Autopsy  4.7.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
MiscTypes.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2014-16 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.timeline.datamodel.eventtype;
20 
21 import java.util.Arrays;
22 import java.util.Collections;
23 import java.util.List;
24 import java.util.Optional;
25 import java.util.function.Function;
26 import java.util.logging.Level;
27 import javafx.scene.image.Image;
28 import org.apache.commons.lang3.StringUtils;
29 import org.openide.util.NbBundle;
32 import org.sleuthkit.datamodel.AbstractFile;
33 import org.sleuthkit.datamodel.BlackboardArtifact;
34 import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
35 import org.sleuthkit.datamodel.BlackboardAttribute;
36 import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
37 import org.sleuthkit.datamodel.TskCoreException;
38 
42 public enum MiscTypes implements EventType, ArtifactEventType {
43 
44  MESSAGE(NbBundle.getMessage(MiscTypes.class, "MiscTypes.message.name"), "message.png", // NON-NLS
45  new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_MESSAGE),
46  new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME),
47  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)),
48  artf -> {
49  final BlackboardAttribute dir = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DIRECTION));
50  final BlackboardAttribute readStatus = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_READ_STATUS));
51  final BlackboardAttribute name = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_NAME));
52  final BlackboardAttribute phoneNumber = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER));
53  final BlackboardAttribute subject = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SUBJECT));
54  List<String> asList = Arrays.asList(stringValueOf(dir), stringValueOf(readStatus), name != null || phoneNumber != null ? toFrom(dir) : "", stringValueOf(name != null ? name : phoneNumber), (subject == null ? "" : stringValueOf(subject)));
55  return StringUtils.join(asList, " ");
56  },
57  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_TEXT))),
58  GPS_ROUTE(NbBundle.getMessage(MiscTypes.class, "MiscTypes.GPSRoutes.name"), "gps-search.png", // NON-NLS
59  new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_GPS_ROUTE),
60  new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME),
61  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)),
62  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_LOCATION)),
63  artf -> {
64  final BlackboardAttribute latStart = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START));
65  final BlackboardAttribute longStart = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START));
66  final BlackboardAttribute latEnd = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END));
67  final BlackboardAttribute longEnd = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END));
68  return String.format("from %1$s %2$s to %3$s %4$s", stringValueOf(latStart), stringValueOf(longStart), stringValueOf(latEnd), stringValueOf(longEnd)); // NON-NLS
69  }),
70  GPS_TRACKPOINT(NbBundle.getMessage(MiscTypes.class, "MiscTypes.GPSTrackpoint.name"), "gps-trackpoint.png", // NON-NLS
71  new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_GPS_TRACKPOINT),
72  new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME),
73  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)),
74  artf -> {
75  final BlackboardAttribute longitude = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE));
76  final BlackboardAttribute latitude = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_GEO_LATITUDE));
77  return stringValueOf(latitude) + " " + stringValueOf(longitude); // NON-NLS
78  },
79  new EmptyExtractor()),
80  CALL_LOG(NbBundle.getMessage(MiscTypes.class, "MiscTypes.Calls.name"), "calllog.png", // NON-NLS
81  new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_CALLLOG),
82  new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_START),
83  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_NAME)),
84  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)),
85  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DIRECTION))),
86  EMAIL(NbBundle.getMessage(MiscTypes.class, "MiscTypes.Email.name"), "mail-icon-16.png", // NON-NLS
87  new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_EMAIL_MSG),
88  new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_SENT),
89  artf -> {
90  final BlackboardAttribute emailFrom = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_FROM));
91  final BlackboardAttribute emailTo = getAttributeSafe(artf, new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_TO));
92  return stringValueOf(emailFrom) + " to " + stringValueOf(emailTo); // NON-NLS
93  },
94  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SUBJECT)),
95  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_EMAIL_CONTENT_PLAIN))),
96  RECENT_DOCUMENTS(NbBundle.getMessage(MiscTypes.class, "MiscTypes.recentDocuments.name"), "recent_docs.png", // NON-NLS
97  new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_RECENT_OBJECT),
98  new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME),
99  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH)).andThen(
100  (String t) -> (StringUtils.substringBeforeLast(StringUtils.substringBeforeLast(t, "\\"), "\\"))),
101  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH)).andThen(
102  (String t) -> StringUtils.substringBeforeLast(t, "\\")),
103  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PATH))) {
104 
105  @Override
106  public AttributeEventDescription parseAttributesHelper(BlackboardArtifact artf) throws TskCoreException {
107  final BlackboardAttribute dateTimeAttr = artf.getAttribute(getDateTimeAttributeType());
108 
109  long time = dateTimeAttr.getValueLong();
110 
111  //Non-default description construction
112  String shortDescription = getShortExtractor().apply(artf);
113  String medDescription = getMedExtractor().apply(artf);
114  String fullDescription = getFullExtractor().apply(artf);
115 
116  return new AttributeEventDescription(time, shortDescription, medDescription, fullDescription);
117  }
118  },
119  INSTALLED_PROGRAM(NbBundle.getMessage(MiscTypes.class, "MiscTypes.installedPrograms.name"), "programs.png", // NON-NLS
120  new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_INSTALLED_PROG),
121  new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME),
122  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)),
123  new EmptyExtractor(),
124  new EmptyExtractor()),
125  EXIF(NbBundle.getMessage(MiscTypes.class, "MiscTypes.exif.name"), "camera-icon-16.png", // NON-NLS
126  new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_METADATA_EXIF),
127  new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME_CREATED),
128  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)),
129  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)),
130  artf -> {
131  try {
132  AbstractFile file = artf.getSleuthkitCase().getAbstractFileById(artf.getObjectID());
133  if (file != null) {
134  return file.getName();
135  }
136  } catch (TskCoreException ex) {
137  LOGGER.log(Level.SEVERE, "Exif event type failed to look up backing file name", ex); //NON-NLS
138  }
139  return "error loading file name";
140  }),
141  DEVICES_ATTACHED(NbBundle.getMessage(MiscTypes.class, "MiscTypes.devicesAttached.name"), "usb_devices.png", // NON-NLS
142  new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_DEVICE_ATTACHED),
143  new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME),
144  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)),
145  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)),
146  new AttributeExtractor(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
147 
148  static public String stringValueOf(BlackboardAttribute attr) {
149  return Optional.ofNullable(attr)
150  .map(BlackboardAttribute::getDisplayString)
151  .orElse("");
152  }
153 
154  public static String toFrom(BlackboardAttribute dir) {
155  if (dir == null) {
156  return "";
157  } else {
158  switch (dir.getDisplayString()) {
159  case "Incoming": // NON-NLS
160  return "from"; // NON-NLS
161  case "Outgoing": // NON-NLS
162  return "to"; // NON-NLS
163  default:
164  return ""; // NON-NLS
165  }
166  }
167  }
168 
169  private final BlackboardAttribute.Type dateTimeAttributeType;
170 
171  private final String iconBase;
172 
173  private final Image image;
174 
175  @Override
176  public Image getFXImage() {
177  return image;
178  }
179 
180  private final Function<BlackboardArtifact, String> longExtractor;
181 
182  private final Function<BlackboardArtifact, String> medExtractor;
183 
184  private final Function<BlackboardArtifact, String> shortExtractor;
185 
186  @Override
187  public Function<BlackboardArtifact, String> getFullExtractor() {
188  return longExtractor;
189  }
190 
191  @Override
192  public Function<BlackboardArtifact, String> getMedExtractor() {
193  return medExtractor;
194  }
195 
196  @Override
197  public Function<BlackboardArtifact, String> getShortExtractor() {
198  return shortExtractor;
199  }
200 
201  @Override
202  public BlackboardAttribute.Type getDateTimeAttributeType() {
203  return dateTimeAttributeType;
204  }
205 
206  @Override
209  }
210 
211  private final String displayName;
212 
213  private final BlackboardArtifact.Type artifactType;
214 
215  @Override
216  public String getDisplayName() {
217  return displayName;
218  }
219 
220  @Override
221  public String getIconBase() {
222  return iconBase;
223  }
224 
225  @Override
226  public EventType getSubType(String string) {
227  return MiscTypes.valueOf(string);
228  }
229 
230  private MiscTypes(String displayName, String iconBase, BlackboardArtifact.Type artifactType,
231  BlackboardAttribute.Type dateTimeAttributeType,
232  Function<BlackboardArtifact, String> shortExtractor,
233  Function<BlackboardArtifact, String> medExtractor,
234  Function<BlackboardArtifact, String> longExtractor) {
235  this.displayName = displayName;
236  this.iconBase = iconBase;
237  this.artifactType = artifactType;
238  this.dateTimeAttributeType = dateTimeAttributeType;
239  this.shortExtractor = shortExtractor;
240  this.medExtractor = medExtractor;
241  this.longExtractor = longExtractor;
242  this.image = new Image("org/sleuthkit/autopsy/timeline/images/" + iconBase, true); // NON-NLS
243  }
244 
245  @Override
246  public EventType getSuperType() {
247  return BaseTypes.MISC_TYPES;
248  }
249 
250  @Override
251  public List<? extends EventType> getSubTypes() {
252  return Collections.emptyList();
253  }
254 
255  @Override
256  public BlackboardArtifact.Type getArtifactType() {
257  return artifactType;
258  }
259 
260 }
final Function< BlackboardArtifact, String > medExtractor
Definition: MiscTypes.java:182
static String toFrom(BlackboardAttribute dir)
Definition: MiscTypes.java:154
Function< BlackboardArtifact, String > getMedExtractor()
Definition: MiscTypes.java:192
MiscTypes(String displayName, String iconBase, BlackboardArtifact.Type artifactType, BlackboardAttribute.Type dateTimeAttributeType, Function< BlackboardArtifact, String > shortExtractor, Function< BlackboardArtifact, String > medExtractor, Function< BlackboardArtifact, String > longExtractor)
Definition: MiscTypes.java:230
Function< BlackboardArtifact, String > getFullExtractor()
Definition: MiscTypes.java:187
static String stringValueOf(BlackboardAttribute attr)
Definition: MiscTypes.java:148
final Function< BlackboardArtifact, String > longExtractor
Definition: MiscTypes.java:180
Function< BlackboardArtifact, String > getShortExtractor()
Definition: MiscTypes.java:197
static BlackboardAttribute getAttributeSafe(BlackboardArtifact artf, BlackboardAttribute.Type attrType)
final Function< BlackboardArtifact, String > shortExtractor
Definition: MiscTypes.java:184

Copyright © 2012-2016 Basis Technology. Generated on: Mon Jun 18 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.