Autopsy  4.19.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Static Public Member Functions | Private Member Functions | Static Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary Class Reference

Classes

class  LastAccessedArtifact
 
class  TopAccountResult
 
class  TopDeviceAttachedResult
 
class  TopDomainsResult
 
class  TopProgramsResult
 
class  TopWebSearchResult
 

Public Member Functions

 UserActivitySummary ()
 
 UserActivitySummary (SleuthkitCaseProvider provider, TextTranslationService translationService, java.util.logging.Logger logger)
 
List< TopWebSearchResultgetMostRecentWebSearches (DataSource dataSource, int count) throws SleuthkitCaseProviderException, TskCoreException
 
List< TopAccountResultgetRecentAccounts (DataSource dataSource, int count) throws SleuthkitCaseProviderException, TskCoreException
 
List< TopDeviceAttachedResultgetRecentDevices (DataSource dataSource, int count) throws SleuthkitCaseProviderException, TskCoreException
 
List< TopDomainsResultgetRecentDomains (DataSource dataSource, int count) throws TskCoreException, SleuthkitCaseProviderException
 
List< TopProgramsResultgetTopPrograms (DataSource dataSource, int count) throws SleuthkitCaseProviderException, TskCoreException
 

Static Public Member Functions

static String getShortFolderName (String strPath, String applicationName)
 

Private Member Functions

Pair< Long, Map< String, List< Pair< BlackboardArtifact, Long > > > > getDomainGroupsAndMostRecent (DataSource dataSource) throws TskCoreException, SleuthkitCaseProviderException
 
TopDomainsResult getDomainsResult (String domain, List< Pair< BlackboardArtifact, Long >> visits, long mostRecentMs)
 
TopDeviceAttachedResult getMostRecentDevice (TopDeviceAttachedResult r1, TopDeviceAttachedResult r2)
 
TopProgramsResult getTopProgramsResult (BlackboardArtifact artifact)
 
String getTranslationOrNull (String original)
 

Static Private Member Functions

static void assertValidCount (int count)
 
static TopAccountResult getAccountResult (BlackboardArtifact artifact, String messageType, BlackboardAttribute.Type...dateAttrs)
 
static Long getMax (Long num1, Long num2)
 
static Date getMax (Date date1, Date date2)
 
static TopAccountResult getMessageAccountResult (BlackboardArtifact artifact)
 
static TopWebSearchResult getWebSearchResult (BlackboardArtifact artifact)
 
static boolean isPositiveNum (Long longNum)
 
static int nullableCompare (Long long1, Long long2)
 

Private Attributes

final SleuthkitCaseProvider caseProvider
 
final java.util.logging.Logger logger
 
final TextTranslationService translationService
 

Static Private Attributes

static final Set< String > DEVICE_EXCLUDE_LIST = new HashSet<>(Arrays.asList("ROOT_HUB", "ROOT_HUB20"))
 
static final Set< String > DOMAIN_EXCLUDE_LIST = new HashSet<>(Arrays.asList("127.0.0.1", "LOCALHOST"))
 
static final long DOMAIN_WINDOW_DAYS = 30
 
static final long DOMAIN_WINDOW_MS = DOMAIN_WINDOW_DAYS * MS_PER_DAY
 
static final long MS_PER_DAY = 1000 * 60 * 60 * 24
 
static final String NTOS_BOOT_IDENTIFIER = "NTOSBOOT"
 
static final List< Function< List< String >, String > > SHORT_FOLDER_MATCHERS
 
static final Comparator< TopAccountResultTOP_ACCOUNT_RESULT_DATE_COMPARE = (a, b) -> a.getLastAccessed().compareTo(b.getLastAccessed())
 
static final Comparator< TopProgramsResultTOP_PROGRAMS_RESULT_COMPARE
 
static final Comparator< TopWebSearchResultTOP_WEBSEARCH_RESULT_DATE_COMPARE = (a, b) -> a.getLastAccessed().compareTo(b.getLastAccessed())
 
static final BlackboardAttribute.Type TYPE_COUNT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_COUNT)
 
static final BlackboardAttribute.Type TYPE_DATETIME = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME)
 
static final BlackboardAttribute.Type TYPE_DATETIME_ACCESSED = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)
 
static final BlackboardAttribute.Type TYPE_DATETIME_END = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_END)
 
static final BlackboardAttribute.Type TYPE_DATETIME_RCVD = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_RCVD)
 
static final BlackboardAttribute.Type TYPE_DATETIME_SENT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_SENT)
 
static final BlackboardAttribute.Type TYPE_DATETIME_START = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_START)
 
static final BlackboardArtifact.Type TYPE_DEVICE_ATTACHED = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_DEVICE_ATTACHED)
 
static final BlackboardAttribute.Type TYPE_DEVICE_ID = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_ID)
 
static final BlackboardAttribute.Type TYPE_DEVICE_MAKE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)
 
static final BlackboardAttribute.Type TYPE_DEVICE_MODEL = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)
 
static final BlackboardAttribute.Type TYPE_DOMAIN = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DOMAIN)
 
static final BlackboardAttribute.Type TYPE_MESSAGE_TYPE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)
 
static final BlackboardAttribute.Type TYPE_PATH = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH)
 
static final BlackboardAttribute.Type TYPE_PROG_NAME = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)
 
static final BlackboardAttribute.Type TYPE_TEXT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_TEXT)
 
static final BlackboardArtifact.Type TYPE_WEB_HISTORY = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_WEB_HISTORY)
 
static final String WINDOWS_PREFIX = "/WINDOWS"
 

Detailed Description

Provides summary information about user activity in a datasource. At this time, the data being provided for domains is fictitious and is done as a placeholder.

Definition at line 56 of file UserActivitySummary.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.UserActivitySummary ( )
org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.UserActivitySummary ( SleuthkitCaseProvider  provider,
TextTranslationService  translationService,
java.util.logging.Logger  logger 
)

Main constructor with external dependencies specified. This constructor is designed with unit testing in mind since mocked dependencies can be utilized.

Parameters
providerThe object providing the current SleuthkitCase.
translationServiceThe translation service.
loggerThe logger to use.

Definition at line 168 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.logger, and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.translationService.

Member Function Documentation

static void org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.assertValidCount ( int  count)
staticprivate
static TopAccountResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getAccountResult ( BlackboardArtifact  artifact,
String  messageType,
BlackboardAttribute.Type...  dateAttrs 
)
staticprivate

Obtains a TopAccountResult from a blackboard artifact. The date is maximum of any found dates for attribute types provided.

Parameters
artifactThe artifact.
messageTypeThe type of message this is.
dateAttrsThe date attribute types.
Returns
The TopAccountResult or null if the account type or max date are not provided.

Definition at line 572 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getDateOrNull().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts().

Pair<Long, Map<String, List<Pair<BlackboardArtifact, Long> > > > org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent ( DataSource  dataSource) throws TskCoreException, SleuthkitCaseProviderException
private
TopDomainsResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainsResult ( String  domain,
List< Pair< BlackboardArtifact, Long >>  visits,
long  mostRecentMs 
)
private

Creates a TopDomainsResult from data or null if no visit date exists within DOMAIN_WINDOW_MS of mostRecentMs.

Parameters
domainThe domain.
visitsThe list of the artifact and its associated time in milliseconds.
mostRecentMsThe most recent visit of any domain.
Returns
The TopDomainsResult or null if no visits to this domain within 30 days of mostRecentMs.

Definition at line 270 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMax().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDomains().

static Long org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMax ( Long  num1,
Long  num2 
)
staticprivate

Returns the maximum value given two longs handling possible null values.

Parameters
num1The first number.
num2The second number.
Returns
The maximum non-null number or null if both numbers are null.

Definition at line 361 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainsResult(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopPrograms().

static Date org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMax ( Date  date1,
Date  date2 
)
staticprivate

Retrieves the maximum date given two (possibly null) dates.

Parameters
date1First date.
date2Second date.
Returns
The maximum non-null date or null if both items are null.

Definition at line 703 of file UserActivitySummary.java.

static TopAccountResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMessageAccountResult ( BlackboardArtifact  artifact)
staticprivate
TopDeviceAttachedResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMostRecentDevice ( TopDeviceAttachedResult  r1,
TopDeviceAttachedResult  r2 
)
private

Gives the most recent TopDeviceAttachedResult. If one is null, the other is returned.

Parameters
r1A result.
r2Another result.
Returns
The most recent one with a non-null date.

Definition at line 486 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.LastAccessedArtifact.getLastAccessed().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices().

List<TopWebSearchResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMostRecentWebSearches ( DataSource  dataSource,
int  count 
) throws SleuthkitCaseProviderException, TskCoreException
List<TopAccountResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentAccounts ( DataSource  dataSource,
int  count 
) throws SleuthkitCaseProviderException, TskCoreException
List<TopDeviceAttachedResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDevices ( DataSource  dataSource,
int  count 
) throws SleuthkitCaseProviderException, TskCoreException

Retrieves most recent devices used by most recent date attached.

Parameters
dataSourceThe data source.
countThe maximum number of records to be shown (must be > 0).
Returns
The list of most recent devices attached where most recent device attached appears first.
Exceptions
org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.SleuthkitCaseProviderException
TskCoreException

Definition at line 512 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.assertValidCount(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.SortOrder.DESCENDING, org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getArtifacts(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getDateOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMostRecentDevice(), org.sleuthkit.autopsy.datasourcesummary.datamodel.DataSourceInfoUtilities.getStringOrNull(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME, org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_ATTACHED, org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_ID, org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_MAKE, and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_MODEL.

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivitySummaryGetter.getRecentDevices().

List<TopDomainsResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getRecentDomains ( DataSource  dataSource,
int  count 
) throws TskCoreException, SleuthkitCaseProviderException

Gets a list of recent domains based on the datasource.

Parameters
dataSourceThe datasource to query for recent domains.
countThe max count of items to return.
Returns
The list of items retrieved from the database.
Exceptions
InterruptedException

Definition at line 232 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.assertValidCount(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainGroupsAndMostRecent(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getDomainsResult().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivitySummaryGetter.getRecentDomains().

static String org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getShortFolderName ( String  strPath,
String  applicationName 
)
static

Determines a short folder name if any. Otherwise, returns empty string.

Parameters
strPathThe string path.
applicationNameThe application name.
Returns
The short folder name or empty string if not found.

Definition at line 197 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivityPanel.getShortFolderName().

List<TopProgramsResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopPrograms ( DataSource  dataSource,
int  count 
) throws SleuthkitCaseProviderException, TskCoreException

Retrieves the top programs results for the given data source limited to the count provided as a parameter. The highest run times are at the top of the list. If that information isn't available the last run date is used. If both, the last run date and the number of run times are unavailable, the programs will be sorted alphabetically, the count will be ignored and all items will be returned.

Parameters
dataSourceThe datasource. If the datasource is null, an empty list will be returned.
countThe number of results to return. This value must be > 0 or an IllegalArgumentException will be thrown.
Returns
The sorted list and limited to the count if last run or run count information is available on any item.
Exceptions
SleuthkitCaseProviderException
TskCoreException

Definition at line 764 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.assertValidCount(), org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.LastAccessedArtifact.getLastAccessed(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMax(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TopProgramsResult.getRunTimes(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.isPositiveNum().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.UserActivitySummaryGetter.getTopPrograms().

TopProgramsResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopProgramsResult ( BlackboardArtifact  artifact)
private
String org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTranslationOrNull ( String  original)
private

Return the translation of the original text if possible and differs from the original. Otherwise, return null.

Parameters
originalThe original text.
Returns
The translated text or null if no translation can be determined or exists.

Definition at line 455 of file UserActivitySummary.java.

References org.sleuthkit.autopsy.texttranslation.TextTranslationService.hasProvider(), org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.logger, and org.sleuthkit.autopsy.texttranslation.TextTranslationService.translate().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getMostRecentWebSearches().

static TopWebSearchResult org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getWebSearchResult ( BlackboardArtifact  artifact)
staticprivate
static boolean org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.isPositiveNum ( Long  longNum)
staticprivate

Returns true if number is non-null and higher than 0.

Parameters
longNumThe number.
Returns
True if non-null and higher than 0.

Definition at line 741 of file UserActivitySummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.getTopPrograms().

static int org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.nullableCompare ( Long  long1,
Long  long2 
)
staticprivate

Returns the compare value favoring the higher non-null number.

Parameters
long1First possibly null long.
long2Second possibly null long.
Returns
Returns the compare value: 1,0,-1 favoring the higher non-null value.

Definition at line 722 of file UserActivitySummary.java.

Member Data Documentation

final SleuthkitCaseProvider org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.caseProvider
private

Definition at line 147 of file UserActivitySummary.java.

final Set<String> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.DEVICE_EXCLUDE_LIST = new HashSet<>(Arrays.asList("ROOT_HUB", "ROOT_HUB20"))
staticprivate

Definition at line 140 of file UserActivitySummary.java.

final Set<String> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.DOMAIN_EXCLUDE_LIST = new HashSet<>(Arrays.asList("127.0.0.1", "LOCALHOST"))
staticprivate

Definition at line 141 of file UserActivitySummary.java.

final long org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.DOMAIN_WINDOW_DAYS = 30
staticprivate

Definition at line 144 of file UserActivitySummary.java.

final long org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.DOMAIN_WINDOW_MS = DOMAIN_WINDOW_DAYS * MS_PER_DAY
staticprivate

Definition at line 145 of file UserActivitySummary.java.

final java.util.logging.Logger org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.logger
private
final long org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.MS_PER_DAY = 1000 * 60 * 60 * 24
staticprivate

Definition at line 143 of file UserActivitySummary.java.

final String org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.NTOS_BOOT_IDENTIFIER = "NTOSBOOT"
staticprivate

Definition at line 107 of file UserActivitySummary.java.

final List<Function<List<String>, String> > org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.SHORT_FOLDER_MATCHERS
staticprivate
Initial value:
= Arrays.asList(
(pathList) -> {
if (pathList.size() < 2) {
return null;
}
String rootParent = pathList.get(0).toUpperCase();
if ("PROGRAM FILES".equals(rootParent) || "PROGRAM FILES (X86)".equals(rootParent)) {
return pathList.get(1);
} else {
return null;
}
},
(pathList) -> {
for (String pathEl : pathList) {
String uppered = pathEl.toUpperCase();
if ("APPLICATION DATA".equals(uppered) || "APPDATA".equals(uppered)) {
return "AppData";
}
}
return null;
}
)

Functions that determine the folder name of a list of path elements. If not matched, function returns null.

Definition at line 62 of file UserActivitySummary.java.

final Comparator<TopAccountResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TOP_ACCOUNT_RESULT_DATE_COMPARE = (a, b) -> a.getLastAccessed().compareTo(b.getLastAccessed())
staticprivate

Definition at line 110 of file UserActivitySummary.java.

final Comparator<TopProgramsResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TOP_PROGRAMS_RESULT_COMPARE
staticprivate
Initial value:
= (a, b) -> {
int runTimesCompare = nullableCompare(a.getRunTimes(), b.getRunTimes());
if (runTimesCompare != 0) {
return -runTimesCompare;
}
int lastRunCompare = nullableCompare(
a.getLastAccessed() == null ? null : a.getLastAccessed().getTime(),
b.getLastAccessed() == null ? null : b.getLastAccessed().getTime());
if (lastRunCompare != 0) {
return -lastRunCompare;
}
return (a.getProgramName() == null ? "" : a.getProgramName())
.compareToIgnoreCase((b.getProgramName() == null ? "" : b.getProgramName()));
}

Sorts TopProgramsResults pushing highest run time count then most recent run and then the program name that comes earliest in the alphabet.

Definition at line 117 of file UserActivitySummary.java.

final Comparator<TopWebSearchResult> org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TOP_WEBSEARCH_RESULT_DATE_COMPARE = (a, b) -> a.getLastAccessed().compareTo(b.getLastAccessed())
staticprivate

Definition at line 111 of file UserActivitySummary.java.

final TextTranslationService org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.translationService
private
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_COUNT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_COUNT)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_ACCESSED = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_END = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_END)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_RCVD = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_RCVD)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_SENT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_SENT)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DATETIME_START = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_START)
staticprivate
final BlackboardArtifact.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_ATTACHED = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_DEVICE_ATTACHED)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_ID = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_ID)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_MAKE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DEVICE_MODEL = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_DOMAIN = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DOMAIN)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_MESSAGE_TYPE = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_PATH = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_PROG_NAME = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)
staticprivate
final BlackboardAttribute.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_TEXT = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_TEXT)
staticprivate
final BlackboardArtifact.Type org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.TYPE_WEB_HISTORY = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_WEB_HISTORY)
staticprivate
final String org.sleuthkit.autopsy.datasourcesummary.datamodel.UserActivitySummary.WINDOWS_PREFIX = "/WINDOWS"
staticprivate

Definition at line 108 of file UserActivitySummary.java.


The documentation for this class was generated from the following file:

Copyright © 2012-2021 Basis Technology. Generated on: Thu Sep 30 2021
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.