From 07f63c4e4c9707377e644d34869b64d3798603a4 Mon Sep 17 00:00:00 2001 From: Brian Carrier <carrier@sleuthkit.org> Date: Mon, 5 Aug 2013 18:18:25 -0400 Subject: [PATCH] Updated doxygen to have comments about making custom artifacts / attributes --- bindings/java/doxygen/main.dox | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/bindings/java/doxygen/main.dox b/bindings/java/doxygen/main.dox index 4f9494280..7a5d8dc48 100644 --- a/bindings/java/doxygen/main.dox +++ b/bindings/java/doxygen/main.dox @@ -23,7 +23,9 @@ This section provides a high-level overview of the relevant topics from the Java To make an artifact, one first calls the org.sleuthkit.datamodel.AbstractContent.newArtifact() method for the object that the artifact is being added to. This returns a org.sleuthkit.datamodel.BlackboardArtifact object. Attributes of type org.sleuthkit.datamodel.BlackboardAttribute are then created and added to the artifact. -To find artifacts, you have two general options. If you have an org.sleuthkit.datamodel.AbstractContent object or a derived object, then you can use the org.sleuthkit.datamodel.AbstractContent.getArtifacts() methods to perform various queries. If you want artifacts beyond those for a single file, then you must use the various get methods in org.sleuthkit.datamodel.SleuthkitCase. +To find artifacts, you have two general options. If you have an org.sleuthkit.datamodel.AbstractContent object or a derived object, then you can use the org.sleuthkit.datamodel.AbstractContent.getArtifacts() methods to perform various queries. If you want artifacts beyond those for a single file, then you must use the various org.sleuthkit.datamodel.SleuthkitCase.getBlackboardArtifacts() methods. + +If you want to create an artifact type that is not defined in the framework/bindings, then use org.sleuthkit.datamodel.SleuthkitCase.addArtifactType() to define the type. This will return back an artifact ID that you can pass in to create actual artifacts. Note that each database instance could assign a different ID for the custom attributes and artifacts. It all depends on what modules were run before it and if they added their own types. Later modules will need the ID of the new type if they want to find artifacts on the blackboard. They can get the ID for that database using org.sleuthkit.datamodel.SleuthkitCase.getArtifactTypeID(). Similarly, you can add custom attributes with org.sleuthkit.datamodel.SleuthkitCase.addAttrType() and find the ID using org.sleuthkit.datamodel.SleuthkitCase.getAttrTypeID(). */ -- GitLab