# Creating new custom artifact

**URL:** <https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367>\
**Category:** Autopsy Development\
**Created:** [December 22, 2020, 4:11pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367 "2020-12-22T16:11:12Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sara\_Ferreira](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/sara_ferreira/32/1220_2.png) [@Sara\_Ferreira](https://sleuthkit.discourse.group/u/Sara_Ferreira)\
**Post date:** [December 22, 2020, 4:11pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/1 "2020-12-22T16:11:12Z")

</div>

Hi there, i am trying to create a new artifact but its always giving me the exception "INFO: Artifacts Creation Error, TSK\_DEEP\_FAKE\_DETECT ".  
What am i doing wrong?

blackboard = Case.getCurrentCase().getServices().getBlackboard()  
skCase = Case.getCurrentCase().getSleuthkitCase()

```
    #create artifact
    try:
         skCase.addBlackboardArtifactType("TSK_DEEP_FAKE_DETECT", "Detections")
         artId = skCase.getArtifactTypeID("TSK_DEEP_FAKE_DETECT")
    except:		
         self.log(Level.INFO, "Artifacts Creation Error for artifact ==> " + "TSK_DEEP_FAKE_DETECT" )

    artifact = file.newArtifact(artId)

    #create attribute
    try:
        attributeId = skCase.addArtifactAttributeType("TSK_DEEP_SVM_SCORE", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Overall svm score for all images")
        skCase.getAttributeType("TSK_DEEP_SVM_SCORE")
    except:		
        self.log(Level.INFO, "Attribute Creation Error for attribute ==> " + "TSK_DEEP_SVM_SCORE")
        return skCase.getAttributeType("TSK_DEEP_SVM_SCORE")

    atribute=BlackboardAttribute(attId, SampleJythonDataSourceIngestModuleFactory.moduleName, svm_score)

    try:
        artifact.addAttribute(atribute)
    except:
        self.log(Level.INFO, "Error adding attribute to artifact")
    try:
        blacboard.indexArtifact(artifact)
    except:
        self.log(Level.INFO, "Error indexing artifact")
```

---

<div class="post-metadata">

**Author:** ![apriestman](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/apriestman/32/24_2.png) [@apriestman](https://sleuthkit.discourse.group/u/apriestman)\
**Post date:** [December 22, 2020, 4:20pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/2 "2020-12-22T16:20:25Z")

</div>

I would suggest first switching to the getOrAddArtifactType() in the Blackboard class, since it’s possible the issue is that the artifact already exists.

> <https://github.com/sleuthkit/sleuthkit/blob/develop/bindings/java/src/org/sleuthkit/datamodel/Blackboard.java>

You can access the Blackboard through getBlackboard() on the SleuthkitCase object. It would also help to print out the exception being returned.

---

<div class="post-metadata">

**Author:** ![Dan\_Sorensen](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/dan_sorensen/32/1213_2.png) [@Dan\_Sorensen](https://sleuthkit.discourse.group/u/Dan_Sorensen)\
**Post date:** [December 22, 2020, 5:12pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/3 "2020-12-22T17:12:51Z")

</div>

@Sara_Ferreira , I would concur with @apriestman that the issue likely resides with similar artifact types in which the error is detecting as part of it’s algorithm of comparing and identifying one of the various artifacts as being similar, yet distinct. Maybe try working to ensure whichever artifacts and creation code you’re using distinctly separates the variables. Just a thought.

---

<div class="post-metadata">

**Author:** ![Sara\_Ferreira](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/sara_ferreira/32/1220_2.png) [@Sara\_Ferreira](https://sleuthkit.discourse.group/u/Sara_Ferreira)\
**Post date:** [December 22, 2020, 6:10pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/4 "2020-12-22T18:10:42Z")

</div>

im only creating one new artifact and one new attribute in that artifact. Are you saying that the names are coliding with the artifacts types defined by autopsy?

---

<div class="post-metadata">

**Author:** ![apriestman](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/apriestman/32/24_2.png) [@apriestman](https://sleuthkit.discourse.group/u/apriestman)\
**Post date:** [December 22, 2020, 8:11pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/5 "2020-12-22T20:11:13Z")

</div>

More that you might be defining your new type multiple times in the same case. But again, it would be helpful if you could print out the actual exceptions that are coming back. Otherwise it is impossible to know what is wrong.

---

<div class="post-metadata">

**Author:** ![Dan\_Sorensen](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/dan_sorensen/32/1213_2.png) [@Dan\_Sorensen](https://sleuthkit.discourse.group/u/Dan_Sorensen)\
**Post date:** [December 22, 2020, 8:22pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/6 "2020-12-22T20:22:28Z")

</div>

yep, could be a few things, but likely it’s finding something twice or similar in some means or fashion.

---

<div class="post-metadata">

**Author:** ![Richard\_Cordovano](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/richard_cordovano/32/15_2.png) [@Richard\_Cordovano](https://sleuthkit.discourse.group/u/Richard_Cordovano)\
**Post date:** [December 22, 2020, 8:56pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/7 "2020-12-22T20:56:48Z")

</div>

Something that might be coming into play here is that under the covers Autopsy makes N copies of a module, one for each ingest thread. If the new artifact type is created in the startUp method of the module, then every module copy other than the first will experience a duplicate type error.

The way to handle this is with IngestModuleReferenceCounter so that only the first module instance creates the artifact type. There are examples of the use of IngestModuleReferenceCounter in several places in the code base.

This only applies to file level ingest modules. Only one thread is used to run the data source level ingest modules pipeline.

---

<div class="post-metadata">

**Author:** ![Sara\_Ferreira](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/sara_ferreira/32/1220_2.png) [@Sara\_Ferreira](https://sleuthkit.discourse.group/u/Sara_Ferreira)\
**Post date:** [December 22, 2020, 9:36pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/8 "2020-12-22T21:36:05Z")

</div>

![Captura de ecrã 2020-12-22 213241](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/6/6ff6b5568f6e9f664d5a7a3929936a97c9f5afae.png)

This is what i got on autopsy log file

---

<div class="post-metadata">

**Author:** ![Sara\_Ferreira](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/sara_ferreira/32/1220_2.png) [@Sara\_Ferreira](https://sleuthkit.discourse.group/u/Sara_Ferreira)\
**Post date:** [December 22, 2020, 9:37pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/9 "2020-12-22T21:37:02Z")

</div>

im developing a data source ingest module

---

<div class="post-metadata">

**Author:** ![apriestman](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/apriestman/32/24_2.png) [@apriestman](https://sleuthkit.discourse.group/u/apriestman)\
**Post date:** [December 22, 2020, 10:07pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/10 "2020-12-22T22:07:48Z")

</div>

I’m not a python person, but the issue may be that you’ve moved outside the scope of the first try block which means artId isn’t set. You could try printing it out to check.

Also, you could save the BlackboardArtifact.Type object that’s returned from addBlackboardArtifactType() and then call getTypeID() on it instead of having the separate call to getArtifactTypeID().

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [December 22, 2020, 10:15pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/11 "2020-12-22T22:15:39Z")

</div>

Hi Sara,

Can you send me your code and I can look at it. You know the email address.

Mark

---

<div class="post-metadata">

**Author:** ![Sara\_Ferreira](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/sara_ferreira/32/1220_2.png) [@Sara\_Ferreira](https://sleuthkit.discourse.group/u/Sara_Ferreira)\
**Post date:** [December 23, 2020, 12:41am UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/12 "2020-12-23T00:41:45Z")

</div>

thank you for the help one more time! Just sent to your email the module 🙂

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [December 23, 2020, 5:28pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/13 "2020-12-23T17:28:44Z")

</div>

I replied to your email but to help anyone else out in the future here is what you can do. This uses what Ann suggested before using the getOrAddArtifactType. You will also need to use the getOrAddAttributeType as well.

```
    # Use blackboard class to index blackboard artifacts for keyword search
    blackboard = Case.getCurrentCase().getServices().getBlackboard()

    #create artifact
    
    artId = blackboard.getOrAddArtifactType("TSK_SOME_ARTIFACT", "Description")
    
    artifact = file.newArtifact(artId.getTypeID())

    #create attribute

    attId = blackboard.getOrAddAttributeType("TSK_SOME_ATTRIBUTE", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Description")

    atribute=BlackboardAttribute(attId, moduleName, data)

    try:
        artifact.addAttribute(atribute)
    except:
        self.log(Level.INFO, "Error adding attribute to artifact")

    try:
        blackboard.postArtifact(artifact, moduleName)
    except:
        self.log(Level.INFO, "Error posting artifact")
```

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [August 7, 2021, 1:40am UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/15 "2021-08-07T01:40:44Z")

</div>

The data is what you want to be displayed to the user for each attribute.

---

<div class="post-metadata">

**Author:** ![sqrl00](https://avatars.discourse-cdn.com/v4/letter/s/ba9def/32.png) [@sqrl00](https://sleuthkit.discourse.group/u/sqrl00)\
**Post date:** [October 22, 2021, 5:26am UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/17 "2021-10-22T05:26:32Z")

</div>

For anyone else having issues creating the custom artifact. There is a slight update for Marks answer, postArtifact looks to be indexArtifact according to the source above. I have tested this with 4.19.1

Source: [Autopsy: org.sleuthkit.autopsy.casemodule.services.Blackboard Class Reference](https://www.sleuthkit.org/autopsy/docs/api-docs/4.4/classorg_1_1sleuthkit_1_1autopsy_1_1casemodule_1_1services_1_1_blackboard.html)

```auto
artId = blackboard.getOrAddArtifactType("TSK_YOUR_ARTIFACT", "Description") [1]
    
artifact = file.newArtifact(artId.getTypeID())

#create attribute

attId = blackboard.getOrAddAttributeType("TSK_YOUR_ATTRIBUTE", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "KEY_NAME")[2]

atribute=BlackboardAttribute(attId, moduleName, data)[3]

try:
	artifact.addAttribute(atribute)
except:
	self.log(Level.INFO, "Error adding attribute to artifact")

try:
	blackboard.indexArtifact(artifact)
except:
        self.log(Level.INFO, "Error posting artifact")

```

[1] Will be presented as the Source/s entry  
[2] Will be the key name  
[3] Value to be presented

moduleName = [YOUR MODULE]IngestModuleFactory.moduleName

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [October 22, 2021, 12:56pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/18 "2021-10-22T12:56:42Z")

</div>

indexArtifact has been deprecated. You should use postArtifact instead.

---

<div class="post-metadata">

**Author:** ![sqrl00](https://avatars.discourse-cdn.com/v4/letter/s/ba9def/32.png) [@sqrl00](https://sleuthkit.discourse.group/u/sqrl00)\
**Post date:** [October 22, 2021, 9:32pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/19 "2021-10-22T21:32:57Z")

</div>

Yep [Autopsy: org.sleuthkit.autopsy.casemodule.services.Blackboard Class Reference](https://www.sleuthkit.org/autopsy/docs/api-docs/4.19.1/classorg_1_1sleuthkit_1_1autopsy_1_1casemodule_1_1services_1_1_blackboard.html)

Just found the updated docs, ignore my update

Thanks Mark

---

<div class="post-metadata">

**Author:** ![heisenberg3008](https://avatars.discourse-cdn.com/v4/letter/h/d9b06d/32.png) [@heisenberg3008](https://sleuthkit.discourse.group/u/heisenberg3008)\
**Post date:** [August 20, 2022, 11:55pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/20 "2022-08-20T23:55:49Z")

</div>

Hi I have referred to this code to create an artifact of Direct Messages but I want to display multiple things along with text such as time and type. How do I implement Arrays.asList over here? If I send my code could you please help? Thanks.

I could manage to create multiple entries but all came on separate line when the time and type related to the message should be on same line. (My timestamps are also wrong for some reason)

 ![Screenshot (244)](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/c/c0462e30ff440893e602f43de26d29271008accc.png)

Edit : previously I was unable to create artifacts but I have figured it out how to do it.

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [August 21, 2022, 2:30am UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/21 "2022-08-21T02:30:24Z")

</div>

Sure, send the code and I will take a look at it tomorrow.

---

<div class="post-metadata">

**Author:** ![heisenberg3008](https://avatars.discourse-cdn.com/v4/letter/h/d9b06d/32.png) [@heisenberg3008](https://sleuthkit.discourse.group/u/heisenberg3008)\
**Post date:** [August 21, 2022, 12:09pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/23 "2022-08-21T12:09:13Z")

</div>

Attached a link to my code since I am new to this website and don’t really know how to respond back on email. Thanks! [Autopsy Plugin link](https://www.dropbox.com/s/p6663ustzost5kx/instaPlugin.py?dl=0)

[Next page](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367.md?page=2)