Autopsy  4.7.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
TableReportGenerator.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2013-2018 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.report;
20 
21 import com.google.common.collect.ListMultimap;
22 import com.google.common.collect.Lists;
23 import com.google.common.collect.Multimaps;
24 import java.sql.ResultSet;
25 import java.sql.SQLException;
26 import java.util.ArrayList;
27 import java.util.Arrays;
28 import java.util.Collection;
29 import java.util.Collections;
30 import java.util.Comparator;
31 import java.util.HashMap;
32 import java.util.HashSet;
33 import java.util.Iterator;
34 import java.util.List;
35 import java.util.Map;
36 import java.util.Objects;
37 import java.util.Set;
38 import java.util.TreeSet;
39 import java.util.logging.Level;
40 import org.openide.util.NbBundle;
41 import org.sleuthkit.autopsy.casemodule.Case;
42 import org.sleuthkit.autopsy.casemodule.NoCurrentCaseException;
43 import org.sleuthkit.autopsy.casemodule.services.TagsManager;
44 import org.sleuthkit.autopsy.coreutils.ImageUtils;
45 import org.sleuthkit.autopsy.coreutils.Logger;
46 import org.sleuthkit.autopsy.datamodel.ContentUtils;
47 import org.sleuthkit.datamodel.AbstractFile;
48 import org.sleuthkit.datamodel.Account;
49 import org.sleuthkit.datamodel.BlackboardArtifact;
50 import org.sleuthkit.datamodel.BlackboardArtifactTag;
51 import org.sleuthkit.datamodel.BlackboardAttribute;
52 import org.sleuthkit.datamodel.BlackboardAttribute.Type;
53 import org.sleuthkit.datamodel.Content;
54 import org.sleuthkit.datamodel.ContentTag;
55 import org.sleuthkit.datamodel.SleuthkitCase;
56 import org.sleuthkit.datamodel.TskCoreException;
57 import org.sleuthkit.datamodel.TskData;
58 
59 class TableReportGenerator {
60 
61  private final List<BlackboardArtifact.Type> artifactTypes = new ArrayList<>();
62  private final HashSet<String> tagNamesFilter = new HashSet<>();
63 
64  private final Set<Content> images = new HashSet<>();
65  private final ReportProgressPanel progressPanel;
66  private final TableReportModule tableReport;
67  private final Map<Integer, List<Column>> columnHeaderMap;
68  private static final Logger logger = Logger.getLogger(TableReportGenerator.class.getName());
69 
70  private final List<String> errorList;
71 
72  TableReportGenerator(Map<BlackboardArtifact.Type, Boolean> artifactTypeSelections, Map<String, Boolean> tagNameSelections, ReportProgressPanel progressPanel, TableReportModule tableReport) {
73 
74  this.progressPanel = progressPanel;
75  this.tableReport = tableReport;
76  this.columnHeaderMap = new HashMap<>();
77  errorList = new ArrayList<>();
78  // Get the artifact types selected by the user.
79  for (Map.Entry<BlackboardArtifact.Type, Boolean> entry : artifactTypeSelections.entrySet()) {
80  if (entry.getValue()) {
81  artifactTypes.add(entry.getKey());
82  }
83  }
84 
85  // Get the tag names selected by the user and make a tag names filter.
86  if (null != tagNameSelections) {
87  for (Map.Entry<String, Boolean> entry : tagNameSelections.entrySet()) {
88  if (entry.getValue() == true) {
89  tagNamesFilter.add(entry.getKey());
90  }
91  }
92  }
93  }
94 
95  protected void execute() {
96  // Start the progress indicators for each active TableReportModule.
97 
98  progressPanel.start();
99  progressPanel.setIndeterminate(false);
100  progressPanel.setMaximumProgress(this.artifactTypes.size() + 2); // +2 for content and blackboard artifact tags
101  // report on the blackboard results
102  if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
103  makeBlackboardArtifactTables();
104  }
105 
106  // report on the tagged files and artifacts
107  if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
108  makeContentTagsTables();
109  }
110 
111  if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
112  makeBlackboardArtifactTagsTables();
113  }
114 
115  if (progressPanel.getStatus() != ReportProgressPanel.ReportStatus.CANCELED) {
116  // report on the tagged images
117  makeThumbnailTable();
118  }
119  }
120 
124  private void makeBlackboardArtifactTables() {
125  // Make a comment string describing the tag names filter in effect.
126  String comment = "";
127  if (!tagNamesFilter.isEmpty()) {
128  comment += NbBundle.getMessage(this.getClass(), "ReportGenerator.artifactTable.taggedResults.text");
129  comment += makeCommaSeparatedList(tagNamesFilter);
130  }
131 
132  // Add a table to the report for every enabled blackboard artifact type.
133  for (BlackboardArtifact.Type type : artifactTypes) {
134  // Check for cancellaton.
135 
136  if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
137  return;
138  }
139 
140  progressPanel.updateStatusLabel(
141  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
142  type.getDisplayName()));
143 
144  // Keyword hits and hashset hit artifacts get special handling.
145  if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
146  writeKeywordHits(tableReport, comment, tagNamesFilter);
147  continue;
148  } else if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()) {
149  writeHashsetHits(tableReport, comment, tagNamesFilter);
150  continue;
151  }
152 
153  List<ArtifactData> artifactList = getFilteredArtifacts(type, tagNamesFilter);
154 
155  if (artifactList.isEmpty()) {
156  continue;
157  }
158 
159  /*
160  * TSK_ACCOUNT artifacts get grouped by their TSK_ACCOUNT_TYPE
161  * attribute, and then handed off to the standard method for writing
162  * tables.
163  */
164  if (type.getTypeID() == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
165  //Group account artifacts by their account type
166  ListMultimap<String, ArtifactData> groupedArtifacts = Multimaps.index(artifactList,
167  artifactData -> {
168  try {
169  return artifactData.getArtifact().getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE)).getValueString();
170  } catch (TskCoreException ex) {
171  logger.log(Level.SEVERE, "Unable to get value of TSK_ACCOUNT_TYPE attribute. Defaulting to \"unknown\"", ex);
172  return "unknown";
173  }
174  });
175  for (String accountTypeStr : groupedArtifacts.keySet()) {
176  /*
177  * If the report is a ReportHTML, the data type name
178  * eventualy makes it to useDataTypeIcon which expects but
179  * does not require a artifact name, so we make a synthetic
180  * compund name by appending a ":" and the account type.
181  */
182  String accountDisplayname = accountTypeStr;
183  if (accountTypeStr != null) {
184  try {
185  Account.Type acctType = Case.getCurrentCaseThrows().getSleuthkitCase().getCommunicationsManager().getAccountType(accountTypeStr);
186  if (acctType != null) {
187  accountDisplayname = acctType.getDisplayName();
188  }
189  } catch (TskCoreException | NoCurrentCaseException ex) {
190  logger.log(Level.SEVERE, "Unable to get display name for account type " + accountTypeStr, ex);
191  }
192  }
193 
194  final String compundDataTypeName = BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getDisplayName() + ": " + accountDisplayname;
195  writeTableForDataType(new ArrayList<>(groupedArtifacts.get(accountTypeStr)), type, compundDataTypeName, comment);
196  }
197  } else {
198  //all other artifact types are sent to writeTableForDataType directly
199  writeTableForDataType(artifactList, type, type.getDisplayName(), comment);
200  }
201  }
202  }
203 
214  private void writeTableForDataType(List<ArtifactData> artifactList, BlackboardArtifact.Type type, String tableName, String comment) {
215  /*
216  * Make a sorted set of all of the attribute types that are on any of
217  * the given artifacts.
218  */
219  Set<BlackboardAttribute.Type> attrTypeSet = new TreeSet<>(Comparator.comparing(BlackboardAttribute.Type::getDisplayName));
220  for (ArtifactData data : artifactList) {
221  List<BlackboardAttribute> attributes = data.getAttributes();
222  for (BlackboardAttribute attribute : attributes) {
223  attrTypeSet.add(attribute.getAttributeType());
224  }
225  }
226  /*
227  * Get the columns appropriate for the artifact type. This is used to
228  * get the data that will be in the cells below based on type, and
229  * display the column headers.
230  */
231  List<Column> columns = getArtifactTableColumns(type.getTypeID(), attrTypeSet);
232  if (columns.isEmpty()) {
233  return;
234  }
235  columnHeaderMap.put(type.getTypeID(), columns);
236 
237  /*
238  * The artifact list is sorted now, as getting the row data is dependent
239  * on having the columns, which is necessary for sorting.
240  */
241  Collections.sort(artifactList);
242 
243  tableReport.startDataType(tableName, comment);
244  tableReport.startTable(Lists.transform(columns, Column::getColumnHeader));
245 
246  for (ArtifactData artifactData : artifactList) {
247  // Get the row data for this artifact, and has the
248  // module add it.
249  List<String> rowData = artifactData.getRow();
250  if (rowData.isEmpty()) {
251  return;
252  }
253 
254  tableReport.addRow(rowData);
255  }
256  // Finish up this data type
257  progressPanel.increment();
258  tableReport.endTable();
259  tableReport.endDataType();
260  }
261 
265  @SuppressWarnings("deprecation")
266  private void makeContentTagsTables() {
267 
268  // Get the content tags.
269  List<ContentTag> tags;
270  try {
271  tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getAllContentTags();
272  } catch (TskCoreException | NoCurrentCaseException ex) {
273  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetContentTags"));
274  logger.log(Level.SEVERE, "failed to get content tags", ex); //NON-NLS
275  return;
276  }
277 
278  // Tell the modules reporting on content tags is beginning.
279  // @@@ This casting is a tricky little workaround to allow the HTML report module to slip in a content hyperlink.
280  // @@@ Alos Using the obsolete ARTIFACT_TYPE.TSK_TAG_FILE is also an expedient hack.
281  progressPanel.updateStatusLabel(
282  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
283  BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName()));
284  ArrayList<String> columnHeaders = new ArrayList<>(Arrays.asList(
285  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.tag"),
286  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.file"),
287  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.comment"),
288  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.timeModified"),
289  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.timeChanged"),
290  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.timeAccessed"),
291  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.timeCreated"),
292  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.size"),
293  NbBundle.getMessage(this.getClass(), "ReportGenerator.htmlOutput.header.hash")));
294 
295  StringBuilder comment = new StringBuilder();
296  if (!tagNamesFilter.isEmpty()) {
297  comment.append(
298  NbBundle.getMessage(this.getClass(), "ReportGenerator.makeContTagTab.taggedFiles.msg"));
299  comment.append(makeCommaSeparatedList(tagNamesFilter));
300  }
301  if (tableReport instanceof ReportHTML) {
302  ReportHTML htmlReportModule = (ReportHTML) tableReport;
303  htmlReportModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
304  htmlReportModule.startContentTagsTable(columnHeaders);
305  } else {
306  tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getDisplayName(), comment.toString());
307  tableReport.startTable(columnHeaders);
308  }
309 
310  // Give the modules the rows for the content tags.
311  for (ContentTag tag : tags) {
312  // skip tags that we are not reporting on
313  String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : "";
314  if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) == false) {
315  continue;
316  }
317 
318  String fileName;
319  try {
320  fileName = tag.getContent().getUniquePath();
321  } catch (TskCoreException ex) {
322  fileName = tag.getContent().getName();
323  }
324 
325  ArrayList<String> rowData = new ArrayList<>(Arrays.asList(tag.getName().getDisplayName() + notableString, fileName, tag.getComment()));
326  Content content = tag.getContent();
327  if (content instanceof AbstractFile) {
328  AbstractFile file = (AbstractFile) content;
329 
330  // Add metadata about the file to HTML output
331  rowData.add(file.getMtimeAsDate());
332  rowData.add(file.getCtimeAsDate());
333  rowData.add(file.getAtimeAsDate());
334  rowData.add(file.getCrtimeAsDate());
335  rowData.add(Long.toString(file.getSize()));
336  rowData.add(file.getMd5Hash());
337  }
338  // @@@ This casting is a tricky little workaround to allow the HTML report module to slip in a content hyperlink.
339  if (tableReport instanceof ReportHTML) {
340  ReportHTML htmlReportModule = (ReportHTML) tableReport;
341  htmlReportModule.addRowWithTaggedContentHyperlink(rowData, tag);
342  } else {
343  tableReport.addRow(rowData);
344  }
345 
346  // see if it is for an image so that we later report on it
347  checkIfTagHasImage(tag);
348  }
349 
350  // The the modules content tags reporting is ended.
351  progressPanel.increment();
352  tableReport.endTable();
353  tableReport.endDataType();
354  }
355 
359  @SuppressWarnings("deprecation")
360  private void makeBlackboardArtifactTagsTables() {
361 
362  List<BlackboardArtifactTag> tags;
363  try {
364  tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getAllBlackboardArtifactTags();
365  } catch (TskCoreException | NoCurrentCaseException ex) {
366  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetBBArtifactTags"));
367  logger.log(Level.SEVERE, "failed to get blackboard artifact tags", ex); //NON-NLS
368  return;
369  }
370 
371  // Tell the modules reporting on blackboard artifact tags data type is beginning.
372  // @@@ Using the obsolete ARTIFACT_TYPE.TSK_TAG_ARTIFACT is an expedient hack.
373  progressPanel.updateStatusLabel(
374  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
375  BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName()));
376  StringBuilder comment = new StringBuilder();
377  if (!tagNamesFilter.isEmpty()) {
378  comment.append(
379  NbBundle.getMessage(this.getClass(), "ReportGenerator.makeBbArtTagTab.taggedRes.msg"));
380  comment.append(makeCommaSeparatedList(tagNamesFilter));
381  }
382  tableReport.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getDisplayName(), comment.toString());
383  tableReport.startTable(new ArrayList<>(Arrays.asList(
384  NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.resultType"),
385  NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.tag"),
386  NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.comment"),
387  NbBundle.getMessage(this.getClass(), "ReportGenerator.tagTable.header.srcFile"))));
388 
389  // Give the modules the rows for the content tags.
390  for (BlackboardArtifactTag tag : tags) {
391  String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : "";
392  if (passesTagNamesFilter(tag.getName().getDisplayName() + notableString) == false) {
393  continue;
394  }
395 
396  List<String> row;
397  row = new ArrayList<>(Arrays.asList(tag.getArtifact().getArtifactTypeName(), tag.getName().getDisplayName() + notableString, tag.getComment(), tag.getContent().getName()));
398  tableReport.addRow(row);
399 
400  // check if the tag is an image that we should later make a thumbnail for
401  checkIfTagHasImage(tag);
402  }
403 
404  // The the modules blackboard artifact tags reporting is ended.
405  progressPanel.increment();
406  tableReport.endTable();
407  tableReport.endDataType();
408  }
409 
417  private boolean passesTagNamesFilter(String tagName) {
418  return tagNamesFilter.isEmpty() || tagNamesFilter.contains(tagName);
419  }
420 
424  private void makeThumbnailTable() {
425  progressPanel.updateStatusLabel(
426  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.createdThumb.text"));
427 
428  if (tableReport instanceof ReportHTML) {
429  ReportHTML htmlModule = (ReportHTML) tableReport;
430  htmlModule.startDataType(
431  NbBundle.getMessage(this.getClass(), "ReportGenerator.thumbnailTable.name"),
432  NbBundle.getMessage(this.getClass(), "ReportGenerator.thumbnailTable.desc"));
433  List<String> emptyHeaders = new ArrayList<>();
434  for (int i = 0; i < ReportHTML.THUMBNAIL_COLUMNS; i++) {
435  emptyHeaders.add("");
436  }
437  htmlModule.startTable(emptyHeaders);
438 
439  htmlModule.addThumbnailRows(images);
440 
441  htmlModule.endTable();
442  htmlModule.endDataType();
443  }
444 
445  }
446 
453  private void checkIfTagHasImage(BlackboardArtifactTag artifactTag) {
454  AbstractFile file;
455  try {
456  file = Case.getCurrentCaseThrows().getSleuthkitCase().getAbstractFileById(artifactTag.getArtifact().getObjectID());
457  } catch (TskCoreException | NoCurrentCaseException ex) {
458  errorList.add(
459  NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.errGetContentFromBBArtifact"));
460  logger.log(Level.WARNING, "Error while getting content from a blackboard artifact to report on.", ex); //NON-NLS
461  return;
462  }
463 
464  if (file != null) {
465  checkIfFileIsImage(file);
466  }
467  }
468 
476  private void checkIfTagHasImage(ContentTag contentTag) {
477  Content c = contentTag.getContent();
478  if (c instanceof AbstractFile == false) {
479  return;
480  }
481  checkIfFileIsImage((AbstractFile) c);
482  }
483 
489  private void checkIfFileIsImage(AbstractFile file) {
490 
491  if (file.isDir()
492  || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS
493  || file.getType() == TskData.TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS) {
494  return;
495  }
496 
497  if (ImageUtils.thumbnailSupported(file)) {
498  images.add(file);
499  }
500  }
501 
510  private String makeCommaSeparatedList(Collection<String> items) {
511  String list = "";
512  for (Iterator<String> iterator = items.iterator(); iterator.hasNext();) {
513  list += iterator.next() + (iterator.hasNext() ? ", " : "");
514  }
515  return list;
516  }
517 
523  @SuppressWarnings("deprecation")
524  @NbBundle.Messages ({"ReportGenerator.errList.noOpenCase=No open case available."})
525  private void writeKeywordHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
526 
527  // Query for keyword lists-only so that we can tell modules what lists
528  // will exist for their index.
529  // @@@ There is a bug in here. We should use the tags in the below code
530  // so that we only report the lists that we will later provide with real
531  // hits. If no keyord hits are tagged, then we make the page for nothing.
532  String orderByClause;
533  Case openCase;
534  try {
535  openCase = Case.getCurrentCaseThrows();
536  } catch (NoCurrentCaseException ex) {
537  errorList.add(Bundle.ReportGenerator_errList_noOpenCase());
538  logger.log(Level.SEVERE, "Exception while getting open case: ", ex); //NON-NLS
539  return;
540  }
541  if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
542  orderByClause = "ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST"; //NON-NLS
543  } else {
544  orderByClause = "ORDER BY list ASC"; //NON-NLS
545  }
546  String keywordListQuery
547  = "SELECT att.value_text AS list "
548  + //NON-NLS
549  "FROM blackboard_attributes AS att, blackboard_artifacts AS art "
550  + //NON-NLS
551  "WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + " "
552  + //NON-NLS
553  "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() + " "
554  + //NON-NLS
555  "AND att.artifact_id = art.artifact_id "
556  + //NON-NLS
557  "GROUP BY list " + orderByClause; //NON-NLS
558 
559  try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(keywordListQuery)) {
560  ResultSet listsRs = dbQuery.getResultSet();
561  List<String> lists = new ArrayList<>();
562  while (listsRs.next()) {
563  String list = listsRs.getString("list"); //NON-NLS
564  if (list.isEmpty()) {
565  list = NbBundle.getMessage(this.getClass(), "ReportGenerator.writeKwHits.userSrchs");
566  }
567  lists.add(list);
568  }
569 
570  // Make keyword data type and give them set index
571  tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), comment);
572  tableModule.addSetIndex(lists);
573  progressPanel.updateStatusLabel(
574  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
575  BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName()));
576  } catch (TskCoreException | SQLException ex) {
577  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryKWLists"));
578  logger.log(Level.SEVERE, "Failed to query keyword lists: ", ex); //NON-NLS
579  return;
580  }
581 
582  if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
583  orderByClause = "ORDER BY convert_to(att3.value_text, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
584  + "convert_to(att1.value_text, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
585  + "convert_to(f.parent_path, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
586  + "convert_to(f.name, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
587  + "convert_to(att2.value_text, 'SQL_ASCII') ASC NULLS FIRST"; //NON-NLS
588  } else {
589  orderByClause = "ORDER BY list ASC, keyword ASC, parent_path ASC, name ASC, preview ASC"; //NON-NLS
590  }
591  // Query for keywords, grouped by list
592  String keywordsQuery
593  = "SELECT art.artifact_id, art.obj_id, att1.value_text AS keyword, att2.value_text AS preview, att3.value_text AS list, f.name AS name, f.parent_path AS parent_path "
594  + //NON-NLS
595  "FROM blackboard_artifacts AS art, blackboard_attributes AS att1, blackboard_attributes AS att2, blackboard_attributes AS att3, tsk_files AS f "
596  + //NON-NLS
597  "WHERE (att1.artifact_id = art.artifact_id) "
598  + //NON-NLS
599  "AND (att2.artifact_id = art.artifact_id) "
600  + //NON-NLS
601  "AND (att3.artifact_id = art.artifact_id) "
602  + //NON-NLS
603  "AND (f.obj_id = art.obj_id) "
604  + //NON-NLS
605  "AND (att1.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD.getTypeID() + ") "
606  + //NON-NLS
607  "AND (att2.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW.getTypeID() + ") "
608  + //NON-NLS
609  "AND (att3.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + ") "
610  + //NON-NLS
611  "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() + ") "
612  + //NON-NLS
613  orderByClause; //NON-NLS
614 
615  try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(keywordsQuery)) {
616  ResultSet resultSet = dbQuery.getResultSet();
617 
618  String currentKeyword = "";
619  String currentList = "";
620  while (resultSet.next()) {
621  // Check to see if all the TableReportModules have been canceled
622  if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
623  break;
624  }
625 
626  // Get any tags that associated with this artifact and apply the tag filter.
627  HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong("artifact_id")); //NON-NLS
628  if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
629  continue;
630  }
631  String tagsList = makeCommaSeparatedList(uniqueTagNames);
632 
633  Long objId = resultSet.getLong("obj_id"); //NON-NLS
634  String keyword = resultSet.getString("keyword"); //NON-NLS
635  String preview = resultSet.getString("preview"); //NON-NLS
636  String list = resultSet.getString("list"); //NON-NLS
637  String uniquePath = "";
638 
639  try {
640  AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
641  if (f != null) {
642  uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
643  }
644  } catch (TskCoreException ex) {
645  errorList.add(
646  NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileByID"));
647  logger.log(Level.WARNING, "Failed to get Abstract File by ID.", ex); //NON-NLS
648  }
649 
650  // If the lists aren't the same, we've started a new list
651  if ((!list.equals(currentList) && !list.isEmpty()) || (list.isEmpty() && !currentList.equals(
652  NbBundle.getMessage(this.getClass(), "ReportGenerator.writeKwHits.userSrchs")))) {
653  if (!currentList.isEmpty()) {
654  tableModule.endTable();
655  tableModule.endSet();
656  }
657  currentList = list.isEmpty() ? NbBundle
658  .getMessage(this.getClass(), "ReportGenerator.writeKwHits.userSrchs") : list;
659  currentKeyword = ""; // reset the current keyword because it's a new list
660  tableModule.startSet(currentList);
661  progressPanel.updateStatusLabel(
662  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processingList",
663  BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getDisplayName(), currentList));
664  }
665  if (!keyword.equals(currentKeyword)) {
666  if (!currentKeyword.equals("")) {
667  tableModule.endTable();
668  }
669  currentKeyword = keyword;
670  tableModule.addSetElement(currentKeyword);
671  List<String> columnHeaderNames = new ArrayList<>();
672  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.preview"));
673  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.srcFile"));
674  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags"));
675  tableModule.startTable(columnHeaderNames);
676  }
677 
678  tableModule.addRow(Arrays.asList(new String[]{preview, uniquePath, tagsList}));
679  }
680 
681  // Finish the current data type
682  progressPanel.increment();
683  tableModule.endDataType();
684  } catch (TskCoreException | SQLException ex) {
685  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryKWs"));
686  logger.log(Level.SEVERE, "Failed to query keywords: ", ex); //NON-NLS
687  }
688  }
689 
695  @SuppressWarnings("deprecation")
696  private void writeHashsetHits(TableReportModule tableModule, String comment, HashSet<String> tagNamesFilter) {
697  String orderByClause;
698  Case openCase;
699  try {
700  openCase = Case.getCurrentCaseThrows();
701  } catch (NoCurrentCaseException ex) {
702  errorList.add(Bundle.ReportGenerator_errList_noOpenCase());
703  logger.log(Level.SEVERE, "Exception while getting open case: ", ex); //NON-NLS
704  return;
705  }
706  if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
707  orderByClause = "ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST"; //NON-NLS
708  } else {
709  orderByClause = "ORDER BY att.value_text ASC"; //NON-NLS
710  }
711  String hashsetsQuery
712  = "SELECT att.value_text AS list "
713  + //NON-NLS
714  "FROM blackboard_attributes AS att, blackboard_artifacts AS art "
715  + //NON-NLS
716  "WHERE att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + " "
717  + //NON-NLS
718  "AND art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() + " "
719  + //NON-NLS
720  "AND att.artifact_id = art.artifact_id "
721  + //NON-NLS
722  "GROUP BY list " + orderByClause; //NON-NLS
723 
724  try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(hashsetsQuery)) {
725  // Query for hashsets
726  ResultSet listsRs = dbQuery.getResultSet();
727  List<String> lists = new ArrayList<>();
728  while (listsRs.next()) {
729  lists.add(listsRs.getString("list")); //NON-NLS
730  }
731 
732  tableModule.startDataType(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), comment);
733  tableModule.addSetIndex(lists);
734  progressPanel.updateStatusLabel(
735  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processing",
736  BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName()));
737  } catch (TskCoreException | SQLException ex) {
738  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryHashsetLists"));
739  logger.log(Level.SEVERE, "Failed to query hashset lists: ", ex); //NON-NLS
740  return;
741  }
742 
743  if (openCase.getCaseType() == Case.CaseType.MULTI_USER_CASE) {
744  orderByClause = "ORDER BY convert_to(att.value_text, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
745  + "convert_to(f.parent_path, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
746  + "convert_to(f.name, 'SQL_ASCII') ASC NULLS FIRST, " //NON-NLS
747  + "size ASC NULLS FIRST"; //NON-NLS
748  } else {
749  orderByClause = "ORDER BY att.value_text ASC, f.parent_path ASC, f.name ASC, size ASC"; //NON-NLS
750  }
751  String hashsetHitsQuery
752  = "SELECT art.artifact_id, art.obj_id, att.value_text AS setname, f.name AS name, f.size AS size, f.parent_path AS parent_path "
753  + //NON-NLS
754  "FROM blackboard_artifacts AS art, blackboard_attributes AS att, tsk_files AS f "
755  + //NON-NLS
756  "WHERE (att.artifact_id = art.artifact_id) "
757  + //NON-NLS
758  "AND (f.obj_id = art.obj_id) "
759  + //NON-NLS
760  "AND (att.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID() + ") "
761  + //NON-NLS
762  "AND (art.artifact_type_id = " + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() + ") "
763  + //NON-NLS
764  orderByClause; //NON-NLS
765 
766  try (SleuthkitCase.CaseDbQuery dbQuery = openCase.getSleuthkitCase().executeQuery(hashsetHitsQuery)) {
767  // Query for hashset hits
768  ResultSet resultSet = dbQuery.getResultSet();
769  String currentSet = "";
770  while (resultSet.next()) {
771  // Check to see if all the TableReportModules have been canceled
772  if (progressPanel.getStatus() == ReportProgressPanel.ReportStatus.CANCELED) {
773  break;
774  }
775 
776  // Get any tags that associated with this artifact and apply the tag filter.
777  HashSet<String> uniqueTagNames = getUniqueTagNames(resultSet.getLong("artifact_id")); //NON-NLS
778  if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
779  continue;
780  }
781  String tagsList = makeCommaSeparatedList(uniqueTagNames);
782 
783  Long objId = resultSet.getLong("obj_id"); //NON-NLS
784  String set = resultSet.getString("setname"); //NON-NLS
785  String size = resultSet.getString("size"); //NON-NLS
786  String uniquePath = "";
787 
788  try {
789  AbstractFile f = openCase.getSleuthkitCase().getAbstractFileById(objId);
790  if (f != null) {
791  uniquePath = openCase.getSleuthkitCase().getAbstractFileById(objId).getUniquePath();
792  }
793  } catch (TskCoreException ex) {
794  errorList.add(
795  NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileFromID"));
796  logger.log(Level.WARNING, "Failed to get Abstract File from ID.", ex); //NON-NLS
797  return;
798  }
799 
800  // If the sets aren't the same, we've started a new set
801  if (!set.equals(currentSet)) {
802  if (!currentSet.isEmpty()) {
803  tableModule.endTable();
804  tableModule.endSet();
805  }
806  currentSet = set;
807  tableModule.startSet(currentSet);
808  List<String> columnHeaderNames = new ArrayList<>();
809  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.file"));
810  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.size"));
811  columnHeaderNames.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags"));
812  tableModule.startTable(columnHeaderNames);
813  progressPanel.updateStatusLabel(
814  NbBundle.getMessage(this.getClass(), "ReportGenerator.progress.processingList",
815  BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getDisplayName(), currentSet));
816  }
817 
818  // Add a row for this hit to every module
819  tableModule.addRow(Arrays.asList(new String[]{uniquePath, size, tagsList}));
820  }
821 
822  // Finish the current data type
823  progressPanel.increment();
824  tableModule.endDataType();
825  } catch (TskCoreException | SQLException ex) {
826  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedQueryHashsetHits"));
827  logger.log(Level.SEVERE, "Failed to query hashsets hits: ", ex); //NON-NLS
828  }
829  }
830 
834  List<String> getErrorList() {
835  return errorList;
836  }
837 
842  private class ArtifactData implements Comparable<ArtifactData> {
843 
844  private BlackboardArtifact artifact;
845  private List<BlackboardAttribute> attributes;
846  private HashSet<String> tags;
847  private List<String> rowData = null;
848  private Content content;
849 
850  ArtifactData(BlackboardArtifact artifact, List<BlackboardAttribute> attrs, HashSet<String> tags) {
851  this.artifact = artifact;
852  this.attributes = attrs;
853  this.tags = tags;
854  try {
855  this.content = Case.getCurrentCaseThrows().getSleuthkitCase().getContentById(artifact.getObjectID());
856  } catch (TskCoreException | NoCurrentCaseException ex) {
857  logger.log(Level.SEVERE, "Could not get content from database", ex);
858  }
859  }
860 
861  public BlackboardArtifact getArtifact() {
862  return artifact;
863  }
864 
865  public List<BlackboardAttribute> getAttributes() {
866  return attributes;
867  }
868 
869  public HashSet<String> getTags() {
870  return tags;
871  }
872 
873  public long getArtifactID() {
874  return artifact.getArtifactID();
875  }
876 
877  public long getObjectID() {
878  return artifact.getObjectID();
879  }
880 
884  public Content getContent() {
885  return content;
886  }
887 
897  @Override
898  public int compareTo(ArtifactData otherArtifactData) {
899  List<String> thisRow = getRow();
900  List<String> otherRow = otherArtifactData.getRow();
901  for (int i = 0; i < thisRow.size(); i++) {
902  int compare = thisRow.get(i).compareTo(otherRow.get(i));
903  if (compare != 0) {
904  return compare;
905  }
906  }
907  return ((Long) this.getArtifactID()).compareTo(otherArtifactData.getArtifactID());
908  }
909 
917  public List<String> getRow() {
918  if (rowData == null) {
919  try {
920  rowData = getOrderedRowDataAsStrings();
921  // If else is done so that row data is not set before
922  // columns are added to the hash map.
923  if (rowData.size() > 0) {
924  // replace null values if attribute was not defined
925  for (int i = 0; i < rowData.size(); i++) {
926  if (rowData.get(i) == null) {
927  rowData.set(i, "");
928  }
929  }
930  } else {
931  rowData = null;
932  return new ArrayList<>();
933  }
934  } catch (TskCoreException ex) {
935  errorList.add(
936  NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.coreExceptionWhileGenRptRow"));
937  logger.log(Level.WARNING, "Core exception while generating row data for artifact report.", ex); //NON-NLS
938  rowData = Collections.<String>emptyList();
939  }
940  }
941  return rowData;
942  }
943 
953  private List<String> getOrderedRowDataAsStrings() throws TskCoreException {
954 
955  List<String> orderedRowData = new ArrayList<>();
956  if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() == getArtifact().getArtifactTypeID()) {
957  if (content != null && content instanceof AbstractFile) {
958  AbstractFile file = (AbstractFile) content;
959  orderedRowData.add(file.getName());
960  orderedRowData.add(file.getNameExtension());
961  String mimeType = file.getMIMEType();
962  if (mimeType == null) {
963  orderedRowData.add("");
964  } else {
965  orderedRowData.add(mimeType);
966  }
967  orderedRowData.add(file.getUniquePath());
968  } else {
969  // Make empty rows to make sure the formatting is correct
970  orderedRowData.add(null);
971  orderedRowData.add(null);
972  orderedRowData.add(null);
973  orderedRowData.add(null);
974  }
975  orderedRowData.add(makeCommaSeparatedList(getTags()));
976 
977  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == getArtifact().getArtifactTypeID()) {
978  String[] attributeDataArray = new String[3];
979  // Array is used so that order of the attributes is maintained.
980  for (BlackboardAttribute attr : attributes) {
981  if (attr.getAttributeType().equals(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME))) {
982  attributeDataArray[0] = attr.getDisplayString();
983  } else if (attr.getAttributeType().equals(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY))) {
984  attributeDataArray[1] = attr.getDisplayString();
985  }
986  }
987 
988  attributeDataArray[2] = content.getUniquePath();
989  orderedRowData.addAll(Arrays.asList(attributeDataArray));
990 
991  HashSet<String> allTags = getTags();
992  try {
993  List<ContentTag> contentTags = Case.getCurrentCaseThrows().getServices().getTagsManager().getContentTagsByContent(content);
994  for (ContentTag ct : contentTags) {
995  String notableString = ct.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : "";
996  allTags.add(ct.getName().getDisplayName() + notableString);
997  }
998  } catch (TskCoreException | NoCurrentCaseException ex) {
999  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetContentTags"));
1000  logger.log(Level.SEVERE, "Failed to get content tags", ex); //NON-NLS
1001  }
1002  orderedRowData.add(makeCommaSeparatedList(allTags));
1003 
1004  } else if (columnHeaderMap.containsKey(this.artifact.getArtifactTypeID())) {
1005 
1006  for (Column currColumn : columnHeaderMap.get(this.artifact.getArtifactTypeID())) {
1007  String cellData = currColumn.getCellData(this);
1008  orderedRowData.add(cellData);
1009  }
1010  }
1011 
1012  return orderedRowData;
1013  }
1014 
1015  }
1016 
1026  private List<ArtifactData> getFilteredArtifacts(BlackboardArtifact.Type type, HashSet<String> tagNamesFilter) {
1027  List<ArtifactData> artifacts = new ArrayList<>();
1028  try {
1029  for (BlackboardArtifact artifact : Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboardArtifacts(type.getTypeID())) {
1030  List<BlackboardArtifactTag> tags = Case.getCurrentCaseThrows().getServices().getTagsManager().getBlackboardArtifactTagsByArtifact(artifact);
1031  HashSet<String> uniqueTagNames = new HashSet<>();
1032  for (BlackboardArtifactTag tag : tags) {
1033  String notableString = tag.getName().getKnownStatus() == TskData.FileKnown.BAD ? TagsManager.getNotableTagLabel() : "";
1034  uniqueTagNames.add(tag.getName().getDisplayName() + notableString);
1035  }
1036  if (failsTagFilter(uniqueTagNames, tagNamesFilter)) {
1037  continue;
1038  }
1039  try {
1040  artifacts.add(new ArtifactData(artifact, Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboardAttributes(artifact), uniqueTagNames));
1041  } catch (TskCoreException ex) {
1042  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetBBAttribs"));
1043  logger.log(Level.SEVERE, "Failed to get Blackboard Attributes when generating report.", ex); //NON-NLS
1044  }
1045  }
1046  } catch (TskCoreException | NoCurrentCaseException ex) {
1047  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetBBArtifacts"));
1048  logger.log(Level.SEVERE, "Failed to get Blackboard Artifacts when generating report.", ex); //NON-NLS
1049  }
1050  return artifacts;
1051  }
1052 
1053  private Boolean failsTagFilter(HashSet<String> tagNames, HashSet<String> tagsNamesFilter) {
1054  if (null == tagsNamesFilter || tagsNamesFilter.isEmpty()) {
1055  return false;
1056  }
1057 
1058  HashSet<String> filteredTagNames = new HashSet<>(tagNames);
1059  filteredTagNames.retainAll(tagsNamesFilter);
1060  return filteredTagNames.isEmpty();
1061  }
1062 
1073  private List<Column> getArtifactTableColumns(int artifactTypeId, Set<BlackboardAttribute.Type> attributeTypeSet) {
1074  ArrayList<Column> columns = new ArrayList<>();
1075 
1076  // Long switch statement to retain ordering of attribute types that are
1077  // attached to pre-defined artifact types.
1078  if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID() == artifactTypeId) {
1079  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.url"),
1080  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1081 
1082  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.title"),
1083  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1084 
1085  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateCreated"),
1086  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1087 
1088  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1089  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1090 
1091  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID() == artifactTypeId) {
1092  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.url"),
1093  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1094 
1095  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1096  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1097 
1098  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1099  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1100 
1101  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.value"),
1102  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_VALUE)));
1103 
1104  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1105  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1106 
1107  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID() == artifactTypeId) {
1108  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.url"),
1109  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1110 
1111  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateAccessed"),
1112  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1113 
1114  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.referrer"),
1115  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REFERRER)));
1116 
1117  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.title"),
1118  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TITLE)));
1119 
1120  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1121  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1122 
1123  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.urlDomainDecoded"),
1124  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL_DECODED)));
1125 
1126  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID() == artifactTypeId) {
1127  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dest"),
1128  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1129 
1130  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.sourceUrl"),
1131  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1132 
1133  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateAccessed"),
1134  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1135 
1136  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1137  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1138 
1139  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID() == artifactTypeId) {
1140  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.path"),
1141  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1142 
1143  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1144  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1145 
1146  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID() == artifactTypeId) {
1147  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.progName"),
1148  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1149 
1150  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.instDateTime"),
1151  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1152 
1153  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() == artifactTypeId) {
1154  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.preview")));
1155 
1156  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() == artifactTypeId) {
1157  columns.add(new SourceFileColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.file")));
1158 
1159  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.size")));
1160 
1161  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID() == artifactTypeId) {
1162  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.devMake"),
1163  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1164 
1165  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.devModel"),
1166  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1167 
1168  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.deviceId"),
1169  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1170 
1171  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1172  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1173 
1174  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID() == artifactTypeId) {
1175  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.text"),
1176  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1177 
1178  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.domain"),
1179  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DOMAIN)));
1180 
1181  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateAccessed"),
1182  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_ACCESSED)));
1183 
1184  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.progName"),
1185  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1186 
1187  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID() == artifactTypeId) {
1188  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTaken"),
1189  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_CREATED)));
1190 
1191  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.devManufacturer"),
1192  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MAKE)));
1193 
1194  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.devModel"),
1195  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_MODEL)));
1196 
1197  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitude"),
1198  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1199 
1200  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitude"),
1201  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1202 
1203  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.altitude"),
1204  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1205 
1206  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID() == artifactTypeId) {
1207  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.personName"),
1208  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1209 
1210  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.phoneNumber"),
1211  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1212 
1213  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.phoneNumHome"),
1214  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_HOME)));
1215 
1216  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.phoneNumOffice"),
1217  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_OFFICE)));
1218 
1219  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.phoneNumMobile"),
1220  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_MOBILE)));
1221 
1222  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.email"),
1223  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL)));
1224 
1225  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID() == artifactTypeId) {
1226  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.msgType"),
1227  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MESSAGE_TYPE)));
1228 
1229  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.direction"),
1230  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1231 
1232  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.readStatus"),
1233  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_READ_STATUS)));
1234 
1235  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1236  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1237 
1238  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.fromPhoneNum"),
1239  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1240 
1241  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.fromEmail"),
1242  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1243 
1244  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.toPhoneNum"),
1245  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1246 
1247  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.toEmail"),
1248  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1249 
1250  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.subject"),
1251  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1252 
1253  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.text"),
1254  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TEXT)));
1255 
1256  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID() == artifactTypeId) {
1257  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.personName"),
1258  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1259 
1260  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.fromPhoneNum"),
1261  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_FROM)));
1262 
1263  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.toPhoneNum"),
1264  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER_TO)));
1265 
1266  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1267  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1268 
1269  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.direction"),
1270  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DIRECTION)));
1271 
1272  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID() == artifactTypeId) {
1273  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.calendarEntryType"),
1274  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CALENDAR_ENTRY_TYPE)));
1275 
1276  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.description"),
1277  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1278 
1279  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.startDateTime"),
1280  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START)));
1281 
1282  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.endDateTime"),
1283  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_END)));
1284 
1285  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.location"),
1286  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1287 
1288  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID() == artifactTypeId) {
1289  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.shortCut"),
1290  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SHORTCUT)));
1291 
1292  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.personName"),
1293  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME_PERSON)));
1294 
1295  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.phoneNumber"),
1296  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PHONE_NUMBER)));
1297 
1298  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID() == artifactTypeId) {
1299  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.deviceName"),
1300  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_NAME)));
1301 
1302  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.deviceAddress"),
1303  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DEVICE_ID)));
1304 
1305  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1306  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1307 
1308  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID() == artifactTypeId) {
1309  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitude"),
1310  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1311 
1312  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitude"),
1313  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1314 
1315  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1316  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1317 
1318  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID() == artifactTypeId) {
1319  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitude"),
1320  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1321 
1322  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitude"),
1323  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1324 
1325  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.altitude"),
1326  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1327 
1328  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1329  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1330 
1331  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.locationAddress"),
1332  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1333 
1334  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1335  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1336 
1337  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID() == artifactTypeId) {
1338  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitude"),
1339  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1340 
1341  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitude"),
1342  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1343 
1344  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.altitude"),
1345  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1346 
1347  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1348  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1349 
1350  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.locationAddress"),
1351  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1352 
1353  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1354  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1355 
1356  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID() == artifactTypeId) {
1357  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitude"),
1358  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE)));
1359 
1360  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitude"),
1361  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE)));
1362 
1363  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.altitude"),
1364  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_ALTITUDE)));
1365 
1366  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1367  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1368 
1369  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.locationAddress"),
1370  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1371 
1372  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1373  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1374 
1375  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID() == artifactTypeId) {
1376  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.category"),
1377  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1378 
1379  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.userId"),
1380  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1381 
1382  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.password"),
1383  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PASSWORD)));
1384 
1385  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.personName"),
1386  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1387 
1388  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.appName"),
1389  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1390 
1391  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.url"),
1392  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_URL)));
1393 
1394  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.appPath"),
1395  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1396 
1397  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.description"),
1398  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)));
1399 
1400  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.replytoAddress"),
1401  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_REPLYTO)));
1402 
1403  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.mailServer"),
1404  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SERVER_NAME)));
1405 
1406  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID() == artifactTypeId ||
1407  BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID() == artifactTypeId) {
1408  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1409  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1410 
1411  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() == artifactTypeId) {
1412  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.file")));
1413 
1414  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.extension.text")));
1415 
1416  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.mimeType.text")));
1417 
1418  columns.add(new HeaderOnlyColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.path")));
1419 
1420  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID() == artifactTypeId) {
1421  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.processorArchitecture.text"),
1422  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROCESSOR_ARCHITECTURE)));
1423 
1424  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.osName.text"),
1425  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1426 
1427  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.osInstallDate.text"),
1428  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1429 
1430  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID() == artifactTypeId) {
1431  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskEmailTo"),
1432  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_TO)));
1433 
1434  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskEmailFrom"),
1435  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_FROM)));
1436 
1437  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskSubject"),
1438  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SUBJECT)));
1439 
1440  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskDateTimeSent"),
1441  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT)));
1442 
1443  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskDateTimeRcvd"),
1444  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_RCVD)));
1445 
1446  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskPath"),
1447  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1448 
1449  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskEmailCc"),
1450  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_CC)));
1451 
1452  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskEmailBcc"),
1453  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_EMAIL_BCC)));
1454 
1455  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskMsgId"),
1456  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_MSG_ID)));
1457 
1458  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() == artifactTypeId) {
1459  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskSetName"),
1460  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1461 
1462  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskInterestingFilesCategory"),
1463  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1464 
1465  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskPath"),
1466  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH)));
1467 
1468  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_ROUTE.getTypeID() == artifactTypeId) {
1469  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskGpsRouteCategory"),
1470  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_CATEGORY)));
1471 
1472  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1473  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1474 
1475  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitudeEnd"),
1476  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_END)));
1477 
1478  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitudeEnd"),
1479  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_END)));
1480 
1481  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.latitudeStart"),
1482  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LATITUDE_START)));
1483 
1484  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.longitudeStart"),
1485  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_GEO_LONGITUDE_START)));
1486 
1487  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.name"),
1488  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_NAME)));
1489 
1490  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.location"),
1491  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCATION)));
1492 
1493  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1494  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1495 
1496  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() == artifactTypeId) {
1497  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tskSetName"),
1498  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME)));
1499 
1500  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.associatedArtifact"),
1501  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1502 
1503  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1504  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1505 
1506  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_PROG_RUN.getTypeID() == artifactTypeId) {
1507  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.program"),
1508  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME)));
1509 
1510  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.associatedArtifact"),
1511  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT)));
1512 
1513  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.dateTime"),
1514  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME)));
1515 
1516  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.count"),
1517  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COUNT)));
1518 
1519  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_ACCOUNT.getTypeID() == artifactTypeId) {
1520  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.userName"),
1521  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_NAME)));
1522 
1523  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.userId"),
1524  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_USER_ID)));
1525 
1526  } else if (BlackboardArtifact.ARTIFACT_TYPE.TSK_REMOTE_DRIVE.getTypeID() == artifactTypeId) {
1527  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.localPath"),
1528  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_LOCAL_PATH)));
1529 
1530  columns.add(new AttributeColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.remotePath"),
1531  new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_REMOTE_PATH)));
1532  } else if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ACCOUNT.getTypeID()) {
1533  columns.add(new StatusColumn());
1534  attributeTypeSet.remove(new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE));
1535  attributeTypeSet.remove(new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT));
1536  attributeTypeSet.remove(new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME));
1537  attributeTypeSet.remove(new Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_KEYWORD_SEARCH_DOCUMENT_ID));
1538  } else {
1539  // This is the case that it is a custom type. The reason an else is
1540  // necessary is to make sure that the source file column is added
1541  for (BlackboardAttribute.Type type : attributeTypeSet) {
1542  columns.add(new AttributeColumn(type.getDisplayName(), type));
1543  }
1544  columns.add(new SourceFileColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.srcFile")));
1545  columns.add(new TaggedResultsColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags")));
1546 
1547  // Short circuits to guarantee that the attribute types aren't added
1548  // twice.
1549  return columns;
1550  }
1551  // If it is an attribute column, it removes the attribute type of that
1552  // column from the set, so types are not reported more than once.
1553  for (Column column : columns) {
1554  attributeTypeSet = column.removeTypeFromSet(attributeTypeSet);
1555  }
1556  // Now uses the remaining types in the set to construct columns
1557  for (BlackboardAttribute.Type type : attributeTypeSet) {
1558  columns.add(new AttributeColumn(type.getDisplayName(), type));
1559  }
1560  // Source file column is added here for ordering purposes.
1561  if (artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_BOOKMARK.getTypeID()
1562  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_COOKIE.getTypeID()
1563  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_HISTORY.getTypeID()
1564  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_DOWNLOAD.getTypeID()
1565  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_RECENT_OBJECT.getTypeID()
1566  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_INSTALLED_PROG.getTypeID()
1567  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID()
1568  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_SEARCH_QUERY.getTypeID()
1569  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_METADATA_EXIF.getTypeID()
1570  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CONTACT.getTypeID()
1571  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()
1572  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALLLOG.getTypeID()
1573  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_CALENDAR_ENTRY.getTypeID()
1574  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SPEED_DIAL_ENTRY.getTypeID()
1575  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING.getTypeID()
1576  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_TRACKPOINT.getTypeID()
1577  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_BOOKMARK.getTypeID()
1578  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_LAST_KNOWN_LOCATION.getTypeID()
1579  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_GPS_SEARCH.getTypeID()
1580  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_SERVICE_ACCOUNT.getTypeID()
1581  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID()
1582  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID()
1583  || artifactTypeId == BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO.getTypeID()) {
1584  columns.add(new SourceFileColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.srcFile")));
1585  }
1586  columns.add(new TaggedResultsColumn(NbBundle.getMessage(this.getClass(), "ReportGenerator.artTableColHdr.tags")));
1587 
1588  return columns;
1589  }
1590 
1598  private String getFileUniquePath(Content content) {
1599  try {
1600  if (content != null) {
1601  return content.getUniquePath();
1602  } else {
1603  return "";
1604  }
1605  } catch (TskCoreException ex) {
1606  errorList.add(NbBundle.getMessage(this.getClass(), "ReportGenerator.errList.failedGetAbstractFileByID"));
1607  logger.log(Level.WARNING, "Failed to get Abstract File by ID.", ex); //NON-NLS
1608  }
1609  return "";
1610 
1611  }
1612 
1622  @SuppressWarnings("deprecation")
1623  private HashSet<String> getUniqueTagNames(long artifactId) throws TskCoreException {
1624  HashSet<String> uniqueTagNames = new HashSet<>();
1625 
1626  String query = "SELECT display_name, artifact_id FROM tag_names AS tn, blackboard_artifact_tags AS bat "
1627  + //NON-NLS
1628  "WHERE tn.tag_name_id = bat.tag_name_id AND bat.artifact_id = " + artifactId; //NON-NLS
1629 
1630  try (SleuthkitCase.CaseDbQuery dbQuery = Case.getCurrentCaseThrows().getSleuthkitCase().executeQuery(query)) {
1631  ResultSet tagNameRows = dbQuery.getResultSet();
1632  while (tagNameRows.next()) {
1633  uniqueTagNames.add(tagNameRows.getString("display_name")); //NON-NLS
1634  }
1635  } catch (TskCoreException | SQLException | NoCurrentCaseException ex) {
1636  throw new TskCoreException("Error getting tag names for artifact: ", ex);
1637  }
1638 
1639  return uniqueTagNames;
1640 
1641  }
1642 
1643  private interface Column {
1644 
1645  String getColumnHeader();
1646 
1647  String getCellData(ArtifactData artData);
1648 
1649  Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types);
1650  }
1651 
1652  private class StatusColumn implements Column {
1653 
1654  @NbBundle.Messages("TableReportGenerator.StatusColumn.Header=Review Status")
1655  @Override
1656  public String getColumnHeader() {
1657  return Bundle.TableReportGenerator_StatusColumn_Header();
1658  }
1659 
1660  @Override
1661  public String getCellData(ArtifactData artData) {
1662  return artData.getArtifact().getReviewStatus().getDisplayName();
1663  }
1664 
1665  @Override
1666  public Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types) {
1667  // This column doesn't have a type, so nothing to remove
1668  return types;
1669  }
1670 
1671  }
1672 
1673  private class AttributeColumn implements Column {
1674 
1675  private final String columnHeader;
1676  private final BlackboardAttribute.Type attributeType;
1677 
1684  AttributeColumn(String columnHeader, BlackboardAttribute.Type attributeType) {
1685  this.columnHeader = Objects.requireNonNull(columnHeader);
1686  this.attributeType = attributeType;
1687  }
1688 
1689  @Override
1690  public String getColumnHeader() {
1691  return this.columnHeader;
1692  }
1693 
1694  @Override
1695  public String getCellData(ArtifactData artData) {
1696  List<BlackboardAttribute> attributes = artData.getAttributes();
1697  for (BlackboardAttribute attribute : attributes) {
1698  if (attribute.getAttributeType().equals(this.attributeType)) {
1699  if (attribute.getAttributeType().getValueType() != BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME) {
1700  return attribute.getDisplayString();
1701  } else {
1702  return ContentUtils.getStringTime(attribute.getValueLong(), artData.getContent());
1703  }
1704  }
1705  }
1706  return "";
1707  }
1708 
1709  @Override
1710  public Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types) {
1711  types.remove(this.attributeType);
1712  return types;
1713  }
1714  }
1715 
1716  private class SourceFileColumn implements Column {
1717 
1718  private final String columnHeader;
1719 
1720  SourceFileColumn(String columnHeader) {
1721  this.columnHeader = columnHeader;
1722  }
1723 
1724  @Override
1725  public String getColumnHeader() {
1726  return this.columnHeader;
1727  }
1728 
1729  @Override
1730  public String getCellData(ArtifactData artData) {
1731  return getFileUniquePath(artData.getContent());
1732  }
1733 
1734  @Override
1735  public Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types) {
1736  // This column doesn't have a type, so nothing to remove
1737  return types;
1738  }
1739  }
1740 
1741  private class TaggedResultsColumn implements Column {
1742 
1743  private final String columnHeader;
1744 
1745  TaggedResultsColumn(String columnHeader) {
1746  this.columnHeader = columnHeader;
1747  }
1748 
1749  @Override
1750  public String getColumnHeader() {
1751  return this.columnHeader;
1752  }
1753 
1754  @Override
1755  public String getCellData(ArtifactData artData) {
1756  return makeCommaSeparatedList(artData.getTags());
1757  }
1758 
1759  @Override
1760  public Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types) {
1761  // This column doesn't have a type, so nothing to remove
1762  return types;
1763  }
1764  }
1765 
1766  private class HeaderOnlyColumn implements Column {
1767 
1768  private final String columnHeader;
1769 
1770  HeaderOnlyColumn(String columnHeader) {
1771  this.columnHeader = columnHeader;
1772  }
1773 
1774  @Override
1775  public String getColumnHeader() {
1776  return columnHeader;
1777  }
1778 
1779  @Override
1780  public String getCellData(ArtifactData artData) {
1781  throw new UnsupportedOperationException("Cannot get cell data of unspecified column");
1782  }
1783 
1784  @Override
1785  public Set<BlackboardAttribute.Type> removeTypeFromSet(Set<BlackboardAttribute.Type> types) {
1786  // This column doesn't have a type, so nothing to remove
1787  return types;
1788  }
1789  }
1790 }
org.sleuthkit.autopsy.report.TableReportGenerator.SourceFileColumn.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Definition: TableReportGenerator.java:1735
org.sleuthkit.autopsy.datamodel.ContentUtils.getStringTime
static String getStringTime(long epochSeconds, TimeZone tzone)
Definition: ContentUtils.java:88
org.sleuthkit.autopsy.datamodel.ContentUtils
Definition: ContentUtils.java:55
org.sleuthkit.autopsy.casemodule.services.TagsManager.getContentTagsByContent
List< ContentTag > getContentTagsByContent(Content content)
Definition: TagsManager.java:444
org.sleuthkit.autopsy.report.TableReportGenerator.Column.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
org.sleuthkit.autopsy.report.TableReportGenerator.StatusColumn.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Definition: TableReportGenerator.java:1666
org.sleuthkit.autopsy.report.TableReportGenerator.AttributeColumn.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Definition: TableReportGenerator.java:1710
org.sleuthkit.autopsy.report.TableReportGenerator.HeaderOnlyColumn.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Definition: TableReportGenerator.java:1785
org.sleuthkit.autopsy.casemodule.services.TagsManager.getBlackboardArtifactTagsByArtifact
List< BlackboardArtifactTag > getBlackboardArtifactTagsByArtifact(BlackboardArtifact artifact)
Definition: TagsManager.java:576
org.sleuthkit.autopsy.report.TableReportGenerator.TaggedResultsColumn.removeTypeFromSet
Set< BlackboardAttribute.Type > removeTypeFromSet(Set< BlackboardAttribute.Type > types)
Definition: TableReportGenerator.java:1760

Copyright © 2012-2016 Basis Technology. Generated on: Mon Jun 18 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.