diff --git a/bindings/java/doxygen/artifact_catalog.dox b/bindings/java/doxygen/artifact_catalog.dox index 5f780c912b1f0e28ab9a1e80a57bc2caf99346ca..de1464f07e890457adf2e3e655082d837f790344 100644 --- a/bindings/java/doxygen/artifact_catalog.dox +++ b/bindings/java/doxygen/artifact_catalog.dox @@ -170,16 +170,6 @@ Indicates that the some content of the file was a hit for a YARA rule match. ## TSK_METADATA_EXIF EXIF metadata found in an image or audio file. -### REQUIRED ATTRIBUTES -- At least one of: -- TSK_DATETIME_CREATED (Creation date of the file, in seconds since 1970-01-01T00:00:00Z) -- TSK_DEVICE_MAKE (Device make, generally the manufacturer, e.g., Apple) -- TSK_DEVICE_MODEL (Device model, generally the product, e.g., iPhone) -- TSK_GEO_ALTITUDE (The camera's altitude when the image/audio was taken) -- TSK_GEO_LATITUDE (The camera's latitude when the image/audio was taken) -- TSK_GEO_LONGITUDE (The camera's longitude when the image/audio was taken)## TSK_METADATA_EXIF -EXIF metadata found in an image or audio file. - ### REQUIRED ATTRIBUTES - At least one of: - TSK_DATETIME_CREATED (Creation date of the file, in seconds since 1970-01-01T00:00:00Z) diff --git a/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java b/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java index 45d8dd41e7b362a0c0bb2738dfbf4b1e43f5eecd..67e3c70ac5d6c91d55053108b942f9c5cff49402 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java +++ b/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java @@ -38,7 +38,6 @@ import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE; import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE; import org.sleuthkit.datamodel.SleuthkitCase.CaseDbTransaction; -import org.sleuthkit.datamodel.SleuthkitCase.ObjectInfo; /** * An artifact that has been posted to the blackboard. Artifacts store analysis @@ -234,10 +233,69 @@ public String getShortDescription() throws TskCoreException { BlackboardAttribute attr = null; StringBuilder shortDescription = new StringBuilder(""); switch (ARTIFACT_TYPE.fromID(artifactTypeId)) { + case TSK_WIFI_NETWORK_ADAPTER: + attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_MAC_ADDRESS)); + break; + case TSK_WIFI_NETWORK: + attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SSID)); + break; + case TSK_REMOTE_DRIVE: + attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_REMOTE_PATH)); + break; + case TSK_SERVICE_ACCOUNT: + case TSK_SCREEN_SHOTS: + case TSK_DELETED_PROG: + case TSK_METADATA: + case TSK_OS_INFO: + case TSK_PROG_NOTIFICATIONS: + case TSK_PROG_RUN: + case TSK_RECENT_OBJECT: + case TSK_USER_DEVICE_EVENT: + case TSK_WEB_SEARCH_QUERY: + attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_PROG_NAME)); + break; + case TSK_BLUETOOTH_PAIRING: + attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DEVICE_NAME)); + break; + case TSK_ACCOUNT: + attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE)); + break; + case TSK_WEB_CATEGORIZATION: + case TSK_BLUETOOTH_ADAPTER: + case TSK_GPS_AREA: + case TSK_GPS_BOOKMARK: + case TSK_GPS_LAST_KNOWN_LOCATION: + case TSK_GPS_ROUTE: + case TSK_GPS_SEARCH: + case TSK_GPS_TRACK: + case TSK_WEB_FORM_AUTOFILL: + attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_NAME)); + break; + case TSK_WEB_ACCOUNT_TYPE: + attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_TEXT)); + break; + case TSK_HASHSET_HIT: + case TSK_INTERESTING_ARTIFACT_HIT: + case TSK_INTERESTING_FILE_HIT: + case TSK_YARA_HIT: + attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SET_NAME)); + break; + case TSK_ENCRYPTION_DETECTED: + case TSK_ENCRYPTION_SUSPECTED: + case TSK_OBJECT_DETECTED: + case TSK_USER_CONTENT_SUSPECTED: + case TSK_VERIFICATION_FAILED: + attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_COMMENT)); + break; + case TSK_DATA_SOURCE_USAGE: + case TSK_CALENDAR_ENTRY: + attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DESCRIPTION)); + break; case TSK_WEB_BOOKMARK: //web_bookmark, web_cookie, web_download, and web_history are the same attribute for now case TSK_WEB_COOKIE: case TSK_WEB_DOWNLOAD: case TSK_WEB_HISTORY: + case TSK_WEB_CACHE: attr = getAttribute(new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DOMAIN)); break; case TSK_KEYWORD_HIT: @@ -249,6 +307,8 @@ public String getShortDescription() throws TskCoreException { case TSK_CONTACT: //contact, message, and calllog are the same attributes for now case TSK_MESSAGE: case TSK_CALLLOG: + case TSK_SPEED_DIAL_ENTRY: + case TSK_WEB_FORM_ADDRESS: //get the first of these attributes which exists and is non null final ATTRIBUTE_TYPE[] typesThatCanHaveName = {ATTRIBUTE_TYPE.TSK_NAME, ATTRIBUTE_TYPE.TSK_PHONE_NUMBER, @@ -261,7 +321,8 @@ public String getShortDescription() throws TskCoreException { ATTRIBUTE_TYPE.TSK_EMAIL_FROM, ATTRIBUTE_TYPE.TSK_EMAIL_TO, ATTRIBUTE_TYPE.TSK_EMAIL_HOME, - ATTRIBUTE_TYPE.TSK_EMAIL_OFFICE}; //in the order we want to use them + ATTRIBUTE_TYPE.TSK_EMAIL_OFFICE, + ATTRIBUTE_TYPE.TSK_LOCATION}; //in the order we want to use them for (ATTRIBUTE_TYPE t : typesThatCanHaveName) { attr = getAttribute(new BlackboardAttribute.Type(t)); if (attr != null && !attr.getDisplayString().isEmpty()) {