diff --git a/bindings/java/src/org/sleuthkit/datamodel/BlackboardAttribute.java b/bindings/java/src/org/sleuthkit/datamodel/BlackboardAttribute.java index f57b1d6a9fe8d903373caff713207df044e0c8e7..0d34029b7ef99e0ed09e646056bc6f720fdf4989 100755 --- a/bindings/java/src/org/sleuthkit/datamodel/BlackboardAttribute.java +++ b/bindings/java/src/org/sleuthkit/datamodel/BlackboardAttribute.java @@ -58,6 +58,14 @@ public class BlackboardAttribute { private long artifactID; private SleuthkitCase sleuthkitCase; private String sources; + + // Cached parent artifact. This field is populated lazily upon the first + // call to getParentArtifact(). + private BlackboardArtifact parentArtifact; + + // The parent data source is defined as being + // the data source of the parent artifact. + private Long parentDataSourceID; /** * Constructs a standard attribute with an integer value. The attribute @@ -474,7 +482,10 @@ public void addSource(String source) throws TskCoreException { * case database. */ public BlackboardArtifact getParentArtifact() throws TskCoreException { - return sleuthkitCase.getBlackboardArtifact(artifactID); + if (parentArtifact == null) { + parentArtifact = sleuthkitCase.getBlackboardArtifact(artifactID); + } + return parentArtifact; } @Override @@ -531,7 +542,11 @@ public String getDisplayString() { case DATETIME: { try { - final Content dataSource = getParentArtifact().getDataSource(); + if (parentDataSourceID == null) { + BlackboardArtifact parent = getParentArtifact(); + parentDataSourceID = parent.getDataSourceObjectID(); + } + final Content dataSource = sleuthkitCase.getContentById(parentDataSourceID); if ((dataSource != null) && (dataSource instanceof Image)) { // return the date/time string in the timezone associated with the datasource, Image image = (Image) dataSource; @@ -612,6 +627,16 @@ void setCaseDatabase(SleuthkitCase sleuthkitCase) { void setArtifactId(long artifactID) { this.artifactID = artifactID; } + + /** + * Sets the parent data source id. The parent data source is defined + * as being the data source of the parent artifact. + * + * @param parentDataSourceID The parent data source id. + */ + void setParentDataSourceID(long parentDataSourceID) { + this.parentDataSourceID = parentDataSourceID; + } /** * Gets the sources of this attribute. diff --git a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java index f380bc88aedeeeaa47004a371a6fd833317bb446..40436741704157b731d3ee429878a5cb251f6c23 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java +++ b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java @@ -4406,6 +4406,7 @@ public ArrayList<BlackboardAttribute> getBlackboardAttributes(final BlackboardAr rs.getString("value_text"), rs.getBytes("value_byte"), this ); + attr.setParentDataSourceID(artifact.getDataSourceObjectID()); attributes.add(attr); } return attributes; diff --git a/win32/NugetPackages.props b/win32/NugetPackages.props index 678c9aa55978e7e7d407c7fc6679b4e7605b3dac..d246d86ac6f7349ef91720c83f4f23b8034969a9 100644 --- a/win32/NugetPackages.props +++ b/win32/NugetPackages.props @@ -7,9 +7,9 @@ <LibVhdiInclude>$(SolutionDir)\packages\libvhdi.20200810.0.0\lib\native\include</LibVhdiInclude> <LibVhdiLib Condition="'$(Platform)' == 'Win32'">$(SolutionDir)\packages\libvhdi.20200810.0.0\lib\native\lib\Win32</LibVhdiLib> <LibVhdiLib Condition="'$(Platform)' == 'x64'">$(SolutionDir)\packages\libvhdi.20200810.0.0\lib\native\lib\x64</LibVhdiLib> - <LibEwfInclude>$(SolutionDir)\packages\sleuthkit-libewf.20130416.0.0\build\native\include</LibEwfInclude> - <LibEwfLib Condition="'$(Platform)' == 'Win32'">$(SolutionDir)\packages\sleuthkit-libewf.20130416.0.0\build\native\msvscpp\Release</LibEwfLib> - <LibEwfLib Condition="'$(Platform)' == 'x64'">$(SolutionDir)\packages\sleuthkit-libewf.20130416.0.0\build\native\msvscpp\x64\Release</LibEwfLib> + <LibEwfInclude>$(SolutionDir)\packages\libewf.20140811.0.0\lib\native\include</LibEwfInclude> + <LibEwfLib Condition="'$(Platform)' == 'Win32'">$(SolutionDir)\packages\libewf.20140811.0.0\lib\native\lib\Win32</LibEwfLib> + <LibEwfLib Condition="'$(Platform)' == 'x64'">$(SolutionDir)\packages\libewf.20140811.0.0\lib\native\lib\x64</LibEwfLib> <ZlibInclude>$(SolutionDir)\packages\zlib_native.1.2.11\build\native\include</ZlibInclude> <ZlibLib Condition="'$(Platform)' == 'Win32'">$(SolutionDir)\packages\zlib_native.1.2.11\build\native\lib\Win32\Release</ZlibLib> <ZlibLib Condition="'$(Platform)' == 'x64'">$(SolutionDir)\packages\zlib_native.1.2.11\build\native\lib\x64\Release</ZlibLib> diff --git a/win32/libtsk/packages.config b/win32/libtsk/packages.config index 7e7769b8c9ce40576783f7a87d996a4dbf834f5e..b35079ef9183affaae8ae9b7e3c8a01b020afb6a 100644 --- a/win32/libtsk/packages.config +++ b/win32/libtsk/packages.config @@ -1,6 +1,6 @@ <?xml version="1.0" encoding="utf-8"?> <packages> - <package id="sleuthkit-libewf" version="20130416.0.0" targetFramework="native" /> + <package id="libewf" version="20140811.0.0" targetFramework="native" /> <package id="libvhdi" version="20200810.0.0" targetFramework="native" /> <package id="libvmdk" version="20200810.0.0" targetFramework="native" /> <package id="openssl-vc140-vc141-x86_64" version="1.1.5" targetFramework="native" />