Autopsy  3.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
InterestingHits.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datamodel;
20 
21 
22 import java.beans.PropertyChangeEvent;
23 import java.beans.PropertyChangeListener;
24 import java.sql.ResultSet;
25 import java.sql.SQLException;
26 import java.util.ArrayList;
27 import java.util.Collections;
28 import java.util.HashSet;
29 import java.util.LinkedHashMap;
30 import java.util.List;
31 import java.util.Map;
32 import java.util.Observable;
33 import java.util.Observer;
34 import java.util.Set;
35 import java.util.logging.Level;
36 import org.openide.nodes.ChildFactory;
37 import org.openide.nodes.Children;
38 import org.openide.nodes.Node;
39 import org.openide.nodes.Sheet;
40 import org.openide.util.Exceptions;
41 import org.openide.util.NbBundle;
42 import org.openide.util.lookup.Lookups;
52 
53 
54 public class InterestingHits implements AutopsyVisitableItem {
55 
56  private static final String INTERESTING_ITEMS = NbBundle
57  .getMessage(InterestingHits.class, "InterestingHits.interestingItems.text");
58  private static final String DISPLAY_NAME = NbBundle.getMessage(InterestingHits.class, "InterestingHits.displayName.text");
59  private static final Logger logger = Logger.getLogger(InterestingHits.class.getName());
62 
63  public InterestingHits(SleuthkitCase skCase) {
64  this.skCase = skCase;
65  interestingResults.update();
66  }
67 
68  private class InterestingResults extends Observable {
69  private final Map<String, Set<Long>> interestingItemsMap = new LinkedHashMap<>();
70 
71  public List<String> getSetNames() {
72  List<String> setNames = new ArrayList<>(interestingItemsMap.keySet());
73  Collections.sort(setNames);
74  return setNames;
75  }
76 
77  public Set<Long> getArtifactIds(String setName) {
78  return interestingItemsMap.get(setName);
79  }
80 
81  public void update() {
82  interestingItemsMap.clear();
85  setChanged();
86  notifyObservers();
87  }
88 
89  /*
90  * Reads the artifacts of specified type, grouped by Set, and loads into the interestingItemsMap
91  */
92  @SuppressWarnings("deprecation")
94  if (skCase == null) {
95  return;
96  }
97 
98  int setNameId = BlackboardAttribute.ATTRIBUTE_TYPE.TSK_SET_NAME.getTypeID();
99  int artId = artType.getTypeID();
100  String query = "SELECT value_text,blackboard_attributes.artifact_id,attribute_type_id " //NON-NLS
101  + "FROM blackboard_attributes,blackboard_artifacts WHERE " //NON-NLS
102  + "attribute_type_id=" + setNameId //NON-NLS
103  + " AND blackboard_attributes.artifact_id=blackboard_artifacts.artifact_id" //NON-NLS
104  + " AND blackboard_artifacts.artifact_type_id=" + artId; //NON-NLS
105 
106  try (CaseDbQuery dbQuery = skCase.executeQuery(query)) {
107  ResultSet resultSet = dbQuery.getResultSet();
108  while (resultSet.next()) {
109  String value = resultSet.getString("value_text"); //NON-NLS
110  long artifactId = resultSet.getLong("artifact_id"); //NON-NLS
111  if (!interestingItemsMap.containsKey(value)) {
112  interestingItemsMap.put(value, new HashSet<>());
113  }
114  interestingItemsMap.get(value).add(artifactId);
115  }
116  } catch (TskCoreException | SQLException ex) {
117  logger.log(Level.WARNING, "SQL Exception occurred: ", ex); //NON-NLS
118  }
119  }
120  }
121 
122  @Override
123  public <T> T accept(AutopsyItemVisitor<T> v) {
124  return v.visit(this);
125  }
126 
130  public class RootNode extends DisplayableItemNode {
131 
132  public RootNode() {
133  super(Children.create(new SetNameFactory(), true), Lookups.singleton(DISPLAY_NAME));
134  super.setName(INTERESTING_ITEMS);
135  super.setDisplayName(DISPLAY_NAME);
136  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS
137  }
138 
139  @Override
140  public boolean isLeafTypeNode() {
141  return false;
142  }
143 
144  @Override
145  public <T> T accept(DisplayableItemNodeVisitor<T> v) {
146  return v.visit(this);
147  }
148 
149  @Override
150  protected Sheet createSheet() {
151  Sheet s = super.createSheet();
152  Sheet.Set ss = s.get(Sheet.PROPERTIES);
153  if (ss == null) {
154  ss = Sheet.createPropertiesSet();
155  s.put(ss);
156  }
157 
158  ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
159  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.displayName"),
160  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.desc"),
161  getName()));
162 
163  return s;
164  }
165  }
166 
167  private class SetNameFactory extends ChildFactory.Detachable<String> implements Observer {
168 
169  /* This should probably be in the top-level class, but the factory has nice methods
170  * for its startup and shutdown, so it seemed like a cleaner place to register the
171  * property change listener.
172  */
173  private final PropertyChangeListener pcl = new PropertyChangeListener() {
174  @Override
175  public void propertyChange(PropertyChangeEvent evt) {
176  String eventType = evt.getPropertyName();
177 
178  if (eventType.equals(IngestManager.IngestModuleEvent.DATA_ADDED.toString())) {
179  if ((((ModuleDataEvent) evt.getOldValue()).getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT) ||
180  (((ModuleDataEvent) evt.getOldValue()).getArtifactType() == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT)) {
181  interestingResults.update();
182  }
183  }
184  else if (eventType.equals(IngestManager.IngestJobEvent.COMPLETED.toString())
185  || eventType.equals(IngestManager.IngestJobEvent.CANCELLED.toString())) {
186  interestingResults.update();
187  }
188  else if (eventType.equals(Case.Events.CURRENT_CASE.toString())) {
189  // case was closed. Remove listeners so that we don't get called with a stale case handle
190  if (evt.getNewValue() == null) {
191  removeNotify();
192  skCase = null;
193  }
194  }
195  }
196  };
197 
198  @Override
199  protected void addNotify() {
203  interestingResults.update();
204  interestingResults.addObserver(this);
205  }
206 
207  @Override
208  protected void removeNotify() {
212  interestingResults.deleteObserver(this);
213  }
214 
215  @Override
216  protected boolean createKeys(List<String> list) {
217  list.addAll(interestingResults.getSetNames());
218  return true;
219  }
220 
221  @Override
222  protected Node createNodeForKey(String key) {
223  return new SetNameNode(key);
224  }
225 
226  @Override
227  public void update(Observable o, Object arg) {
228  refresh(true);
229  }
230  }
231 
232  public class SetNameNode extends DisplayableItemNode implements Observer {
233  private final String setName;
234  public SetNameNode(String setName) {//, Set<Long> children) {
235  super(Children.create(new HitFactory(setName), true), Lookups.singleton(setName));
236  this.setName = setName;
237  super.setName(setName);
239  this.setIconBaseWithExtension("org/sleuthkit/autopsy/images/interesting_item.png"); //NON-NLS
240  interestingResults.addObserver(this);
241  }
242 
243  private void updateDisplayName() {
244  super.setDisplayName(setName + " (" + interestingResults.getArtifactIds(setName).size() + ")");
245  }
246 
247  @Override
248  public boolean isLeafTypeNode() {
249  return true;
250  }
251 
252  @Override
253  protected Sheet createSheet() {
254  Sheet s = super.createSheet();
255  Sheet.Set ss = s.get(Sheet.PROPERTIES);
256  if (ss == null) {
257  ss = Sheet.createPropertiesSet();
258  s.put(ss);
259  }
260 
261  ss.put(new NodeProperty<>(NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
262  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.name"),
263  NbBundle.getMessage(this.getClass(), "InterestingHits.createSheet.name.desc"),
264  getName()));
265 
266  return s;
267  }
268 
269  @Override
270  public <T> T accept(DisplayableItemNodeVisitor<T> v) {
271  return v.visit(this);
272  }
273 
274  @Override
275  public void update(Observable o, Object arg) {
277  }
278  }
279 
280  private class HitFactory extends ChildFactory<Long> implements Observer {
281  private final String setName;
282 
283  private HitFactory(String setName) {
284  super();
285  this.setName = setName;
286  interestingResults.addObserver(this);
287  }
288 
289  @Override
290  protected boolean createKeys(List<Long> list) {
291  for (long l : interestingResults.getArtifactIds(setName)) {
292  list.add(l);
293  }
294  return true;
295  }
296 
297  @Override
298  protected Node createNodeForKey(Long l) {
299  if (skCase == null) {
300  return null;
301  }
302  try {
303  return new BlackboardArtifactNode(skCase.getBlackboardArtifact(l));
304  } catch (TskCoreException ex) {
305  Exceptions.printStackTrace(ex);
306  return null;
307  }
308  }
309 
310  @Override
311  public void update(Observable o, Object arg) {
312  refresh(true);
313  }
314  }
315 }
void removeIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized IngestManager getInstance()
void loadArtifacts(BlackboardArtifact.ARTIFACT_TYPE artType)
BlackboardArtifact getBlackboardArtifact(long artifactID)
void removeIngestJobEventListener(final PropertyChangeListener listener)
void addIngestJobEventListener(final PropertyChangeListener listener)
static synchronized void removePropertyChangeListener(PropertyChangeListener listener)
Definition: Case.java:837
void addIngestModuleEventListener(final PropertyChangeListener listener)
static synchronized void addPropertyChangeListener(PropertyChangeListener listener)
Definition: Case.java:833
static Logger getLogger(String name)
Definition: Logger.java:131
CaseDbQuery executeQuery(String query)

Copyright © 2012-2015 Basis Technology. Generated on: Mon Oct 19 2015
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.