Autopsy
4.15.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
|
Inherits org.sleuthkit.autopsy.datamodel.AbstractContentNode< BlackboardArtifact >.
Inherited by org.sleuthkit.autopsy.communications.relationships.CallLogNode, org.sleuthkit.autopsy.communications.relationships.ContactNode, org.sleuthkit.autopsy.communications.relationships.MessageNode, and org.sleuthkit.autopsy.datamodel.accounts.Accounts.AccountArtifactNode.
Public Member Functions | |
BlackboardArtifactNode (BlackboardArtifact artifact, String iconPath) | |
BlackboardArtifactNode (BlackboardArtifact artifact) | |
void | addNodeProperty (NodeProperty<?> property) |
Action[] | getActions (boolean context) |
BlackboardArtifact | getArtifact () |
T | getContent () |
List< Content > | getContentChildren () |
int | getContentChildrenCount () |
List< Long > | getContentChildrenIds () |
String | getItemType () |
String | getName () |
String | getSourceName () |
boolean | hasContentChildren () |
boolean | hasVisibleContentChildren () |
boolean | isLeafTypeNode () |
int | read (byte[] buf, long offset, long len) throws TskException |
void | setName (String name) |
Static Public Member Functions | |
static boolean | contentHasVisibleContentChildren (Content c) |
Protected Member Functions | |
final void | addCommentProperty (Sheet.Set sheetSet, List< Tag > tags, CorrelationAttributeInstance attribute) |
final void | addCountProperty (Sheet.Set sheetSet, CorrelationAttributeInstance attribute) |
final void | addScorePropertyAndDescription (Sheet.Set sheetSet, List< Tag > tags) |
void | addTagProperty (Sheet.Set sheetSet) throws MissingResourceException |
final void | addTagProperty (Sheet.Set sheetSet, List< Tag > tags) |
Sheet | createSheet () |
void | finalize () throws Throwable |
final List< Tag > | getAllTagsFromDatabase () |
DataResultViewerTable.HasCommentStatus | getCommentProperty (List< Tag > tags, CorrelationAttributeInstance attribute) |
final CorrelationAttributeInstance | getCorrelationAttributeInstance () |
Pair< Long, String > | getCountPropertyAndDescription (Type corrAttrType, String attributeValue, String defaultDescription) |
Pair< DataResultViewerTable.Score, String > | getScorePropertyAndDescription (List< Tag > tags) |
synchronized void | updateSheet (NodeProperty<?>...newProps) |
Static Protected Attributes | |
static final String | NO_DESCR |
static final String | VALUE_LOADING |
Private Member Functions | |
void | addEmailMsgProperty (Map< String, Object > map, BlackboardAttribute attribute) |
void | fillPropertyMap (Map< String, Object > map, BlackboardArtifact artifact) |
String | getRootAncestorName () |
void | unregisterListener () |
void | updateSheet () |
Static Private Member Functions | |
static Lookup | createLookup (BlackboardArtifact artifact) |
Private Attributes | |
final BlackboardArtifact | artifact |
List< NodeProperty<?extends Object > > | customProperties |
final PropertyChangeListener | listener |
Content | srcContent |
volatile String | translatedSourceName |
final PropertyChangeListener | weakListener = WeakListeners.propertyChange(listener, null) |
Static Private Attributes | |
static final Set< Case.Events > | CASE_EVENTS_OF_INTEREST |
static final Cache< Long, Content > | contentCache = CacheBuilder.newBuilder().expireAfterWrite(1, TimeUnit.MINUTES).build() |
static final Logger | logger = Logger.getLogger(BlackboardArtifactNode.class.getName()) |
static final Integer[] | SHOW_FILE_METADATA |
static final Integer[] | SHOW_UNIQUE_PATH |
A BlackboardArtifactNode is an AbstractNode implementation that can be used to represent an artifact of any type.
Definition at line 88 of file BlackboardArtifactNode.java.
org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.BlackboardArtifactNode | ( | BlackboardArtifact | artifact, |
String | iconPath | ||
) |
Constructs a BlackboardArtifactNode, an AbstractNode implementation that can be used to represent an artifact of any type.
artifact | The artifact to represent. |
iconPath | The path to the icon for the artifact type. |
Definition at line 236 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.casemodule.Case.addEventTypeSubscriber(), org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.artifact, org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.CASE_EVENTS_OF_INTEREST, org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.createLookup(), and org.sleuthkit.autopsy.datamodel.AbstractContentNode< BlackboardArtifact >.setName().
org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.BlackboardArtifactNode | ( | BlackboardArtifact | artifact | ) |
Constructs a BlackboardArtifactNode, an AbstractNode implementation that can be used to represent an artifact of any type.
artifact | The artifact to represent. |
Definition at line 273 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.artifact, and org.sleuthkit.autopsy.datamodel.utils.IconsUtil.getIconFilePath().
|
protected |
Adds the other occurrences property for the artifact represented by this node to the node property sheet.
sheetSet | The property sheet. |
tags | The tags that have been applied to the artifact and its source content. |
attribute | The correlation attribute instance to use for the central repository lookup. |
Definition at line 1121 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.getCommentProperty(), and org.sleuthkit.autopsy.datamodel.AbstractContentNode< BlackboardArtifact >.NO_DESCR.
|
protected |
Adds the count property for the artifact represented by this node to the node property sheet.
sheetSet | The property sheet. |
attribute | The correlation attribute instance to use for the central repository lookup. |
Definition at line 1099 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.getCorrelationType(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.getCorrelationValue(), and org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.getCountPropertyAndDescription().
|
private |
Adds an email message attribute of the artifact this node represents to a map of name-value pairs, where the names are attribute type display names.
map | The map to be populated with the artifact attribute name-value pair. |
attribute | The attribute to use to make the map entry. |
Definition at line 970 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.datamodel.ContentUtils.getStringTime(), and org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.srcContent.
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.fillPropertyMap().
void org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.addNodeProperty | ( | NodeProperty<?> | property | ) |
Adds a "custom" property to the property sheet of this node, indepoendent of the artifact this node represents or its source content.
property | The custom property. |
Definition at line 904 of file BlackboardArtifactNode.java.
Referenced by org.sleuthkit.autopsy.datamodel.KeywordHits.createBlackboardArtifactNode().
|
protected |
Adds the score property for the artifact represented by this node to the node property sheet.
sheetSet | The property sheet. |
tags | The tags that have been applied to the artifact and its source content. |
Definition at line 1034 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.getScorePropertyAndDescription().
|
protected |
Adds the tags property for the artifact represented by this node to the node property sheet.
sheetSet | The property sheet. |
Definition at line 1052 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.casemodule.services.TagsManager.getBlackboardArtifactTagsByArtifact(), org.sleuthkit.autopsy.casemodule.services.TagsManager.getContentTagsByContent(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.casemodule.Case.getServices(), org.sleuthkit.autopsy.casemodule.services.Services.getTagsManager(), and org.sleuthkit.autopsy.datamodel.AbstractContentNode< BlackboardArtifact >.NO_DESCR.
|
protected |
Adds the tags property for the artifact represented by this node to the node property sheet.
sheetSet | The property sheet. |
tags | The tags that have been applied to the artifact and its source content. |
Definition at line 1075 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.datamodel.AbstractContentNode< BlackboardArtifact >.NO_DESCR.
|
staticinherited |
Return true if the given content object has children. Useful for lazy loading.
c | The content object to look for children on |
Definition at line 155 of file AbstractContentNode.java.
|
staticprivate |
Creates a Lookup object for this node and populates it with both the artifact this node represents and its source content.
artifact | The artifact this node represents. |
Definition at line 285 of file BlackboardArtifactNode.java.
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.BlackboardArtifactNode().
|
protected |
Definition at line 403 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.core.UserPreferences.displayTranslatedFileNames(), org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.fillPropertyMap(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.core.UserPreferences.getHideSCOColumns(), org.sleuthkit.autopsy.texttranslation.TextTranslationService.getInstance(), org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.getRootAncestorName(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.datamodel.ContentUtils.getStringTime(), org.sleuthkit.autopsy.texttranslation.TextTranslationService.hasProvider(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.isEnabled(), org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.listener, org.sleuthkit.autopsy.datamodel.AbstractContentNode< BlackboardArtifact >.NO_DESCR, and org.sleuthkit.autopsy.datamodel.AbstractContentNode< BlackboardArtifact >.VALUE_LOADING.
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.updateSheet().
|
private |
Converts the attributes of the artifact this node represents to a map of name-value pairs, where the names are attribute type display names.
map | The map to be populated with the artifact attribute name-value pairs. |
artifact | The artifact. |
Definition at line 920 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.addEmailMsgProperty(), org.sleuthkit.autopsy.datamodel.ContentUtils.getStringTime(), and org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.srcContent.
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.createSheet().
|
protected |
Unregisters the application event listener when this node is garbage collected, if this finalizer is actually called.
RC: Isn't there some node lifecycle property change event that could be used to unregister the listener instead?
Throwable |
Definition at line 310 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.unregisterListener().
Action [] org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.getActions | ( | boolean | context | ) |
Definition at line 332 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.timeline.actions.ViewFileInTimelineAction.createViewFileAction(), org.sleuthkit.autopsy.timeline.actions.ViewFileInTimelineAction.createViewSourceFileAction(), and org.sleuthkit.autopsy.timeline.actions.ViewArtifactInTimelineAction.hasSupportedTimeStamp().
Referenced by org.sleuthkit.autopsy.directorytree.DataResultFilterNode.GetPopupActionsDisplayableItemNodeVisitor.visit().
|
protected |
Gets all of the tags applied to the artifact represented by this node and its source content.
Definition at line 673 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.casemodule.services.TagsManager.getBlackboardArtifactTagsByArtifact(), org.sleuthkit.autopsy.casemodule.services.TagsManager.getContentTagsByContent(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.casemodule.Case.getServices(), and org.sleuthkit.autopsy.casemodule.services.Services.getTagsManager().
BlackboardArtifact org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.getArtifact | ( | ) |
Gets the artifact represented by this node.
Definition at line 327 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.artifact.
Referenced by org.sleuthkit.autopsy.directorytree.DirectoryTreeFilterChildren.IsLeafItemVisitor.visit(), org.sleuthkit.autopsy.directorytree.DirectoryTreeFilterChildren.ShowItemVisitor.visit(), and org.sleuthkit.autopsy.directorytree.DataResultFilterNode.GetPreferredActionsDisplayableItemNodeVisitor.visit().
|
protected |
Computes the value of the comment property ("C" in S, C, O) for the artifact represented by this node.
An icon is displayed in the property sheet if a commented tag has been applied to the artifact or its source content, or if there is a corresponding commented correlation attribute instance in the central repository.
tags | The tags applied to the artifact and its source content. |
attribute | A correlation attribute instance Ffor the central repository lookup. |
Definition at line 717 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.corecomponents.DataResultViewerTable.HasCommentStatus.CR_AND_TAG_COMMENTS, org.sleuthkit.autopsy.corecomponents.DataResultViewerTable.HasCommentStatus.CR_COMMENT, org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.getComment(), org.sleuthkit.autopsy.corecomponents.DataResultViewerTable.HasCommentStatus.NO_COMMENT, org.sleuthkit.autopsy.corecomponents.DataResultViewerTable.HasCommentStatus.TAG_COMMENT, and org.sleuthkit.autopsy.corecomponents.DataResultViewerTable.HasCommentStatus.TAG_NO_COMMENT.
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.addCommentProperty().
|
inherited |
Return the content data associated with this node
Definition at line 123 of file AbstractContentNode.java.
|
inherited |
Return children of the underlying content.
Definition at line 235 of file AbstractContentNode.java.
|
inherited |
Get count of the underlying content object children.
Useful for lazy loading.
Definition at line 257 of file AbstractContentNode.java.
|
inherited |
Return ids of children of the underlying content. The ids can be treated as keys - useful for lazy loading.
Definition at line 215 of file AbstractContentNode.java.
|
protected |
Gets the correlation attribute for the MD5 hash of the source file of the artifact represented by this node. The correlation attribute instance can only be returned if the central repository is enabled and the source content is a file.
Definition at line 693 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.getCorrAttrForFile(), and org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.isEnabled().
|
protected |
Computes the value of the other occurrences property ("O" in S, C, O) for the artifact represented by this node. The value of the other occurrences property is the number of other data sources this artifact appears in according to a correlation attribute instance lookup in the central repository, plus one for the data source for this instance of the artifact.
corrAttrType | The correlation attribute instance type to use for the central repsoitory lookup. |
attributeValue | The correlation attribute instane value to use for the central repsoitory lookup. |
defaultDescription | A default description. |
Definition at line 853 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getCountUniqueCaseDataSourceTuplesHavingTypeValue(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.Type.getDisplayName(), and org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getInstance().
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.addCountProperty().
String org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.getItemType | ( | ) |
Definition at line 1005 of file BlackboardArtifactNode.java.
|
inherited |
Definition at line 133 of file AbstractContentNode.java.
|
private |
Gets the name of the root ancestor of the source content for the artifact represented by this node.
Definition at line 884 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.srcContent.
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.createSheet().
|
protected |
Computes the value of the score property ("S" in S, C, O) for the artifact represented by this node. The score property indicates whether the artifact or its source content is notable or interesting.
IMPORTANT: Notability takes precedence when computing the score.
A red icon will be displayed in the property sheet if the hash of the source file has been found in a notable hash set or if either the artifact or its source content has been tagged with a notable tag. A yellow icon will be displayed if the source file belongs to an interesting file set or either the artifact or its source content has been tagged with a non-notable tag.
tags | The tags that have been applied to the artifact and its source content. |
Definition at line 767 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getInstance(), org.sleuthkit.autopsy.modules.hashdatabase.HashDbManager.getKnownBadFileHashSets(), org.sleuthkit.autopsy.corecomponents.DataResultViewerTable.Score.INTERESTING_SCORE, org.sleuthkit.autopsy.corecomponents.DataResultViewerTable.Score.NO_SCORE, and org.sleuthkit.autopsy.corecomponents.DataResultViewerTable.Score.NOTABLE_SCORE.
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.addScorePropertyAndDescription().
String org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.getSourceName | ( | ) |
Gets the name of the source content of the artifact represented by this node.
Definition at line 382 of file BlackboardArtifactNode.java.
|
inherited |
Return true if the underlying content object has children Useful for lazy loading.
Definition at line 195 of file AbstractContentNode.java.
|
inherited |
Return true if the underlying content object has children Useful for lazy loading.
Definition at line 143 of file AbstractContentNode.java.
boolean org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.isLeafTypeNode | ( | ) |
Definition at line 1000 of file BlackboardArtifactNode.java.
|
inherited |
Reads the content of this node (of the underlying content object).
buf | buffer to read into |
offset | the starting offset in the content object |
len | the length to read |
TskException | exception thrown if the requested part of content could not be read |
Definition at line 283 of file AbstractContentNode.java.
|
inherited |
Definition at line 128 of file AbstractContentNode.java.
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode::BlackboardArtifactNode().
|
private |
Unregisters this node's application event listener.
Definition at line 318 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.CASE_EVENTS_OF_INTEREST, and org.sleuthkit.autopsy.casemodule.Case.removeEventTypeSubscriber().
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.finalize().
|
protectedinherited |
Updates the values of the properties in the current property sheet with the new properties being passed in. Only if that property exists in the current sheet will it be applied. That way, we allow for subclasses to add their own (or omit some!) properties and we will not accidentally disrupt their UI.
Race condition if not synchronized. Only one update should be applied at a time.
newProps | New file property instances to be updated in the current sheet. |
Definition at line 300 of file AbstractContentNode.java.
|
private |
Refreshes this node's property sheet.
Definition at line 874 of file BlackboardArtifactNode.java.
References org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.createSheet().
|
private |
Definition at line 130 of file BlackboardArtifactNode.java.
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.BlackboardArtifactNode(), and org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.getArtifact().
|
staticprivate |
Definition at line 103 of file BlackboardArtifactNode.java.
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.BlackboardArtifactNode(), and org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.unregisterListener().
|
staticprivate |
Definition at line 97 of file BlackboardArtifactNode.java.
|
private |
Definition at line 139 of file BlackboardArtifactNode.java.
|
private |
Definition at line 141 of file BlackboardArtifactNode.java.
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.createSheet().
|
staticprivate |
Definition at line 90 of file BlackboardArtifactNode.java.
|
staticprotectedinherited |
Default no description string
Definition at line 75 of file AbstractContentNode.java.
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode::addCommentProperty(), org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode::addTagProperty(), and org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode::createSheet().
|
staticprivate |
Definition at line 126 of file BlackboardArtifactNode.java.
|
staticprivate |
Definition at line 115 of file BlackboardArtifactNode.java.
|
private |
Definition at line 131 of file BlackboardArtifactNode.java.
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.addEmailMsgProperty(), org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.fillPropertyMap(), and org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode.getRootAncestorName().
|
private |
Definition at line 132 of file BlackboardArtifactNode.java.
|
staticprotectedinherited |
Definition at line 76 of file AbstractContentNode.java.
Referenced by org.sleuthkit.autopsy.datamodel.BlackboardArtifactNode::createSheet().
|
private |
Definition at line 227 of file BlackboardArtifactNode.java.
Copyright © 2012-2020 Basis Technology. Generated on: Mon Jul 6 2020
This work is licensed under a
Creative Commons Attribution-Share Alike 3.0 United States License.