diff --git a/bindings/java/doxygen/artifact_catalog.dox b/bindings/java/doxygen/artifact_catalog.dox
index 53ad511e8febc358dcec6ee5430605f0f92b02cc..c333ca6319ce027120ca92539c56fa93a01c3398 100644
--- a/bindings/java/doxygen/artifact_catalog.dox
+++ b/bindings/java/doxygen/artifact_catalog.dox
@@ -35,7 +35,6 @@ TSK_CARD_NUMBER (Credit card number)
---
-
## TSK_ASSOCIATED_OBJECT
Provides a backwards link to an artifact that references the parent file of this artifact. Example usage is that a downloaded file will have this artifact and it will point back to the TSK_WEB_DOWNLOAD artifact that is associated with a browser's SQLite database. See \ref jni_bb_associated_object.
@@ -43,6 +42,20 @@ Provides a backwards link to an artifact that references the parent file of this
- TSK_ASSOCIATED_ARTIFACT (Artifact ID of associated artifact)
+---
+## TSK_BACKUP_EVENT
+Details about System/aplication/file backups.
+
+### REQUIRED ATTRIBUTES
+- TSK_DATETIME_START (Date/Time the backup happened)
+ or
+ TSK_DATETIME
+
+### OPTIONAL ATTRIBUTES
+- TSK_DATETIME_ENDED (Date/Time the backup ended)
+
+
+
---
## TSK_BLUETOOTH_ADAPTER
Details about a Bluetooth adapter.
@@ -136,6 +149,20 @@ Describes how a data source was used, e.g., as a SIM card or an OS drive (such a
- TSK_DESCRIPTION (Description of the usage, e.g., "OS Drive (Windows Vista)").
+---
+## TSK_DELETED_PROG
+Programs that have been deleted from the system.
+
+### REQUIRED ATTRIBUTES
+- TSK_DATETIME_DELETED (Date/Time the program was deleted)
+ or
+ TSK_DATETIME
+- TSK_PROG_NAME (Program that was deleted)
+
+### OPTIONAL Attributes
+- TSK_PATH (Location where the program resided before being deleted)
+
+
---
## TSK_DEVICE_ATTACHED
@@ -163,7 +190,6 @@ Details about a device data source.
- TSK_IMSI (IMSI number of the device)
-
---
## TSK_EMAIL_MSG
An email message found in an application file or database.
@@ -376,6 +402,15 @@ Indication that the source file matches some set of criteria (possibly user defi
+---
+## TSK_IP_DHCP
+DHCP information that is stored.
+
+### REQUIRED ATTRIBUTES
+- TSK_NAME (Description of Information)
+- TSK_VALUE (Value of Information)
+
+
---
## TSK_KEYWORD_HIT
Indication that the source artifact or file contains a keyword. Keywords are grouped into named sets.
@@ -508,6 +543,20 @@ Details about an operating system recovered from the data source.
+---
+## TSK_PROG_NOTIFICATION
+Notifications to the user.
+
+### REQUIRED ATTRIBUTES
+- TSK_DATETIME (When the notification was sent/received)
+- TSK_PROG_NAME (Program to send/receive notification)
+
+### OPTIONAL ATTRIBUTES
+- TSK_TITLE (Title of the notification)
+- TSK_VALUE (Message being sent or received)
+
+
+
---
## TSK_PROG_RUN
The number of times a program/application was run.
@@ -556,6 +605,18 @@ Details about a remote drive found in the data source.
+---
+## TSK_SCREEN_SHOTS
+Screenshots from a device or application.
+
+### REQUIRED ATTRIBUTES
+- TSK_DATETIME (When the screenshot was taken)
+- TSK_PROG_NAME (Program that took the screenshot)
+
+### OPTIONAL ATTRIBUTES
+- TSK_PATH (Location of screenshot)
+
+
---
## TSK_SERVICE_ACCOUNT
An application or web user account.
@@ -623,6 +684,23 @@ An indication that some media file content was generated by the user.
- TSK_COMMENT (The reason why user-generated content is suspected)
+---
+
+## TSK_USER_DEVICE_EVENT
+Activity on the system or from an application. Example usage is a mobile device being locked and unlocked.
+.
+
+### REQUIRED ATTRIBUTES
+- TSK_DATETIME_START (When activity started)
+ or
+ TSK_DATETIME
+
+### OPTIONAL ATTRIBUTES
+- TSK_ACTIVITY_TYPE (Activity type i.e.: On or Off)
+- TSK_DATETIME_END (When activity ended)
+- TSK_PROG_NAME (Name of the program doing the activity)
+- TSK_VALUE (Connection type)
+
---
## TSK_VERIFICATION_FAILED
@@ -797,5 +875,14 @@ Details about a WiFi adapter.
+---
+## TSK_YARA_HIT
+Indicates that the some content of the file was a hit for a YARA rule match.
+
+### REQUIRED ATTRIBUTES
+- TSK_RULE (The rule that was a hit for this file)
+- TSK_SET_NAME (Name of the rule set containing the matching rule YARA rule)
+
+
*/
diff --git a/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java b/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java
index 41d96b3f3e49e6d845822ba93db2dea143c7154b..74fed7fbadd37a90219d93f0ece95dd747b7e204 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/BlackboardArtifact.java
@@ -1260,13 +1260,43 @@ public enum ARTIFACT_TYPE implements SleuthkitVisitableItem {
* Stores a role on a given domain.
*/
TSK_WEB_ACCOUNT_TYPE(59, "TSK_WEB_ACCOUNT_TYPE",
- bundle.getString("BlackboardArtifact.tskWebAccountType.text")),
-
+ bundle.getString("BlackboardArtifact.tskWebAccountType.text")),
+ /**
+ * Screen shots from device or Application.
+ */
+ TSK_SCREEN_SHOTS(60, "TSK_SCREEN_SHOTS",
+ bundle.getString("BlackboardArtifact.tskScreenShots.text")),
+ /**
+ * DHCP Information that is store for a device.
+ */
+ TSK_IP_DHCP(61, "TSK_IP_DHCP",
+ bundle.getString("BlackboardArtifact.tskDhcpInfo.text")),
+ /**
+ * Notifications Sent to User.
+ */
+ TSK_PROG_NOTIFICATIONS(62, "TSK_PROG_NOTIFICATIONS",
+ bundle.getString("BlackboardArtifact.tskProgNotifications.text")),
+ /**
+ * System/Application/File backup.
+ */
+ TSK_BACKUP_EVENT (63, "TSK_BACKUP_EVENT",
+ bundle.getString("BlackboardArtifact.tskBackupEvent.text")),
+ /**
+ * Programs that have been deleted.
+ */
+ TSK_DELETED_PROG(64, "TSK_DELETED_PROG",
+ bundle.getString("BlackboardArtifact.tskDeletedProg.text")),
+ /**
+ * Activity on the System/Application.
+ */
+ TSK_USER_DEVICE_EVENT(65, "TSK_USER_DEVICE_EVENT",
+ bundle.getString("BlackboardArtifact.tskUserDeviceEvent.text")),
/**
* Indicates that the file had a yara pattern match hit.
*/
- TSK_YARA_HIT(60, "TSK_YARA_HIT",
- bundle.getString("BlackboardArtifact.tskWebAccountType.text"));
+ TSK_YARA_HIT(66, "TSK_YARA_HIT",
+ bundle.getString("BlackboardArtifact.tskWebAccountType.text"));
+
/* To developers: For each new artifact, ensure that:
* - The enum value has 1-line JavaDoc description
* - The artifact catalog (artifact_catalog.dox) is updated to reflect the attributes it uses
diff --git a/bindings/java/src/org/sleuthkit/datamodel/BlackboardAttribute.java b/bindings/java/src/org/sleuthkit/datamodel/BlackboardAttribute.java
index 2ddd7d231f0a02758471a94f7cf3a9039eeb081f..def82e1a892799f40926ae9a87a11c6b9a5b54cd 100755
--- a/bindings/java/src/org/sleuthkit/datamodel/BlackboardAttribute.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/BlackboardAttribute.java
@@ -1421,6 +1421,10 @@ public enum ATTRIBUTE_TYPE {
bundle.getString("BlackboardAttribute.tskrule.text"),
TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING),
+ TSK_ACTIVITY_TYPE(151, "TSK_ACTIVITY_TYPE",
+ bundle.getString("BlackboardAttribute.tskActivityType.text"),
+ TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING)
+
;
private final int typeID;
diff --git a/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties b/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties
index 8c3f488f38143ab0d2cbf4fa8957749c25d8db13..c7efb626b67f72c4b77aabecb54d12c5e84b14be 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties
+++ b/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties
@@ -55,6 +55,12 @@ BlackboardArtifact.tskUserContentSuspected.text=User Content Suspected
BlackboardArtifact.tskMetadata.text=Metadata
BlackboardArtifact.tskTrack.text=GPS Track
BlackboardArtifact.tskWebAccountType.text=Web Account Type
+BlackboardArtifact.tskScreenShots.text=Screenshots
+BlackboardArtifact.tskDhcpInfo.text=DHCP Information
+BlackboardArtifact.tskProgNotifications.text=Program Notifications
+BlackboardArtifact.tskBackupEvent.text=Backup Events
+BlackboardArtifact.tskDeletedProg.text=Deleted Programs
+BlackboardArtifact.tskUserDeviceEvent.text=User Device Events
BlackboardArtifact.shortDescriptionDate.text=at {0}
BlackboardArtifact.tskAssociatedObject.text=Associated Object
BlackboardAttribute.tskAccountType.text=Account Type
@@ -201,6 +207,7 @@ BlackboardAttribute.tskbytessent.text=Bytes Sent
BlackboardAttribute.tskbytesreceived.text=Bytes Received
BlackboardAttribute.tsklastprinteddatetime.text=Last Printed Date
BlackboardAttribute.tskrule.text = Rule
+BlackboardAttribute.tskActivityType.text=Activity Type
AbstractFile.readLocal.exception.msg4.text=Error reading local file\: {0}
AbstractFile.readLocal.exception.msg1.text=Error reading local file, local path is not set
AbstractFile.readLocal.exception.msg2.text=Error reading local file, it does not exist at local path\: {0}
diff --git a/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties-MERGED b/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties-MERGED
index 8c3f488f38143ab0d2cbf4fa8957749c25d8db13..c7efb626b67f72c4b77aabecb54d12c5e84b14be 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties-MERGED
+++ b/bindings/java/src/org/sleuthkit/datamodel/Bundle.properties-MERGED
@@ -55,6 +55,12 @@ BlackboardArtifact.tskUserContentSuspected.text=User Content Suspected
BlackboardArtifact.tskMetadata.text=Metadata
BlackboardArtifact.tskTrack.text=GPS Track
BlackboardArtifact.tskWebAccountType.text=Web Account Type
+BlackboardArtifact.tskScreenShots.text=Screenshots
+BlackboardArtifact.tskDhcpInfo.text=DHCP Information
+BlackboardArtifact.tskProgNotifications.text=Program Notifications
+BlackboardArtifact.tskBackupEvent.text=Backup Events
+BlackboardArtifact.tskDeletedProg.text=Deleted Programs
+BlackboardArtifact.tskUserDeviceEvent.text=User Device Events
BlackboardArtifact.shortDescriptionDate.text=at {0}
BlackboardArtifact.tskAssociatedObject.text=Associated Object
BlackboardAttribute.tskAccountType.text=Account Type
@@ -201,6 +207,7 @@ BlackboardAttribute.tskbytessent.text=Bytes Sent
BlackboardAttribute.tskbytesreceived.text=Bytes Received
BlackboardAttribute.tsklastprinteddatetime.text=Last Printed Date
BlackboardAttribute.tskrule.text = Rule
+BlackboardAttribute.tskActivityType.text=Activity Type
AbstractFile.readLocal.exception.msg4.text=Error reading local file\: {0}
AbstractFile.readLocal.exception.msg1.text=Error reading local file, local path is not set
AbstractFile.readLocal.exception.msg2.text=Error reading local file, it does not exist at local path\: {0}
diff --git a/bindings/java/src/org/sleuthkit/datamodel/blackboardutils/attributes/GeoTrackPoints.java b/bindings/java/src/org/sleuthkit/datamodel/blackboardutils/attributes/GeoTrackPoints.java
index fb61d5a53bd4234cf2d023a3e1a51fd0d20b807c..0fbf3db96d28238886b6e5281ec97d9b62eb652e 100755
--- a/bindings/java/src/org/sleuthkit/datamodel/blackboardutils/attributes/GeoTrackPoints.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/blackboardutils/attributes/GeoTrackPoints.java
@@ -219,8 +219,12 @@ public Long getTimeStamp() {
public int compareTo(TrackPoint otherTP) {
Long otherTimeStamp = otherTP.getTimeStamp();
- if (timestamp == null && otherTimeStamp != null) {
- return -1;
+ if (timestamp == null) {
+ if (otherTimeStamp != null) {
+ return -1;
+ } else {
+ return 0;
+ }
} else if (timestamp != null && otherTimeStamp == null) {
return 1;
} else {