From ca0919215d129ded6d9c8b17124e7708b422185c Mon Sep 17 00:00:00 2001
From: apriestman <apriestman@basistech.com>
Date: Tue, 21 Dec 2021 15:13:58 -0500
Subject: [PATCH] Allow accounts artifacts to be created with passed in
attributes
---
.../datamodel/CommunicationsManager.java | 22 ++++++++++++-------
.../CommunicationArtifactsHelper.java | 4 ++--
.../WebBrowserArtifactsHelper.java | 4 ++--
3 files changed, 18 insertions(+), 12 deletions(-)
diff --git a/bindings/java/src/org/sleuthkit/datamodel/CommunicationsManager.java b/bindings/java/src/org/sleuthkit/datamodel/CommunicationsManager.java
index 0a6cf3646..b1b525b04 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/CommunicationsManager.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/CommunicationsManager.java
@@ -248,6 +248,7 @@ public org.sleuthkit.datamodel.Account.Type addAccountType(String accountTypeNam
* address).
* @param moduleName The module creating the account.
* @param sourceFile The source file the account was found in.
+ * @param attributes List of blackboard attributes to add to the data artifact.
* @param ingestJobId The ingest job in which the analysis that found
* the account was performed, may be null.
*
@@ -259,7 +260,8 @@ public org.sleuthkit.datamodel.Account.Type addAccountType(String accountTypeNam
* ID is not valid for the account type.
*/
// NOTE: Full name given for Type for doxygen linking
- public AccountFileInstance createAccountFileInstance(org.sleuthkit.datamodel.Account.Type accountType, String accountUniqueID, String moduleName, Content sourceFile, Long ingestJobId) throws TskCoreException, InvalidAccountIDException {
+ public AccountFileInstance createAccountFileInstance(org.sleuthkit.datamodel.Account.Type accountType, String accountUniqueID,
+ String moduleName, Content sourceFile, List<BlackboardAttribute> attributes, Long ingestJobId) throws TskCoreException, InvalidAccountIDException {
// make or get the Account (unique at the case-level)
Account account = getOrCreateAccount(accountType, normalizeAccountID(accountType, accountUniqueID));
@@ -270,7 +272,7 @@ public AccountFileInstance createAccountFileInstance(org.sleuthkit.datamodel.Acc
* address multiple times. Only one artifact is created for each email
* message in that PST.
*/
- BlackboardArtifact accountArtifact = getOrCreateAccountFileInstanceArtifact(accountType, normalizeAccountID(accountType, accountUniqueID), moduleName, sourceFile, ingestJobId);
+ BlackboardArtifact accountArtifact = getOrCreateAccountFileInstanceArtifact(accountType, normalizeAccountID(accountType, accountUniqueID), moduleName, sourceFile, attributes, ingestJobId);
// The account instance map was unused so we have removed it from the database,
// but we expect we may need it so I am preserving this method comment and usage here.
@@ -307,7 +309,7 @@ public AccountFileInstance createAccountFileInstance(org.sleuthkit.datamodel.Acc
@Deprecated
// NOTE: Full name given for Type for doxygen linking
public AccountFileInstance createAccountFileInstance(org.sleuthkit.datamodel.Account.Type accountType, String accountUniqueID, String moduleName, Content sourceFile) throws TskCoreException, InvalidAccountIDException {
- return createAccountFileInstance(accountType, accountUniqueID, moduleName, sourceFile, null);
+ return createAccountFileInstance(accountType, accountUniqueID, moduleName, sourceFile, null, null);
}
/**
@@ -514,6 +516,7 @@ private Account getOrCreateAccount(Account.Type accountType, String accountUniqu
* @param moduleName The name of the module that found the account
* instance.
* @param sourceFile The file in which the account instance was found.
+ * @param originalAttrs List of blackboard attributes to add to the data artifact.
* @param ingestJobId The ingest job in which the analysis that found
* the account was performed, may be null.
*
@@ -522,17 +525,20 @@ private Account getOrCreateAccount(Account.Type accountType, String accountUniqu
* @throws TskCoreException If there is an error querying or updating the
* case database.
*/
- private BlackboardArtifact getOrCreateAccountFileInstanceArtifact(Account.Type accountType, String accountUniqueID, String moduleName, Content sourceFile, Long ingestJobId) throws TskCoreException {
+ private BlackboardArtifact getOrCreateAccountFileInstanceArtifact(Account.Type accountType, String accountUniqueID, String moduleName,
+ Content sourceFile, List<BlackboardAttribute> originalAttrs, Long ingestJobId) throws TskCoreException {
if (sourceFile == null) {
throw new TskCoreException("Source file not provided.");
}
BlackboardArtifact accountArtifact = getAccountFileInstanceArtifact(accountType, accountUniqueID, sourceFile);
if (accountArtifact == null) {
- List<BlackboardAttribute> attributes = Arrays.asList(
- new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE, moduleName, accountType.getTypeName()),
- new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ID, moduleName, accountUniqueID)
- );
+ List<BlackboardAttribute> attributes = new ArrayList<>();
+ attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE, moduleName, accountType.getTypeName()));
+ attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ID, moduleName, accountUniqueID));
+ if (originalAttrs != null) {
+ attributes.addAll(originalAttrs);
+ }
accountArtifact = sourceFile.newDataArtifact(ACCOUNT_TYPE, attributes);
diff --git a/bindings/java/src/org/sleuthkit/datamodel/blackboardutils/CommunicationArtifactsHelper.java b/bindings/java/src/org/sleuthkit/datamodel/blackboardutils/CommunicationArtifactsHelper.java
index 362fdb323..b73728217 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/blackboardutils/CommunicationArtifactsHelper.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/blackboardutils/CommunicationArtifactsHelper.java
@@ -418,7 +418,7 @@ private void createContactMethodAccountAndRelationship(Account.Type accountType,
*/
private AccountFileInstance createAccountInstance(Account.Type accountType, String accountUniqueID) throws TskCoreException, InvalidAccountIDException {
Optional<Long> ingestJobId = getIngestJobId();
- return getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(accountType, accountUniqueID, getModuleName(), getContent(), ingestJobId.orElse(null));
+ return getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(accountType, accountUniqueID, getModuleName(), getContent(), null, ingestJobId.orElse(null));
}
/**
@@ -1046,7 +1046,7 @@ private void addMessageReadStatusIfKnown(MessageReadStatus readStatus, Collectio
private synchronized AccountFileInstance getSelfAccountInstance() throws TskCoreException, InvalidAccountIDException {
if (selfAccountInstance == null) {
Optional<Long> ingestJobId = getIngestJobId();
- selfAccountInstance = getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(selfAccountType, selfAccountId, this.getModuleName(), getContent(), ingestJobId.orElse(null));
+ selfAccountInstance = getSleuthkitCase().getCommunicationsManager().createAccountFileInstance(selfAccountType, selfAccountId, this.getModuleName(), getContent(), null, ingestJobId.orElse(null));
}
return selfAccountInstance;
}
diff --git a/bindings/java/src/org/sleuthkit/datamodel/blackboardutils/WebBrowserArtifactsHelper.java b/bindings/java/src/org/sleuthkit/datamodel/blackboardutils/WebBrowserArtifactsHelper.java
index 3086aeb41..704f11918 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/blackboardutils/WebBrowserArtifactsHelper.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/blackboardutils/WebBrowserArtifactsHelper.java
@@ -328,7 +328,7 @@ public BlackboardArtifact addWebFormAddress(String personName, String email,
Optional<Long> ingestJobId = getIngestJobId();
if (StringUtils.isNotEmpty(email)) {
try {
- commManager.createAccountFileInstance(Account.Type.EMAIL, email, this.getModuleName(), this.getContent(), ingestJobId.orElse(null));
+ commManager.createAccountFileInstance(Account.Type.EMAIL, email, this.getModuleName(), this.getContent(), null, ingestJobId.orElse(null));
} catch (InvalidAccountIDException ex) {
LOGGER.log(Level.WARNING, String.format("Invalid account identifier %s", email), ex);
}
@@ -336,7 +336,7 @@ public BlackboardArtifact addWebFormAddress(String personName, String email,
if (StringUtils.isNotEmpty(phoneNumber)) {
try {
- commManager.createAccountFileInstance(Account.Type.PHONE, phoneNumber, this.getModuleName(), this.getContent(), ingestJobId.orElse(null));
+ commManager.createAccountFileInstance(Account.Type.PHONE, phoneNumber, this.getModuleName(), this.getContent(), null, ingestJobId.orElse(null));
} catch (InvalidAccountIDException ex) {
LOGGER.log(Level.WARNING, String.format("Invalid account identifier %s", phoneNumber), ex);
}
--
GitLab