Static Public Member Functions
static CorrelationAttributeInstance	getCorrAttrForFile (AbstractFile file)

static boolean	isSupportedAbstractFileType (AbstractFile file)

static List< CorrelationAttributeInstance >	makeCorrAttrsForSearch (AnalysisResult analysisResult)

static List< CorrelationAttributeInstance >	makeCorrAttrsForSearch (DataArtifact artifact)

static List< CorrelationAttributeInstance >	makeCorrAttrsForSearch (AbstractFile file)

static List< CorrelationAttributeInstance >	makeCorrAttrsForSearch (OsAccountInstance osAccountInst)

static List< CorrelationAttributeInstance >	makeCorrAttrsToSave (DataArtifact artifact)

static List< CorrelationAttributeInstance >	makeCorrAttrsToSave (AbstractFile file)

static List< CorrelationAttributeInstance >	makeCorrAttrsToSave (AnalysisResult file)

static List< CorrelationAttributeInstance >	makeCorrAttrsToSave (OsAccountInstance osAccountInstance)

Private Member Functions
	CorrelationAttributeUtil ()

Static Private Member Functions
static BlackboardAttribute	getAttribute (List< BlackboardAttribute > attributes, BlackboardAttribute.Type attributeType) throws TskCoreException

static String	getEmailAddressAttrDisplayName ()

static CorrelationAttributeInstance	makeCorrAttr (BlackboardArtifact artifact, CorrelationAttributeInstance.Type correlationType, String value)

static CorrelationAttributeInstance	makeCorrAttr (BlackboardArtifact artifact, CorrelationAttributeInstance.Type correlationType, String value, Content sourceContent, Content dataSource)

static void	makeCorrAttrFromAcctArtifact (List< CorrelationAttributeInstance > corrAttrInstances, BlackboardArtifact acctArtifact) throws InvalidAccountIDException, TskCoreException, CentralRepoException

static List< CorrelationAttributeInstance >	makeCorrAttrFromArtifactAttr (BlackboardArtifact artifact, ATTRIBUTE_TYPE artAttrType, int typeId, List< BlackboardAttribute > attributes, Content sourceContent, Content dataSource) throws CentralRepoException, TskCoreException

static List< CorrelationAttributeInstance >	makeCorrAttrFromArtifactAttr (BlackboardArtifact artifact, ATTRIBUTE_TYPE artAttrType, int typeId, List< BlackboardAttribute > attributes) throws CentralRepoException, TskCoreException

static List< CorrelationAttributeInstance >	makeCorrAttrsFromCommunicationArtifact (BlackboardArtifact artifact, List< BlackboardAttribute > attributes) throws TskCoreException, CentralRepoException, CorrelationAttributeNormalizationException

Static Private Attributes
static final Set< Integer >	DOMAIN_ARTIFACT_TYPE_IDS

static final List< String >	domainsToSkip = Arrays.asList("localhost", "127.0.0.1")

static final Logger	logger = Logger.getLogger(CorrelationAttributeUtil.class.getName())

Detailed Description

Utility class for working with correlation attributes in the central repository.

Definition at line 55 of file CorrelationAttributeUtil.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.CorrelationAttributeUtil ( )

private

Prevent instantiation of this utility class.

Definition at line 797 of file CorrelationAttributeUtil.java.

Member Function Documentation

static BlackboardAttribute org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.getAttribute	(	List< BlackboardAttribute >	attributes,
		BlackboardAttribute.Type	attributeType
	)		throws TskCoreException

staticprivate

Gets a specific attribute from a list of attributes.

Parameters

attributes	List of attributes
attributeType	Attribute type of interest

Returns: Attribute of interest, null if not found.

Exceptions

TskCoreException

Definition at line 314 of file CorrelationAttributeUtil.java.

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrFromArtifactAttr(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch(), and org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsFromCommunicationArtifact().

static CorrelationAttributeInstance org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.getCorrAttrForFile ( AbstractFile file )

static

Gets the correlation attribute instance for a file. This method goes to the CR to get an actual instance. It does not simply package the data from file into a generic instance object.

Parameters

file The file.

TODO (Jira-6088): The methods in this low-level, utility class should throw exceptions instead of logging them. The reason for this is that the clients of the utility class, not the utility class itself, should be in charge of error handling policy, per the Autopsy Coding Standard. Note that clients of several of these methods currently cannot determine whether receiving a null return value is an error or not, plus null checking is easy to forget, while catching exceptions is enforced.

Returns: The correlation attribute instance or null, if no such correlation attribute instance was found or an error occurred.

Definition at line 601 of file CorrelationAttributeUtil.java.

Referenced by org.sleuthkit.autopsy.centralrepository.AddEditCentralRepoCommentAction.AddEditCentralRepoCommentAction().

static String org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.getEmailAddressAttrDisplayName ( )

staticprivate

Gets a string that is expected to be the same string that is stored in the correlation_types table in the central repository as the display name for the email address correlation attribute type. This string is duplicated in the CorrelationAttributeInstance class.

TODO (Jira-6088): We should not have multiple definitions of this string.

Returns: The display name of the email address correlation attribute type.

Definition at line 80 of file CorrelationAttributeUtil.java.

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch().

static boolean org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.isSupportedAbstractFileType ( AbstractFile file )

static

Checks whether or not a file is of a type that can be added to the central repository as a correlation attribute instance.

Parameters

file A file.

Returns: True or false.

Definition at line 728 of file CorrelationAttributeUtil.java.

Referenced by org.sleuthkit.autopsy.centralrepository.CentralRepoContextMenuActionsProvider.getActions(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.getCorrAttrForFile(), and org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch().

static CorrelationAttributeInstance org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttr	(	BlackboardArtifact	artifact,
		CorrelationAttributeInstance.Type	correlationType,
		String	value
	)

staticprivate

Makes a correlation attribute instance of a given type from an artifact.

Parameters

artifact	The artifact.
correlationType	the correlation attribute type.
value	The correlation attribute value.

TODO (Jira-6088): The methods in this low-level, utility class should throw exceptions instead of logging them. The reason for this is that the clients of the utility class, not the utility class itself, should be in charge of error handling policy, per the Autopsy Coding Standard. Note that clients of several of these methods currently cannot determine whether receiving a null return value is an error or not, plus null checking is easy to forget, while catching exceptions is enforced.

Returns: The correlation attribute instance or null, if an error occurred.

Definition at line 496 of file CorrelationAttributeUtil.java.

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrFromAcctArtifact(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrFromArtifactAttr(), and org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsFromCommunicationArtifact().

static CorrelationAttributeInstance org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttr	(	BlackboardArtifact	artifact,
		CorrelationAttributeInstance.Type	correlationType,
		String	value,
		Content	sourceContent,
		Content	dataSource
	)

staticprivate

Makes a correlation attribute instance of a given type from an artifact.

Parameters

artifact	The artifact.
correlationType	the correlation attribute type.
value	The correlation attribute value.
sourceContent	The source content object.
dataSource	The data source content object.

TODO (Jira-6088): The methods in this low-level, utility class should throw exceptions instead of logging them. The reason for this is that the clients of the utility class, not the utility class itself, should be in charge of error handling policy, per the Autopsy Coding Standard. Note that clients of several of these methods currently cannot determine whether receiving a null return value is an error or not, plus null checking is easy to forget, while catching exceptions is enforced.

Returns: The correlation attribute instance or null, if an error occurred.

Definition at line 519 of file CorrelationAttributeUtil.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.fromTSKDataSource(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getCase(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getInstance(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.getName(), and org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase().

static void org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrFromAcctArtifact	(	List< CorrelationAttributeInstance >	corrAttrInstances,
		BlackboardArtifact	acctArtifact
	)		throws InvalidAccountIDException, TskCoreException, CentralRepoException

staticprivate

Makes a correlation attribute instance for an account artifact.

Also creates an account in the CR DB if it doesn't exist.

IMPORTANT: The correlation attribute instance is NOT added to the central repository by this method.

Parameters

corrAttrInstances	A list of correlation attribute instances.
acctArtifact	An account artifact.

Returns: The correlation attribute instance.

Definition at line 382 of file CorrelationAttributeUtil.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getAccountTypeByName(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getCorrelationTypeById(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepoAccount.CentralRepoAccountType.getCorrelationTypeId(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepoAccount.getId(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getInstance(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getOrCreateAccount(), and org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttr().

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch().

static List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrFromArtifactAttr	(	BlackboardArtifact	artifact,
		ATTRIBUTE_TYPE	artAttrType,
		int	typeId,
		List< BlackboardAttribute >	attributes,
		Content	sourceContent,
		Content	dataSource
	)		throws CentralRepoException, TskCoreException

staticprivate

Makes a correlation attribute instance from a specified attribute of an artifact. The correlation attribute instance is added to an input list.

Parameters

artifact	An artifact.
artAttrType	The type of the attribute of the artifact that is to be made into a correlation attribute instance.
typeId	The type ID for the desired correlation attribute instance.
attributes	List of attributes.
sourceContent	The source content object.
dataSource	The data source content object.

Exceptions

CentralRepoException	If there is an error querying the central repository.
TskCoreException	If there is an error querying the case database.

Definition at line 440 of file CorrelationAttributeUtil.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.getAttribute(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getCorrelationTypeById(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getInstance(), and org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttr().

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrFromArtifactAttr(), and org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch().

static List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrFromArtifactAttr	(	BlackboardArtifact	artifact,
		ATTRIBUTE_TYPE	artAttrType,
		int	typeId,
		List< BlackboardAttribute >	attributes
	)		throws CentralRepoException, TskCoreException

staticprivate

Makes a correlation attribute instance from a specified attribute of an artifact. The correlation attribute instance is added to an input list.

Parameters

artifact	An artifact.
artAttrType	The type of the attribute of the artifact that is to be made into a correlation attribute instance.
typeId	The type ID for the desired correlation attribute instance.
attributes	List of attributes.

Exceptions

CentralRepoException	If there is an error querying the central repository.
TskCoreException	If there is an error querying the case database.

Definition at line 473 of file CorrelationAttributeUtil.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrFromArtifactAttr().

static List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch ( AnalysisResult analysisResult )

static

Makes zero to many correlation attribute instances from the attributes of AnalysisResult that have correlatable data. The intention of this method is to use the results to correlate with, not to save. If you want to save, please use makeCorrAttrsToSave. An artifact that can have data to search for != An artifact that should be the source of data in the CR, so results may be too lenient.

IMPORTANT: The correlation attribute instances are NOT added to the central repository by this method.

JIRA-TODO (Jira-6088)

Parameters

analysisResult An AnalysisResult object.

Returns: A list, possibly empty, of correlation attribute instances for the AnalysisResult.

Definition at line 138 of file CorrelationAttributeUtil.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.EMAIL_TYPE_ID, org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.getEmailAddressAttrDisplayName(), org.sleuthkit.autopsy.casemodule.Case.getSleuthkitCase(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrFromArtifactAttr(), and org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch().

static List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch ( DataArtifact artifact )

static

Makes zero to many correlation attribute instances from the attributes of a DataArtifact that have correlatable data. The intention of this method is to use the results to correlate with, not to save. If you want to save, please use makeCorrAttrsToSave. An artifact that can have data to search for != An artifact that should be the source of data in the CR, so results may be too lenient.

IMPORTANT: The correlation attribute instances are NOT added to the central repository by this method.

JIRA-TODO (Jira-6088)

Parameters

artifact A DataArtifact object.

Returns: A list, possibly empty, of correlation attribute instances for the DataArtifact.

Definition at line 210 of file CorrelationAttributeUtil.java.

static List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch ( AbstractFile file )

static

Makes a correlation attribute instance for a file. Will include the specific object ID.

IMPORTANT: The correlation attribute instance is NOT added to the central repository by this method.

TODO (Jira-6088): The methods in this low-level, utility class should throw exceptions instead of logging them. The reason for this is that the clients of the utility class, not the utility class itself, should be in charge of error handling policy, per the Autopsy Coding Standard. Note that clients of several of these methods currently cannot determine whether receiving a null return value is an error or not, plus null checking is easy to forget, while catching exceptions is enforced.

Parameters

file The file.

Returns: The correlation attribute instance in a list, or an empty list if an error occurred.

Definition at line 683 of file CorrelationAttributeUtil.java.

static List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch ( OsAccountInstance osAccountInst )

static

Definition at line 752 of file CorrelationAttributeUtil.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationDataSource.fromTSKDataSource(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getCase(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getCorrelationTypeById(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getInstance(), and org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.OSACCOUNT_TYPE_ID.

static List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsFromCommunicationArtifact	(	BlackboardArtifact	artifact,
		List< BlackboardAttribute >	attributes
	)		throws TskCoreException, CentralRepoException, CorrelationAttributeNormalizationException

staticprivate

Makes a correlation attribute instance from a phone number attribute of an artifact.

Parameters

artifact	An artifact with a phone number attribute.
attributes	List of attributes.

Exceptions

TskCoreException	If there is an error querying the case database.
CentralRepoException	If there is an error querying the central repository.
CorrelationAttributeNormalizationException	If there is an error in normalizing the attribute.

Definition at line 340 of file CorrelationAttributeUtil.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.getAttribute(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getCorrelationTypeById(), org.sleuthkit.autopsy.centralrepository.datamodel.CentralRepository.getInstance(), org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttr(), and org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeInstance.PHONE_TYPE_ID.

Referenced by org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch().

static List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsToSave ( DataArtifact artifact )

static

Definition at line 84 of file CorrelationAttributeUtil.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch().

Referenced by org.sleuthkit.autopsy.centralrepository.eventlisteners.IngestEventsListener.DataAddedTask.run().

static List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsToSave ( AbstractFile file )

static

Makes zero to many correlation attribute instances from the attributes of abstract file objects that have correlatable data. The intention of this method is to use the results to save to the CR, not to correlate with them. If you want to correlate, please use makeCorrAttrsForSearch. An artifact that can have correlatable data != An artifact that should be the source of data in the CR, so results may be un-necessarily incomplete.

Parameters

file	A AbstractFile object.

Returns: A list, possibly empty, of correlation attribute instances for the content.

Definition at line 108 of file CorrelationAttributeUtil.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch().

static List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsToSave ( AnalysisResult file )

static

Definition at line 112 of file CorrelationAttributeUtil.java.

static List<CorrelationAttributeInstance> org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsToSave ( OsAccountInstance osAccountInstance )

static

Definition at line 116 of file CorrelationAttributeUtil.java.

References org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.makeCorrAttrsForSearch().

Member Data Documentation

final Set<Integer> org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.DOMAIN_ARTIFACT_TYPE_IDS

staticprivate

Initial value:

= new HashSet<>(Arrays.asList(
            ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID(),
            ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID(),
            ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID(),
            ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID(),
            ARTIFACT_TYPE.TSK_WEB_CACHE.getTypeID()
    ))

Definition at line 61 of file CorrelationAttributeUtil.java.

final List<String> org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.domainsToSkip = Arrays.asList("localhost", "127.0.0.1")

staticprivate

Definition at line 58 of file CorrelationAttributeUtil.java.

final Logger org.sleuthkit.autopsy.centralrepository.datamodel.CorrelationAttributeUtil.logger = Logger.getLogger(CorrelationAttributeUtil.class.getName())

staticprivate

Definition at line 57 of file CorrelationAttributeUtil.java.

The documentation for this class was generated from the following file:

/home/carriersleuth/repos/autopsy/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeUtil.java

Static Public Member Functions

Private Member Functions

Static Private Member Functions

Static Private Attributes

Detailed Description

Constructor & Destructor Documentation

Member Function Documentation

Member Data Documentation