org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule Class Reference

Inherits org.sleuthkit.autopsy.report.ReportModule.

Classes
class	GetImageTagCallback
class	GetInterestingItemSetNamesCallback
class	StoreMaxIdCallback

Public Member Functions
	PortableCaseReportModule ()
void	generateReport (String reportPath, PortableCaseReportModuleSettings options, ReportProgressPanel progressPanel)
default ReportModuleSettings	getConfiguration ()
default JPanel	getConfigurationPanel ()
default ReportModuleSettings	getDefaultConfiguration ()
String	getDescription ()
String	getName ()
String	getRelativeFilePath ()
default void	setConfiguration (ReportModuleSettings settings)

Private Member Functions
void	addArtifactsToPortableCase (TagName oldTagName, ReportProgressPanel progressPanel) throws TskCoreException
void	addFilesToPortableCase (TagName oldTagName, ReportProgressPanel progressPanel) throws TskCoreException
void	addImageTagToPortableCase (ContentTag newContentTag, String appData) throws TskCoreException
boolean	addUniqueFile (Content content, Content dataSource, Path tmpDir, CaseUcoReportGenerator reportGenerator, boolean dataSourceHasBeenIncluded) throws IOException, TskCoreException
void	cleanup ()
void	closePortableCaseDatabase ()
boolean	compressCase (ReportProgressPanel progressPanel)
BlackboardArtifact	copyArtifact (long newContentId, BlackboardArtifact artifactToCopy) throws TskCoreException
long	copyContent (Content content) throws TskCoreException
long	copyContentToPortableCase (Content content, ReportProgressPanel progressPanel) throws TskCoreException
void	createCase (File outputDir, ReportProgressPanel progressPanel)
void	generateCaseUcoReport (List< TagName > tagNames, List< String > setNames, ReportProgressPanel progressPanel)
List< String >	getAllInterestingItemsSets () throws NoCurrentCaseException, TskCoreException
String	getExportSubfolder (AbstractFile abstractFile)
String	getImageTagDataForContentTag (ContentTag tag) throws TskCoreException
Multimap< Long, BlackboardArtifact >	getInterestingArtifactsBySetName (SleuthkitCase skCase, List< String > setNames) throws TskCoreException
int	getNewArtifactTypeId (BlackboardArtifact oldArtifact) throws TskCoreException
BlackboardAttribute.Type	getNewAttributeType (BlackboardAttribute oldAttribute) throws TskCoreException
void	handleCancellation (ReportProgressPanel progressPanel)
void	handleError (String logWarning, String dialogWarning, Exception ex, ReportProgressPanel progressPanel)
void	initializeImageTags (ReportProgressPanel progressPanel) throws TskCoreException
void	saveHighestIds () throws TskCoreException

Static Private Member Functions
static File	locate7ZipExecutable ()

Private Attributes
File	caseFolder = null
String	caseName = ""
File	copiedFilesFolder = null
Case	currentCase = null
final Map< Long, Content >	newIdToContent = new HashMap<>()
final Map< Long, BlackboardArtifact >	oldArtifactIdToNewArtifact = new HashMap<>()
final Map< Integer, Integer >	oldArtTypeIdToNewArtTypeId = new HashMap<>()
final Map< Integer, BlackboardAttribute.Type >	oldAttrTypeIdToNewAttrType = new HashMap<>()
final Map< Long, Content >	oldIdToNewContent = new HashMap<>()
final Map< TagName, TagName >	oldTagNameToNewTagName = new HashMap<>()
SleuthkitCase	portableSkCase = null
PortableCaseReportModuleSettings	settings

Static Private Attributes
static final String	CASE_UCO_FILE_NAME = "portable_CASE_UCO_output"
static final String	CASE_UCO_TMP_DIR = "case_uco_tmp"
static final String	FILE_FOLDER_NAME = "PortableCaseFiles"
static final List< FileTypeCategory >	FILE_TYPE_CATEGORIES
static final Logger	logger = Logger.getLogger(PortableCaseReportModule.class.getName())
static final String	MAX_ID_TABLE_NAME = "portable_case_max_ids"
static final String	UNKNOWN_FILE_TYPE_FOLDER = "Other"

Detailed Description

Creates a portable case from tagged files

Definition at line 78 of file PortableCaseReportModule.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.PortableCaseReportModule

(

)

Definition at line 115 of file PortableCaseReportModule.java.

Member Function Documentation

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addArtifactsToPortableCase ( TagName  oldTagName, ReportProgressPanel  progressPanel  ) throws TskCoreException

private

Add all artifacts with a given tag to the portable case.

Parameters

oldTagName	The TagName object from the current case
progressPanel	The progress panel

Exceptions

TskCoreException

Definition at line 828 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.CANCELED, org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyArtifact(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContentToPortableCase(), org.sleuthkit.autopsy.casemodule.services.TagsManager.getBlackboardArtifactTagsByTagName(), org.sleuthkit.autopsy.casemodule.Case.getServices(), org.sleuthkit.autopsy.report.ReportProgressPanel.getStatus(), and org.sleuthkit.autopsy.casemodule.services.Services.getTagsManager().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addFilesToPortableCase ( TagName  oldTagName, ReportProgressPanel  progressPanel  ) throws TskCoreException

private

Add all files with a given tag to the portable case.

Parameters

oldTagName	The TagName object from the current case
progressPanel	The progress panel

Exceptions

TskCoreException

Definition at line 722 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addImageTagToPortableCase(), org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.CANCELED, org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContentToPortableCase(), org.sleuthkit.autopsy.casemodule.services.TagsManager.getContentTagsByTagName(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getImageTagDataForContentTag(), org.sleuthkit.autopsy.casemodule.Case.getServices(), org.sleuthkit.autopsy.report.ReportProgressPanel.getStatus(), and org.sleuthkit.autopsy.casemodule.services.Services.getTagsManager().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addImageTagToPortableCase ( ContentTag  newContentTag, String  appData  ) throws TskCoreException

private

Add an image tag to the portable case.

Parameters

newContentTag	The content tag in the portable case
appData	The string to copy into app_data

Exceptions

TskCoreException

Definition at line 814 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.casemodule.services.contentviewertags.ContentViewerTagManager.TABLE_NAME.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addFilesToPortableCase().

boolean org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addUniqueFile ( Content  content, Content  dataSource, Path  tmpDir, CaseUcoReportGenerator  reportGenerator, boolean  dataSourceHasBeenIncluded  ) throws IOException, TskCoreException

private

Adds the content if and only if it has not already been seen.

Parameters

content	Content to add to the report.
dataSource	Parent dataSource of the content instance.
tmpDir	Path to the tmpDir to enforce uniqueness
reportGenerator	Report generator instance to add the content to
dataSourceHasBeenIncluded	Flag determining if the data source should be written before the file. False will cause the data source to be written.

Exceptions

IOException	If an I/O error occurs.
TskCoreException	If an internal database error occurs.

return True if the data source was written during this operation.

Definition at line 564 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.coreutils.FileUtil.escapeFileName(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getExportSubfolder().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateCaseUcoReport().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.cleanup ( )

private

Clear out the maps and other fields and close the database connections.

Definition at line 1126 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.closePortableCaseDatabase(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldAttrTypeIdToNewAttrType.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleCancellation(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleError().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.closePortableCaseDatabase ( )

private

Close the portable case

Definition at line 1144 of file PortableCaseReportModule.java.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.cleanup(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.compressCase().

boolean org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.compressCase ( ReportProgressPanel  progressPanel )

private

Definition at line 1195 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.CANCELED, org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.closePortableCaseDatabase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.getChunkSize(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.ChunkSize.getSevenZipParam(), org.sleuthkit.autopsy.report.ReportProgressPanel.getStatus(), org.sleuthkit.autopsy.casemodule.Case.getTempDirectory(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleError(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.locate7ZipExecutable(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.ChunkSize.NONE.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport().

BlackboardArtifact org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyArtifact ( long  newContentId, BlackboardArtifact  artifactToCopy  ) throws TskCoreException

private

Copy an artifact into the new case. Will also copy any associated artifacts

Parameters

newContentId	The content ID (in the portable case) of the source content
artifactToCopy	The artifact to copy

Returns

The new artifact in the portable case

Exceptions

TskCoreException

Definition at line 865 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getNewArtifactTypeId(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getNewAttributeType(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addArtifactsToPortableCase(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContent().

long org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContent ( Content  content ) throws TskCoreException

private

Returns the object ID for the given content object in the portable case.

Parameters

content

The content object to copy into the portable case

Returns

the new object ID for this content

Exceptions

TskCoreException

Definition at line 1004 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyArtifact(), org.sleuthkit.autopsy.coreutils.FileUtil.escapeFileName(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getExportSubfolder(), and org.sleuthkit.autopsy.datamodel.ContentUtils.writeToFile().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContentToPortableCase().

long org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContentToPortableCase ( Content  content, ReportProgressPanel  progressPanel  ) throws TskCoreException

private

Top level method to copy a content object to the portable case.

Parameters

content	The content object to copy
progressPanel	The progress panel

Returns

The object ID of the copied content in the portable case

Exceptions

TskCoreException

Definition at line 990 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContent(), and org.sleuthkit.autopsy.report.ReportProgressPanel.updateStatusLabel().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addArtifactsToPortableCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addFilesToPortableCase(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createCase ( File  outputDir, ReportProgressPanel  progressPanel  )

private

Create the case directory and case database. portableSkCase will be set if this completes without error.

Parameters

outputDir	The parent for the case folder
progressPanel

Definition at line 623 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.caseName, org.sleuthkit.autopsy.casemodule.Case.createPortableCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.FILE_FOLDER_NAME, org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleError(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.saveHighestIds(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.UNKNOWN_FILE_TYPE_FOLDER.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateCaseUcoReport ( List< TagName >  tagNames, List< String >  setNames, ReportProgressPanel  progressPanel  )

private

Generates a CASE-UCO report for all files that have a specified TagName or TSK_INTERESTING artifacts that are flagged by the specified SET_NAMEs.

Only one copy of the file will be saved in the report if it is the source of more than one of the above.

Parameters

tagNames	TagNames to included in the report.
setNames	SET_NAMEs to include in the report.
progressPanel	ProgressPanel to relay progress messages.

It is currently believed that DataSources in a CASE-UCO report should precede all file entities. Therefore, before writing a file, add the data source if it has yet to be included.

Definition at line 456 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.caseuco.CaseUcoReportGenerator.addCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addUniqueFile(), org.sleuthkit.autopsy.report.modules.caseuco.CaseUcoReportGenerator.generateReport(), org.sleuthkit.autopsy.casemodule.services.TagsManager.getBlackboardArtifactTagsByTagName(), org.sleuthkit.autopsy.casemodule.services.TagsManager.getContentTagsByTagName(), org.sleuthkit.autopsy.casemodule.Case.getDataSources(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getInterestingArtifactsBySetName(), org.sleuthkit.autopsy.casemodule.Case.getServices(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.casemodule.services.Services.getTagsManager(), org.sleuthkit.autopsy.casemodule.Case.getTempDirectory(), and org.sleuthkit.autopsy.report.ReportProgressPanel.updateStatusLabel().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport	(	String	reportPath,
		PortableCaseReportModuleSettings	options,
		ReportProgressPanel	progressPanel
	)

Definition at line 206 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addArtifactsToPortableCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addFilesToPortableCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.areAllSetsSelected(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.areAllTagsSelected(), org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.CANCELED, org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.cleanup(), org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.COMPLETE, org.sleuthkit.autopsy.report.ReportProgressPanel.complete(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.compressCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContentToPortableCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateCaseUcoReport(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getAllInterestingItemsSets(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.casemodule.Case.getDisplayName(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.getSelectedSetNames(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.getSelectedTagNames(), org.sleuthkit.autopsy.casemodule.Case.getServices(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.report.ReportProgressPanel.getStatus(), org.sleuthkit.autopsy.casemodule.services.TagsManager.getTagNamesInUse(), org.sleuthkit.autopsy.casemodule.services.Services.getTagsManager(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleCancellation(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleError(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.initializeImageTags(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldAttrTypeIdToNewAttrType, org.sleuthkit.autopsy.report.ReportProgressPanel.setIndeterminate(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModuleSettings.shouldCompress(), org.sleuthkit.autopsy.report.ReportProgressPanel.start(), and org.sleuthkit.autopsy.report.ReportProgressPanel.updateStatusLabel().

List<String> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getAllInterestingItemsSets ( ) throws NoCurrentCaseException, TskCoreException

private

Definition at line 584 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.GetInterestingItemSetNamesCallback.getSetCountMap(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport().

default ReportModuleSettings org.sleuthkit.autopsy.report.ReportModule.getConfiguration ( )

inherited

Get current configuration for this report module.

Returns

Object which contains current report module settings.

Implemented in org.sleuthkit.autopsy.report.modules.stix.STIXReportModule, org.sleuthkit.autopsy.report.modules.html.HTMLReport, and org.sleuthkit.autopsy.report.modules.taggedhashes.SaveTaggedHashesToHashDb.

Definition at line 79 of file ReportModule.java.

default JPanel org.sleuthkit.autopsy.report.ReportModule.getConfigurationPanel ( )

inherited

Returns the configuration panel for the report, which is displayed in the report configuration step of the report wizard.

Returns

Configuration panel or null if the module does not need configuration.

Implemented in org.sleuthkit.autopsy.report.modules.kml.KMLReport, org.sleuthkit.autopsy.report.modules.stix.STIXReportModule, org.sleuthkit.autopsy.report.modules.taggedhashes.SaveTaggedHashesToHashDb, org.sleuthkit.autopsy.report.modules.html.HTMLReport, org.sleuthkit.autopsy.report.modules.caseuco.CaseUcoReportModule, and org.sleuthkit.autopsy.report.GeneralReportModuleAdapter.

Definition at line 61 of file ReportModule.java.

default ReportModuleSettings org.sleuthkit.autopsy.report.ReportModule.getDefaultConfiguration ( )

inherited

Get default configuration for this report module.

Returns

Object which contains default report module settings.

Implemented in org.sleuthkit.autopsy.report.modules.stix.STIXReportModule, org.sleuthkit.autopsy.report.modules.html.HTMLReport, and org.sleuthkit.autopsy.report.modules.taggedhashes.SaveTaggedHashesToHashDb.

Definition at line 70 of file ReportModule.java.

Referenced by org.sleuthkit.autopsy.report.infrastructure.ReportGenerator.generateReports().

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getDescription

(

)

Gets a one-line, user friendly description of the type of report this module generates.

Implements org.sleuthkit.autopsy.report.ReportModule.

Definition at line 130 of file PortableCaseReportModule.java.

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getExportSubfolder ( AbstractFile  abstractFile )

private

Return the subfolder name for this file based on MIME type

Parameters

abstractFile

the file

Returns

the name of the appropriate subfolder for this file type

Definition at line 1110 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.UNKNOWN_FILE_TYPE_FOLDER.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addUniqueFile(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyContent().

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getImageTagDataForContentTag ( ContentTag  tag ) throws TskCoreException

private

Gets the image tag data for a given content tag

Parameters

tag	The ContentTag in the current case

Returns

The app_data string for this content tag or an empty string if there was none

Exceptions

TskCoreException

Definition at line 765 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), and org.sleuthkit.autopsy.casemodule.services.contentviewertags.ContentViewerTagManager.TABLE_NAME.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.addFilesToPortableCase().

Multimap<Long, BlackboardArtifact> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getInterestingArtifactsBySetName ( SleuthkitCase  skCase, List< String >  setNames  ) throws TskCoreException

private

Load all interesting BlackboardArtifacts that belong to the selected SET_NAME. This operation would be duplicated for every data source, since the Sleuthkit API does not have a notion of searching by data source id.

Definition at line 531 of file PortableCaseReportModule.java.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateCaseUcoReport().

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getName

(

)

Get the name of the report this module generates.

Implements org.sleuthkit.autopsy.report.ReportModule.

Definition at line 122 of file PortableCaseReportModule.java.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.locate7ZipExecutable().

int org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getNewArtifactTypeId ( BlackboardArtifact  oldArtifact ) throws TskCoreException

private

Get the artifact type ID in the portable case and create new artifact type if needed. For built-in artifacts this will be the same as the original.

Parameters

oldArtifact

The artifact in the current case

Returns

The corresponding artifact type ID in the portable case

Definition at line 937 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyArtifact().

BlackboardAttribute.Type org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getNewAttributeType ( BlackboardAttribute  oldAttribute ) throws TskCoreException

private

Get the attribute type ID in the portable case and create new attribute type if needed. For built-in attributes this will be the same as the original.

Parameters

oldAttribute

The attribute in the current case

Returns

The corresponding attribute type in the portable case

Definition at line 960 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldAttrTypeIdToNewAttrType.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copyArtifact().

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getRelativeFilePath

(

)

Gets the relative path of the report file, if any, generated by this module. The path should be relative to the location that gets passed in to generateReport() (or similar).

Returns

Relative path to where report will be stored. Return an empty string if the location passed to generateReport() is the output location. Return null to indicate that there is no report file.

Implements org.sleuthkit.autopsy.report.ReportModule.

Definition at line 135 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.caseName, org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), and org.sleuthkit.autopsy.casemodule.Case.getDisplayName().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleCancellation ( ReportProgressPanel  progressPanel )

private

Convenience method for handling cancellation

Parameters

progressPanel

The report progress panel

Definition at line 150 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.CANCELED, org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.cleanup(), org.sleuthkit.autopsy.report.ReportProgressPanel.complete(), and org.sleuthkit.autopsy.report.ReportProgressPanel.setIndeterminate().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.handleError ( String  logWarning, String  dialogWarning, Exception  ex, ReportProgressPanel  progressPanel  )

private

Convenience method to avoid code duplication. Assumes that if an exception is supplied then the error is SEVERE. Otherwise it is logged as a WARNING.

Parameters

logWarning	Warning to write to the log
dialogWarning	Warning to write to a pop-up window
ex	The exception (can be null)
progressPanel	The report progress panel

Definition at line 167 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.cleanup(), org.sleuthkit.autopsy.report.ReportProgressPanel.complete(), org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.ERROR, and org.sleuthkit.autopsy.report.ReportProgressPanel.setIndeterminate().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.compressCase(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createCase(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.initializeImageTags ( ReportProgressPanel  progressPanel ) throws TskCoreException

private

Set up the image tag table in the portable case

Parameters

progressPanel

Exceptions

TskCoreException

Definition at line 705 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.casemodule.services.contentviewertags.ContentViewerTagManager.TABLE_NAME, and org.sleuthkit.autopsy.casemodule.services.contentviewertags.ContentViewerTagManager.TABLE_SCHEMA_SQLITE.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport().

static File org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.locate7ZipExecutable ( )

staticprivate

Locate the 7-Zip executable from the release folder.

Returns

7-Zip executable

Definition at line 1278 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getName(), and org.sleuthkit.autopsy.coreutils.PlatformUtil.isWindowsOS().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.compressCase().

void org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.saveHighestIds ( ) throws TskCoreException

private

Save the current highest IDs to the portable case.

Exceptions

TskCoreException

Definition at line 683 of file PortableCaseReportModule.java.

References org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createCase().

default void org.sleuthkit.autopsy.report.ReportModule.setConfiguration ( ReportModuleSettings  settings )

inherited

Set report module configuration.

Parameters

settings

Object which contains report module settings.

Implemented in org.sleuthkit.autopsy.report.modules.stix.STIXReportModule, org.sleuthkit.autopsy.report.modules.html.HTMLReport, and org.sleuthkit.autopsy.report.modules.taggedhashes.SaveTaggedHashesToHashDb.

Definition at line 88 of file ReportModule.java.

Referenced by org.sleuthkit.autopsy.report.infrastructure.ReportGenerator.generateReports().

Member Data Documentation

final String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.CASE_UCO_FILE_NAME = "portable_CASE_UCO_output"

staticprivate

Definition at line 83 of file PortableCaseReportModule.java.

final String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.CASE_UCO_TMP_DIR = "case_uco_tmp"

staticprivate

Definition at line 84 of file PortableCaseReportModule.java.

File org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.caseFolder = null

private

Definition at line 94 of file PortableCaseReportModule.java.

String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.caseName = ""

private

Definition at line 93 of file PortableCaseReportModule.java.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createCase(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getRelativeFilePath().

File org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.copiedFilesFolder = null

private

Definition at line 95 of file PortableCaseReportModule.java.

Case org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.currentCase = null

private

Definition at line 91 of file PortableCaseReportModule.java.

final String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.FILE_FOLDER_NAME = "PortableCaseFiles"

staticprivate

Definition at line 80 of file PortableCaseReportModule.java.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createCase().

final List<FileTypeCategory> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.FILE_TYPE_CATEGORIES

staticprivate

Initial value:

= Arrays.asList(FileTypeCategory.AUDIO, FileTypeCategory.DOCUMENTS,
            FileTypeCategory.EXECUTABLE, FileTypeCategory.IMAGE, FileTypeCategory.VIDEO)

Definition at line 88 of file PortableCaseReportModule.java.

final Logger org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.logger = Logger.getLogger(PortableCaseReportModule.class.getName())

staticprivate

Definition at line 79 of file PortableCaseReportModule.java.

final String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.MAX_ID_TABLE_NAME = "portable_case_max_ids"

staticprivate

Definition at line 82 of file PortableCaseReportModule.java.

final Map<Long, Content> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.newIdToContent = new HashMap<>()

private

Definition at line 101 of file PortableCaseReportModule.java.

final Map<Long, BlackboardArtifact> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldArtifactIdToNewArtifact = new HashMap<>()

private

Definition at line 113 of file PortableCaseReportModule.java.

final Map<Integer, Integer> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldArtTypeIdToNewArtTypeId = new HashMap<>()

private

Definition at line 107 of file PortableCaseReportModule.java.

final Map<Integer, BlackboardAttribute.Type> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldAttrTypeIdToNewAttrType = new HashMap<>()

private

Definition at line 110 of file PortableCaseReportModule.java.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.cleanup(), org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.generateReport(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getNewAttributeType().

final Map<Long, Content> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldIdToNewContent = new HashMap<>()

private

Definition at line 98 of file PortableCaseReportModule.java.

final Map<TagName, TagName> org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.oldTagNameToNewTagName = new HashMap<>()

private

Definition at line 104 of file PortableCaseReportModule.java.

SleuthkitCase org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.portableSkCase = null

private

Definition at line 92 of file PortableCaseReportModule.java.

PortableCaseReportModuleSettings org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.settings

private

Definition at line 85 of file PortableCaseReportModule.java.

final String org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.UNKNOWN_FILE_TYPE_FOLDER = "Other"

staticprivate

Definition at line 81 of file PortableCaseReportModule.java.

Referenced by org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.createCase(), and org.sleuthkit.autopsy.report.modules.portablecase.PortableCaseReportModule.getExportSubfolder().

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/report/modules/portablecase/PortableCaseReportModule.java