codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-09-29 05:49:50 +00:00
Code Issues Releases Wiki Activity

Merge branch '4629-DetectOsxFiles' into 4630-DetectLinuxOsFiles

Browse Source
This commit is contained in:
William Schaefer
2019-01-16 12:20:02 -05:00
parent 3956fb1c1f 99053a0028
commit 72fede76ea
1 changed files with 25 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
RecentActivity/src/org/sleuthkit/autopsy/recentactivity/DataSourceUsageAnalyzer.java
+25 -12
View File
@@ -139,20 +139,33 @@ public class DataSourceUsageAnalyzer extends Extract {
//if any files existed matching the specified file
if (!files.isEmpty()) {
if (!dataSourceUsageDescription.isEmpty()) {
//if the data source usage description is not empty create a data source usage artifact
Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION,
Bundle.DataSourceUsageAnalyzer_parentModuleName(),
dataSourceUsageDescription)); //NON-NLS
addArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_USAGE, dataSource, bbattributes);
//if the data source usage description is not empty create a data source usage artifact if an Usage artifact does not already exist with the same description
List<BlackboardArtifact> artifacts = tskCase.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_USAGE, dataSource.getId());
boolean createNewUsageArtifact = true;
for (BlackboardArtifact artifact : artifacts) {
if (artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION)).getValueString().equals(dataSourceUsageDescription)) {
createNewUsageArtifact = false;
break;
}
}
if (createNewUsageArtifact) {
Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DESCRIPTION,
Bundle.DataSourceUsageAnalyzer_parentModuleName(),
dataSourceUsageDescription)); //NON-NLS
addArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_USAGE, dataSource, bbattributes);
}
}
if (!osInfoProgramName.isEmpty()) {
//if the os info program name is not empty create an os info artifacts
Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME,
Bundle.DataSourceUsageAnalyzer_parentModuleName(),
osInfoProgramName)); //NON-NLS
addArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO, dataSource, bbattributes);
//check if OS INFO artifact already created on this file
if (tskCase.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO, files.get(0).getId()).isEmpty()) {
//if the os info program name is not empty create an os info artifact on the first of the files found
Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PROG_NAME,
Bundle.DataSourceUsageAnalyzer_parentModuleName(),
osInfoProgramName)); //NON-NLS
addArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_OS_INFO, files.get(0), bbattributes);
}
}
}
}