Creating new custom artifact

Hi there, i am trying to create a new artifact but its always giving me the exception "INFO: Artifacts Creation Error, TSK_DEEP_FAKE_DETECT ".
What am i doing wrong?

blackboard = Case.getCurrentCase().getServices().getBlackboard()
skCase = Case.getCurrentCase().getSleuthkitCase()

    #create artifact
    try:
         skCase.addBlackboardArtifactType("TSK_DEEP_FAKE_DETECT", "Detections")
         artId = skCase.getArtifactTypeID("TSK_DEEP_FAKE_DETECT")
    except:		
         self.log(Level.INFO, "Artifacts Creation Error for artifact ==> " + "TSK_DEEP_FAKE_DETECT" )


    artifact = file.newArtifact(artId)

    #create attribute
    try:
        attributeId = skCase.addArtifactAttributeType("TSK_DEEP_SVM_SCORE", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Overall svm score for all images")
        skCase.getAttributeType("TSK_DEEP_SVM_SCORE")
    except:		
        self.log(Level.INFO, "Attribute Creation Error for attribute ==> " + "TSK_DEEP_SVM_SCORE")
        return skCase.getAttributeType("TSK_DEEP_SVM_SCORE")

    atribute=BlackboardAttribute(attId, SampleJythonDataSourceIngestModuleFactory.moduleName, svm_score)

    try:
        artifact.addAttribute(atribute)
    except:
        self.log(Level.INFO, "Error adding attribute to artifact")
    try:
        blacboard.indexArtifact(artifact)
    except:
        self.log(Level.INFO, "Error indexing artifact")

I would suggest first switching to the getOrAddArtifactType() in the Blackboard class, since it’s possible the issue is that the artifact already exists.

You can access the Blackboard through getBlackboard() on the SleuthkitCase object. It would also help to print out the exception being returned.

1 Like

@Sara_Ferreira , I would concur with @apriestman that the issue likely resides with similar artifact types in which the error is detecting as part of it’s algorithm of comparing and identifying one of the various artifacts as being similar, yet distinct. Maybe try working to ensure whichever artifacts and creation code you’re using distinctly separates the variables. Just a thought.

im only creating one new artifact and one new attribute in that artifact. Are you saying that the names are coliding with the artifacts types defined by autopsy?

More that you might be defining your new type multiple times in the same case. But again, it would be helpful if you could print out the actual exceptions that are coming back. Otherwise it is impossible to know what is wrong.

2 Likes

yep, could be a few things, but likely it’s finding something twice or similar in some means or fashion.

1 Like

Something that might be coming into play here is that under the covers Autopsy makes N copies of a module, one for each ingest thread. If the new artifact type is created in the startUp method of the module, then every module copy other than the first will experience a duplicate type error.

The way to handle this is with IngestModuleReferenceCounter so that only the first module instance creates the artifact type. There are examples of the use of IngestModuleReferenceCounter in several places in the code base.

This only applies to file level ingest modules. Only one thread is used to run the data source level ingest modules pipeline.

1 Like

This is what i got on autopsy log file

im developing a data source ingest module

I’m not a python person, but the issue may be that you’ve moved outside the scope of the first try block which means artId isn’t set. You could try printing it out to check.

Also, you could save the BlackboardArtifact.Type object that’s returned from addBlackboardArtifactType() and then call getTypeID() on it instead of having the separate call to getArtifactTypeID().

Hi Sara,

Can you send me your code and I can look at it. You know the email address.

Mark

thank you for the help one more time! Just sent to your email the module :slight_smile:

I replied to your email but to help anyone else out in the future here is what you can do. This uses what Ann suggested before using the getOrAddArtifactType. You will also need to use the getOrAddAttributeType as well.

    # Use blackboard class to index blackboard artifacts for keyword search
    blackboard = Case.getCurrentCase().getServices().getBlackboard()

    #create artifact
    
    artId = blackboard.getOrAddArtifactType("TSK_SOME_ARTIFACT", "Description")
    
    artifact = file.newArtifact(artId.getTypeID())

    #create attribute

    attId = blackboard.getOrAddAttributeType("TSK_SOME_ATTRIBUTE", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Description")

    atribute=BlackboardAttribute(attId, moduleName, data)

    try:
        artifact.addAttribute(atribute)
    except:
        self.log(Level.INFO, "Error adding attribute to artifact")

    try:
        blackboard.postArtifact(artifact, moduleName)
    except:
        self.log(Level.INFO, "Error posting artifact")
2 Likes