codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-10-02 23:39:50 +00:00
Code Issues Releases Wiki Activity

4590 change data source profile artifact/attribute relationship to 1 to 1

Browse Source
This commit is contained in:
William Schaefer
2019-01-08 13:41:03 -05:00
parent cde86ea894
commit 7c9d4e1596
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
RecentActivity/src/org/sleuthkit/autopsy/recentactivity/DataSourceProfiler.java
+9 -9
View File
@@ -40,35 +40,35 @@ public class DataSourceProfiler extends Extract {
@Override
void process(Content dataSource, IngestJobContext context) {
Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
this.dataSource = dataSource;
try {
checkForWindowsVolume(bbattributes);
checkForWindowsVolume();
} catch (TskCoreException ex) {
logger.log(Level.WARNING, "Failed to check if datasource contained Windows volume.", ex);
}
//create an artifact if any attributes were added
if (!bbattributes.isEmpty()) {
addArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_PROFILE, dataSource, bbattributes);
}
}
/**
* Check if the data source contains files which would indicate a windows
* volume is present in it.
*
* @param bbattributes the list of blackboard attributes to add to if a windows volume is present
* @param bbattributes the list of blackboard attributes to add to if a
* windows volume is present
*
* @throws TskCoreException
*/
private void checkForWindowsVolume(Collection<BlackboardAttribute> bbattributes) throws TskCoreException {
private void checkForWindowsVolume() throws TskCoreException {
Collection<BlackboardAttribute> bbattributes = new ArrayList<>();
FileManager fileManager = currentCase.getServices().getFileManager();
List<AbstractFile> files = fileManager.findFilesByParentPath(dataSource.getId(), "/windows/system32");
//create an attribute if any files with the windows/system32 path were found
//create an artifact if any files with the windows/system32 path were found
if (!files.isEmpty()) {
bbattributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATA_SOURCE_DESCRIPTOR,
Bundle.DataSourceProfiler_parentModuleName(),
"Windows volume")); //NON-NLS
addArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_PROFILE, dataSource, bbattributes);
}
}