Autopsy  4.19.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
NodeData.java
Go to the documentation of this file.
1 /*
2  * Central Repository
3  *
4  * Copyright 2018-2019 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.centralrepository.application;
20 
24 import org.sleuthkit.datamodel.AbstractFile;
25 import org.sleuthkit.datamodel.DataSource;
26 import org.sleuthkit.datamodel.TskCoreException;
27 import org.sleuthkit.datamodel.TskData;
28 import org.sleuthkit.datamodel.TskDataException;
29 
33 public class NodeData {
34 
35  // For now hard code the string for the central repo files type, since
36  // getting it dynamically can fail.
37  private static final String FILE_TYPE_STR = "Files";
38  private static final String CSV_ITEM_SEPARATOR = "\",\"";
39 
40  private final String caseName;
41  private String deviceID;
42  private String dataSourceName;
43  private final String filePath;
44  private final String typeStr;
45  private final String value;
46  private TskData.FileKnown known;
47  private String comment;
48 
49  private AbstractFile originalAbstractFile = null;
51 
60  caseName = instance.getCorrelationCase().getDisplayName();
61  deviceID = instance.getCorrelationDataSource().getDeviceID();
62  dataSourceName = instance.getCorrelationDataSource().getName();
63  filePath = instance.getFilePath();
64  this.typeStr = type.getDisplayName();
65  this.value = value;
66  known = instance.getKnownStatus();
67  comment = instance.getComment();
68 
69  originalCorrelationInstance = instance;
70  }
71 
80  NodeData(AbstractFile newFile, Case autopsyCase) throws CentralRepoException {
81  caseName = autopsyCase.getDisplayName();
82  try {
83  DataSource dataSource = autopsyCase.getSleuthkitCase().getDataSource(newFile.getDataSource().getId());
84  deviceID = dataSource.getDeviceId();
85  dataSourceName = dataSource.getName();
86  } catch (TskDataException | TskCoreException ex) {
87  throw new CentralRepoException("Error loading data source for abstract file ID " + newFile.getId(), ex);
88  }
89 
90  filePath = newFile.getParentPath() + newFile.getName();
91  typeStr = FILE_TYPE_STR;
92  value = newFile.getMd5Hash();
93  known = newFile.getKnown();
94  comment = "";
95 
96  originalAbstractFile = newFile;
97  }
98 
104  boolean isFileType() {
105  return FILE_TYPE_STR.equals(typeStr);
106  }
107 
113  void updateKnown(TskData.FileKnown newKnownStatus) {
114  known = newKnownStatus;
115  }
116 
122  public void updateComment(String newComment) {
123  comment = newComment;
124  }
125 
132  public boolean isCentralRepoNode() {
133  return (originalCorrelationInstance != null);
134  }
135 
141  public String getCaseName() {
142  return caseName;
143  }
144 
150  public String getDeviceID() {
151  return deviceID;
152  }
153 
159  public String getDataSourceName() {
160  return dataSourceName;
161  }
162 
168  public String getFilePath() {
169  return filePath;
170  }
171 
177  public String getType() {
178  return typeStr;
179  }
180 
186  public String getValue() {
187  return value;
188  }
189 
195  public TskData.FileKnown getKnown() {
196  return known;
197  }
198 
204  public String getComment() {
205  return comment;
206  }
207 
214  public AbstractFile getAbstractFile() throws CentralRepoException {
215  if (originalAbstractFile == null) {
216  throw new CentralRepoException("AbstractFile is null");
217  }
218  return originalAbstractFile;
219  }
220 
230  if (originalCorrelationInstance == null) {
231  throw new CentralRepoException("CorrelationAttributeInstance is null");
232  }
234  }
235 
242  public static String getCsvItemSeparator() {
243  return CSV_ITEM_SEPARATOR;
244  }
245 
252  String toCsvString() {
253  StringBuilder line = new StringBuilder("\"");
254  line.append(getCaseName()).append(CSV_ITEM_SEPARATOR)
255  .append(getDataSourceName()).append(CSV_ITEM_SEPARATOR)
256  .append(getType()).append(CSV_ITEM_SEPARATOR)
257  .append(getValue()).append(CSV_ITEM_SEPARATOR)
258  .append(getKnown().toString()).append(CSV_ITEM_SEPARATOR)
259  .append(getFilePath()).append(CSV_ITEM_SEPARATOR)
260  .append(getComment()).append('"')
261  .append(System.getProperty("line.separator"));
262  return line.toString();
263  }
264 }
NodeData(CorrelationAttributeInstance instance, CorrelationAttributeInstance.Type type, String value)
Definition: NodeData.java:59
CorrelationAttributeInstance getCorrelationAttributeInstance()
Definition: NodeData.java:229

Copyright © 2012-2021 Basis Technology. Generated on: Fri Aug 6 2021
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.