Skip to content
Snippets Groups Projects
Commit ca091921 authored by apriestman's avatar apriestman
Browse files

Allow accounts artifacts to be created with passed in attributes

parent a4095138
No related branches found
No related tags found
No related merge requests found
...@@ -248,6 +248,7 @@ public org.sleuthkit.datamodel.Account.Type addAccountType(String accountTypeNam ...@@ -248,6 +248,7 @@ public org.sleuthkit.datamodel.Account.Type addAccountType(String accountTypeNam
* address). * address).
* @param moduleName The module creating the account. * @param moduleName The module creating the account.
* @param sourceFile The source file the account was found in. * @param sourceFile The source file the account was found in.
* @param attributes List of blackboard attributes to add to the data artifact.
* @param ingestJobId The ingest job in which the analysis that found * @param ingestJobId The ingest job in which the analysis that found
* the account was performed, may be null. * the account was performed, may be null.
* *
...@@ -259,7 +260,8 @@ public org.sleuthkit.datamodel.Account.Type addAccountType(String accountTypeNam ...@@ -259,7 +260,8 @@ public org.sleuthkit.datamodel.Account.Type addAccountType(String accountTypeNam
* ID is not valid for the account type. * ID is not valid for the account type.
*/ */
// NOTE: Full name given for Type for doxygen linking // NOTE: Full name given for Type for doxygen linking
public AccountFileInstance createAccountFileInstance(org.sleuthkit.datamodel.Account.Type accountType, String accountUniqueID, String moduleName, Content sourceFile, Long ingestJobId) throws TskCoreException, InvalidAccountIDException { public AccountFileInstance createAccountFileInstance(org.sleuthkit.datamodel.Account.Type accountType, String accountUniqueID,
String moduleName, Content sourceFile, List<BlackboardAttribute> attributes, Long ingestJobId) throws TskCoreException, InvalidAccountIDException {
// make or get the Account (unique at the case-level) // make or get the Account (unique at the case-level)
Account account = getOrCreateAccount(accountType, normalizeAccountID(accountType, accountUniqueID)); Account account = getOrCreateAccount(accountType, normalizeAccountID(accountType, accountUniqueID));
...@@ -270,7 +272,7 @@ public AccountFileInstance createAccountFileInstance(org.sleuthkit.datamodel.Acc ...@@ -270,7 +272,7 @@ public AccountFileInstance createAccountFileInstance(org.sleuthkit.datamodel.Acc
* address multiple times. Only one artifact is created for each email * address multiple times. Only one artifact is created for each email
* message in that PST. * message in that PST.
*/ */
BlackboardArtifact accountArtifact = getOrCreateAccountFileInstanceArtifact(accountType, normalizeAccountID(accountType, accountUniqueID), moduleName, sourceFile, ingestJobId); BlackboardArtifact accountArtifact = getOrCreateAccountFileInstanceArtifact(accountType, normalizeAccountID(accountType, accountUniqueID), moduleName, sourceFile, attributes, ingestJobId);
// The account instance map was unused so we have removed it from the database, // The account instance map was unused so we have removed it from the database,
// but we expect we may need it so I am preserving this method comment and usage here. // but we expect we may need it so I am preserving this method comment and usage here.
...@@ -307,7 +309,7 @@ public AccountFileInstance createAccountFileInstance(org.sleuthkit.datamodel.Acc ...@@ -307,7 +309,7 @@ public AccountFileInstance createAccountFileInstance(org.sleuthkit.datamodel.Acc
@Deprecated @Deprecated
// NOTE: Full name given for Type for doxygen linking // NOTE: Full name given for Type for doxygen linking
public AccountFileInstance createAccountFileInstance(org.sleuthkit.datamodel.Account.Type accountType, String accountUniqueID, String moduleName, Content sourceFile) throws TskCoreException, InvalidAccountIDException { public AccountFileInstance createAccountFileInstance(org.sleuthkit.datamodel.Account.Type accountType, String accountUniqueID, String moduleName, Content sourceFile) throws TskCoreException, InvalidAccountIDException {
return createAccountFileInstance(accountType, accountUniqueID, moduleName, sourceFile, null); return createAccountFileInstance(accountType, accountUniqueID, moduleName, sourceFile, null, null);
} }
/** /**
...@@ -514,6 +516,7 @@ private Account getOrCreateAccount(Account.Type accountType, String accountUniqu ...@@ -514,6 +516,7 @@ private Account getOrCreateAccount(Account.Type accountType, String accountUniqu
* @param moduleName The name of the module that found the account * @param moduleName The name of the module that found the account
* instance. * instance.
* @param sourceFile The file in which the account instance was found. * @param sourceFile The file in which the account instance was found.
* @param originalAttrs List of blackboard attributes to add to the data artifact.
* @param ingestJobId The ingest job in which the analysis that found * @param ingestJobId The ingest job in which the analysis that found
* the account was performed, may be null. * the account was performed, may be null.
* *
...@@ -522,17 +525,20 @@ private Account getOrCreateAccount(Account.Type accountType, String accountUniqu ...@@ -522,17 +525,20 @@ private Account getOrCreateAccount(Account.Type accountType, String accountUniqu
* @throws TskCoreException If there is an error querying or updating the * @throws TskCoreException If there is an error querying or updating the
* case database. * case database.
*/ */
private BlackboardArtifact getOrCreateAccountFileInstanceArtifact(Account.Type accountType, String accountUniqueID, String moduleName, Content sourceFile, Long ingestJobId) throws TskCoreException { private BlackboardArtifact getOrCreateAccountFileInstanceArtifact(Account.Type accountType, String accountUniqueID, String moduleName,
Content sourceFile, List<BlackboardAttribute> originalAttrs, Long ingestJobId) throws TskCoreException {
if (sourceFile == null) { if (sourceFile == null) {
throw new TskCoreException("Source file not provided."); throw new TskCoreException("Source file not provided.");
} }
BlackboardArtifact accountArtifact = getAccountFileInstanceArtifact(accountType, accountUniqueID, sourceFile); BlackboardArtifact accountArtifact = getAccountFileInstanceArtifact(accountType, accountUniqueID, sourceFile);
if (accountArtifact == null) { if (accountArtifact == null) {
List<BlackboardAttribute> attributes = Arrays.asList( List<BlackboardAttribute> attributes = new ArrayList<>();
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE, moduleName, accountType.getTypeName()), attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE, moduleName, accountType.getTypeName()));
new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ID, moduleName, accountUniqueID) attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ID, moduleName, accountUniqueID));
); if (originalAttrs != null) {
attributes.addAll(originalAttrs);
}
accountArtifact = sourceFile.newDataArtifact(ACCOUNT_TYPE, attributes); accountArtifact = sourceFile.newDataArtifact(ACCOUNT_TYPE, attributes);
......
...@@ -418,7 +418,7 @@ private void createContactMethodAccountAndRelationship(Account.Type accountType, ...@@ -418,7 +418,7 @@ private void createContactMethodAccountAndRelationship(Account.Type accountType,
*/ */
private AccountFileInstance createAccountInstance(Account.Type accountType, String accountUniqueID) throws TskCoreException, InvalidAccountIDException { private AccountFileInstance createAccountInstance(Account.Type accountType, String accountUniqueID) throws TskCoreException, InvalidAccountIDException {
Optional<Long> ingestJobId = getIngestJobId(); Optional<Long> ingestJobId = getIngestJobId();
return getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(accountType, accountUniqueID, getModuleName(), getContent(), ingestJobId.orElse(null)); return getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(accountType, accountUniqueID, getModuleName(), getContent(), null, ingestJobId.orElse(null));
} }
/** /**
...@@ -1046,7 +1046,7 @@ private void addMessageReadStatusIfKnown(MessageReadStatus readStatus, Collectio ...@@ -1046,7 +1046,7 @@ private void addMessageReadStatusIfKnown(MessageReadStatus readStatus, Collectio
private synchronized AccountFileInstance getSelfAccountInstance() throws TskCoreException, InvalidAccountIDException { private synchronized AccountFileInstance getSelfAccountInstance() throws TskCoreException, InvalidAccountIDException {
if (selfAccountInstance == null) { if (selfAccountInstance == null) {
Optional<Long> ingestJobId = getIngestJobId(); Optional<Long> ingestJobId = getIngestJobId();
selfAccountInstance = getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(selfAccountType, selfAccountId, this.getModuleName(), getContent(), ingestJobId.orElse(null)); selfAccountInstance = getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(selfAccountType, selfAccountId, this.getModuleName(), getContent(), null, ingestJobId.orElse(null));
} }
return selfAccountInstance; return selfAccountInstance;
} }
......
...@@ -328,7 +328,7 @@ public BlackboardArtifact addWebFormAddress(String personName, String email, ...@@ -328,7 +328,7 @@ public BlackboardArtifact addWebFormAddress(String personName, String email,
Optional<Long> ingestJobId = getIngestJobId(); Optional<Long> ingestJobId = getIngestJobId();
if (StringUtils.isNotEmpty(email)) { if (StringUtils.isNotEmpty(email)) {
try { try {
commManager.createAccountFileInstance(Account.Type.EMAIL, email, this.getModuleName(), this.getContent(), ingestJobId.orElse(null)); commManager.createAccountFileInstance(Account.Type.EMAIL, email, this.getModuleName(), this.getContent(), null, ingestJobId.orElse(null));
} catch (InvalidAccountIDException ex) { } catch (InvalidAccountIDException ex) {
LOGGER.log(Level.WARNING, String.format("Invalid account identifier %s", email), ex); LOGGER.log(Level.WARNING, String.format("Invalid account identifier %s", email), ex);
} }
...@@ -336,7 +336,7 @@ public BlackboardArtifact addWebFormAddress(String personName, String email, ...@@ -336,7 +336,7 @@ public BlackboardArtifact addWebFormAddress(String personName, String email,
if (StringUtils.isNotEmpty(phoneNumber)) { if (StringUtils.isNotEmpty(phoneNumber)) {
try { try {
commManager.createAccountFileInstance(Account.Type.PHONE, phoneNumber, this.getModuleName(), this.getContent(), ingestJobId.orElse(null)); commManager.createAccountFileInstance(Account.Type.PHONE, phoneNumber, this.getModuleName(), this.getContent(), null, ingestJobId.orElse(null));
} catch (InvalidAccountIDException ex) { } catch (InvalidAccountIDException ex) {
LOGGER.log(Level.WARNING, String.format("Invalid account identifier %s", phoneNumber), ex); LOGGER.log(Level.WARNING, String.format("Invalid account identifier %s", phoneNumber), ex);
} }
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment