new blackboard artifact

Autopsy Development
1

Could you help create a new blackboard artifact?

2

There’s some documentation here: Sleuth Kit Java Bindings (JNI): The Blackboard

Generally, to make a new blackboard artifact type you need to decide whether it should be a data artifact or analysis result. There’s a general description of what each type does on that page. Then in Java you can create a new type like this for a data artifact:

BlackboardArtifact.Type artifactType = 
   Case.getCurrentCase().getSleuthkitCase().getBlackboard().getOrAddArtifactType(
   "ARTIFACT_NAME", "Artifact Display Name", BlackboardArtifact.Category.DATA_ARTIFACT);
3

can I send you the code, and would I change the code?
BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE,

tsk_tag_file, if it could be “music”

4

image
image746×261 16 KB

5

Can you send me your email, I’ll send you the code?

6

I think I misunderstood - you’re just trying to create an artifact of an existing type? You should not use TSK_TAG_FILE - that has long been deprecated and is not how we tag files now. For now, if you’re trying to mark that a file has passed some kind of check, I would use TSK_INTERESTING_FILE_HIT. In Java the code would look more or less like this:

String setName = "Music Files";
String MODULE_NAME = "My Module";
Collection<BlackboardAttribute> attributes = Arrays.asList(
	new BlackboardAttribute(
	BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME, MODULE_NAME,
	setName));

AnalysisResult result = file.newAnalysisResult(
	BlackboardArtifact.Type.TSK_INTERESTING_FILE_HIT, Score.SCORE_LIKELY_NOTABLE, 
	null, setName, null, 
	attributes)
	.getAnalysisResult();
7

I really wanted to create a blackboard artifact name music

8

Ok then do what I said in my first comment and use “MUSIC_ARTIFACT” and “Music” for the name and display name.

9

can i send you my code?

11

Which module is this for and does it work in Autopsy 4.21.0, as I’m having problems with blackboard artefacts myself when developing my own modules based on FaceRadar and SmutDetect.

How would I update this?

                BlackboardArtifact artifact = file.newArtifact(BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
                BlackboardAttribute attribute = new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID(), FaceRadarIngestModuleFactory.getModuleName(), "FaceRadar Detected Faces");
                artifact.addAttribute(attribute);

                // This method is thread-safe with per ingest job reference counted
                // management of shared data.
                addToBlackboardPostCount(context.getJobId(), 1L);

                // Fire an event to notify any listeners for blackboard postings.
                ModuleDataEvent event = new ModuleDataEvent(FaceRadarIngestModuleFactory.getModuleName(), BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT);
                IngestServices.getInstance().fireModuleDataEvent(event);
            }
            return IngestModule.ProcessResult.OK;