I’ve recently updated to Autopsy 4.19.1, on Linux, and I’ve noticed there are some changes with regards to artifact types, namely the two categories: analysis results and data artifacts.
Based on the latest blackboard documentation my module adds artifacts somewhat in the following manner:
SleuthkitCase sleuthkitCase = Case.getCurrentCase().getSleuthkitCase(); /* output omitted for brevity */ /* custom artifacts, custom attributes */ DataArtifact artifact = content.newDataArtifact(artifactType, null); /* output omitted for brevity */ artifact.addAttribute(attr); sleuthkitCase.getBlackboard().postArtifact(artifact, MyModule.getModuleName());
This runs without error, it inserts data into the
blackboard_attributes tables in
autopsy.db corresponding to the current case, but the UI is not updated in order to display the new results. I have to close the case and reopen it in order to see the results in the UI.
Am I missing something? As much as I can tell from the source code there should be an event fired such that the UI is updated. Has anybody else dealt with this?