19 package org.sleuthkit.autopsy.datamodel;
21 import java.beans.PropertyChangeEvent;
22 import java.beans.PropertyChangeListener;
23 import java.sql.ResultSet;
24 import java.sql.SQLException;
25 import java.util.ArrayList;
26 import java.util.HashMap;
27 import java.util.LinkedHashMap;
28 import java.util.List;
30 import java.util.Observable;
31 import java.util.Observer;
33 import java.util.logging.Level;
34 import org.openide.nodes.ChildFactory;
35 import org.openide.nodes.Children;
36 import org.openide.nodes.Node;
37 import org.openide.nodes.Sheet;
38 import org.openide.util.NbBundle;
39 import org.openide.util.lookup.Lookups;
76 private final Map<String, Map<String, List<Long>>>
accounts =
new LinkedHashMap<>();
83 return accounts.keySet();
87 return accounts.get(account).keySet();
91 return accounts.get(account).get(folder);
93 @SuppressWarnings(
"deprecation")
102 String query =
"SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id "
103 +
"FROM blackboard_attributes,blackboard_artifacts WHERE "
104 +
"attribute_type_id=" + pathAttrId
105 +
" AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id"
106 +
" AND blackboard_artifacts.artifact_type_id=" + artId;
109 ResultSet resultSet = dbQuery.getResultSet();
110 while (resultSet.next()) {
111 final String path = resultSet.getString(
"value_text");
112 final long artifactId = resultSet.getLong(
"artifact_id");
113 final Map<String, String> parsedPath =
parsePath(path);
114 final String account = parsedPath.get(MAIL_ACCOUNT);
115 final String folder = parsedPath.get(MAIL_FOLDER);
117 Map<String, List<Long>> folders = accounts.get(account);
118 if (folders == null) {
119 folders =
new LinkedHashMap<>();
120 accounts.put(account, folders);
122 List<Long> messages = folders.get(folder);
123 if (messages == null) {
124 messages =
new ArrayList<>();
125 folders.put(folder, messages);
127 messages.add(artifactId);
130 logger.log(Level.WARNING,
"Cannot initialize email extraction: ", ex);
135 Map<String, String> parsed =
new HashMap<>();
136 String[] split = path.split(MAIL_PATH_SEPARATOR);
137 if (split.length < 4) {
138 parsed.put(MAIL_ACCOUNT, NbBundle.getMessage(
EmailExtracted.class,
"EmailExtracted.defaultAcct.text"));
139 parsed.put(MAIL_FOLDER, NbBundle.getMessage(
EmailExtracted.class,
"EmailExtracted.defaultFolder.text"));
142 parsed.put(MAIL_ACCOUNT, split[2]);
143 parsed.put(MAIL_FOLDER, split[3]);
149 public <T> T accept(AutopsyItemVisitor<T> v) {
150 return v.visit(
this);
160 super(Children.create(
new AccountFactory(),
true), Lookups.singleton(DISPLAY_NAME));
161 super.setName(LABEL_NAME);
162 super.setDisplayName(DISPLAY_NAME);
163 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/mail-icon-16.png");
174 return v.
visit(
this);
179 Sheet s = super.createSheet();
180 Sheet.Set ss = s.get(Sheet.PROPERTIES);
182 ss = Sheet.createPropertiesSet();
186 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.name"),
187 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.displayName"),
188 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.desc"),
198 private class AccountFactory extends ChildFactory.Detachable<String> implements Observer {
203 private final PropertyChangeListener
pcl =
new PropertyChangeListener() {
205 public void propertyChange(PropertyChangeEvent evt) {
206 String eventType = evt.getPropertyName();
219 if (evt.getNewValue() == null) {
233 emailResults.addObserver(
this);
241 emailResults.deleteObserver(
this);
256 public void update(Observable o, Object arg) {
269 super(Children.create(
new FolderFactory(accountName),
true), Lookups.singleton(accountName));
270 super.setName(accountName);
272 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/account-icon-16.png");
274 emailResults.addObserver(
this);
278 super.setDisplayName(accountName +
" (" + emailResults.
getFolders(accountName) +
")");
283 Sheet s = super.createSheet();
284 Sheet.Set ss = s.get(Sheet.PROPERTIES);
286 ss = Sheet.createPropertiesSet();
290 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.name"),
291 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.displayName"),
292 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.desc"),
305 return v.
visit(
this);
309 public void update(Observable o, Object arg) {
317 private class FolderFactory extends ChildFactory<String> implements Observer {
324 emailResults.addObserver(
this);
329 list.addAll(emailResults.
getFolders(accountName));
335 return new FolderNode(accountName, folderName);
339 public void update(Observable o, Object arg) {
353 super(Children.create(
new MessageFactory(accountName, folderName),
true), Lookups.singleton(accountName));
354 super.setName(folderName);
355 this.setIconBaseWithExtension(
"org/sleuthkit/autopsy/images/folder-icon-16.png");
359 emailResults.addObserver(
this);
363 super.setDisplayName(folderName +
" (" + emailResults.
getArtifactIds(accountName, folderName).size() +
")");
374 Sheet s = super.createSheet();
375 Sheet.Set ss = s.get(Sheet.PROPERTIES);
377 ss = Sheet.createPropertiesSet();
381 ss.put(
new NodeProperty<>(NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.name"),
382 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.displayName"),
383 NbBundle.getMessage(
this.getClass(),
"EmailExtracted.createSheet.name.desc"),
391 return v.
visit(
this);
395 public void update(Observable o, Object arg) {
412 emailResults.addObserver(
this);
417 list.addAll(emailResults.
getArtifactIds(accountName, folderName));
423 if (skCase == null) {
430 logger.log(Level.WARNING,
"Error creating mail messages nodes", ex);
436 public void update(Observable o, Object arg) {
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized IngestManager getInstance()
BlackboardArtifact getBlackboardArtifact(long artifactID)
T visit(DataSourcesNode in)
void removeIngestJobEventListener(final PropertyChangeListener listener)
void addIngestJobEventListener(final PropertyChangeListener listener)
static synchronized void removePropertyChangeListener(PropertyChangeListener listener)
void addIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized void addPropertyChangeListener(PropertyChangeListener listener)
static Logger getLogger(String name)
CaseDbQuery executeQuery(String query)