Skip to content
Snippets Groups Projects
Commit ba313a6e authored by apriestman's avatar apriestman
Browse files

Assign all artifact types to a category. 

Update artifact catalog.
parent 16aab39e
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
bindings/java/doxygen/artifact_catalog.dox
+ 139
− 176
View file @ ba313a6e
......@@ -4,7 +4,9 @@
# Introduction
This document reflects current standard usage of artifact and attribute types for posting analysis results to the case blackboard in Autopsy. Refer to \ref mod_bbpage for more background on the blackboard and how to make artifacts.
The catalog section below has one entry for each standard artifact type. Each entry lists the required and optional attributes of artifacts of the type.
The catalog section below has one entry for each standard artifact type divided by categories. Each entry lists the required and optional attributes of artifacts of the type. The category types are:
- \ref art_catalog_analysis "Analysis Result": Result from an analysis technique on a given object with a given configuration. Includes Conclusion, Relevance Score, and Confidence.
- \ref art_catalog_data "Data Artifact": Data that was originally embedded by an application/OS in a file or other data container.
NOTE:
- While we have listed some attributes as "Required", nothing will enforce that they exist. Modules that use artifacts from the blackboard should assume that some of the attributes may not actually exist.
......@@ -15,9 +17,143 @@ For the full list of types, refer to:
- org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE
<h1>Artifacts Catalog</h1>
\section art_catalog_analysis Analysis Result Types
In alphabetical order.
---
## TSK_DATA_SOURCE_USAGE
Describes how a data source was used, e.g., as a SIM card or an OS drive (such as for Windows or Android).
### REQUIRED ATTRIBUTES
- TSK_DESCRIPTION (Description of the usage, e.g., "OS Drive (Windows Vista)").
---
## TSK_ENCRYPTION_DETECTED
An indication that the content is encrypted.
### REQUIRED ATTRIBUTES
- TSK_COMMENT (A comment on the encryption, e.g., encryption type or password)
---
## TSK_ENCRYPTION_SUSPECTED
An indication that the content is likely encrypted.
### REQUIRED ATTRIBUTES
- TSK_COMMENT (Reason for suspecting encryption)
---
## TSK_EXT_MISMATCH_DETECTED
An indication that the registered extensions for a file's mime type do not match the file's extension.
### REQUIRED ATTRIBUTES
None
---
## TSK_FACE_DETECTED
An indication that a human face was detected in some content.
### REQUIRED ATTRIBUTES
None
---
## TSK_HASHSET_HIT
Indicates that the MD5 hash of a file matches a set of known MD5s (possibly user defined).
### REQUIRED ATTRIBUTES
- TSK_SET_NAME (Name of hashset containing the file's MD5)
### OPTIONAL ATTRIBUTES
- TSK_COMMENT (Additional comments about the hit)
---
## TSK_INTERESTING_ARTIFACT_HIT
Indicates that the source artifact matches some set of criteria which deem it interesting. Artifacts with this meta artifact will be brought to the attention of the user.
### REQUIRED ATTRIBUTES
- TSK_ASSOCIATED_ARTIFACT (The source artifact)
- TSK_SET_NAME (The name of the set of criteria which deemed this artifact interesting)
### OPTIONAL ATTRIBUTES
- TSK_COMMENT (Comment on the reason that the source artifact is interesting)
- TSK_CATEGORY (The set membership rule that was satisfied)
---
## TSK_INTERESTING_FILE_HIT
Indication that the source file matches some set of criteria (possibly user defined) which deem it interesting. Files with this artifact will be brought to the attention of the user.
### REQUIRED ATTRIBUTES
- TSK_SET_NAME (The name of the set of criteria which deemed this file interesting)
### OPTIONAL ATTRIBUTES
- TSK_COMMENT (Comment on the reason that the source artifact is interesting)
- TSK_CATEGORY (The set membership rule that was satisfied. I.e. a particular mime)
---
## TSK_KEYWORD_HIT
Indication that the source artifact or file contains a keyword. Keywords are grouped into named sets.
### REQUIRED ATTRIBUTES
- TSK_KEYWORD (Keyword that was found in the artifact or file)
- TSK_KEYWORD_SEARCH_TYPE (Specifies the type of match, e.g., an exact match, a substring match, or a regex match)
- TSK_SET_NAME (The set name that the keyword was contained in)
- TSK_KEYWORD_REGEXP (The regular expression that matched, only required for regex matches)
- TSK_ASSOCIATED_ARTIFACT (Only required if the keyword hit source is an artifact)
### OPTIONAL ATTRIBUTES
- TSK_KEYWORD_PREVIEW (Snippet of text around keyword)
---
## TSK_OBJECT_DETECTED
Indicates that an object was detected in a media file. Typically used by computer vision software to classify images.
### REQUIRED ATTRIBUTES
- TSK_COMMENT (What was detected)
### OPTIONAL ATTRIBUTES
- TSK_DESCRIPTION (Additional comments about the object or observer, e.g., what detected the object)
---
## TSK_USER_CONTENT_SUSPECTED
An indication that some media file content was generated by the user.
### REQUIRED ATTRIBUTES
- TSK_COMMENT (The reason why user-generated content is suspected)
---
## TSK_VERIFICATION_FAILED
An indication that some data did not pass verification. One example would be verifying a SHA-1 hash.
### REQUIRED ATTRIBUTES
- TSK_COMMENT (Reason for failure, what failed)
---
## TSK_WEB_ACCOUNT_TYPE
A web account type entry.
### REQUIRED ATTRIBUTES
- TSK_DOMAIN (Domain of the URL)
- TSK_TEXT (Indicates type of account (admin/moderator/user) and possible platform)
- TSK_URL (URL indicating the user has an account on this domain)
---
## TSK_WEB_CATEGORIZATION
The categorization of a web host using a specific usage type, e.g. mail.google.com would correspond to Web Email.
### REQUIRED ATTRIBUTES
- TSK_NAME (The usage category identifier, e.g. Web Email)
- TSK_DOMAIN (The domain of the host, e.g. google.com)
- TSK_HOST (The full host, e.g. mail.google.com)
---
## TSK_YARA_HIT
Indicates that the some content of the file was a hit for a YARA rule match.
### REQUIRED ATTRIBUTES
- TSK_RULE (The rule that was a hit for this file)
- TSK_SET_NAME (Name of the rule set containing the matching rule YARA rule)
<br><br>
\section art_catalog_data Data Artifact Types
---
## TSK_ACCOUNT
......@@ -141,13 +277,6 @@ A contact book entry in an application file or database.
---
## TSK_DATA_SOURCE_USAGE
Describes how a data source was used, e.g., as a SIM card or an OS drive (such as for Windows or Android).
### REQUIRED ATTRIBUTES
- TSK_DESCRIPTION (Description of the usage, e.g., "OS Drive (Windows Vista)").
---
## TSK_DELETED_PROG
......@@ -213,26 +342,6 @@ An email message found in an application file or database.
- TSK_SUBJECT (Subject of the email message)
- TSK_THREAD_ID (ID specified by the analysis module to group emails into threads for display purposes)
---
## TSK_ENCRYPTION_DETECTED
An indication that the content is encrypted.
### REQUIRED ATTRIBUTES
- TSK_COMMENT (A comment on the encryption, e.g., encryption type or password)
---
## TSK_ENCRYPTION_SUSPECTED
An indication that the content is likely encrypted.
### REQUIRED ATTRIBUTES
- TSK_COMMENT (Reason for suspecting encryption)
---
## TSK_EXTRACTED_TEXT
Text extracted from some content.
......@@ -240,26 +349,6 @@ Text extracted from some content.
### REQUIRED ATTRIBUTES
TSK_TEXT (The extracted text)
---
## TSK_EXT_MISMATCH_DETECTED
An indication that the registered extensions for a file's mime type do not match the file's extension.
### REQUIRED ATTRIBUTES
None
---
## TSK_FACE_DETECTED
An indication that a human face was detected in some content.
### REQUIRED ATTRIBUTES
None
---
## TSK_GEN_INFO
A generic information artifact. Each content object will have at most one TSK_GEN_INFO artifact, which is easily accessed through org.sleuthkit.datamodel.AbstractContent.getGenInfoArtifact() and related methods. The TSK_GEN_INFO object is useful for storing values related to the content object without making a new artifact type.
......@@ -359,18 +448,6 @@ A Global Positioning System (GPS) track artifact records the track, or path, of
---
## TSK_HASHSET_HIT
Indicates that the MD5 hash of a file matches a set of known MD5s (possibly user defined).
### REQUIRED ATTRIBUTES
- TSK_SET_NAME (Name of hashset containing the file's MD5)
### OPTIONAL ATTRIBUTES
- TSK_COMMENT (Additional comments about the hit)
---
## TSK_INSTALLED_PROG
Details about an installed program.
......@@ -385,51 +462,6 @@ Details about an installed program.
- TSK_PATH_SOURCE (Path to an Android Package Kit (APK) file for an Android program)
- TSK_PERMISSIONS (Permissions of the installed program)
---
## TSK_INTERESTING_ARTIFACT_HIT
Indicates that the source artifact matches some set of criteria which deem it interesting. Artifacts with this meta artifact will be brought to the attention of the user.
### REQUIRED ATTRIBUTES
- TSK_ASSOCIATED_ARTIFACT (The source artifact)
- TSK_SET_NAME (The name of the set of criteria which deemed this artifact interesting)
### OPTIONAL ATTRIBUTES
- TSK_COMMENT (Comment on the reason that the source artifact is interesting)
- TSK_CATEGORY (The set membership rule that was satisfied)
---
## TSK_INTERESTING_FILE_HIT
Indication that the source file matches some set of criteria (possibly user defined) which deem it interesting. Files with this artifact will be brought to the attention of the user.
### REQUIRED ATTRIBUTES
- TSK_SET_NAME (The name of the set of criteria which deemed this file interesting)
### OPTIONAL ATTRIBUTES
- TSK_COMMENT (Comment on the reason that the source artifact is interesting)
- TSK_CATEGORY (The set membership rule that was satisfied. I.e. a particular mime)
---
## TSK_KEYWORD_HIT
Indication that the source artifact or file contains a keyword. Keywords are grouped into named sets.
### REQUIRED ATTRIBUTES
- TSK_KEYWORD (Keyword that was found in the artifact or file)
- TSK_KEYWORD_SEARCH_TYPE (Specifies the type of match, e.g., an exact match, a substring match, or a regex match)
- TSK_SET_NAME (The set name that the keyword was contained in)
- TSK_KEYWORD_REGEXP (The regular expression that matched, only required for regex matches)
- TSK_ASSOCIATED_ARTIFACT (Only required if the keyword hit source is an artifact)
### OPTIONAL ATTRIBUTES
- TSK_KEYWORD_PREVIEW (Snippet of text around keyword)
---
## TSK_MESSAGE
A message that is found in some content.
......@@ -485,18 +517,6 @@ EXIF metadata found in an image or audio file.
- TSK_GEO_LONGITUDE (The camera's longitude when the image/audio was taken)
---
## TSK_OBJECT_DETECTED
Indicates that an object was detected in a media file. Typically used by computer vision software to classify images.
### REQUIRED ATTRIBUTES
- TSK_COMMENT (What was detected)
### OPTIONAL ATTRIBUTES
- TSK_DESCRIPTION (Additional comments about the object or observer, e.g., what detected the object)
---
## TSK_OS_ACCOUNT
Details about an operating system account recovered from the data source. Examples include user or administrator accounts.
......@@ -676,18 +696,7 @@ An event in the timeline of a case.
- TSK_DATETIME (When the event occurred, in seconds since 1970-01-01T00:00:00Z)
- TSK_DESCRIPTION (A description of the event)
---
## TSK_USER_CONTENT_SUSPECTED
An indication that some media file content was generated by the user.
### REQUIRED ATTRIBUTES
- TSK_COMMENT (The reason why user-generated content is suspected)
---
## TSK_USER_DEVICE_EVENT
Activity on the system or from an application. Example usage is a mobile device being locked and unlocked.
......@@ -702,27 +711,6 @@ Activity on the system or from an application. Example usage is a mobile device
- TSK_PROG_NAME (Name of the program doing the activity)
- TSK_VALUE (Connection type)
---
## TSK_VERIFICATION_FAILED
An indication that some data did not pass verification. One example would be verifying a SHA-1 hash.
### REQUIRED ATTRIBUTES
- TSK_COMMENT (Reason for failure, what failed)
---
## TSK_WEB_ACCOUNT_TYPE
A web account type entry.
### REQUIRED ATTRIBUTES
- TSK_DOMAIN (Domain of the URL)
- TSK_TEXT (Indicates type of account (admin/moderator/user) and possible platform)
- TSK_URL (URL indicating the user has an account on this domain)
---
## TSK_WEB_BOOKMARK
A web bookmark entry.
......@@ -737,8 +725,6 @@ A web bookmark entry.
- TSK_NAME (Name of the bookmark entry)
- TSK_TITLE (Title of the web page that was bookmarked)
---
## TSK_WEB_CACHE
A web cache entry. The resource that was cached may or may not be present in the data source.
......@@ -753,19 +739,6 @@ A web cache entry. The resource that was cached may or may not be present in the
- TSK_PATH_ID (Object ID of the source cache file)
- TSK_DOMAIN (Domain of the URL)
---
## TSK_WEB_CATEGORIZATION
The categorization of a web host using a specific usage type, e.g. mail.google.com would correspond to Web Email.
### REQUIRED ATTRIBUTES
- TSK_NAME (The usage category identifier, e.g. Web Email)
- TSK_DOMAIN (The domain of the host, e.g. google.com)
- TSK_HOST (The full host, e.g. mail.google.com)
---
## TSK_WEB_COOKIE
A Web cookie found.
......@@ -887,14 +860,4 @@ Details about a WiFi adapter.
---
## TSK_YARA_HIT
Indicates that the some content of the file was a hit for a YARA rule match.
### REQUIRED ATTRIBUTES
- TSK_RULE (The rule that was a hit for this file)
- TSK_SET_NAME (Name of the rule set containing the matching rule YARA rule)
*/
bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java
+ 58
− 58
View file @ ba313a6e
......@@ -1038,40 +1038,40 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
* A generic information artifact.
*/
TSK_GEN_INFO(1, "TSK_GEN_INFO", //NON-NLS
bundle.getString("BlackboardArtifact.tskGenInfo.text")),
bundle.getString("BlackboardArtifact.tskGenInfo.text"), Category.DATA_ARTIFACT),
/**
* A Web bookmark. Use methods in
* org.sleuthkit.datamodel.blackboardutils.WebBrowserArtifactsHelper to
* create bookmark artifacts.
*/
TSK_WEB_BOOKMARK(2, "TSK_WEB_BOOKMARK", //NON-NLS
bundle.getString("BlackboardArtifact.tskWebBookmark.text")),
bundle.getString("BlackboardArtifact.tskWebBookmark.text"), Category.DATA_ARTIFACT),
/**
* A Web cookie. Use methods in
* org.sleuthkit.datamodel.blackboardutils.WebBrowserArtifactsHelper to
* create cookie artifacts.
*/
TSK_WEB_COOKIE(3, "TSK_WEB_COOKIE",
bundle.getString("BlackboardArtifact.tskWebCookie.text")), //NON-NLS
bundle.getString("BlackboardArtifact.tskWebCookie.text"), Category.DATA_ARTIFACT), //NON-NLS
/**
* A Web history. Use methods in
* org.sleuthkit.datamodel.blackboardutils.WebBrowserArtifactsHelper to
* create history artifacts.
*/
TSK_WEB_HISTORY(4, "TSK_WEB_HISTORY", //NON-NLS
bundle.getString("BlackboardArtifact.tskWebHistory.text")),
bundle.getString("BlackboardArtifact.tskWebHistory.text"), Category.DATA_ARTIFACT),
/**
* A Web download. Use methods in
* org.sleuthkit.datamodel.blackboardutils.WebBrowserArtifactsHelper to
* create download artifacts.
*/
TSK_WEB_DOWNLOAD(5, "TSK_WEB_DOWNLOAD", //NON-NLS
bundle.getString("BlackboardArtifact.tskWebDownload.text")),
bundle.getString("BlackboardArtifact.tskWebDownload.text"), Category.DATA_ARTIFACT),
/**
* A recent object.
*/
TSK_RECENT_OBJECT(6, "TSK_RECENT_OBJ", //NON-NLS
bundle.getString("BlackboardArtifact.tsk.recentObject.text")),
bundle.getString("BlackboardArtifact.tsk.recentObject.text"), Category.DATA_ARTIFACT),
/**
* A GPS track point (geolocation data).
*
......@@ -1079,12 +1079,12 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
*/
@Deprecated
TSK_GPS_TRACKPOINT(7, "TSK_GPS_TRACKPOINT", //NON-NLS
bundle.getString("BlackboardArtifact.tskGpsTrackpoint.text")),
bundle.getString("BlackboardArtifact.tskGpsTrackpoint.text"), Category.DATA_ARTIFACT),
/**
* An installed program.
*/
TSK_INSTALLED_PROG(8, "TSK_INSTALLED_PROG", //NON-NLS
bundle.getString("BlackboardArtifact.tskInstalledProg.text")),
bundle.getString("BlackboardArtifact.tskInstalledProg.text"), Category.DATA_ARTIFACT),
/**
* A search hit for a keyword.
*/
......@@ -1099,7 +1099,7 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
* An attached device.
*/
TSK_DEVICE_ATTACHED(11, "TSK_DEVICE_ATTACHED", //NON-NLS
bundle.getString("BlackboardArtifact.tskDeviceAttached.text")),
bundle.getString("BlackboardArtifact.tskDeviceAttached.text"), Category.DATA_ARTIFACT),
/**
* An meta-artifact to call attention to a file deemed to be
* interesting.
......@@ -1110,22 +1110,22 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
* An email message.
*/
TSK_EMAIL_MSG(13, "TSK_EMAIL_MSG", //NON-NLS
bundle.getString("BlackboardArtifact.tskEmailMsg.text")),
bundle.getString("BlackboardArtifact.tskEmailMsg.text"), Category.DATA_ARTIFACT),
/**
* Text extracted from the source content.
*/
TSK_EXTRACTED_TEXT(14, "TSK_EXTRACTED_TEXT", //NON-NLS
bundle.getString("BlackboardArtifact.tskExtractedText.text")),
bundle.getString("BlackboardArtifact.tskExtractedText.text"), Category.DATA_ARTIFACT),
/**
* A Web search engine query extracted from Web history.
*/
TSK_WEB_SEARCH_QUERY(15, "TSK_WEB_SEARCH_QUERY", //NON-NLS
bundle.getString("BlackboardArtifact.tskWebSearchQuery.text")),
bundle.getString("BlackboardArtifact.tskWebSearchQuery.text"), Category.DATA_ARTIFACT),
/**
* EXIF metadata.
*/
TSK_METADATA_EXIF(16, "TSK_METADATA_EXIF", //NON-NLS
bundle.getString("BlackboardArtifact.tskMetadataExif.text")),
bundle.getString("BlackboardArtifact.tskMetadataExif.text"), Category.DATA_ARTIFACT),
/**
* A tag applied to a file.
*
......@@ -1133,7 +1133,7 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
*/
@Deprecated
TSK_TAG_FILE(17, "TSK_TAG_FILE", //NON-NLS
bundle.getString("BlackboardArtifact.tagFile.text")),
bundle.getString("BlackboardArtifact.tagFile.text"), Category.ANALYSIS_RESULT),
/**
* A tag applied to an artifact.
*
......@@ -1141,22 +1141,22 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
*/
@Deprecated
TSK_TAG_ARTIFACT(18, "TSK_TAG_ARTIFACT", //NON-NLS
bundle.getString("BlackboardArtifact.tskTagArtifact.text")),
bundle.getString("BlackboardArtifact.tskTagArtifact.text"), Category.ANALYSIS_RESULT),
/**
* Information pertaining to an operating system.
*/
TSK_OS_INFO(19, "TSK_OS_INFO", //NON-NLS
bundle.getString("BlackboardArtifact.tskOsInfo.text")),
bundle.getString("BlackboardArtifact.tskOsInfo.text"), Category.DATA_ARTIFACT),
/**
* An operating system user account.
*/
TSK_OS_ACCOUNT(20, "TSK_OS_ACCOUNT", //NON-NLS
bundle.getString("BlackboardArtifact.tskOsAccount.text")),
bundle.getString("BlackboardArtifact.tskOsAccount.text"), Category.DATA_ARTIFACT),
/**
* An application or Web service account.
*/
TSK_SERVICE_ACCOUNT(21, "TSK_SERVICE_ACCOUNT", //NON-NLS
bundle.getString("BlackboardArtifact.tskServiceAccount.text")),
bundle.getString("BlackboardArtifact.tskServiceAccount.text"), Category.DATA_ARTIFACT),
/**
* Output from an external tool or module (raw text).
*
......@@ -1164,7 +1164,7 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
*/
@Deprecated
TSK_TOOL_OUTPUT(22, "TSK_TOOL_OUTPUT", //NON-NLS
bundle.getString("BlackboardArtifact.tskToolOutput.text")),
bundle.getString("BlackboardArtifact.tskToolOutput.text"), Category.DATA_ARTIFACT),
/**
* A contact extracted from a phone, or from an address
* book/email/messaging application. Use methods in
......@@ -1172,7 +1172,7 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
* to create contact artifacts.
*/
TSK_CONTACT(23, "TSK_CONTACT", //NON-NLS
bundle.getString("BlackboardArtifact.tskContact.text")),
bundle.getString("BlackboardArtifact.tskContact.text"), Category.DATA_ARTIFACT),
/**
* An SMS/MMS message extracted from phone, or from another messaging
* application, like IM. Use methods in
......@@ -1180,7 +1180,7 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
* to create message artifacts.
*/
TSK_MESSAGE(24, "TSK_MESSAGE", //NON-NLS
bundle.getString("BlackboardArtifact.tskMessage.text")),
bundle.getString("BlackboardArtifact.tskMessage.text"), Category.DATA_ARTIFACT),
/**
* A phone call log extracted from a phone or softphone application. Use
* methods in
......@@ -1188,42 +1188,42 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
* to create call log artifacts.
*/
TSK_CALLLOG(25, "TSK_CALLLOG", //NON-NLS
bundle.getString("BlackboardArtifact.tskCalllog.text")),
bundle.getString("BlackboardArtifact.tskCalllog.text"), Category.DATA_ARTIFACT),
/**
* A calendar entry from a phone, PIM, or a calendar application.
*/
TSK_CALENDAR_ENTRY(26, "TSK_CALENDAR_ENTRY", //NON-NLS
bundle.getString("BlackboardArtifact.tskCalendarEntry.text")),
bundle.getString("BlackboardArtifact.tskCalendarEntry.text"), Category.DATA_ARTIFACT),
/**
* A speed dial entry from a phone.
*/
TSK_SPEED_DIAL_ENTRY(27, "TSK_SPEED_DIAL_ENTRY", //NON-NLS
bundle.getString("BlackboardArtifact.tskSpeedDialEntry.text")),
bundle.getString("BlackboardArtifact.tskSpeedDialEntry.text"), Category.DATA_ARTIFACT),
/**
* A bluetooth pairing entry.
*/
TSK_BLUETOOTH_PAIRING(28, "TSK_BLUETOOTH_PAIRING", //NON-NLS
bundle.getString("BlackboardArtifact.tskBluetoothPairing.text")),
bundle.getString("BlackboardArtifact.tskBluetoothPairing.text"), Category.DATA_ARTIFACT),
/**
* A GPS bookmark / way point that the user saved.
*/
TSK_GPS_BOOKMARK(29, "TSK_GPS_BOOKMARK", //NON-NLS
bundle.getString("BlackboardArtifact.tskGpsBookmark.text")),
bundle.getString("BlackboardArtifact.tskGpsBookmark.text"), Category.DATA_ARTIFACT),
/**
* A GPS last known location record.
*/
TSK_GPS_LAST_KNOWN_LOCATION(30, "TSK_GPS_LAST_KNOWN_LOCATION", //NON-NLS
bundle.getString("BlackboardArtifact.tskGpsLastKnownLocation.text")),
bundle.getString("BlackboardArtifact.tskGpsLastKnownLocation.text"), Category.DATA_ARTIFACT),
/**
* A GPS search record.
*/
TSK_GPS_SEARCH(31, "TSK_GPS_SEARCH", //NON-NLS
bundle.getString("BlackboardArtifact.tskGpsSearch.text")),
bundle.getString("BlackboardArtifact.tskGpsSearch.text"), Category.DATA_ARTIFACT),
/**
* Application run information.
*/
TSK_PROG_RUN(32, "TSK_PROG_RUN", //NON-NLS
bundle.getString("BlackboardArtifact.tskProgRun.text")),
bundle.getString("BlackboardArtifact.tskProgRun.text"), Category.DATA_ARTIFACT),
/**
* An encrypted file.
*/
......@@ -1246,12 +1246,12 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
* to create route artifacts.
*/
TSK_GPS_ROUTE(36, "TSK_GPS_ROUTE", //NON-NLS
bundle.getString("BlackboardArtifact.tskGpsRoute.text")),
bundle.getString("BlackboardArtifact.tskGpsRoute.text"), Category.DATA_ARTIFACT),
/**
* A remote drive.
*/
TSK_REMOTE_DRIVE(37, "TSK_REMOTE_DRIVE", //NON-NLS
bundle.getString("BlackboardArtifact.tskRemoteDrive.text")),
bundle.getString("BlackboardArtifact.tskRemoteDrive.text"), Category.DATA_ARTIFACT),
/**
* A human face was detected in a media file.
*/
......@@ -1261,7 +1261,7 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
* An account.
*/
TSK_ACCOUNT(39, "TSK_ACCOUNT", //NON-NLS
bundle.getString("BlackboardArtifact.tskAccount.text")),
bundle.getString("BlackboardArtifact.tskAccount.text"), Category.DATA_ARTIFACT),
/**
* An encrypted file.
*/
......@@ -1276,51 +1276,51 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
* A wireless network.
*/
TSK_WIFI_NETWORK(42, "TSK_WIFI_NETWORK", //NON-NLS
bundle.getString("BlackboardArtifact.tskWIFINetwork.text")),
bundle.getString("BlackboardArtifact.tskWIFINetwork.text"), Category.DATA_ARTIFACT),
/**
* Information related to a device.
*/
TSK_DEVICE_INFO(43, "TSK_DEVICE_INFO", //NON-NLS
bundle.getString("BlackboardArtifact.tskDeviceInfo.text")),
bundle.getString("BlackboardArtifact.tskDeviceInfo.text"), Category.DATA_ARTIFACT),
/**
* A SIM card.
*/
TSK_SIM_ATTACHED(44, "TSK_SIM_ATTACHED", //NON-NLS
bundle.getString("BlackboardArtifact.tskSimAttached.text")),
bundle.getString("BlackboardArtifact.tskSimAttached.text"), Category.DATA_ARTIFACT),
/**
* A bluetooth adapter.
*/
TSK_BLUETOOTH_ADAPTER(45, "TSK_BLUETOOTH_ADAPTER", //NON-NLS
bundle.getString("BlackboardArtifact.tskBluetoothAdapter.text")),
bundle.getString("BlackboardArtifact.tskBluetoothAdapter.text"), Category.DATA_ARTIFACT),
/**
* A wireless network adapter.
*/
TSK_WIFI_NETWORK_ADAPTER(46, "TSK_WIFI_NETWORK_ADAPTER", //NON-NLS
bundle.getString("BlackboardArtifact.tskWIFINetworkAdapter.text")),
bundle.getString("BlackboardArtifact.tskWIFINetworkAdapter.text"), Category.DATA_ARTIFACT),
/**
* Indicates a verification failure
*/
TSK_VERIFICATION_FAILED(47, "TSK_VERIFICATION_FAILED", //NON-NLS
bundle.getString("BlackboardArtifact.tskVerificationFailed.text")),
bundle.getString("BlackboardArtifact.tskVerificationFailed.text"), Category.ANALYSIS_RESULT),
/**
* Categorization information for a data source.
*/
TSK_DATA_SOURCE_USAGE(48, "TSK_DATA_SOURCE_USAGE", //NON-NLS
bundle.getString("BlackboardArtifact.tskDataSourceUsage.text")),
bundle.getString("BlackboardArtifact.tskDataSourceUsage.text"), Category.ANALYSIS_RESULT),
/**
* Indicates auto fill data from a Web form. Use methods in
* org.sleuthkit.datamodel.blackboardutils.WebBrowserArtifactsHelper to
* create web form autofill artifacts.
*/
TSK_WEB_FORM_AUTOFILL(49, "TSK_WEB_FORM_AUTOFILL", //NON-NLS
bundle.getString("BlackboardArtifact.tskWebFormAutofill.text")),
bundle.getString("BlackboardArtifact.tskWebFormAutofill.text"), Category.DATA_ARTIFACT),
/**
* Indicates an person's address filled in a web form. Use methods in
* org.sleuthkit.datamodel.blackboardutils.WebBrowserArtifactsHelper to
* create web form address artifacts.
*/
TSK_WEB_FORM_ADDRESS(50, "TSK_WEB_FORM_ADDRESSES ", //NON-NLS
bundle.getString("BlackboardArtifact.tskWebFormAddresses.text")),
bundle.getString("BlackboardArtifact.tskWebFormAddresses.text"), Category.DATA_ARTIFACT),
/**
* Indicates source of a file/object
*
......@@ -1329,87 +1329,87 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
*/
@Deprecated
TSK_DOWNLOAD_SOURCE(51, "TSK_DOWNLOAD_SOURCE", //NON-NLS
bundle.getString("BlackboardArtifact.tskDownloadSource.text")),
bundle.getString("BlackboardArtifact.tskDownloadSource.text"), Category.DATA_ARTIFACT),
/**
* Indicates web cache data
*/
TSK_WEB_CACHE(52, "TSK_WEB_CACHE", //NON-NLS
bundle.getString("BlackboardArtifact.tskWebCache.text")),
bundle.getString("BlackboardArtifact.tskWebCache.text"), Category.DATA_ARTIFACT),
/**
* A generic (timeline) event.
*/
TSK_TL_EVENT(53, "TSK_TL_EVENT", //NON-NLS
bundle.getString("BlackboardArtifact.tskTLEvent.text")),
bundle.getString("BlackboardArtifact.tskTLEvent.text"), Category.DATA_ARTIFACT),
/**
* Indicates clipboard content
*/
TSK_CLIPBOARD_CONTENT(54, "TSK_CLIPBOARD_CONTENT", //NON-NLS
bundle.getString("BlackboardArtifact.tskClipboardContent.text")),
bundle.getString("BlackboardArtifact.tskClipboardContent.text"), Category.DATA_ARTIFACT),
/**
* An associated object.
*/
TSK_ASSOCIATED_OBJECT(55, "TSK_ASSOCIATED_OBJECT", //NON-NLS
bundle.getString("BlackboardArtifact.tskAssociatedObject.text")),
bundle.getString("BlackboardArtifact.tskAssociatedObject.text"), Category.DATA_ARTIFACT),
/**
* Indicates file may have been created by the user.
*/
TSK_USER_CONTENT_SUSPECTED(56, "TSK_USER_CONTENT_SUSPECTED", //NON-NLS
bundle.getString("BlackboardArtifact.tskUserContentSuspected.text")),
bundle.getString("BlackboardArtifact.tskUserContentSuspected.text"), Category.ANALYSIS_RESULT),
/**
* Stores metadata about an object.
*/
TSK_METADATA(57, "TSK_METADATA", //NON-NLS
bundle.getString("BlackboardArtifact.tskMetadata.text")),
bundle.getString("BlackboardArtifact.tskMetadata.text"), Category.DATA_ARTIFACT),
/**
* Stores a GPS track log. Use
* org.sleuthkit.datamodel.blackboardutils.GeoArtifactsHelper.addTrack()
* to create track artifacts.
*/
TSK_GPS_TRACK(58, "TSK_GPS_TRACK",
bundle.getString("BlackboardArtifact.tskTrack.text")),
bundle.getString("BlackboardArtifact.tskTrack.text"), Category.DATA_ARTIFACT),
/**
* Stores a role on a given domain.
*/
TSK_WEB_ACCOUNT_TYPE(59, "TSK_WEB_ACCOUNT_TYPE",
bundle.getString("BlackboardArtifact.tskWebAccountType.text")),
bundle.getString("BlackboardArtifact.tskWebAccountType.text"), Category.ANALYSIS_RESULT),
/**
* Screen shots from device or Application.
*/
TSK_SCREEN_SHOTS(60, "TSK_SCREEN_SHOTS",
bundle.getString("BlackboardArtifact.tskScreenShots.text")),
bundle.getString("BlackboardArtifact.tskScreenShots.text"), Category.DATA_ARTIFACT),
/**
* Notifications Sent to User.
*/
TSK_PROG_NOTIFICATIONS(62, "TSK_PROG_NOTIFICATIONS",
bundle.getString("BlackboardArtifact.tskProgNotifications.text")),
bundle.getString("BlackboardArtifact.tskProgNotifications.text"), Category.DATA_ARTIFACT),
/**
* System/Application/File backup.
*/
TSK_BACKUP_EVENT(63, "TSK_BACKUP_EVENT",
bundle.getString("BlackboardArtifact.tskBackupEvent.text")),
bundle.getString("BlackboardArtifact.tskBackupEvent.text"), Category.DATA_ARTIFACT),
/**
* Programs that have been deleted.
*/
TSK_DELETED_PROG(64, "TSK_DELETED_PROG",
bundle.getString("BlackboardArtifact.tskDeletedProg.text")),
bundle.getString("BlackboardArtifact.tskDeletedProg.text"), Category.DATA_ARTIFACT),
/**
* Activity on the System/Application.
*/
TSK_USER_DEVICE_EVENT(65, "TSK_USER_DEVICE_EVENT",
bundle.getString("BlackboardArtifact.tskUserDeviceEvent.text")),
bundle.getString("BlackboardArtifact.tskUserDeviceEvent.text"), Category.DATA_ARTIFACT),
/**
* Indicates that the file had a yara pattern match hit.
*/
TSK_YARA_HIT(66, "TSK_YARA_HIT",
bundle.getString("BlackboardArtifact.tskYaraHit.text")),
bundle.getString("BlackboardArtifact.tskYaraHit.text"), Category.ANALYSIS_RESULT),
/**
* Stores the outline of an area using GPS coordinates.
*/
TSK_GPS_AREA(67, "TSK_GPS_AREA",
bundle.getString("BlackboardArtifact.tskGPSArea.text")),
bundle.getString("BlackboardArtifact.tskGPSArea.text"), Category.DATA_ARTIFACT),
TSK_WEB_CATEGORIZATION(68, "TSK_WEB_CATEGORIZATION",
bundle.getString("BlackboardArtifact.tskWebCategorization.text")),
bundle.getString("BlackboardArtifact.tskWebCategorization.text"), Category.ANALYSIS_RESULT),
;
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment