
	)

Adds a TSK_CALLLOG artifact.

Also creates an account instance for the caller/callee, and creates a relationship between the self account and the caller/callee account.

Parameters

direction	call direction
fromAddress	caller address, may be empty
toAddress	callee address, may be empty
startDateTime	start date/time
endDateTime	end date/time

Returns: call log artifact

Definition at line 510 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.coreutils.AppDBParserHelper.CallMediaType.UNKNOWN.

Referenced by org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addCalllog().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addCalllog	(	CommunicationDirection	direction,
		Account.Address	fromAddress,
		Account.Address	toAddress,
		long	startDateTime,
		long	endDateTime,
		CallMediaType	mediaType
	)

Adds a TSK_CALLLOG artifact.

Also creates an account instance for the caller/callee, and creates a relationship between the self account and the caller/callee account.

Parameters

direction	call direction
fromAddress	caller address, may be empty
toAddress	callee address, may be empty
startDateTime	start date/time
endDateTime	end date/time
mediaType	media type

Returns: call log artifact

Definition at line 533 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addCalllog().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addCalllog	(	CommunicationDirection	direction,
		Account.Address	fromAddress,
		Account.Address	toAddress,
		long	startDateTime,
		long	endDateTime,
		CallMediaType	mediaType,
		Collection< BlackboardAttribute >	otherAttributesList
	)

Adds a TSK_CALLLOG artifact.

Also creates an account instance for the caller/receiver, and creates a relationship between the self account and the caller/receiver account.

Parameters

direction	call direction
fromAddress	caller address, may be empty
toAddress	callee address, may be empty
startDateTime	start date/time
endDateTime	end date/time
mediaType	media type
otherAttributesList	other attributes

Returns: call log artifact

Definition at line 557 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addCalllog().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addCalllog	(	CommunicationDirection	direction,
		Account.Address	fromAddress,
		Collection< Account.Address >	toAddressList,
		long	startDateTime,
		long	endDateTime
	)

Adds a TSK_CALLLOG artifact.

Also creates an account instance for the caller/callees, and creates a relationship between the device owner account and the caller account as well between the device owner account and each callee account

Parameters

direction	call direction
fromAddress	caller address, may be empty
toAddressList	callee address list, may be empty
startDateTime	start date/time
endDateTime	end date/time

Returns: call log artifact

Definition at line 586 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addCalllog(), and org.sleuthkit.autopsy.coreutils.AppDBParserHelper.CallMediaType.UNKNOWN.

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addCalllog	(	CommunicationDirection	direction,
		Account.Address	fromAddress,
		Collection< Account.Address >	toAddressList,
		long	startDateTime,
		long	endDateTime,
		CallMediaType	mediaType
	)

Adds a TSK_CALLLOG artifact.

Also creates an account instance for the caller/callees, and creates a relationship between the device owner account and the caller account as well between the device owner account and each callee account

Parameters

direction	call direction
fromAddress	caller address, may be empty
toAddressList	callee address list, may be empty
startDateTime	start date/time
endDateTime	end date/time
mediaType	call media type

Returns: call log artifact

Definition at line 612 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addCalllog().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addCalllog	(	CommunicationDirection	direction,
		Account.Address	fromAddress,
		Collection< Account.Address >	toAddressList,
		long	startDateTime,
		long	endDateTime,
		CallMediaType	mediaType,
		Collection< BlackboardAttribute >	otherAttributesList
	)

Adds a TSK_CALLLOG artifact.

Also creates an account instance for the caller/callees, and creates a relationship between the device owner account and the caller account as well between the device owner account and each callee account

Parameters

direction	call direction
fromAddress	caller address, may be empty
toAddressList	callee address list, may be empty
startDateTime	start date/time
endDateTime	end date/time
mediaType	called media type
otherAttributesList	other attributes

Returns: calllog artifact

Definition at line 641 of file AppDBParserHelper.java.

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addContact	(	String	contactAccountUniqueID,
		String	contactName,
		String	phoneNumber,
		String	homePhoneNumber,
		String	mobilePhoneNumber,
		String	emailAddr
	)

Creates and adds a TSK_CONTACT artifact to the case, with specified attributes. Also creates an account instance of specified type for the contact with the specified ID.

Parameters

contactAccountUniqueID	unique id for the contact's account
contactName	Name of contact
phoneNumber	primary phone number for contact
homePhoneNumber	home phone number
mobilePhoneNumber	mobile phone number,
emailAddr	Email address for contact

Returns: artifact created

Definition at line 192 of file AppDBParserHelper.java.

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addContact	(	String	contactAccountUniqueID,
		String	contactName,
		String	phoneNumber,
		String	homePhoneNumber,
		String	mobilePhoneNumber,
		String	emailAddr,
		Collection< BlackboardAttribute >	additionalAttributes
	)

Creates and adds a TSK_CONTACT artifact to the case, with specified attributes. Also creates an account instance for the contact with the specified ID.

Parameters

contactAccountUniqueID	unique id for contact account
contactName	Name of contact
phoneNumber	primary phone number for contact
homePhoneNumber	home phone number
mobilePhoneNumber	mobile phone number,
emailAddr	Email address for contact
additionalAttributes	additional attributes for contact

Returns: contact artifact created

Definition at line 219 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.coreutils.AppDBParserHelper.accountsType, org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addRelationship(), org.sleuthkit.autopsy.coreutils.AppDBParserHelper.createAccountInstance(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addGPSLocation	(	double	latitude,
		double	longitude,
		long	timeStamp,
		String	poiName,
		String	programName
	)

Adds a TSK_GPS_TRACKPOINT artifact

Parameters

latitude	location latitude
longitude	location longitude
timeStamp	date/time trackpoint recoded
poiName	trackpoint name
programName	name of program that recorded trackpoint

Returns: artifact added

Definition at line 1239 of file AppDBParserHelper.java.

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addGPSLocation	(	double	latitude,
		double	longitude,
		long	timeStamp,
		String	name,
		String	programName,
		Collection< BlackboardAttribute >	otherAttributesList
	)

Adds a TSK_GPS_TRACKPOINT artifact

Parameters

latitude	location latitude
longitude	location longitude
timeStamp	date/time trackpoint recorded
name	trackpoint name
programName	name of program that recorded trackpoint
otherAttributesList	other attributes

Returns: artifact added

Definition at line 1258 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addInstalledProgram	(	String	programName,
		long	dateInstalled
	)

Adds a TSK_INSTALLED_PROGRAM artifact

Parameters

programName	name of program
dateInstalled	date of install

Returns: artifact added

Definition at line 1180 of file AppDBParserHelper.java.

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addInstalledProgram	(	String	programName,
		long	dateInstalled,
		Collection< BlackboardAttribute >	otherAttributesList
	)

Adds a TSK_INSTALLED_PROGRAM artifact

Parameters

programName	name of program
dateInstalled	date of install
otherAttributesList	additional attributes

Returns: artifact added

Definition at line 1194 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addMessage	(	String	messageType,
		CommunicationDirection	direction,
		Account.Address	fromAddress,
		Account.Address	toAddress,
		long	dateTime,
		MessageReadStatusEnum	readStatus,
		String	subject,
		String	messageText,
		String	threadId
	)

Adds a TSK_MESSAGE artifact.

Also creates an account instance for the sender/receiver, and creates a relationship between the self account and the sender/receiver account.

Parameters

messageType	message type
direction	message direction
fromAddress	sender address, may be null
toAddress	recipient address, may be null
dateTime	date/time of message,
readStatus	message read or not
subject	message subject, may be empty
messageText	message body, may be empty
threadId,message	thread id

Returns: message artifact

Definition at line 323 of file AppDBParserHelper.java.

Referenced by org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addMessage().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addMessage	(	String	messageType,
		CommunicationDirection	direction,
		Account.Address	fromAddress,
		Account.Address	toAddress,
		long	dateTime,
		MessageReadStatusEnum	readStatus,
		String	subject,
		String	messageText,
		String	threadId,
		Collection< BlackboardAttribute >	otherAttributesList
	)

Adds a TSK_MESSAGE artifact.

Also creates an account instance for the sender/receiver, and creates a relationship between the self account and the sender/receiver account.

Parameters

messageType	message type
direction	message direction
fromAddress	sender address, may be empty
toAddress	recipient address, may be empty
dateTime	date/time of message,
readStatus	message read or not
subject	message subject, may be empty
messageText	message body, may be empty
threadId,message	thread id
otherAttributesList	additional attributes

Returns: message artifact

Definition at line 356 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addMessage().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addMessage	(	String	messageType,
		CommunicationDirection	direction,
		Account.Address	fromAddress,
		List< Account.Address >	recipientsList,
		long	dateTime,
		MessageReadStatusEnum	readStatus,
		String	subject,
		String	messageText,
		String	threadId
	)

Adds a TSK_MESSAGE artifact.

Also creates an account instance for the sender/receiver, and creates a relationship between the self account and the sender/receiver account.

This method is for messages with a multiple recipients.

Parameters

messageType	message type
direction	message direction
fromAddress	sender address, may be null
recipientsList	recipient address list, may be null or empty list
dateTime	date/time of message,
readStatus	message read or not
subject	message subject, may be empty
messageText	message body, may be empty
threadId,message	thread id

Returns: message artifact

Definition at line 393 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addMessage().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addMessage	(	String	messageType,
		CommunicationDirection	direction,
		Account.Address	fromAddress,
		List< Account.Address >	recipientsList,
		long	dateTime,
		MessageReadStatusEnum	readStatus,
		String	subject,
		String	messageText,
		String	threadId,
		Collection< BlackboardAttribute >	otherAttributesList
	)

Definition at line 407 of file AppDBParserHelper.java.

void org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addRelationship	(	AccountFileInstance	selfAccountInstance,
		AccountFileInstance	otherAccountInstance,
		BlackboardArtifact	sourceArtifact,
		Relationship.Type	relationshipType,
		long	dateTime
	)

private

Adds a relations between the two specified account instances.

Parameters

selfAccount	device owner account
otherAccount	other account
sourceArtifact	artifact from which relationship is derived.
relationshipType	type of relationship
dateTime	date/time of relationship

Definition at line 292 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addCalllog(), org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addContact(), and org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addMessage().

String org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addressListToString ( Collection< Account.Address > addressList )

private

Converts a list of addresses into a single comma separated string of addresses.

Parameters

addressList

Returns: comma separated string of addresses

Definition at line 1307 of file AppDBParserHelper.java.

Referenced by org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addCalllog(), and org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addMessage().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addWebBookmark	(	String	url,
		String	title,
		long	creationTime,
		String	progName
	)

Adds a TSK_WEB_BOOKMARK artifact.

Parameters

url	bookmark URL
title	bookmark title, may be empty
creationTime	date/time created
progName	application/program that created bookmark

Returns: bookmark artifact

Definition at line 724 of file AppDBParserHelper.java.

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addWebBookmark	(	String	url,
		String	title,
		long	creationTime,
		String	progName,
		Collection< BlackboardAttribute >	otherAttributesList
	)

Adds a TSK_WEB_BOOKMARK artifact.

Parameters

url	bookmark URL
title	bookmark title, may be empty
creationTime	date/time created
progName	application/program that created bookmark
otherAttributesList	other attributes

Returns: bookmark artifact

Definition at line 740 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.coreutils.NetworkUtils.extractDomain(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addWebCookie	(	String	url,
		long	creationTime,
		String	name,
		String	value,
		String	programName
	)

Adds a TSK_WEB_COOKIE artifact

Parameters

url	url of the site that created the cookie
creationTime	create time of cookie
name	cookie name
value	cookie value
programName	name of the application that created the cookie

Returns: WebCookie artifact

Definition at line 795 of file AppDBParserHelper.java.

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addWebCookie	(	String	url,
		long	creationTime,
		String	name,
		String	value,
		String	programName,
		Collection< BlackboardAttribute >	otherAttributesList
	)

Adds a TSK_WEB_COOKIE artifact

Parameters

url	url of the site that created the cookie
creationTime	create time of cookie
name	cookie name
value	cookie value
programName	name of the application that created the cookie
otherAttributesList	other attributes

Returns: WebCookie artifact

Definition at line 815 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.coreutils.NetworkUtils.extractDomain(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addWebDownload	(	String	path,
		long	startTime,
		String	url,
		String	progName
	)

Created a TSK_WEB_DOWNNLOAD artifact

Parameters

path	path of downloaded file
startTime	date/time downloaded
url	URL downloaded from
progName	program that initiated download

Returns: artifact created

Definition at line 952 of file AppDBParserHelper.java.

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addWebDownload	(	String	path,
		long	startTime,
		String	url,
		String	programName,
		Collection< BlackboardAttribute >	otherAttributesList
	)

Created a TSK_WEB_DOWNNLOAD artifact

Parameters

path	path of downloaded file
startTime	date/time downloaded
url	URL downloaded from
programName	program that initiated download
otherAttributesList	other attributes

Returns: artifact created

Convert path to pathID

Definition at line 968 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.coreutils.NetworkUtils.extractDomain(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addWebFormAddress	(	String	personName,
		String	email,
		String	phoneNumber,
		String	mailingAddress,
		long	creationTime,
		long	accessTime,
		int	count
	)

Adds a TSK_WEB_FORM_AUTOFILL artifact.

Parameters

personName	person name
email	email address
phoneNumber	phone number
mailingAddress	mailing address
creationTime	creation time
accessTime	last access time
count	use count

Returns: artifact created

Definition at line 1099 of file AppDBParserHelper.java.

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addWebFormAddress	(	String	personName,
		String	email,
		String	phoneNumber,
		String	mailingAddress,
		long	creationTime,
		long	accessTime,
		int	count,
		Collection< BlackboardAttribute >	otherAttributesList
	)

Adds a TSK_WEB_FORM_AUTOFILL artifact.

Parameters

personName	person name
email	email address
phoneNumber	phone number
mailingAddress	mailing address
creationTime	creation time
accessTime	last access time
count	use count
otherAttributesList	other attributes

Returns: artifact created

Definition at line 1121 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addWebFormAutofill	(	String	name,
		String	value,
		long	creationTime,
		long	accessTime,
		int	count
	)

Adds a TSK_WEB_FORM_AUTOFILL artifact

Parameters

name	name of autofill field
value	value of autofill field
creationTime	create date/time
accessTime	last access date/time
count	count of times used

Returns: artifact created

Definition at line 1027 of file AppDBParserHelper.java.

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addWebFormAutofill	(	String	name,
		String	value,
		long	creationTime,
		long	accessTime,
		int	count,
		Collection< BlackboardAttribute >	otherAttributesList
	)

Adds a TSK_WEB_FORM_AUTOFILL artifact

Parameters

name	name of autofill field
value	value of autofill field
creationTime	create date/time
accessTime	last access date/time
count	count of times used
otherAttributesList	additional attributes

Returns: artifact created

Definition at line 1045 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addWebHistory	(	String	url,
		long	accessTime,
		String	referrer,
		String	title,
		String	programName
	)

Adds a Web History artifact

Parameters

url	url visited
accessTime	last access time
referrer	referrer, may be empty
title	website title, may be empty
programName,application	recording the history

Returns: artifact created

Definition at line 874 of file AppDBParserHelper.java.

BlackboardArtifact org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addWebHistory	(	String	url,
		long	accessTime,
		String	referrer,
		String	title,
		String	programName,
		Collection< BlackboardAttribute >	otherAttributesList
	)

Adds a Web History artifact

Parameters

url	url visited
accessTime	last access time
referrer	referrer, may be empty
title	website title, may be empty
programName,application	recording the history
otherAttributesList	other attributes

Returns: artifact created

Definition at line 894 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.coreutils.NetworkUtils.extractDomain(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

AccountFileInstance org.sleuthkit.autopsy.coreutils.AppDBParserHelper.createAccountInstance	(	Account.Type	accountType,
		String	accountUniqueID
	)		throws TskCoreException

private

Creates an account file instance associated with the DB file.

Parameters

accountType
accountUniqueID

Returns

Exceptions

TskCoreException

Definition at line 278 of file AppDBParserHelper.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCase(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addCalllog(), org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addContact(), and org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addMessage().

Member Data Documentation

final Account.Type org.sleuthkit.autopsy.coreutils.AppDBParserHelper.accountsType

private

Definition at line 108 of file AppDBParserHelper.java.

Referenced by org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addCalllog(), org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addContact(), org.sleuthkit.autopsy.coreutils.AppDBParserHelper.addMessage(), and org.sleuthkit.autopsy.coreutils.AppDBParserHelper.AppDBParserHelper().

final AbstractFile org.sleuthkit.autopsy.coreutils.AppDBParserHelper.dbAbstractFile

private

Definition at line 101 of file AppDBParserHelper.java.

final Logger org.sleuthkit.autopsy.coreutils.AppDBParserHelper.logger = Logger.getLogger(AppDBParserHelper.class.getName())

staticprivate

Definition at line 48 of file AppDBParserHelper.java.

final String org.sleuthkit.autopsy.coreutils.AppDBParserHelper.moduleName

private

Definition at line 102 of file AppDBParserHelper.java.

Referenced by org.sleuthkit.autopsy.coreutils.AppDBParserHelper.AppDBParserHelper().

final AccountFileInstance org.sleuthkit.autopsy.coreutils.AppDBParserHelper.selfAccountInstance

private

Definition at line 105 of file AppDBParserHelper.java.

The documentation for this class was generated from the following file:

/home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/coreutils/AppDBParserHelper.java

Classes

Public Member Functions

Private Member Functions

Private Attributes

Static Private Attributes

Detailed Description

Constructor & Destructor Documentation

Member Function Documentation

Member Data Documentation