Autopsy  4.16.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
XRYWebBookmarksFileParser.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2019-2020 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datasourceprocessors.xry;
20 
21 import java.util.ArrayList;
22 import java.util.Map;
23 import java.util.HashMap;
24 import java.util.List;
25 import java.util.Optional;
26 import org.sleuthkit.datamodel.Blackboard.BlackboardException;
27 import org.sleuthkit.datamodel.BlackboardAttribute;
28 import org.sleuthkit.datamodel.BlackboardArtifact;
29 import org.sleuthkit.datamodel.Content;
30 import org.sleuthkit.datamodel.SleuthkitCase;
31 import org.sleuthkit.datamodel.TskCoreException;
32 
36 final class XRYWebBookmarksFileParser extends AbstractSingleEntityParser {
37 
38  //All known XRY keys for web bookmarks.
39  private static final Map<String, BlackboardAttribute.ATTRIBUTE_TYPE> XRY_KEYS
40  = new HashMap<String, BlackboardAttribute.ATTRIBUTE_TYPE>() {
41  {
42  put("web address", BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL);
43  put("domain", BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN);
44  put("application", BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME);
45  }
46  };
47 
48  @Override
49  boolean canProcess(XRYKeyValuePair pair) {
50  String normalizedKey = pair.getKey().toLowerCase();
51  return XRY_KEYS.containsKey(normalizedKey);
52  }
53 
54  @Override
55  boolean isNamespace(String nameSpace) {
56  //No known namespaces for web reports.
57  return false;
58  }
59 
64  private Optional<BlackboardAttribute> getBlackboardAttribute(XRYKeyValuePair pair) {
65  String normalizedKey = pair.getKey().toLowerCase();
66  return Optional.of(new BlackboardAttribute(
67  XRY_KEYS.get(normalizedKey),
68  PARSER_NAME, pair.getValue()));
69  }
70 
71  @Override
72  void makeArtifact(List<XRYKeyValuePair> keyValuePairs, Content parent, SleuthkitCase currentCase) throws TskCoreException, BlackboardException {
73  List<BlackboardAttribute> attributes = new ArrayList<>();
74  for(XRYKeyValuePair pair : keyValuePairs) {
75  Optional<BlackboardAttribute> attribute = getBlackboardAttribute(pair);
76  if(attribute.isPresent()) {
77  attributes.add(attribute.get());
78  }
79  }
80  if(!attributes.isEmpty()) {
81  BlackboardArtifact artifact = parent.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK);
82  artifact.addAttributes(attributes);
83  }
84  }
85 }

Copyright © 2012-2020 Basis Technology. Generated on: Tue Sep 22 2020
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.