# Creating new custom artifact **URL:** \ **Category:** Autopsy Development\ **Created:** [December 22, 2020, 4:11pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367 "2020-12-22T16:11:12Z")\ **Posts on this page:** 9\ **Page:** 2
**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\ **Post date:** [August 21, 2022, 2:14pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/24 "2022-08-21T14:14:19Z")
The issue is that you were creating a new artifact for every attribute. I made a few changes to your code and see if it does what you want it to. I also moved the createOrAddArtifact and createOrAddAttribute out of the result loop since you only need to do it once in the script, doing it where you had it would make it do those calls everytime and that might slow the script down. If you have any questions please let me know. ``` def process(self, dataSource, progressBar): progressBar.switchToIndeterminate() blackboard = Case.getCurrentCase().getSleuthkitCase().getBlackboard() fileManager = Case.getCurrentCase().getServices().getFileManager() files = fileManager.findFiles(dataSource, "direct.db", ".instagram") numFiles = len(files) progressBar.switchToDeterminate(numFiles) fileCount = 0 for file in files: if self.context.isJobCancelled(): return IngestModule.ProcessResult.OK self.log(Level.INFO, "Processing file: " + file.getName()) fileCount += 1 # Save the DB locally in the temp folder. use file id as name to reduce collisions lclDbPath = os.path.join(Case.getCurrentCase().getTempDirectory(), str(file.getId()) + ".db") ContentUtils.writeToFile(file, File(lclDbPath)) # Create/Get artifact to use artId = blackboard.getOrAddArtifactType("TSK_INSTAGRAM_MESSAGES", "Instagram DMs") # Create/Get attributes to use attId = blackboard.getOrAddAttributeType("TSK_MESSAGES", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Instagram DMs") attId1 = blackboard.getOrAddAttributeType("TSK_TIME", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME, "Time") attId2 = blackboard.getOrAddAttributeType("TSK_MESSAGES_TYPE", BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING, "Message Type") # Open the DB using JDBC try: Class.forName("org.sqlite.JDBC").newInstance() dbConn = DriverManager.getConnection("jdbc:sqlite:%s" % lclDbPath) except SQLException as e: self.log(Level.INFO, "Could not open database file (not SQLite) " + file.getName() + " (" + e.getMessage() + ")") return IngestModule.ProcessResult.OK # Query the notification table in the database and get all columns. try: stmt = dbConn.createStatement() resultSet = stmt.executeQuery("SELECT * FROM messages") except SQLException as e: self.log(Level.INFO, "Error querying database for contacts table (" + e.getMessage() + ")") return IngestModule.ProcessResult.OK # Cycle through each row and create artifacts while resultSet.next(): try: timestamp = resultSet.getLong("timestamp")/1000 text = resultSet.getString("text") message_type = resultSet.getString("message_type") except SQLException as e: self.log(Level.INFO, "Error getting values from contacts table (" + e.getMessage() + ")") artId = blackboard.getOrAddArtifactType("TSK_INSTAGRAM_MESSAGES", "Instagram DMs") artifact = file.newArtifact(artId.getTypeID()) attributes = ArrayList() attributes.add(BlackboardAttribute(attId, InstagramDMIngestModuleFactory.moduleName, text)) attributes.add(BlackboardAttribute(attId1, InstagramDMIngestModuleFactory.moduleName, timestamp)) attributes.add(BlackboardAttribute(attId2, InstagramDMIngestModuleFactory.moduleName, message_type)) try: artifact.addAttributes(attributes) except: self.log(Level.INFO, "Error adding attribute to artifact") #artifacts try catch try: blackboard.postArtifact(artifact) except: self.log(Level.INFO, "Error posting artifact") '''art = file.newDataArtifact(BlackboardArtifact.Type.TSK_PROG_NOTIFICATIONS, Arrays.asList( BlackboardAttribute(BlackboardAttribute.Type.TSK_DATETIME, InstagramDMIngestModuleFactory.moduleName, timestamp), BlackboardAttribute(BlackboardAttribute.Type.TSK_TITLE, InstagramDMIngestModuleFactory.moduleName, message_type), BlackboardAttribute(BlackboardAttribute.Type.TSK_VALUE, InstagramDMIngestModuleFactory.moduleName, text) )) try: blackboard.postArtifact(art, InstagramDMIngestModuleFactory.moduleName) except Blackboard.BlackboardException as e: self.log(Level.SEVERE, "Error indexing artifact " + art.getDisplayName())''' stmt.close() dbConn.close() os.remove(lclDbPath) message = IngestMessage.createMessage(IngestMessage.MessageType.DATA, "ContactsDb Analyzer", "Found %d files" % fileCount) IngestServices.getInstance().postMessage(message) return IngestModule.ProcessResult.OK ``` ---
**Author:** ![heisenberg3008](https://avatars.discourse-cdn.com/v4/letter/h/d9b06d/32.png) [@heisenberg3008](https://sleuthkit.discourse.group/u/heisenberg3008)\ **Post date:** [August 21, 2022, 7:52pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/25 "2022-08-21T19:52:28Z")
I tried this code but the attributes are not getting created at all. Even the line ```auto attributes = ArrayList() ``` gives an error. I imported yet the error was there. ```auto from array import array ``` I changed it to following but still I got the same results. ```auto attributes = Arrays.asList() ``` ![Screenshot (245)](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/f/f77309fdbd679f91d3a6f7d5661988551022bba9.png) No attributes are getting created. Have attached the [modified code](https://www.dropbox.com/s/pulh4m3oe0tuxvh/Instagram.py?dl=0) ---
**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\ **Post date:** [August 21, 2022, 9:19pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/26 "2022-08-21T21:19:14Z")
Try importing this instead and Lee port back. from java.util import ArrayList ---
**Author:** ![heisenberg3008](https://avatars.discourse-cdn.com/v4/letter/h/d9b06d/32.png) [@heisenberg3008](https://sleuthkit.discourse.group/u/heisenberg3008)\ **Post date:** [August 21, 2022, 9:50pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/27 "2022-08-21T21:50:18Z")
Thank you so much. It finally works. I was importing a wrong array library. But the timestamps are still weird. For ex : 54556-08-01 09:57:58 BST whereas when I manually convert it comes to August 2, 2022 9:31:44.278 PM which is the correct value. ---
**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\ **Post date:** [August 21, 2022, 11:03pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/28 "2022-08-21T23:03:36Z")
What does the original date actually look like? Is it a Unix Epoch Timestamp or a MS Epoch Time stamp. ? When you store a value in a date attribute it assumes that the timestamp is an Unix Epoch timestamp, so if you have a MS epoch timestamp it will be way off. ---
**Author:** ![heisenberg3008](https://avatars.discourse-cdn.com/v4/letter/h/d9b06d/32.png) [@heisenberg3008](https://sleuthkit.discourse.group/u/heisenberg3008)\ **Post date:** [August 21, 2022, 11:55pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/29 "2022-08-21T23:55:00Z")
The original format is this : 1659472304278109 ---
**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\ **Post date:** [August 22, 2022, 12:19am UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/30 "2022-08-22T00:19:35Z")
Try dropping off the last 6 digits from the number you posted and see if the changes to the date time you are expecting. ---
**Author:** ![heisenberg3008](https://avatars.discourse-cdn.com/v4/letter/h/d9b06d/32.png) [@heisenberg3008](https://sleuthkit.discourse.group/u/heisenberg3008)\ **Post date:** [August 22, 2022, 3:04am UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/32 "2022-08-22T03:04:17Z")
Yes it gives the correct value now. Thank you! ---
**Author:** ![Dinobots](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/dinobots/32/557_2.png) [@Dinobots](https://sleuthkit.discourse.group/u/Dinobots)\ **Post date:** [April 13, 2024, 12:29pm UTC](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367/33 "2024-04-13T12:29:55Z")
How would I update this? ```auto BlackboardArtifact artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT); BlackboardAttribute attribute = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), FaceRadarIngestModuleFactory.getModuleName(), "FaceRadar Detected Faces"); artifact.addAttribute(attribute); // This method is thread-safe with per ingest job reference counted // management of shared data. addToBlackboardPostCount(context.getJobId(), 1L); // Fire an event to notify any listeners for blackboard postings. ModuleDataEvent event = new ModuleDataEvent(FaceRadarIngestModuleFactory.getModuleName(), BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT); IngestServices.getInstance().fireModuleDataEvent(event); } return IngestModule.ProcessResult.OK; ``` [Previous page](https://sleuthkit.discourse.group/t/creating-new-custom-artifact/2367.md?page=1)