Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
S
Sleuthkit
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Iterations
Requirements
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Locked files
Build
Pipelines
Jobs
Pipeline schedules
Test cases
Artifacts
Deploy
Releases
Package registry
Model registry
Operate
Environments
Terraform modules
Monitor
Incidents
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Code review analytics
Issue analytics
Insights
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Terms and privacy
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
IRT
Sleuthkit
Commits
8a11aae1
Commit
8a11aae1
authored
3 years ago
by
Kelly Kelly
Browse files
Options
Downloads
Patches
Plain Diff
Updated getShortDescription
parent
629bd458
No related branches found
No related tags found
No related merge requests found
Changes
2
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
bindings/java/doxygen/artifact_catalog.dox
+0
-10
0 additions, 10 deletions
bindings/java/doxygen/artifact_catalog.dox
bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java
+63
-2
63 additions, 2 deletions
.../java/src/org/sleuthkit/datamodel/BlackboardArtifact.java
with
63 additions
and
12 deletions
bindings/java/doxygen/artifact_catalog.dox
+
0
−
10
View file @
8a11aae1
...
...
@@ -170,16 +170,6 @@ Indicates that the some content of the file was a hit for a YARA rule match.
## TSK_METADATA_EXIF
EXIF metadata found in an image or audio file.
### REQUIRED ATTRIBUTES
- At least one of:
- TSK_DATETIME_CREATED (Creation date of the file, in seconds since 1970-01-01T00:00:00Z)
- TSK_DEVICE_MAKE (Device make, generally the manufacturer, e.g., Apple)
- TSK_DEVICE_MODEL (Device model, generally the product, e.g., iPhone)
- TSK_GEO_ALTITUDE (The camera's altitude when the image/audio was taken)
- TSK_GEO_LATITUDE (The camera's latitude when the image/audio was taken)
- TSK_GEO_LONGITUDE (The camera's longitude when the image/audio was taken)## TSK_METADATA_EXIF
EXIF metadata found in an image or audio file.
### REQUIRED ATTRIBUTES
- At least one of:
- TSK_DATETIME_CREATED (Creation date of the file, in seconds since 1970-01-01T00:00:00Z)
...
...
This diff is collapsed.
Click to expand it.
bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java
+
63
−
2
View file @
8a11aae1
...
...
@@ -38,7 +38,6 @@
import
org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE
;
import
org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE
;
import
org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction
;
import
org.sleuthkit.datamodel.SleuthkitCase.ObjectInfo
;
/**
* An artifact that has been posted to the blackboard. Artifacts store analysis
...
...
@@ -234,10 +233,69 @@ public String getShortDescription() throws TskCoreException {
BlackboardAttribute
attr
=
null
;
StringBuilder
shortDescription
=
new
StringBuilder
(
""
);
switch
(
ARTIFACT_TYPE
.
fromID
(
artifactTypeId
))
{
case
TSK_WIFI_NETWORK_ADAPTER:
attr
=
getAttribute
(
new
BlackboardAttribute
.
Type
(
ATTRIBUTE_TYPE
.
TSK_MAC_ADDRESS
));
break
;
case
TSK_WIFI_NETWORK:
attr
=
getAttribute
(
new
BlackboardAttribute
.
Type
(
ATTRIBUTE_TYPE
.
TSK_SSID
));
break
;
case
TSK_REMOTE_DRIVE:
attr
=
getAttribute
(
new
BlackboardAttribute
.
Type
(
ATTRIBUTE_TYPE
.
TSK_REMOTE_PATH
));
break
;
case
TSK_SERVICE_ACCOUNT:
case
TSK_SCREEN_SHOTS:
case
TSK_DELETED_PROG:
case
TSK_METADATA:
case
TSK_OS_INFO:
case
TSK_PROG_NOTIFICATIONS:
case
TSK_PROG_RUN:
case
TSK_RECENT_OBJECT:
case
TSK_USER_DEVICE_EVENT:
case
TSK_WEB_SEARCH_QUERY:
attr
=
getAttribute
(
new
BlackboardAttribute
.
Type
(
ATTRIBUTE_TYPE
.
TSK_PROG_NAME
));
break
;
case
TSK_BLUETOOTH_PAIRING:
attr
=
getAttribute
(
new
BlackboardAttribute
.
Type
(
ATTRIBUTE_TYPE
.
TSK_DEVICE_NAME
));
break
;
case
TSK_ACCOUNT:
attr
=
getAttribute
(
new
BlackboardAttribute
.
Type
(
ATTRIBUTE_TYPE
.
TSK_ACCOUNT_TYPE
));
break
;
case
TSK_WEB_CATEGORIZATION:
case
TSK_BLUETOOTH_ADAPTER:
case
TSK_GPS_AREA:
case
TSK_GPS_BOOKMARK:
case
TSK_GPS_LAST_KNOWN_LOCATION:
case
TSK_GPS_ROUTE:
case
TSK_GPS_SEARCH:
case
TSK_GPS_TRACK:
case
TSK_WEB_FORM_AUTOFILL:
attr
=
getAttribute
(
new
BlackboardAttribute
.
Type
(
ATTRIBUTE_TYPE
.
TSK_NAME
));
break
;
case
TSK_WEB_ACCOUNT_TYPE:
attr
=
getAttribute
(
new
BlackboardAttribute
.
Type
(
ATTRIBUTE_TYPE
.
TSK_TEXT
));
break
;
case
TSK_HASHSET_HIT:
case
TSK_INTERESTING_ARTIFACT_HIT:
case
TSK_INTERESTING_FILE_HIT:
case
TSK_YARA_HIT:
attr
=
getAttribute
(
new
BlackboardAttribute
.
Type
(
ATTRIBUTE_TYPE
.
TSK_SET_NAME
));
break
;
case
TSK_ENCRYPTION_DETECTED:
case
TSK_ENCRYPTION_SUSPECTED:
case
TSK_OBJECT_DETECTED:
case
TSK_USER_CONTENT_SUSPECTED:
case
TSK_VERIFICATION_FAILED:
attr
=
getAttribute
(
new
BlackboardAttribute
.
Type
(
ATTRIBUTE_TYPE
.
TSK_COMMENT
));
break
;
case
TSK_DATA_SOURCE_USAGE:
case
TSK_CALENDAR_ENTRY:
attr
=
getAttribute
(
new
BlackboardAttribute
.
Type
(
ATTRIBUTE_TYPE
.
TSK_DESCRIPTION
));
break
;
case
TSK_WEB_BOOKMARK:
//web_bookmark, web_cookie, web_download, and web_history are the same attribute for now
case
TSK_WEB_COOKIE:
case
TSK_WEB_DOWNLOAD:
case
TSK_WEB_HISTORY:
case
TSK_WEB_CACHE:
attr
=
getAttribute
(
new
BlackboardAttribute
.
Type
(
ATTRIBUTE_TYPE
.
TSK_DOMAIN
));
break
;
case
TSK_KEYWORD_HIT:
...
...
@@ -249,6 +307,8 @@ public String getShortDescription() throws TskCoreException {
case
TSK_CONTACT:
//contact, message, and calllog are the same attributes for now
case
TSK_MESSAGE:
case
TSK_CALLLOG:
case
TSK_SPEED_DIAL_ENTRY:
case
TSK_WEB_FORM_ADDRESS:
//get the first of these attributes which exists and is non null
final
ATTRIBUTE_TYPE
[]
typesThatCanHaveName
=
{
ATTRIBUTE_TYPE
.
TSK_NAME
,
ATTRIBUTE_TYPE
.
TSK_PHONE_NUMBER
,
...
...
@@ -261,7 +321,8 @@ public String getShortDescription() throws TskCoreException {
ATTRIBUTE_TYPE
.
TSK_EMAIL_FROM
,
ATTRIBUTE_TYPE
.
TSK_EMAIL_TO
,
ATTRIBUTE_TYPE
.
TSK_EMAIL_HOME
,
ATTRIBUTE_TYPE
.
TSK_EMAIL_OFFICE
};
//in the order we want to use them
ATTRIBUTE_TYPE
.
TSK_EMAIL_OFFICE
,
ATTRIBUTE_TYPE
.
TSK_LOCATION
};
//in the order we want to use them
for
(
ATTRIBUTE_TYPE
t
:
typesThatCanHaveName
)
{
attr
=
getAttribute
(
new
BlackboardAttribute
.
Type
(
t
));
if
(
attr
!=
null
&&
!
attr
.
getDisplayString
().
isEmpty
())
{
...
...
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment