diff --git a/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties b/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties index 16335ea7bdca9678b386461b6e9db36b52ef82ad..1064791a09a0ac80d54e54d12f79cc7fcd79b003 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties +++ b/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties @@ -327,6 +327,7 @@ MiscTypes.GPSTrack.name=GPS Track MiscTypes.metadataLastPrinted.name=Document Last Printed MiscTypes.metadataLastSaved.name=Document Last Saved MiscTypes.metadataCreated.name=Document Created +MiscTypes.programexecuted.name=Program Execution RootEventType.eventTypes.name=Event Types WebTypes.webDownloads.name=Web Downloads WebTypes.webCookies.name=Web Cookies diff --git a/bindings/java/src/org/sleuthkit/datamodel/TimelineEventType.java b/bindings/java/src/org/sleuthkit/datamodel/TimelineEventType.java index 8f99e5af32c36792f65d390f349776e0b42f0aab..87c1d3426deecab0336aa33d041dfb4626906cbe 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/TimelineEventType.java +++ b/bindings/java/src/org/sleuthkit/datamodel/TimelineEventType.java @@ -224,7 +224,8 @@ public int compare(TimelineEventType o1, TimelineEventType o2) { builder.add(CALL_LOG, DEVICES_ATTACHED, EMAIL, EXIF, GPS_BOOKMARK, GPS_LAST_KNOWN_LOCATION, GPS_TRACKPOINT, GPS_ROUTE, GPS_SEARCH, GPS_TRACK, INSTALLED_PROGRAM, LOG_ENTRY, MESSAGE, - METADATA_LAST_PRINTED, METADATA_LAST_SAVED, METADATA_CREATED, RECENT_DOCUMENTS, REGISTRY); + METADATA_LAST_PRINTED, METADATA_LAST_SAVED, METADATA_CREATED, PROGRAM_EXECUTION, + RECENT_DOCUMENTS, REGISTRY); return builder.build(); } @@ -544,7 +545,7 @@ public SortedSet< TimelineEventType> getChildren() { new BlackboardAttribute.Type(TSK_DATETIME_MODIFIED), artf -> {return getBundle().getString("MiscTypes.metadataLastSaved.name");}, new EmptyExtractor(), - new EmptyExtractor()); + new EmptyExtractor()); TimelineEventType METADATA_CREATED = new TimelineEventArtifactTypeImpl(35, getBundle().getString("MiscTypes.metadataCreated.name"),// NON-NLS @@ -554,6 +555,20 @@ public SortedSet< TimelineEventType> getChildren() { artf -> {return getBundle().getString("MiscTypes.metadataCreated.name");}, new EmptyExtractor(), new EmptyExtractor()); + + TimelineEventType PROGRAM_EXECUTION = new TimelineEventArtifactTypeImpl(36, + getBundle().getString("MiscTypes.programexecuted.name"),// NON-NLS + MISC_TYPES, + new BlackboardArtifact.Type(TSK_PROG_RUN), + new Type(TSK_DATETIME), + new AttributeExtractor(new Type(TSK_PROG_NAME)), + artf -> { + String userName = stringValueOf(getAttributeSafe(artf, new Type(TSK_USER_NAME))); + if (userName != null) { + return userName; + } + return "";}, + new AttributeExtractor(new Type(TSK_COMMENT))); static SortedSet<? extends TimelineEventType> getCategoryTypes() { return ROOT_EVENT_TYPE.getChildren();