Autopsy  4.4
Graphical digital forensics platform for The Sleuth Kit and other tools.
InterestingArtifactCreatorIngestModule.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2017 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.test;
20 
21 import java.util.logging.Level;
22 
23 import org.openide.util.Exceptions;
24 import org.openide.util.NbBundle;
30 import org.sleuthkit.datamodel.AbstractFile;
31 import org.sleuthkit.datamodel.BlackboardArtifact;
32 import org.sleuthkit.datamodel.BlackboardAttribute;
33 import org.sleuthkit.datamodel.TskCoreException;
34 
39 @NbBundle.Messages({
40  "InterestingArtifactCreatorIngestModule.exceptionMessage.errorCreatingCustomType=Error creating custom artifact type."
41 })
42 final class InterestingArtifactCreatorIngestModule extends FileIngestModuleAdapter {
43 
44  private static final Logger logger = Logger.getLogger(InterestingArtifactCreatorIngestModule.class.getName());
45  private static final String MODULE_NAME = InterestingArtifactCreatorIngestModuleFactory.getModuleName();
46  private static final String[] ARTIFACT_TYPE_NAMES = {"TSK_WEB_BOOKMARK", "TSK_KEYWORD_HIT", "TSK_CALLLOG"};
47  private static final String[] ARTIFACT_DISPLAY_NAMES = {"Web Bookmarks", "Keyword Hits", "Call Logs"};
48  private static final String INT_ARTIFACT_TYPE_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getLabel();
49  private static final String INT_ARTIFACT_DISPLAY_NAME = BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getDisplayName();
50  private BlackboardArtifact.Type artifactType;
51 
52  @Override
53  public void startUp(IngestJobContext context) throws IngestModuleException {
54  Blackboard blackboard = Case.getCurrentCase().getServices().getBlackboard();
55  try {
56  artifactType = blackboard.getOrAddArtifactType(INT_ARTIFACT_TYPE_NAME, INT_ARTIFACT_DISPLAY_NAME);
57  } catch (Blackboard.BlackboardException ex) {
58  throw new IngestModuleException(Bundle.InterestingArtifactCreatorIngestModule_exceptionMessage_errorCreatingCustomType(), ex);
59  }
60  }
61 
62  @Override
63  public ProcessResult process(AbstractFile file) {
64  /*
65  * Skip directories and virtual files.
66  */
67  if (file.isDir() || file.isVirtual()) {
68  return ProcessResult.OK;
69  }
70 
71  try {
72  /*
73  * Add a custom artifact with one custom attribute of each value
74  * type.
75  */
76  int randomArtIndex = (int) (Math.random() * 3);
77  Blackboard blackboard = Case.getCurrentCase().getServices().getBlackboard();
78  BlackboardArtifact.Type artifactTypeBase = blackboard.getOrAddArtifactType(ARTIFACT_TYPE_NAMES[randomArtIndex], ARTIFACT_DISPLAY_NAMES[randomArtIndex]);
79  BlackboardArtifact artifactBase = file.newArtifact(artifactTypeBase.getTypeID());
80  String commentTxt;
81  BlackboardAttribute baseAttr;
82  switch (artifactBase.getArtifactTypeID()) {
83  case 2:
84  commentTxt = "www.placeholderWebsiteDOTCOM";
85  baseAttr = new BlackboardAttribute(
86  BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL, "Fake Web BookMark", "www.thisWebsiteIsStillFake.com");
87  artifactBase.addAttribute(baseAttr);
88  break;
89  case 9:
90  commentTxt = "fakeKeyword";
91  baseAttr = new BlackboardAttribute(
92  BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW, "Fake Keyword Search", "Fake Keyword Preview Text");
93  BlackboardAttribute set = new BlackboardAttribute(
94  BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, "Fake Keyword Search", "Fake");
95  BlackboardAttribute keyword = new BlackboardAttribute(
96  BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD, "Fake Keyword Search", "FakeKeyword");
97  artifactBase.addAttribute(baseAttr);
98  artifactBase.addAttribute(set);
99  artifactBase.addAttribute(keyword);
100  break;
101  case 25:
102  commentTxt = "fake phone number from";
103  baseAttr = new BlackboardAttribute(
104  BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM, "Fake Call Log Whatever", "555-555-5555");
105  artifactBase.addAttribute(baseAttr);
106  break;
107  default:
108  commentTxt = "DEPENDENT ON ARTIFACT TYPE";
109  break;
110  }
111  BlackboardArtifact artifact = file.newArtifact(artifactType.getTypeID());
112  BlackboardAttribute att = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, MODULE_NAME, "ArtifactsAndTxt");
113 
114  BlackboardAttribute att2 = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT, MODULE_NAME, commentTxt);
115  BlackboardAttribute att3 = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY, MODULE_NAME, "");
116  artifact.addAttribute(att);
117  artifact.addAttribute(att2);
118  artifact.addAttribute(att3);
119  artifact.addAttribute(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT, MODULE_NAME, artifactBase.getArtifactID()));
120  } catch (TskCoreException ex) {
121  logger.log(Level.SEVERE, String.format("Failed to process file (obj_id = %d)", file.getId()), ex);
122  return ProcessResult.ERROR;
123  } catch (Blackboard.BlackboardException ex) {
124  Exceptions.printStackTrace(ex);
125  }
126  return ProcessResult.OK;
127  }
128 
129 }

Copyright © 2012-2016 Basis Technology. Generated on: Tue Jun 13 2017
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.