Skip to content
Snippets Groups Projects
Commit 8a11aae1 authored by Kelly Kelly's avatar Kelly Kelly
Browse files

Updated getShortDescription

parent 629bd458
No related branches found
No related tags found
No related merge requests found
......@@ -170,16 +170,6 @@ Indicates that the some content of the file was a hit for a YARA rule match.
## TSK_METADATA_EXIF
EXIF metadata found in an image or audio file.
### REQUIRED ATTRIBUTES
- At least one of:
- TSK_DATETIME_CREATED (Creation date of the file, in seconds since 1970-01-01T00:00:00Z)
- TSK_DEVICE_MAKE (Device make, generally the manufacturer, e.g., Apple)
- TSK_DEVICE_MODEL (Device model, generally the product, e.g., iPhone)
- TSK_GEO_ALTITUDE (The camera's altitude when the image/audio was taken)
- TSK_GEO_LATITUDE (The camera's latitude when the image/audio was taken)
- TSK_GEO_LONGITUDE (The camera's longitude when the image/audio was taken)## TSK_METADATA_EXIF
EXIF metadata found in an image or audio file.
### REQUIRED ATTRIBUTES
- At least one of:
- TSK_DATETIME_CREATED (Creation date of the file, in seconds since 1970-01-01T00:00:00Z)
......
......@@ -38,7 +38,6 @@
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
import org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction;
import org.sleuthkit.datamodel.SleuthkitCase.ObjectInfo;
/**
* An artifact that has been posted to the blackboard. Artifacts store analysis
......@@ -234,10 +233,69 @@ public String getShortDescription() throws TskCoreException {
BlackboardAttribute attr = null;
StringBuilder shortDescription = new StringBuilder("");
switch (ARTIFACT_TYPE.fromID(artifactTypeId)) {
case TSK_WIFI_NETWORK_ADAPTER:
attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_MAC_ADDRESS));
break;
case TSK_WIFI_NETWORK:
attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SSID));
break;
case TSK_REMOTE_DRIVE:
attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_REMOTE_PATH));
break;
case TSK_SERVICE_ACCOUNT:
case TSK_SCREEN_SHOTS:
case TSK_DELETED_PROG:
case TSK_METADATA:
case TSK_OS_INFO:
case TSK_PROG_NOTIFICATIONS:
case TSK_PROG_RUN:
case TSK_RECENT_OBJECT:
case TSK_USER_DEVICE_EVENT:
case TSK_WEB_SEARCH_QUERY:
attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME));
break;
case TSK_BLUETOOTH_PAIRING:
attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_NAME));
break;
case TSK_ACCOUNT:
attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE));
break;
case TSK_WEB_CATEGORIZATION:
case TSK_BLUETOOTH_ADAPTER:
case TSK_GPS_AREA:
case TSK_GPS_BOOKMARK:
case TSK_GPS_LAST_KNOWN_LOCATION:
case TSK_GPS_ROUTE:
case TSK_GPS_SEARCH:
case TSK_GPS_TRACK:
case TSK_WEB_FORM_AUTOFILL:
attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_NAME));
break;
case TSK_WEB_ACCOUNT_TYPE:
attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_TEXT));
break;
case TSK_HASHSET_HIT:
case TSK_INTERESTING_ARTIFACT_HIT:
case TSK_INTERESTING_FILE_HIT:
case TSK_YARA_HIT:
attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SET_NAME));
break;
case TSK_ENCRYPTION_DETECTED:
case TSK_ENCRYPTION_SUSPECTED:
case TSK_OBJECT_DETECTED:
case TSK_USER_CONTENT_SUSPECTED:
case TSK_VERIFICATION_FAILED:
attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_COMMENT));
break;
case TSK_DATA_SOURCE_USAGE:
case TSK_CALENDAR_ENTRY:
attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DESCRIPTION));
break;
case TSK_WEB_BOOKMARK: //web_bookmark, web_cookie, web_download, and web_history are the same attribute for now
case TSK_WEB_COOKIE:
case TSK_WEB_DOWNLOAD:
case TSK_WEB_HISTORY:
case TSK_WEB_CACHE:
attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DOMAIN));
break;
case TSK_KEYWORD_HIT:
......@@ -249,6 +307,8 @@ public String getShortDescription() throws TskCoreException {
case TSK_CONTACT: //contact, message, and calllog are the same attributes for now
case TSK_MESSAGE:
case TSK_CALLLOG:
case TSK_SPEED_DIAL_ENTRY:
case TSK_WEB_FORM_ADDRESS:
//get the first of these attributes which exists and is non null
final ATTRIBUTE_TYPE[] typesThatCanHaveName = {ATTRIBUTE_TYPE.TSK_NAME,
ATTRIBUTE_TYPE.TSK_PHONE_NUMBER,
......@@ -261,7 +321,8 @@ public String getShortDescription() throws TskCoreException {
ATTRIBUTE_TYPE.TSK_EMAIL_FROM,
ATTRIBUTE_TYPE.TSK_EMAIL_TO,
ATTRIBUTE_TYPE.TSK_EMAIL_HOME,
ATTRIBUTE_TYPE.TSK_EMAIL_OFFICE}; //in the order we want to use them
ATTRIBUTE_TYPE.TSK_EMAIL_OFFICE,
ATTRIBUTE_TYPE.TSK_LOCATION}; //in the order we want to use them
for (ATTRIBUTE_TYPE t : typesThatCanHaveName) {
attr = getAttribute(new BlackboardAttribute.Type(t));
if (attr != null && !attr.getDisplayString().isEmpty()) {
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment