Autopsy  4.19.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Public Attributes | Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary Class Reference

Inherits org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.

Classes

class  RecentAttachmentDetails
 
class  RecentDownloadDetails
 
class  RecentFileDetails
 

Public Member Functions

 RecentFilesSummary ()
 
 RecentFilesSummary (SleuthkitCaseProvider provider)
 
Set< Integer > getArtifactTypeIdsForRefresh ()
 
default Set< Case.Events > getCaseEventUpdates ()
 
default Set< IngestJobEvent > getIngestJobEventUpdates ()
 
List< RecentAttachmentDetailsgetRecentAttachments (DataSource dataSource, int maxCount) throws SleuthkitCaseProviderException, TskCoreException
 
List< RecentDownloadDetailsgetRecentDownloads (DataSource dataSource, int maxCount) throws TskCoreException, SleuthkitCaseProviderException
 
List< RecentFileDetailsgetRecentlyOpenedDocuments (DataSource dataSource, int maxCount) throws SleuthkitCaseProviderException, TskCoreException
 
default boolean isRefreshRequired (ModuleDataEvent evt)
 
default boolean isRefreshRequired (ModuleContentEvent evt)
 
default boolean isRefreshRequired (IngestManager.IngestJobEvent evt)
 
default boolean isRefreshRequired (AbstractFile evt)
 
boolean isRefreshRequired (IngestJobEvent evt)
 
default boolean isRefreshRequiredForCaseEvent (PropertyChangeEvent evt)
 

Public Attributes

Set< IngestJobEvent > INGEST_JOB_EVENTS
 

Private Member Functions

RecentAttachmentDetails getRecentAttachment (BlackboardArtifact artifact, SleuthkitCase skCase) throws TskCoreException
 
RecentDownloadDetails getRecentDownload (BlackboardArtifact artifact)
 
RecentFileDetails getRecentlyOpenedDocument (BlackboardArtifact artifact)
 
boolean isMessageArtifact (BlackboardArtifact nodeArtifact)
 
void throwOnNonPositiveCount (int count)
 

Private Attributes

final SleuthkitCaseProvider provider
 

Static Private Attributes

static final Set< Integer > ARTIFACT_UPDATE_TYPE_IDS
 
static final BlackboardAttribute.Type ASSOCATED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)
 
static final BlackboardArtifact.Type ASSOCATED_OBJ_ART = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT)
 
static final BlackboardAttribute.Type DATETIME_ACCESSED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)
 
static final DateFormat DATETIME_FORMAT = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss", Locale.getDefault())
 
static final BlackboardAttribute.Type DOMAIN_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)
 
static final BlackboardAttribute.Type EMAIL_FROM_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)
 
static final BlackboardAttribute.Type MSG_DATEIME_SENT_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)
 
static final BlackboardAttribute.Type PATH_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)
 

Detailed Description

Helper class for getting data for the Recent Files Data Summary tab.

Definition at line 49 of file RecentFilesSummary.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.RecentFilesSummary ( )
org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.RecentFilesSummary ( SleuthkitCaseProvider  provider)

Construct object with given SleuthkitCaseProvider

Parameters
providerSleuthkitCaseProvider provider, cannot be null.

Definition at line 83 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.provider.

Member Function Documentation

Set<Integer> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getArtifactTypeIdsForRefresh ( )
default Set<Case.Events> org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.getCaseEventUpdates ( )
inherited
Returns
The set of Case Events for which data should be updated.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.UpdateGovernor.

Definition at line 57 of file DefaultUpdateGovernor.java.

default Set<IngestJobEvent> org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.getIngestJobEventUpdates ( )
inherited
RecentAttachmentDetails org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachment ( BlackboardArtifact  artifact,
SleuthkitCase  skCase 
) throws TskCoreException
private
List<RecentAttachmentDetails> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachments ( DataSource  dataSource,
int  maxCount 
) throws SleuthkitCaseProviderException, TskCoreException

Returns a list of the most recent message attachments.

Parameters
dataSourceData source to query.
maxCountMaximum number of results to return, passing 0 will return all results.
Returns
A list of RecentFileDetails of the most recent attachments.
Exceptions
SleuthkitCaseProviderException
TskCoreException

Definition at line 238 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ASSOCATED_OBJ_ART, org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachment(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.throwOnNonPositiveCount().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.RecentFilesPanel.RecentFilesPanel().

RecentDownloadDetails org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownload ( BlackboardArtifact  artifact)
private

Returns a RecentDownloadDetails object as derived from the recent download artifact or null if no appropriate object can be made.

Parameters
artifactThe artifact.
Returns
The derived object or null if artifact is invalid.

Definition at line 173 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DATETIME_ACCESSED_ATT, org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DOMAIN_ATT, and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.PATH_ATT.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownloads().

List<RecentDownloadDetails> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownloads ( DataSource  dataSource,
int  maxCount 
) throws TskCoreException, SleuthkitCaseProviderException

Return a list of the most recent downloads based on the value of the the artifact TSK_DATETIME_ACCESSED attribute.

Parameters
dataSourceData source to query.
maxCountMaximum number of results to return, passing 0 will return all results.
Returns
A list of RecentFileDetails objects or empty list if none were found.
Exceptions
TskCoreException
SleuthkitCaseProviderException

Definition at line 210 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentDownload(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.throwOnNonPositiveCount().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.RecentFilesPanel.RecentFilesPanel().

RecentFileDetails org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocument ( BlackboardArtifact  artifact)
private

Returns a RecentFileDetails object as derived from the recent document artifact or null if no appropriate object can be made.

Parameters
artifactThe artifact.
Returns
The derived object or null if artifact is invalid.

Definition at line 125 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DATETIME_ACCESSED_ATT, and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.PATH_ATT.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocuments().

List<RecentFileDetails> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocuments ( DataSource  dataSource,
int  maxCount 
) throws SleuthkitCaseProviderException, TskCoreException

Return a list of the most recently opened documents based on the TSK_RECENT_OBJECT artifact.

Parameters
dataSourceThe data source to query.
maxCountThe maximum number of results to return, pass 0 to get a list of all results.
Returns
A list RecentFileDetails representing the most recently opened documents or an empty list if none were found.
Exceptions
SleuthkitCaseProviderException
TskCoreException

Definition at line 150 of file RecentFilesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentlyOpenedDocument(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.throwOnNonPositiveCount().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.RecentFilesPanel.RecentFilesPanel().

boolean org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.isMessageArtifact ( BlackboardArtifact  nodeArtifact)
private

Is the given artifact a message.

Parameters
nodeArtifactAn artifact that might be a message. Must not be null.
Returns
True if the given artifact is a message artifact

Definition at line 312 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getRecentAttachment().

default boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.isRefreshRequired ( ModuleDataEvent  evt)
inherited

Given a module data event, whether or not an update should occur.

Parameters
evtThe ModuleDataEvent that is occurring.
Returns
Whether or not this event should trigger an update.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.

Definition at line 38 of file DefaultArtifactUpdateGovernor.java.

References org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.getArtifactTypeIdsForRefresh(), and org.sleuthkit.autopsy.ingest.ModuleDataEvent.getBlackboardArtifactType().

default boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.isRefreshRequired ( ModuleContentEvent  evt)
inherited

Given a module content event, whether or not an update should occur.

Parameters
evtThe ModuleContentEvent.
Returns
Whether or not this event should trigger an update.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.UpdateGovernor.

Implemented in org.sleuthkit.autopsy.datasourcesummary.datamodel.TimelineSummary, org.sleuthkit.autopsy.datasourcesummary.datamodel.ContainerSummary, org.sleuthkit.autopsy.datasourcesummary.datamodel.MimeTypeSummary, and org.sleuthkit.autopsy.datasourcesummary.datamodel.TypesSummary.

Definition at line 42 of file DefaultUpdateGovernor.java.

default boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.isRefreshRequired ( IngestManager.IngestJobEvent  evt)
inherited
default boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.isRefreshRequired ( AbstractFile  evt)
inherited
boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.UpdateGovernor.isRefreshRequired ( IngestJobEvent  evt)
inherited

Given an ingest job event, determines whether or not an update should occur.

Parameters
evtThe event.
Returns
Whether or not this event should trigger an update.

Implemented in org.sleuthkit.autopsy.datasourcesummary.datamodel.TimelineSummary, org.sleuthkit.autopsy.datasourcesummary.datamodel.MimeTypeSummary, and org.sleuthkit.autopsy.datasourcesummary.datamodel.TypesSummary.

default boolean org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultUpdateGovernor.isRefreshRequiredForCaseEvent ( PropertyChangeEvent  evt)
inherited

Given a case event, whether or not an update should occur.

Parameters
evtThe event.
Returns
Whether or not this event should trigger an update.

Implements org.sleuthkit.autopsy.datasourcesummary.uiutils.UpdateGovernor.

Definition at line 37 of file DefaultUpdateGovernor.java.

void org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.throwOnNonPositiveCount ( int  count)
private

Member Data Documentation

final Set<Integer> org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ARTIFACT_UPDATE_TYPE_IDS
staticprivate
Initial value:
= new HashSet<>(Arrays.asList(
ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID(),
ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID(),
ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT.getTypeID(),
ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID(),
ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()
))

Definition at line 61 of file RecentFilesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.getArtifactTypeIdsForRefresh().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ASSOCATED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)
staticprivate
final BlackboardArtifact.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.ASSOCATED_OBJ_ART = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DATETIME_ACCESSED_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)
staticprivate
final DateFormat org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DATETIME_FORMAT = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss", Locale.getDefault())
staticprivate

Definition at line 59 of file RecentFilesSummary.java.

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.DOMAIN_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.EMAIL_FROM_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)
staticprivate
Set<IngestJobEvent> org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.INGEST_JOB_EVENTS
inherited
Initial value:
= new HashSet<>(
Arrays.asList(IngestJobEvent.COMPLETED, IngestJobEvent.CANCELLED))

Definition at line 34 of file DefaultArtifactUpdateGovernor.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.uiutils.DefaultArtifactUpdateGovernor.getIngestJobEventUpdates().

final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.MSG_DATEIME_SENT_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.PATH_ATT = new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)
staticprivate
final SleuthkitCaseProvider org.sleuthkit.autopsy.datasourcesummary.datamodel.RecentFilesSummary.provider
private

The documentation for this class was generated from the following file:

Copyright © 2012-2021 Basis Technology. Generated on: Fri Aug 6 2021
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.