org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary Class Reference

Inherits org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.

Classes
class	RecentAttachmentDetails
class	RecentDownloadDetails
class	RecentFileDetails

Public Member Functions
	RecentFilesSummary ()
	RecentFilesSummary (SleuthkitCaseProvider provider)
Set< Integer >	getArtifactTypeIdsForRefresh ()
default Set< Case.Events >	getCaseEventUpdates ()
default Set< IngestJobEvent >	getIngestJobEventUpdates ()
List< RecentAttachmentDetails >	getRecentAttachments (DataSource dataSource, int maxCount) throws SleuthkitCaseProviderException, TskCoreException
List< RecentDownloadDetails >	getRecentDownloads (DataSource dataSource, int maxCount) throws TskCoreException, SleuthkitCaseProviderException
List< RecentFileDetails >	getRecentlyOpenedDocuments (DataSource dataSource, int maxCount) throws SleuthkitCaseProviderException, TskCoreException
default boolean	isRefreshRequired (ModuleDataEvent evt)
default boolean	isRefreshRequired (ModuleContentEvent evt)
default boolean	isRefreshRequired (IngestManager.IngestJobEvent evt)
default boolean	isRefreshRequired (AbstractFile evt)
boolean	isRefreshRequired (IngestJobEvent evt)
default boolean	isRefreshRequiredForCaseEvent (PropertyChangeEvent evt)

Public Attributes
Set< IngestJobEvent >	INGEST_JOB_EVENTS

Private Member Functions
SortedMap< Long, List< RecentAttachmentDetails > >	buildAttachmentMap (DataSource dataSource) throws SleuthkitCaseProviderException, TskCoreException
List< RecentAttachmentDetails >	createListFromMap (SortedMap< Long, List< RecentAttachmentDetails >> sortedMap, int maxCount)
boolean	isMessageArtifact (BlackboardArtifact nodeArtifact)

Private Attributes
final SleuthkitCaseProvider	provider

Static Private Attributes
static final Set< Integer >	ARTIFACT_UPDATE_TYPE_IDS
static final BlackboardAttribute.Type	ASSOCATED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)
static final BlackboardArtifact.Type	ASSOCATED_OBJ_ART = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT)
static final BlackboardAttribute.Type	DATETIME_ACCESSED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)
static final BlackboardAttribute.Type	DATETIME_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)
static final DateFormat	DATETIME_FORMAT = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss", Locale.getDefault())
static final BlackboardAttribute.Type	DOMAIN_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)
static final BlackboardAttribute.Type	EMAIL_FROM_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)
static final BlackboardAttribute.Type	MSG_DATEIME_SENT_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)
static final BlackboardAttribute.Type	PATH_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)

Detailed Description

Helper class for getting data for the Recent Files Data Summary tab.

Definition at line 48 of file RecentFilesSummary.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.RecentFilesSummary

(

)

Default constructor.

Definition at line 74 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.DEFAULT.

org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.RecentFilesSummary

(

SleuthkitCaseProvider

provider

)

Construct object with given SleuthkitCaseProvider

Parameters

provider

SleuthkitCaseProvider provider, cannot be null.

Definition at line 83 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.provider.

Member Function Documentation

SortedMap<Long, List<RecentAttachmentDetails> > org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.buildAttachmentMap ( DataSource  dataSource ) throws SleuthkitCaseProviderException, TskCoreException

private

Build a map of all of the message attachment sorted in date order.

Parameters

dataSource

Data source to query.

Returns

Returns a SortedMap of details objects returned in descending order.

Exceptions

SleuthkitCaseProviderException
TskCoreException

Definition at line 232 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ASSOCATED_ATT, org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ASSOCATED_OBJ_ART, org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.EMAIL_FROM_ATT, org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.isMessageArtifact(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.MSG_DATEIME_SENT_ATT.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachments().

List<RecentAttachmentDetails> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.createListFromMap ( SortedMap< Long, List< RecentAttachmentDetails >>  sortedMap, int  maxCount  )

private

Create a list of detail objects from the given sorted map of the max size.

Parameters

sortedMap	A Map of attachment details sorted by date.
maxCount	Maximum number of values to return.

Returns

A list of the details of the most recent attachments or empty list if none where found.

Definition at line 293 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachments().

Set<Integer> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getArtifactTypeIdsForRefresh

(

)

Returns

The set of artifact type id's that should trigger an update.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.

Definition at line 92 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ARTIFACT_UPDATE_TYPE_IDS.

default Set<Case.Events> org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.getCaseEventUpdates ( )

inherited

Returns

The set of Case Events for which data should be updated.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.UpdateGovernor.

Definition at line 57 of file DefaultUpdateGovernor.java.

default Set<IngestJobEvent> org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.getIngestJobEventUpdates ( )

inherited

Returns

The set of Ingest Job Events for which data should be updated.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.

Definition at line 52 of file DefaultArtifactUpdateGovernor.java.

References org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.INGEST_JOB_EVENTS.

List<RecentAttachmentDetails> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachments	(	DataSource	dataSource,
		int	maxCount
	)		throws SleuthkitCaseProviderException, TskCoreException

Returns a list of the most recent message attachments.

Parameters

dataSource	Data source to query.
maxCount	Maximum number of results to return, passing 0 will return all results.

Returns

A list of RecentFileDetails of the most recent attachments.

Exceptions

SleuthkitCaseProviderException
TskCoreException

Definition at line 213 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.buildAttachmentMap(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.createListFromMap().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.RecentFilesPanel.initalizeAttchementsTable().

List<RecentDownloadDetails> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownloads	(	DataSource	dataSource,
		int	maxCount
	)		throws TskCoreException, SleuthkitCaseProviderException

Return a list of the most recent downloads based on the value of the the artifact TSK_DATETIME_ACCESSED attribute.

Parameters

dataSource	Data source to query.
maxCount	Maximum number of results to return, passing 0 will return all results.

Returns

A list of RecentFileDetails objects or empty list if none were found.

Exceptions

TskCoreException
SleuthkitCaseProviderException

Definition at line 162 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DATETIME_ACCESSED_ATT, org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DOMAIN_ATT, org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.PATH_ATT.

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.RecentFilesPanel.initalizeDownloadTable().

List<RecentFileDetails> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocuments	(	DataSource	dataSource,
		int	maxCount
	)		throws SleuthkitCaseProviderException, TskCoreException

Return a list of the most recently opened documents based on the TSK_RECENT_OBJECT artifact.

Parameters

dataSource	The data source to query.
maxCount	The maximum number of results to return, pass 0 to get a list of all results.

Returns

A list RecentFileDetails representing the most recently opened documents or an empty list if none were found.

Exceptions

SleuthkitCaseProviderException
TskCoreException

Definition at line 110 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DATETIME_ATT, org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.PATH_ATT.

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.RecentFilesPanel.initalizeOpenDocsTable().

boolean org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.isMessageArtifact ( BlackboardArtifact  nodeArtifact )

private

Is the given artifact a message.

Parameters

nodeArtifact

An artifact that might be a message. Must not be null.

Returns

True if the given artifact is a message artifact

Definition at line 326 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.buildAttachmentMap().

default boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.isRefreshRequired ( ModuleDataEvent  evt )

inherited

Given a module data event, whether or not an update should occur.

Parameters

evt	The ModuleDataEvent that is occurring.

Returns

Whether or not this event should trigger an update.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.

Definition at line 38 of file DefaultArtifactUpdateGovernor.java.

References org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.getArtifactTypeIdsForRefresh(), and org.sleuthkit.autopsy.ingest.ModuleDataEvent.getBlackboardArtifactType().

default boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.isRefreshRequired ( ModuleContentEvent  evt )

inherited

Given a module content event, whether or not an update should occur.

Parameters

evt	The ModuleContentEvent.

Returns

Whether or not this event should trigger an update.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.UpdateGovernor.

Implemented in org.sleuthkit.autopsy.datasourcesummary.datamodel.ContainerSummary, org.sleuthkit.autopsy.datasourcesummary.datamodel.MimeTypeSummary, and org.sleuthkit.autopsy.datasourcesummary.datamodel.TypesSummary.

Definition at line 42 of file DefaultUpdateGovernor.java.

default boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.isRefreshRequired ( IngestManager.IngestJobEvent  evt )

inherited

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.

Definition at line 47 of file DefaultArtifactUpdateGovernor.java.

default boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.isRefreshRequired ( AbstractFile  evt )

inherited

Whether or not a newly added AbstractFile should trigger an update.

Parameters

evt	The AbstractFile.

Returns

True if an update should occur.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.UpdateGovernor.

Implemented in org.sleuthkit.autopsy.datasourcesummary.datamodel.ContainerSummary, org.sleuthkit.autopsy.datasourcesummary.datamodel.MimeTypeSummary, and org.sleuthkit.autopsy.datasourcesummary.datamodel.TypesSummary.

Definition at line 67 of file DefaultUpdateGovernor.java.

boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.UpdateGovernor.isRefreshRequired ( IngestJobEvent  evt )

inherited

Given an ingest job event, determines whether or not an update should occur.

Parameters

evt	The event.

Returns

Whether or not this event should trigger an update.

Implemented in org.sleuthkit.autopsy.datasourcesummary.datamodel.MimeTypeSummary, and org.sleuthkit.autopsy.datasourcesummary.datamodel.TypesSummary.

default boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.isRefreshRequiredForCaseEvent ( PropertyChangeEvent  evt )

inherited

Given a case event, whether or not an update should occur.

Parameters

evt	The event.

Returns

Whether or not this event should trigger an update.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.UpdateGovernor.

Definition at line 37 of file DefaultUpdateGovernor.java.

Member Data Documentation

final Set<Integer> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ARTIFACT_UPDATE_TYPE_IDS

staticprivate

Initial value:

= new HashSet<>(Arrays.asList(
            ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID(),
            ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID(),
            ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT.getTypeID(),
            ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID(),
            ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()
    ))

Definition at line 61 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getArtifactTypeIdsForRefresh().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ASSOCATED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)

staticprivate

Definition at line 54 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.buildAttachmentMap().

final BlackboardArtifact.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ASSOCATED_OBJ_ART = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT)

staticprivate

Definition at line 57 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.buildAttachmentMap().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DATETIME_ACCESSED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)

staticprivate

Definition at line 50 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownloads().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DATETIME_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)

staticprivate

Definition at line 53 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocuments().

final DateFormat org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DATETIME_FORMAT = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss", Locale.getDefault())

staticprivate

Definition at line 59 of file RecentFilesSummary.java.

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DOMAIN_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)

staticprivate

Definition at line 51 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownloads().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.EMAIL_FROM_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)

staticprivate

Definition at line 55 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.buildAttachmentMap().

Set<IngestJobEvent> org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.INGEST_JOB_EVENTS

inherited

Initial value:

= new HashSet<>(
            Arrays.asList(IngestJobEvent.COMPLETED, IngestJobEvent.CANCELLED))

Definition at line 34 of file DefaultArtifactUpdateGovernor.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.getIngestJobEventUpdates().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.MSG_DATEIME_SENT_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)

staticprivate

Definition at line 56 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.buildAttachmentMap().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.PATH_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)

staticprivate

Definition at line 52 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownloads(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocuments().

final SleuthkitCaseProvider org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.provider

private

Definition at line 69 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.RecentFilesSummary().

---

The documentation for this class was generated from the following file:

• /home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/RecentFilesSummary.java