Autopsy  4.14.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Private Member Functions | Static Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule Class Reference

Inherits org.sleuthkit.autopsy.report.ReportModule.

Classes

class  GetImageTagCallback
 
class  GetInterestingItemSetNamesCallback
 
class  StoreMaxIdCallback
 

Public Member Functions

 PortableCaseReportModule ()
 
void generateReport (String reportPath, PortableCaseReportModuleSettings options, ReportProgressPanel progressPanel)
 
default ReportModuleSettings getConfiguration ()
 
default JPanel getConfigurationPanel ()
 
default ReportModuleSettings getDefaultConfiguration ()
 
String getDescription ()
 
String getName ()
 
String getRelativeFilePath ()
 
default void setConfiguration (ReportModuleSettings settings)
 

Private Member Functions

void addArtifactsToPortableCase (TagName oldTagName, ReportProgressPanel progressPanel) throws TskCoreException
 
void addFilesToPortableCase (TagName oldTagName, ReportProgressPanel progressPanel) throws TskCoreException
 
void addImageTagToPortableCase (ContentTag newContentTag, String appData) throws TskCoreException
 
boolean addUniqueFile (Content content, Content dataSource, Path tmpDir, CaseUcoReportGenerator reportGenerator, boolean dataSourceHasBeenIncluded) throws IOException, TskCoreException
 
void cleanup ()
 
void closePortableCaseDatabase ()
 
boolean compressCase (ReportProgressPanel progressPanel)
 
BlackboardArtifact copyArtifact (long newContentId, BlackboardArtifact artifactToCopy) throws TskCoreException
 
long copyContent (Content content) throws TskCoreException
 
long copyContentToPortableCase (Content content, ReportProgressPanel progressPanel) throws TskCoreException
 
void createCase (File outputDir, ReportProgressPanel progressPanel)
 
void generateCaseUcoReport (List< TagName > tagNames, List< String > setNames, ReportProgressPanel progressPanel)
 
List< String > getAllInterestingItemsSets () throws NoCurrentCaseException, TskCoreException
 
String getExportSubfolder (AbstractFile abstractFile)
 
String getImageTagDataForContentTag (ContentTag tag) throws TskCoreException
 
Multimap< Long, BlackboardArtifact > getInterestingArtifactsBySetName (SleuthkitCase skCase, List< String > setNames) throws TskCoreException
 
int getNewArtifactTypeId (BlackboardArtifact oldArtifact) throws TskCoreException
 
BlackboardAttribute.Type getNewAttributeType (BlackboardAttribute oldAttribute) throws TskCoreException
 
void handleCancellation (ReportProgressPanel progressPanel)
 
void handleError (String logWarning, String dialogWarning, Exception ex, ReportProgressPanel progressPanel)
 
void initializeImageTags (ReportProgressPanel progressPanel) throws TskCoreException
 
void saveHighestIds () throws TskCoreException
 

Static Private Member Functions

static File locate7ZipExecutable ()
 

Private Attributes

File caseFolder = null
 
String caseName = ""
 
File copiedFilesFolder = null
 
Case currentCase = null
 
final Map< Long, Content > newIdToContent = new HashMap<>()
 
final Map< Long, BlackboardArtifact > oldArtifactIdToNewArtifact = new HashMap<>()
 
final Map< Integer, Integer > oldArtTypeIdToNewArtTypeId = new HashMap<>()
 
final Map< Integer, BlackboardAttribute.Type > oldAttrTypeIdToNewAttrType = new HashMap<>()
 
final Map< Long, Content > oldIdToNewContent = new HashMap<>()
 
final Map< TagName, TagName > oldTagNameToNewTagName = new HashMap<>()
 
SleuthkitCase portableSkCase = null
 
PortableCaseReportModuleSettings settings
 

Static Private Attributes

static final String CASE_UCO_FILE_NAME = "portable_CASE_UCO_output"
 
static final String CASE_UCO_TMP_DIR = "case_uco_tmp"
 
static final String FILE_FOLDER_NAME = "PortableCaseFiles"
 
static final List< FileTypeCategoryFILE_TYPE_CATEGORIES
 
static final Logger logger = Logger.getLogger(PortableCaseReportModule.class.getName())
 
static final String MAX_ID_TABLE_NAME = "portable_case_max_ids"
 
static final String UNKNOWN_FILE_TYPE_FOLDER = "Other"
 

Detailed Description

Creates a portable case from tagged files

Definition at line 77 of file PortableCaseReportModule.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.PortableCaseReportModule ( )

Definition at line 114 of file PortableCaseReportModule.java.

Member Function Documentation

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addArtifactsToPortableCase ( TagName  oldTagName,
ReportProgressPanel  progressPanel 
) throws TskCoreException
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addFilesToPortableCase ( TagName  oldTagName,
ReportProgressPanel  progressPanel 
) throws TskCoreException
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addImageTagToPortableCase ( ContentTag  newContentTag,
String  appData 
) throws TskCoreException
private

Add an image tag to the portable case.

Parameters
newContentTagThe content tag in the portable case
appDataThe string to copy into app_data
Exceptions
TskCoreException

Definition at line 813 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.casemodule.services.contentviewertags.ContentViewerTagManager.TABLE_NAME.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addFilesToPortableCase().

boolean org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addUniqueFile ( Content  content,
Content  dataSource,
Path  tmpDir,
CaseUcoReportGenerator  reportGenerator,
boolean  dataSourceHasBeenIncluded 
) throws IOException, TskCoreException
private

Adds the content if and only if it has not already been seen.

Parameters
contentContent to add to the report.
dataSourceParent dataSource of the content instance.
tmpDirPath to the tmpDir to enforce uniqueness
reportGeneratorReport generator instance to add the content to
dataSourceHasBeenIncludedFlag determining if the data source should be written before the file. False will cause the data source to be written.
Exceptions
IOExceptionIf an I/O error occurs.
TskCoreExceptionIf an internal database error occurs.

return True if the data source was written during this operation.

Definition at line 563 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.coreutils.FileUtil.escapeFileName(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getExportSubfolder().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateCaseUcoReport().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.cleanup ( )
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.closePortableCaseDatabase ( )
private
boolean org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.compressCase ( ReportProgressPanel  progressPanel)
private
BlackboardArtifact org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyArtifact ( long  newContentId,
BlackboardArtifact  artifactToCopy 
) throws TskCoreException
private

Copy an artifact into the new case. Will also copy any associated artifacts

Parameters
newContentIdThe content ID (in the portable case) of the source content
artifactToCopyThe artifact to copy
Returns
The new artifact in the portable case
Exceptions
TskCoreException

Definition at line 864 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getNewArtifactTypeId(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getNewAttributeType(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addArtifactsToPortableCase(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContent().

long org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContent ( Content  content) throws TskCoreException
private
long org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContentToPortableCase ( Content  content,
ReportProgressPanel  progressPanel 
) throws TskCoreException
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createCase ( File  outputDir,
ReportProgressPanel  progressPanel 
)
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateCaseUcoReport ( List< TagName >  tagNames,
List< String >  setNames,
ReportProgressPanel  progressPanel 
)
private

Generates a CASE-UCO report for all files that have a specified TagName or TSK_INTERESTING artifacts that are flagged by the specified SET_NAMEs.

Only one copy of the file will be saved in the report if it is the source of more than one of the above.

Parameters
tagNamesTagNames to included in the report.
setNamesSET_NAMEs to include in the report.
progressPanelProgressPanel to relay progress messages.

It is currently believed that DataSources in a CASE-UCO report should precede all file entities. Therefore, before writing a file, add the data source if it has yet to be included.

Definition at line 455 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.caseuco.CaseUcoReportGenerator.addCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addUniqueFile(), org.sleuthkit.autopsy.report.modules.caseuco.CaseUcoReportGenerator.generateReport(), org.sleuthkit.autopsy.casemodule.services.TagsManager.getBlackboardArtifactTagsByTagName(), org.sleuthkit.autopsy.casemodule.services.TagsManager.getContentTagsByTagName(), org.sleuthkit.autopsy.casemodule.Case.getDataSources(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getInterestingArtifactsBySetName(), org.sleuthkit.autopsy.casemodule.Case.getServices(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.casemodule.services.Services.getTagsManager(), org.sleuthkit.autopsy.casemodule.Case.getTempDirectory(), and org.sleuthkit.autopsy.report.ReportProgressPanel.updateStatusLabel().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport ( String  reportPath,
PortableCaseReportModuleSettings  options,
ReportProgressPanel  progressPanel 
)

Definition at line 205 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addArtifactsToPortableCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addFilesToPortableCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.areAllSetsSelected(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.areAllTagsSelected(), org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.CANCELED, org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.cleanup(), org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.COMPLETE, org.sleuthkit.autopsy.report.ReportProgressPanel.complete(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.compressCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContentToPortableCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateCaseUcoReport(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getAllInterestingItemsSets(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.casemodule.Case.getDisplayName(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.getSelectedSetNames(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.getSelectedTagNames(), org.sleuthkit.autopsy.casemodule.Case.getServices(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.report.ReportProgressPanel.getStatus(), org.sleuthkit.autopsy.casemodule.services.TagsManager.getTagNamesInUse(), org.sleuthkit.autopsy.casemodule.services.Services.getTagsManager(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleCancellation(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleError(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.initializeImageTags(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldAttrTypeIdToNewAttrType, org.sleuthkit.autopsy.report.ReportProgressPanel.setIndeterminate(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.shouldCompress(), org.sleuthkit.autopsy.report.ReportProgressPanel.start(), and org.sleuthkit.autopsy.report.ReportProgressPanel.updateStatusLabel().

List<String> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getAllInterestingItemsSets ( ) throws NoCurrentCaseException, TskCoreException
private
default ReportModuleSettings org.sleuthkit.autopsy.report.ReportModule.getConfiguration ( )
inherited

Get current configuration for this report module.

Returns
Object which contains current report module settings.

Implemented in org.sleuthkit.autopsy.report.modules.stix.STIXReportModule, org.sleuthkit.autopsy.report.modules.html.HTMLReport, and org.sleuthkit.autopsy.report.modules.taggedhashes.SaveTaggedHashesToHashDb.

Definition at line 79 of file ReportModule.java.

default JPanel org.sleuthkit.autopsy.report.ReportModule.getConfigurationPanel ( )
inherited

Returns the configuration panel for the report, which is displayed in the report configuration step of the report wizard.

Returns
Configuration panel or null if the module does not need configuration.

Implemented in org.sleuthkit.autopsy.report.modules.kml.KMLReport, org.sleuthkit.autopsy.report.modules.stix.STIXReportModule, org.sleuthkit.autopsy.report.modules.taggedhashes.SaveTaggedHashesToHashDb, org.sleuthkit.autopsy.report.modules.html.HTMLReport, org.sleuthkit.autopsy.report.modules.caseuco.CaseUcoReportModule, and org.sleuthkit.autopsy.report.GeneralReportModuleAdapter.

Definition at line 61 of file ReportModule.java.

default ReportModuleSettings org.sleuthkit.autopsy.report.ReportModule.getDefaultConfiguration ( )
inherited
String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getDescription ( )

Gets a one-line, user friendly description of the type of report this module generates.

Implements org.sleuthkit.autopsy.report.ReportModule.

Definition at line 129 of file PortableCaseReportModule.java.

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getExportSubfolder ( AbstractFile  abstractFile)
private

Return the subfolder name for this file based on MIME type

Parameters
abstractFilethe file
Returns
the name of the appropriate subfolder for this file type

Definition at line 1109 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.UNKNOWN_FILE_TYPE_FOLDER.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addUniqueFile(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContent().

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getImageTagDataForContentTag ( ContentTag  tag) throws TskCoreException
private

Gets the image tag data for a given content tag

Parameters
tagThe ContentTag in the current case
Returns
The app_data string for this content tag or an empty string if there was none
Exceptions
TskCoreException

Definition at line 764 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.casemodule.services.contentviewertags.ContentViewerTagManager.TABLE_NAME.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addFilesToPortableCase().

Multimap<Long, BlackboardArtifact> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getInterestingArtifactsBySetName ( SleuthkitCase  skCase,
List< String >  setNames 
) throws TskCoreException
private

Load all interesting BlackboardArtifacts that belong to the selected SET_NAME. This operation would be duplicated for every data source, since the Sleuthkit API does not have a notion of searching by data source id.

Definition at line 530 of file PortableCaseReportModule.java.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateCaseUcoReport().

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getName ( )
int org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getNewArtifactTypeId ( BlackboardArtifact  oldArtifact) throws TskCoreException
private

Get the artifact type ID in the portable case and create new artifact type if needed. For built-in artifacts this will be the same as the original.

Parameters
oldArtifactThe artifact in the current case
Returns
The corresponding artifact type ID in the portable case

Definition at line 936 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyArtifact().

BlackboardAttribute.Type org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getNewAttributeType ( BlackboardAttribute  oldAttribute) throws TskCoreException
private

Get the attribute type ID in the portable case and create new attribute type if needed. For built-in attributes this will be the same as the original.

Parameters
oldAttributeThe attribute in the current case
Returns
The corresponding attribute type in the portable case

Definition at line 959 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldAttrTypeIdToNewAttrType.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyArtifact().

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getRelativeFilePath ( )

Gets the relative path of the report file, if any, generated by this module. The path should be relative to the location that gets passed in to generateReport() (or similar).

Returns
Relative path to where report will be stored. Return an empty string if the location passed to generateReport() is the output location. Return null to indicate that there is no report file.

Implements org.sleuthkit.autopsy.report.ReportModule.

Definition at line 134 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.caseName, org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), and org.sleuthkit.autopsy.casemodule.Case.getDisplayName().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleCancellation ( ReportProgressPanel  progressPanel)
private
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleError ( String  logWarning,
String  dialogWarning,
Exception  ex,
ReportProgressPanel  progressPanel 
)
private

Convenience method to avoid code duplication. Assumes that if an exception is supplied then the error is SEVERE. Otherwise it is logged as a WARNING.

Parameters
logWarningWarning to write to the log
dialogWarningWarning to write to a pop-up window
exThe exception (can be null)
progressPanelThe report progress panel

Definition at line 166 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.cleanup(), org.sleuthkit.autopsy.report.ReportProgressPanel.complete(), org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.ERROR, and org.sleuthkit.autopsy.report.ReportProgressPanel.setIndeterminate().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.compressCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createCase(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.initializeImageTags ( ReportProgressPanel  progressPanel) throws TskCoreException
private
static File org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.locate7ZipExecutable ( )
staticprivate
void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.saveHighestIds ( ) throws TskCoreException
private

Save the current highest IDs to the portable case.

Exceptions
TskCoreException

Definition at line 682 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createCase().

default void org.sleuthkit.autopsy.report.ReportModule.setConfiguration ( ReportModuleSettings  settings)
inherited

Member Data Documentation

final String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.CASE_UCO_FILE_NAME = "portable_CASE_UCO_output"
staticprivate

Definition at line 82 of file PortableCaseReportModule.java.

final String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.CASE_UCO_TMP_DIR = "case_uco_tmp"
staticprivate

Definition at line 83 of file PortableCaseReportModule.java.

File org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.caseFolder = null
private

Definition at line 93 of file PortableCaseReportModule.java.

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.caseName = ""
private
File org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copiedFilesFolder = null
private

Definition at line 94 of file PortableCaseReportModule.java.

Case org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.currentCase = null
private

Definition at line 90 of file PortableCaseReportModule.java.

final String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.FILE_FOLDER_NAME = "PortableCaseFiles"
staticprivate
final List<FileTypeCategory> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.FILE_TYPE_CATEGORIES
staticprivate
Initial value:
= Arrays.asList(FileTypeCategory.AUDIO, FileTypeCategory.DOCUMENTS,
FileTypeCategory.EXECUTABLE, FileTypeCategory.IMAGE, FileTypeCategory.VIDEO)

Definition at line 87 of file PortableCaseReportModule.java.

final Logger org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.logger = Logger.getLogger(PortableCaseReportModule.class.getName())
staticprivate

Definition at line 78 of file PortableCaseReportModule.java.

final String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.MAX_ID_TABLE_NAME = "portable_case_max_ids"
staticprivate

Definition at line 81 of file PortableCaseReportModule.java.

final Map<Long, Content> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.newIdToContent = new HashMap<>()
private

Definition at line 100 of file PortableCaseReportModule.java.

final Map<Long, BlackboardArtifact> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldArtifactIdToNewArtifact = new HashMap<>()
private

Definition at line 112 of file PortableCaseReportModule.java.

final Map<Integer, Integer> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldArtTypeIdToNewArtTypeId = new HashMap<>()
private

Definition at line 106 of file PortableCaseReportModule.java.

final Map<Integer, BlackboardAttribute.Type> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldAttrTypeIdToNewAttrType = new HashMap<>()
private
final Map<Long, Content> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldIdToNewContent = new HashMap<>()
private

Definition at line 97 of file PortableCaseReportModule.java.

final Map<TagName, TagName> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldTagNameToNewTagName = new HashMap<>()
private

Definition at line 103 of file PortableCaseReportModule.java.

SleuthkitCase org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.portableSkCase = null
private

Definition at line 91 of file PortableCaseReportModule.java.

PortableCaseReportModuleSettings org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.settings
private

Definition at line 84 of file PortableCaseReportModule.java.

final String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.UNKNOWN_FILE_TYPE_FOLDER = "Other"
staticprivate

The documentation for this class was generated from the following file:

Copyright © 2012-2020 Basis Technology. Generated on: Wed Apr 8 2020
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.