Autopsy  4.16.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
ArtifactTextExtractor.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2018 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.textextractors;
20 
21 import java.io.InputStreamReader;
22 import java.io.Reader;
23 import java.nio.charset.StandardCharsets;
24 import org.apache.commons.io.IOUtils;
26 import org.sleuthkit.datamodel.BlackboardArtifact;
27 import org.sleuthkit.datamodel.BlackboardAttribute;
28 import org.sleuthkit.datamodel.Content;
29 import org.sleuthkit.datamodel.TskCoreException;
30 
35 class ArtifactTextExtractor implements TextExtractor {
36 
37  private final BlackboardArtifact artifact;
38 
39  public ArtifactTextExtractor(BlackboardArtifact artifact) {
40  this.artifact = artifact;
41  }
42 
43  @Override
44  public Reader getReader() throws InitReaderException {
45  // Concatenate the string values of all attributes into a single
46  // "content" string to be indexed.
47  StringBuilder artifactContents = new StringBuilder();
48 
49  try {
50  for (BlackboardAttribute attribute : artifact.getAttributes()) {
51  artifactContents.append(attribute.getAttributeType().getDisplayName());
52  artifactContents.append(" : ");
53  // We have also discussed modifying BlackboardAttribute.getDisplayString()
54  // to magically format datetime attributes but that is complicated by
55  // the fact that BlackboardAttribute exists in Sleuthkit data model
56  // while the utility to determine the timezone to use is in ContentUtils
57  // in the Autopsy datamodel.
58  switch (attribute.getValueType()) {
59  case DATETIME:
60  artifactContents.append(ContentUtils.getStringTime(attribute.getValueLong(), artifact));
61  break;
62  default:
63  artifactContents.append(attribute.getDisplayString());
64  }
65  artifactContents.append(System.lineSeparator());
66  }
67  } catch (TskCoreException tskCoreException) {
68  throw new InitReaderException("Unable to get attributes for artifact: " + artifact.toString(), tskCoreException);
69  }
70 
71  return new InputStreamReader(IOUtils.toInputStream(artifactContents,
72  StandardCharsets.UTF_8), StandardCharsets.UTF_8);
73  }
74 
75  @Override
76  public boolean isSupported() {
77  return true;
78  }
79 }
static String getStringTime(long epochSeconds, TimeZone tzone)

Copyright © 2012-2020 Basis Technology. Generated on: Tue Sep 22 2020
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.