19 package org.sleuthkit.autopsy.centralrepository.datamodel;
21 import java.util.ArrayList;
22 import java.util.List;
23 import java.util.logging.Level;
24 import org.openide.util.NbBundle.Messages;
47 @Messages({
"EamArtifactUtil.emailaddresses.text=Email Addresses"})
49 return Bundle.EamArtifactUtil_emailaddresses_text();
67 boolean addInstanceDetails,
boolean checkEnabled) {
69 List<CorrelationAttribute> eamArtifacts =
new ArrayList<>();
78 if ((checkEnabled && aType.isEnabled()) || !checkEnabled) {
80 if (eamArtifact != null) {
81 eamArtifacts.add(eamArtifact);
86 LOGGER.log(Level.SEVERE,
"Error getting defined correlation types.", ex);
91 if (!eamArtifacts.isEmpty() && addInstanceDetails) {
94 AbstractFile bbSourceFile = currentCase.
getSleuthkitCase().getAbstractFileById(bbArtifact.getObjectID());
95 if (null == bbSourceFile) {
102 if (null == correlationCase) {
108 bbSourceFile.getParentPath() + bbSourceFile.
getName(),
110 TskData.FileKnown.UNKNOWN
115 eamArtifact.addInstance(eamInstance);
118 LOGGER.log(Level.SEVERE,
"Error creating artifact instance.", ex);
121 LOGGER.log(Level.SEVERE,
"Case is closed.", ex);
142 int artifactTypeID = bbArtifact.getArtifactTypeID();
145 if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == artifactTypeID) {
147 BlackboardAttribute attribute = bbArtifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
148 if (attribute != null) {
154 && BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() == artifactTypeID) {
156 BlackboardAttribute setNameAttr = bbArtifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME));
157 if (setNameAttr != null
159 value = bbArtifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD)).getValueString();
162 && (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID() == artifactTypeID
163 || BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID() == artifactTypeID
164 || BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifactTypeID
165 || BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID() == artifactTypeID)) {
168 value = bbArtifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)).getValueString();
170 && (BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID() == artifactTypeID
171 || BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID() == artifactTypeID
172 || BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() == artifactTypeID)) {
174 if (null != bbArtifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER))) {
175 value = bbArtifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)).getValueString();
176 }
else if (null != bbArtifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM))) {
177 value = bbArtifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)).getValueString();
178 }
else if (null != bbArtifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO))) {
179 value = bbArtifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)).getValueString();
184 String newValue = value.replaceAll(
"\\D",
"");
185 if (value.startsWith(
"+")) {
186 newValue =
"+" + newValue;
193 if (value.length() <= 5) {
199 && BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID() == artifactTypeID) {
201 value = bbArtifact.getAttribute(
new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)).getValueString();
204 }
catch (TskCoreException ex) {
205 LOGGER.log(Level.SEVERE,
"Error getting attribute while getting type from BlackboardArtifact.", ex);
208 LOGGER.log(Level.SEVERE,
"Exception while getting open case.", ex);
237 if (!(content instanceof AbstractFile)) {
241 final AbstractFile af = (AbstractFile) content;
248 String md5 = af.getMd5Hash();
249 if (md5 == null || md5.isEmpty() || HashUtility.isNoDataMd5(md5)) {
258 if (null == correlationCase) {
264 af.getParentPath() + af.
getName(),
271 LOGGER.log(Level.SEVERE,
"Error making correlation attribute.", ex);
290 if (af.getKnown() == TskData.FileKnown.KNOWN) {
294 switch (af.getType()) {
306 return af.isMetaFlagSet(TskData.TSK_FS_META_FLAG_ENUM.ALLOC);
308 LOGGER.log(Level.WARNING,
"Unexpected file type {0}", af.getType().getName());
CorrelationAttribute.Type getCorrelationTypeById(int typeId)
static CorrelationAttribute getCorrelationAttributeFromContent(Content content, TskData.FileKnown knownStatus, String comment)
static final long serialVersionUID
static CorrelationAttribute getCorrelationAttributeFromBlackboardArtifact(CorrelationAttribute.Type correlationType, BlackboardArtifact bbArtifact)
static final int PHONE_TYPE_ID
static final int FILES_TYPE_ID
CorrelationCase newCase(CorrelationCase eamCase)
static Case getOpenCase()
static CorrelationDataSource fromTSKDataSource(CorrelationCase correlationCase, Content dataSource)
static boolean isValidCentralRepoFile(AbstractFile af)
static String getEmailAddressAttrString()
static final int EMAIL_TYPE_ID
void addInstance(CorrelationAttributeInstance artifactInstance)
static EamDb getInstance()
SleuthkitCase getSleuthkitCase()
static final Logger LOGGER
CorrelationCase getCase(Case autopsyCase)
static final int DOMAIN_TYPE_ID
synchronized static Logger getLogger(String name)
List< CorrelationAttribute.Type > getDefinedCorrelationTypes()
static final int USBID_TYPE_ID
static List< CorrelationAttribute > getCorrelationAttributeFromBlackboardArtifact(BlackboardArtifact bbArtifact, boolean addInstanceDetails, boolean checkEnabled)