Case.java

Go to the documentation of this file.

/*
 * Autopsy Forensic Browser
 *
 * Copyright 2011-2016 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.casemodule;

import java.awt.Cursor;
import java.awt.Frame;
import java.beans.PropertyChangeListener;
import java.beans.PropertyChangeSupport;
import java.io.BufferedInputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.nio.file.InvalidPathException;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.text.DateFormat;
import java.text.SimpleDateFormat;
import java.util.Date;
import java.util.Collection;
import java.util.GregorianCalendar;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.TimeZone;
import java.util.UUID;
import java.util.logging.Level;
import java.util.stream.Collectors;
import java.util.stream.Stream;
import javax.swing.JOptionPane;
import javax.swing.SwingUtilities;
import org.apache.commons.io.FileUtils;
import org.openide.util.NbBundle;
import org.openide.util.actions.CallableSystemAction;
import org.openide.windows.WindowManager;
import org.sleuthkit.autopsy.casemodule.CaseMetadata.CaseMetadataException;
import org.sleuthkit.autopsy.casemodule.events.AddingDataSourceEvent;
import org.sleuthkit.autopsy.casemodule.events.AddingDataSourceFailedEvent;
import org.sleuthkit.autopsy.casemodule.events.DataSourceAddedEvent;
import org.sleuthkit.autopsy.casemodule.events.ReportAddedEvent;
import org.sleuthkit.autopsy.casemodule.services.Services;
import org.sleuthkit.autopsy.core.UserPreferences;
import org.sleuthkit.autopsy.corecomponentinterfaces.CoreComponentControl;
import org.sleuthkit.autopsy.coreutils.FileUtil;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.MessageNotifyUtil;
import org.sleuthkit.autopsy.coreutils.PlatformUtil;
import org.sleuthkit.autopsy.coreutils.Version;
import org.sleuthkit.autopsy.coreutils.NetworkUtils;
import org.sleuthkit.autopsy.events.AutopsyEvent;
import org.sleuthkit.autopsy.events.AutopsyEventException;
import org.sleuthkit.autopsy.events.AutopsyEventPublisher;
import org.sleuthkit.autopsy.casemodule.events.BlackBoardArtifactTagAddedEvent;
import org.sleuthkit.autopsy.casemodule.events.BlackBoardArtifactTagDeletedEvent;
import org.sleuthkit.autopsy.casemodule.events.ContentTagAddedEvent;
import org.sleuthkit.autopsy.casemodule.events.ContentTagDeletedEvent;
import org.sleuthkit.autopsy.core.RuntimeProperties;
import org.sleuthkit.autopsy.core.UserPreferencesException;
import org.sleuthkit.autopsy.ingest.IngestJob;
import org.sleuthkit.autopsy.ingest.IngestManager;
import org.sleuthkit.datamodel.BlackboardArtifactTag;
import org.sleuthkit.datamodel.Content;
import org.sleuthkit.datamodel.ContentTag;
import org.sleuthkit.datamodel.Image;
import org.sleuthkit.datamodel.Report;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.SleuthkitJNI.CaseDbHandle.AddImageProcess;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.datamodel.TskException;

public class Case implements SleuthkitCase.ErrorObserver {

    private static final String autopsyVer = Version.getVersion(); // current version of autopsy. Change it when the version is changed
    private static final String EVENT_CHANNEL_NAME = "%s-Case-Events"; //NON-NLS
    private static String appName = null;
    volatile private IntervalErrorReportData tskErrorReporter = null;
    private static final int MIN_SECONDS_BETWEEN_ERROR_REPORTS = 60; // No less than 60 seconds between warnings for errors
    private static final int MAX_SANITIZED_NAME_LENGTH = 47;

    public static final String propStartup = "LBL_StartupDialog"; //NON-NLS

    private static final AutopsyEventPublisher eventPublisher = new AutopsyEventPublisher();

    public enum Events {

        NAME,
        NUMBER,
        EXAMINER,
        ADDING_DATA_SOURCE,
        ADDING_DATA_SOURCE_FAILED,
        DATA_SOURCE_ADDED,
        DATA_SOURCE_DELETED,
        CURRENT_CASE,
        REPORT_ADDED,
        REPORT_DELETED,
        BLACKBOARD_ARTIFACT_TAG_ADDED,
        BLACKBOARD_ARTIFACT_TAG_DELETED,
        CONTENT_TAG_ADDED,
        CONTENT_TAG_DELETED;
    };

    @NbBundle.Messages({"Case_caseType_singleUser=Single-user case",
        "Case_caseType_multiUser=Multi-user case"})
    public enum CaseType {

        SINGLE_USER_CASE("Single-user case"), //NON-NLS
        MULTI_USER_CASE("Multi-user case");   //NON-NLS

        private final String caseType;

        private CaseType(String s) {
            caseType = s;
        }

        public boolean equalsName(String otherType) {
            return (otherType == null) ? false : caseType.equals(otherType);
        }

        public static CaseType fromString(String typeName) {
            if (typeName != null) {
                for (CaseType c : CaseType.values()) {
                    if (typeName.equalsIgnoreCase(c.caseType)) {
                        return c;
                    }
                }
            }
            return null;
        }

        @Override
        public String toString() {
            return caseType;
        }

        String getLocalizedDisplayName() {
            if (fromString(caseType) == SINGLE_USER_CASE) {
                return Bundle.Case_caseType_singleUser();
            } else {
                return Bundle.Case_caseType_multiUser();
            }
        }
    };

    private String name;
    private String number;
    private String examiner;
    private String configFilePath;
    private final XMLCaseManagement xmlcm;
    private final SleuthkitCase db;
    // Track the current case (only set with changeCase() method)
    private static Case currentCase = null;
    private final CaseType caseType;
    private final Services services;
    private static final Logger logger = Logger.getLogger(Case.class.getName());
    static final String CASE_EXTENSION = "aut"; //NON-NLS
    static final String CASE_DOT_EXTENSION = "." + CASE_EXTENSION;
    private final static String CACHE_FOLDER = "Cache"; //NON-NLS
    private final static String EXPORT_FOLDER = "Export"; //NON-NLS
    private final static String LOG_FOLDER = "Log"; //NON-NLS
    final static String MODULE_FOLDER = "ModuleOutput"; //NON-NLS
    private final static String REPORTS_FOLDER = "Reports"; //NON-NLS
    private final static String TEMP_FOLDER = "Temp"; //NON-NLS

    // we cache if the case has data in it yet since a few places ask for it and we dont' need to keep going to DB
    private boolean hasData = false;

    private CollaborationMonitor collaborationMonitor;

    private Case(String name, String number, String examiner, String configFilePath, XMLCaseManagement xmlcm, SleuthkitCase db, CaseType type) {
        this.name = name;
        this.number = number;
        this.examiner = examiner;
        this.configFilePath = configFilePath;
        this.xmlcm = xmlcm;
        this.caseType = type;
        this.db = db;
        this.services = new Services(db);
    }

    public static Case getCurrentCase() {
        if (currentCase != null) {
            return currentCase;
        } else {
            throw new IllegalStateException(NbBundle.getMessage(Case.class, "Case.getCurCase.exception.noneOpen"));
        }
    }

    public static boolean isCaseOpen() {
        return currentCase != null;
    }

    private static void changeCase(Case newCase) {
        // close the existing case
        Case oldCase = Case.currentCase;
        Case.currentCase = null;
        if (oldCase != null) {
            SwingUtilities.invokeLater(() -> {
                WindowManager.getDefault().getMainWindow().setCursor(Cursor.getPredefinedCursor(Cursor.WAIT_CURSOR));
            });
            IngestManager.getInstance().cancelAllIngestJobs(IngestJob.CancellationReason.CASE_CLOSED);
            doCaseChange(null); //closes windows, etc   
            if (null != oldCase.tskErrorReporter) {
                oldCase.tskErrorReporter.shutdown(); // stop listening for TSK errors for the old case
                oldCase.tskErrorReporter = null;
            }
            eventPublisher.publishLocally(new AutopsyEvent(Events.CURRENT_CASE.toString(), oldCase, null));
            if (CaseType.MULTI_USER_CASE == oldCase.getCaseType()) {
                if (null != oldCase.collaborationMonitor) {
                    oldCase.collaborationMonitor.shutdown();
                }
                eventPublisher.closeRemoteEventChannel();
            }
        }

        if (newCase != null) {
            currentCase = newCase;
            Logger.setLogDirectory(currentCase.getLogDirectoryPath());
            // sanity check
            if (null != currentCase.tskErrorReporter) {
                currentCase.tskErrorReporter.shutdown();
            }
            // start listening for TSK errors for the new case
            currentCase.tskErrorReporter = new IntervalErrorReportData(currentCase, MIN_SECONDS_BETWEEN_ERROR_REPORTS,
                    NbBundle.getMessage(Case.class, "IntervalErrorReport.ErrorText"));
            doCaseChange(currentCase);
            SwingUtilities.invokeLater(() -> {
                RecentCases.getInstance().addRecentCase(currentCase.name, currentCase.configFilePath); // update the recent cases
            });
            if (CaseType.MULTI_USER_CASE == newCase.getCaseType()) {
                try {
                    eventPublisher.openRemoteEventChannel(String.format(EVENT_CHANNEL_NAME, newCase.getTextIndexName()));
                    currentCase.collaborationMonitor = new CollaborationMonitor();
                } catch (AutopsyEventException | CollaborationMonitor.CollaborationMonitorException ex) {
                    logger.log(Level.SEVERE, "Failed to setup for collaboration", ex); //NON-NLS
                    MessageNotifyUtil.Notify.error(NbBundle.getMessage(Case.class, "Case.CollaborationSetup.FailNotify.Title"), NbBundle.getMessage(Case.class, "Case.CollaborationSetup.FailNotify.ErrMsg"));
                }
            }
            eventPublisher.publishLocally(new AutopsyEvent(Events.CURRENT_CASE.toString(), null, currentCase));

        } else {
            Logger.setLogDirectory(PlatformUtil.getLogDirectory());
        }
        SwingUtilities.invokeLater(() -> {
            WindowManager.getDefault().getMainWindow().setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR));
        });
    }

    @Override
    public void receiveError(String context, String errorMessage) {
        /*
         * NOTE: We are accessing tskErrorReporter from two different threads.
         * This is ok as long as we only read the value of tskErrorReporter
         * because tskErrorReporter is declared as volatile.
         */
        if (null != tskErrorReporter) {
            tskErrorReporter.addProblems(context, errorMessage);
        }
    }

    AddImageProcess makeAddImageProcess(String timezone, boolean processUnallocSpace, boolean noFatOrphans) {
        return this.db.makeAddImageProcess(timezone, processUnallocSpace, noFatOrphans);
    }

    public static void create(String caseDir, String caseName, String caseNumber, String examiner) throws CaseActionException {
        create(caseDir, caseName, caseNumber, examiner, CaseType.SINGLE_USER_CASE);
    }

    public static void create(String caseDir, String caseName, String caseNumber, String examiner, CaseType caseType) throws CaseActionException {
        logger.log(Level.INFO, "Creating case with case directory {0}, caseName {1}", new Object[]{caseDir, caseName}); //NON-NLS

        /*
         * Create case directory if it doesn't already exist.
         */
        if (new File(caseDir).exists() == false) {
            Case.createCaseDirectory(caseDir, caseType);
        }

        /*
         * Sanitize the case name, create a unique keyword search index name,
         * and create a standard (single-user) or unique (multi-user) case
         * database name.
         */
        String santizedCaseName = sanitizeCaseName(caseName);
        SimpleDateFormat dateFormat = new SimpleDateFormat("yyyyMMdd_HHmmss");
        Date date = new Date();
        String indexName = santizedCaseName + "_" + dateFormat.format(date);
        String dbName = null;
        if (caseType == CaseType.SINGLE_USER_CASE) {
            dbName = caseDir + File.separator + "autopsy.db"; //NON-NLS
        } else if (caseType == CaseType.MULTI_USER_CASE) {
            dbName = indexName;
        }

        /*
         * Create the case metadata (.aut) file.
         *
         * TODO (AUT-1885): Replace use of obsolete and unsafe XMLCaseManagement
         * class with use of CaseMetadata class.
         */
        String configFilePath = caseDir + File.separator + caseName + CASE_DOT_EXTENSION;
        XMLCaseManagement xmlcm = new XMLCaseManagement();
        xmlcm.create(caseDir, caseName, examiner, caseNumber, caseType, dbName, indexName);
        xmlcm.writeFile();

        /*
         * Create the case database.
         */
        SleuthkitCase db = null;
        try {
            if (caseType == CaseType.SINGLE_USER_CASE) {
                db = SleuthkitCase.newCase(dbName);
            } else if (caseType == CaseType.MULTI_USER_CASE) {
                db = SleuthkitCase.newCase(dbName, UserPreferences.getDatabaseConnectionInfo(), caseDir);
            }
        } catch (TskCoreException ex) {
            logger.log(Level.SEVERE, String.format("Error creating a case %s in %s ", caseName, caseDir), ex); //NON-NLS
            SwingUtilities.invokeLater(() -> {
                WindowManager.getDefault().getMainWindow().setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR));
            });
            /*
             * SleuthkitCase.newCase throws TskCoreExceptions with user-friendly
             * messages, so propagate the exception message.
             */
            throw new CaseActionException(ex.getMessage(), ex); //NON-NLS
        } catch (UserPreferencesException ex) {
            logger.log(Level.SEVERE, "Error accessing case database connection info", ex); //NON-NLS
            SwingUtilities.invokeLater(() -> {
                WindowManager.getDefault().getMainWindow().setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR));
            });
            throw new CaseActionException(NbBundle.getMessage(Case.class, "Case.databaseConnectionInfo.error.msg"), ex);
        }

        Case newCase = new Case(caseName, caseNumber, examiner, configFilePath, xmlcm, db, caseType);
        changeCase(newCase);
    }

    static String sanitizeCaseName(String caseName) {

        String result;

        // Remove all non-ASCII characters
        result = caseName.replaceAll("[^\\p{ASCII}]", "_"); //NON-NLS

        // Remove all control characters
        result = result.replaceAll("[\\p{Cntrl}]", "_"); //NON-NLS

        // Remove / \ : ? space ' "
        result = result.replaceAll("[ /?:'\"\\\\]", "_"); //NON-NLS

        // Make it all lowercase
        result = result.toLowerCase();

        // Must start with letter or underscore for PostgreSQL. If not, prepend an underscore.
        if (result.length() > 0 && !(Character.isLetter(result.codePointAt(0))) && !(result.codePointAt(0) == '_')) {
            result = "_" + result;
        }

        // Chop to 63-16=47 left (63 max for PostgreSQL, taking 16 for the date _20151225_123456)
        if (result.length() > MAX_SANITIZED_NAME_LENGTH) {
            result = result.substring(0, MAX_SANITIZED_NAME_LENGTH);
        }

        if (result.isEmpty()) {
            result = "case"; //NON-NLS
        }

        return result;
    }

    public static void open(String caseMetadataFilePath) throws CaseActionException {
        logger.log(Level.INFO, "Opening case with metadata file path {0}", caseMetadataFilePath); //NON-NLS

        /*
         * Verify the extension of the case metadata file.
         */
        if (!caseMetadataFilePath.endsWith(CASE_DOT_EXTENSION)) {
            throw new CaseActionException(NbBundle.getMessage(Case.class, "Case.open.exception.checkFile.msg", CASE_DOT_EXTENSION));
        }

        try {
            /*
             * Get the case metadata required to open the case database.
             */
            CaseMetadata metadata = new CaseMetadata(Paths.get(caseMetadataFilePath));
            String caseName = metadata.getCaseName();
            String caseNumber = metadata.getCaseNumber();
            String examiner = metadata.getExaminer();
            CaseType caseType = metadata.getCaseType();
            String caseDir = metadata.getCaseDirectory();

            /*
             * Open the case database.
             */
            SleuthkitCase db;
            if (caseType == CaseType.SINGLE_USER_CASE) {
                String dbPath = Paths.get(caseDir, "autopsy.db").toString(); //NON-NLS
                db = SleuthkitCase.openCase(dbPath);
            } else {
                if (!UserPreferences.getIsMultiUserModeEnabled()) {
                    throw new CaseActionException(NbBundle.getMessage(Case.class, "Case.open.exception.multiUserCaseNotEnabled"));
                }
                try {
                    db = SleuthkitCase.openCase(metadata.getCaseDatabaseName(), UserPreferences.getDatabaseConnectionInfo(), caseDir);
                } catch (UserPreferencesException ex) {
                    throw new CaseActionException(NbBundle.getMessage(Case.class, "Case.databaseConnectionInfo.error.msg"), ex);
                }
            }

            /*
             * Check for the presence of the UI and do things that can only be
             * done with user interaction.
             */
            if (RuntimeProperties.coreComponentsAreActive()) {
                /*
                 * If the case database was upgraded for a new schema, notify
                 * the user.
                 */
                if (null != db.getBackupDatabasePath()) {
                    SwingUtilities.invokeLater(() -> {
                        JOptionPane.showMessageDialog(
                                WindowManager.getDefault().getMainWindow(),
                                NbBundle.getMessage(Case.class, "Case.open.msgDlg.updated.msg", db.getBackupDatabasePath()),
                                NbBundle.getMessage(Case.class, "Case.open.msgDlg.updated.title"),
                                JOptionPane.INFORMATION_MESSAGE);
                    });
                }

                /*
                 * Look for the files for the data sources listed in the case
                 * database and give the user the opportunity to locate any that
                 * are missing.
                 */
                Map<Long, String> imgPaths = getImagePaths(db);
                for (Map.Entry<Long, String> entry : imgPaths.entrySet()) {
                    long obj_id = entry.getKey();
                    String path = entry.getValue();
                    boolean fileExists = (pathExists(path) || driveExists(path));
                    if (!fileExists) {
                        int ret = JOptionPane.showConfirmDialog(
                                WindowManager.getDefault().getMainWindow(),
                                NbBundle.getMessage(Case.class, "Case.checkImgExist.confDlg.doesntExist.msg", getAppName(), path),
                                NbBundle.getMessage(Case.class, "Case.checkImgExist.confDlg.doesntExist.title"),
                                JOptionPane.YES_NO_OPTION);
                        if (ret == JOptionPane.YES_OPTION) {
                            MissingImageDialog.makeDialog(obj_id, db);
                        } else {
                            logger.log(Level.WARNING, "Selected image files don't match old files!"); //NON-NLS
                        }
                    }
                }
            }

            /*
             * TODO (AUT-1885): Replace use of obsolete and unsafe
             * XMLCaseManagement class with use of CaseMetadata class.
             */
            XMLCaseManagement xmlcm = new XMLCaseManagement();
            xmlcm.open(caseMetadataFilePath);
            Case openedCase = new Case(caseName, caseNumber, examiner, caseMetadataFilePath, xmlcm, db, caseType);
            changeCase(openedCase);

        } catch (CaseMetadataException ex) {
            throw new CaseActionException(NbBundle.getMessage(Case.class, "Case.metaDataFileCorrupt.exception.msg"), ex); //NON-NLS
        } catch (TskCoreException ex) {
            SwingUtilities.invokeLater(() -> {
                WindowManager.getDefault().getMainWindow().setCursor(Cursor.getPredefinedCursor(Cursor.DEFAULT_CURSOR));
            });
            /*
             * SleuthkitCase.openCase throws TskCoreExceptions with
             * user-friendly messages, so propagate the exception message.
             */
            throw new CaseActionException(ex.getMessage(), ex);
        }
    }

    static Map<Long, String> getImagePaths(SleuthkitCase db) { //TODO: clean this up
        Map<Long, String> imgPaths = new HashMap<>();
        try {
            Map<Long, List<String>> imgPathsList = db.getImagePaths();
            for (Map.Entry<Long, List<String>> entry : imgPathsList.entrySet()) {
                if (entry.getValue().size() > 0) {
                    imgPaths.put(entry.getKey(), entry.getValue().get(0));
                }
            }
        } catch (TskException ex) {
            logger.log(Level.WARNING, "Error getting image paths", ex); //NON-NLS
        }
        return imgPaths;
    }

    @Deprecated
    public Image addImage(String imgPath, long imgId, String timeZone) throws CaseActionException {
        try {
            Image newDataSource = db.getImageById(imgId);
            notifyDataSourceAdded(newDataSource, UUID.randomUUID());
            return newDataSource;
        } catch (Exception ex) {
            throw new CaseActionException(NbBundle.getMessage(this.getClass(), "Case.addImg.exception.msg"), ex);
        }
    }

    @Deprecated
    void addLocalDataSource(Content newDataSource) {
        notifyDataSourceAdded(newDataSource, UUID.randomUUID());
    }

    public void notifyAddingDataSource(UUID dataSourceId) {
        eventPublisher.publish(new AddingDataSourceEvent(dataSourceId));
    }

    public void notifyFailedAddingDataSource(UUID dataSourceId) {
        eventPublisher.publish(new AddingDataSourceFailedEvent(dataSourceId));
    }

    public void notifyDataSourceAdded(Content newDataSource, UUID dataSourceId) {
        eventPublisher.publish(new DataSourceAddedEvent(newDataSource, dataSourceId));
    }

    public void notifyContentTagAdded(ContentTag newTag) {
        eventPublisher.publish(new ContentTagAddedEvent(newTag));
    }

    public void notifyContentTagDeleted(ContentTag deletedTag) {
        eventPublisher.publish(new ContentTagDeletedEvent(deletedTag));
    }

    public void notifyBlackBoardArtifactTagAdded(BlackboardArtifactTag newTag) {
        eventPublisher.publish(new BlackBoardArtifactTagAddedEvent(newTag));
    }

    public void notifyBlackBoardArtifactTagDeleted(BlackboardArtifactTag deletedTag) {
        eventPublisher.publish(new BlackBoardArtifactTagDeletedEvent(deletedTag));
    }

    public Services getServices() {
        return services;
    }

    public SleuthkitCase getSleuthkitCase() {
        return this.db;
    }

    public void closeCase() throws CaseActionException {
        changeCase(null);
        try {
            services.close();
            this.xmlcm.close(); // close the xmlcm
            this.db.close();
        } catch (Exception e) {
            throw new CaseActionException(NbBundle.getMessage(this.getClass(), "Case.closeCase.exception.msg"), e);
        }
    }

    void deleteCase(File caseDir) throws CaseActionException {
        logger.log(Level.INFO, "Deleting case.\ncaseDir: {0}", caseDir); //NON-NLS

        try {

            xmlcm.close(); // close the xmlcm
            boolean result = deleteCaseDirectory(caseDir); // delete the directory

            RecentCases.getInstance().removeRecentCase(this.name, this.configFilePath); // remove it from the recent case
            Case.changeCase(null);
            if (result == false) {
                throw new CaseActionException(
                        NbBundle.getMessage(this.getClass(), "Case.deleteCase.exception.msg", caseDir));
            }
        } catch (Exception ex) {
            logger.log(Level.SEVERE, "Error deleting the current case dir: " + caseDir, ex); //NON-NLS
            throw new CaseActionException(
                    NbBundle.getMessage(this.getClass(), "Case.deleteCase.exception.msg2", caseDir), ex);
        }
    }

    void updateCaseName(String oldCaseName, String oldPath, String newCaseName, String newPath) throws CaseActionException {
        try {
            xmlcm.setCaseName(newCaseName); // set the case
            name = newCaseName; // change the local value
            eventPublisher.publish(new AutopsyEvent(Events.NAME.toString(), oldCaseName, newCaseName));
            SwingUtilities.invokeLater(() -> {
                try {
                    RecentCases.getInstance().updateRecentCase(oldCaseName, oldPath, newCaseName, newPath); // update the recent case 
                    updateMainWindowTitle(newCaseName);
                } catch (Exception e) {
                    Logger.getLogger(Case.class.getName()).log(Level.WARNING, "Error: problem updating case name.", e); //NON-NLS
                }
            });
        } catch (Exception e) {
            throw new CaseActionException(NbBundle.getMessage(this.getClass(), "Case.updateCaseName.exception.msg"), e);
        }
    }

    void updateExaminer(String oldExaminer, String newExaminer) throws CaseActionException {
        try {
            xmlcm.setCaseExaminer(newExaminer); // set the examiner
            examiner = newExaminer;
            eventPublisher.publish(new AutopsyEvent(Events.EXAMINER.toString(), oldExaminer, newExaminer));
        } catch (Exception e) {
            throw new CaseActionException(NbBundle.getMessage(this.getClass(), "Case.updateExaminer.exception.msg"), e);
        }
    }

    void updateCaseNumber(String oldCaseNumber, String newCaseNumber) throws CaseActionException {
        try {
            xmlcm.setCaseNumber(newCaseNumber); // set the case number
            number = newCaseNumber;
            eventPublisher.publish(new AutopsyEvent(Events.NUMBER.toString(), oldCaseNumber, newCaseNumber));
        } catch (Exception e) {
            throw new CaseActionException(NbBundle.getMessage(this.getClass(), "Case.updateCaseNum.exception.msg"), e);
        }
    }

    public static boolean existsCurrentCase() {
        return currentCase != null;
    }

    private void setConfigFilePath(String givenPath) {
        configFilePath = givenPath;
    }

    String getConfigFilePath() {
        return configFilePath;
    }

    public static String getAutopsyVersion() {
        return autopsyVer;
    }

    public static String getAppName() {
        if ((appName == null) || appName.equals("")) {
            appName = WindowManager.getDefault().getMainWindow().getTitle();
        }
        return appName;
    }

    public String getName() {
        return name;
    }

    public String getNumber() {
        return number;
    }

    public String getExaminer() {
        return examiner;
    }

    public String getCaseDirectory() {
        if (xmlcm == null) {
            return "";
        } else {
            return xmlcm.getCaseDirectory();
        }
    }

    public CaseType getCaseType() {
        return this.caseType;
    }

    public String getTempDirectory() {
        return getDirectory(TEMP_FOLDER);
    }

    public String getCacheDirectory() {
        return getDirectory(CACHE_FOLDER);
    }

    public String getExportDirectory() {
        return getDirectory(EXPORT_FOLDER);
    }

    public String getLogDirectoryPath() {
        return getDirectory(LOG_FOLDER);
    }

    public String getReportDirectory() {
        return getDirectory(REPORTS_FOLDER);
    }

    public String getModuleDirectory() {
        return getDirectory(MODULE_FOLDER);
    }

    public String getOutputDirectory() {
        return getHostDirectory();
    }

    private String getDirectory(String input) {
        File theDirectory = new File(getHostDirectory() + File.separator + input);
        if (!theDirectory.exists()) {  // Create it if it doesn't exist already.
            theDirectory.mkdirs();
        }
        return theDirectory.toString();
    }

    public String getModuleOutputDirectoryRelativePath() {
        Path thePath;
        if (getCaseType() == CaseType.MULTI_USER_CASE) {
            thePath = Paths.get(NetworkUtils.getLocalHostName(), MODULE_FOLDER);
        } else {
            thePath = Paths.get(MODULE_FOLDER);
        }
        // Do not autocreate this relative path. It will have already been
        // created when the case was made.
        return thePath.toString();
    }

    private String getHostDirectory() {
        String caseDirectory = getCaseDirectory();
        Path hostPath;
        if (caseType == CaseType.MULTI_USER_CASE) {
            hostPath = Paths.get(caseDirectory, NetworkUtils.getLocalHostName());
        } else {
            hostPath = Paths.get(caseDirectory);
        }
        if (!hostPath.toFile().exists()) {
            hostPath.toFile().mkdirs();
        }
        return hostPath.toString();
    }

    @Deprecated
    public String getModulesOutputDirAbsPath() {
        return getModuleDirectory();
    }

    @Deprecated
    public static String getModulesOutputDirRelPath() {
        return "ModuleOutput"; //NON-NLS
    }

    @Deprecated
    public static PropertyChangeSupport getPropertyChangeSupport() {
        return new PropertyChangeSupport(Case.class);
    }

    public List<Content> getDataSources() throws TskCoreException {
        List<Content> list = db.getRootObjects();
        hasData = (list.size() > 0);
        return list;
    }

    public String getCreatedDate() {
        if (xmlcm == null) {
            return "";
        } else {
            return xmlcm.getCreatedDate();
        }
    }

    public String getTextIndexName() {
        if (xmlcm == null) {
            return "";
        } else {
            return xmlcm.getTextIndexName();
        }
    }

    public Set<TimeZone> getTimeZone() {
        Set<TimeZone> timezones = new HashSet<>();
        try {
            for (Content c : getDataSources()) {
                final Content dataSource = c.getDataSource();
                if ((dataSource != null) && (dataSource instanceof Image)) {
                    Image image = (Image) dataSource;
                    timezones.add(TimeZone.getTimeZone(image.getTimeZone()));
                }
            }
        } catch (TskCoreException ex) {
            logger.log(Level.INFO, "Error getting time zones", ex); //NON-NLS
        }
        return timezones;
    }

    public static synchronized void addPropertyChangeListener(PropertyChangeListener listener) {
        addEventSubscriber(Stream.of(Events.values())
                .map(Events::toString)
                .collect(Collectors.toSet()), listener);
    }

    public static synchronized void removePropertyChangeListener(PropertyChangeListener listener) {
        removeEventSubscriber(Stream.of(Events.values())
                .map(Events::toString)
                .collect(Collectors.toSet()), listener);
    }

    public static void addEventSubscriber(Set<String> eventNames, PropertyChangeListener subscriber) {
        eventPublisher.addSubscriber(eventNames, subscriber);
    }

    public static void addEventSubscriber(String eventName, PropertyChangeListener subscriber) {
        eventPublisher.addSubscriber(eventName, subscriber);
    }

    public static void removeEventSubscriber(String eventName, PropertyChangeListener subscriber) {
        eventPublisher.removeSubscriber(eventName, subscriber);
    }

    public static void removeEventSubscriber(Set<String> eventNames, PropertyChangeListener subscriber) {
        eventPublisher.removeSubscriber(eventNames, subscriber);
    }

    public static boolean pathExists(String imgPath) {
        return new File(imgPath).isFile();
    }
    private static final String pdisk = "\\\\.\\physicaldrive"; //NON-NLS
    private static final String dev = "/dev/"; //NON-NLS

    static boolean isPhysicalDrive(String path) {
        return path.toLowerCase().startsWith(pdisk)
                || path.toLowerCase().startsWith(dev);
    }

    static boolean isPartition(String path) {
        return path.toLowerCase().startsWith("\\\\.\\")
                && path.toLowerCase().endsWith(":");
    }

    static boolean driveExists(String path) {
        // Test the drive by reading the first byte and checking if it's -1
        BufferedInputStream br = null;
        try {
            File tmp = new File(path);
            br = new BufferedInputStream(new FileInputStream(tmp));
            int b = br.read();
            return b != -1;
        } catch (Exception ex) {
            return false;
        } finally {
            try {
                if (br != null) {
                    br.close();
                }
            } catch (IOException ex) {
            }
        }
    }

    public static String convertTimeZone(String timezoneID) {

        TimeZone zone = TimeZone.getTimeZone(timezoneID);
        int offset = zone.getRawOffset() / 1000;
        int hour = offset / 3600;
        int min = (offset % 3600) / 60;

        DateFormat dfm = new SimpleDateFormat("z");
        dfm.setTimeZone(zone);
        boolean hasDaylight = zone.useDaylightTime();
        String first = dfm.format(new GregorianCalendar(2010, 1, 1).getTime()).substring(0, 3); // make it only 3 letters code
        String second = dfm.format(new GregorianCalendar(2011, 6, 6).getTime()).substring(0, 3); // make it only 3 letters code
        int mid = hour * -1;
        String result = first + Integer.toString(mid);
        if (min != 0) {
            result = result + ":" + Integer.toString(min);
        }
        if (hasDaylight) {
            result = result + second;
        }

        return result;
    }

    @Deprecated
    static void createCaseDirectory(String caseDir, String caseName) throws CaseActionException {
        createCaseDirectory(caseDir, CaseType.SINGLE_USER_CASE);
    }

    static void createCaseDirectory(String caseDir, CaseType caseType) throws CaseActionException {

        File caseDirF = new File(caseDir);
        if (caseDirF.exists()) {
            if (caseDirF.isFile()) {
                throw new CaseActionException(
                        NbBundle.getMessage(Case.class, "Case.createCaseDir.exception.existNotDir", caseDir));
            } else if (!caseDirF.canRead() || !caseDirF.canWrite()) {
                throw new CaseActionException(
                        NbBundle.getMessage(Case.class, "Case.createCaseDir.exception.existCantRW", caseDir));
            }
        }

        try {
            boolean result = (caseDirF).mkdirs(); // create root case Directory
            if (result == false) {
                throw new CaseActionException(
                        NbBundle.getMessage(Case.class, "Case.createCaseDir.exception.cantCreate", caseDir));
            }

            // create the folders inside the case directory
            String hostClause = "";

            if (caseType == CaseType.MULTI_USER_CASE) {
                hostClause = File.separator + NetworkUtils.getLocalHostName();
            }
            result = result && (new File(caseDir + hostClause + File.separator + EXPORT_FOLDER)).mkdirs()
                    && (new File(caseDir + hostClause + File.separator + LOG_FOLDER)).mkdirs()
                    && (new File(caseDir + hostClause + File.separator + TEMP_FOLDER)).mkdirs()
                    && (new File(caseDir + hostClause + File.separator + CACHE_FOLDER)).mkdirs();

            if (result == false) {
                throw new CaseActionException(
                        NbBundle.getMessage(Case.class, "Case.createCaseDir.exception.cantCreateCaseDir", caseDir));
            }

            final String modulesOutDir = caseDir + hostClause + File.separator + MODULE_FOLDER;
            result = new File(modulesOutDir).mkdir();
            if (result == false) {
                throw new CaseActionException(
                        NbBundle.getMessage(Case.class, "Case.createCaseDir.exception.cantCreateModDir",
                                modulesOutDir));
            }

            final String reportsOutDir = caseDir + hostClause + File.separator + REPORTS_FOLDER;
            result = new File(reportsOutDir).mkdir();
            if (result == false) {
                throw new CaseActionException(
                        NbBundle.getMessage(Case.class, "Case.createCaseDir.exception.cantCreateReportsDir",
                                modulesOutDir));
            }

        } catch (Exception e) {
            throw new CaseActionException(
                    NbBundle.getMessage(Case.class, "Case.createCaseDir.exception.gen", caseDir), e);
        }
    }

    static boolean deleteCaseDirectory(File casePath) {
        logger.log(Level.INFO, "Deleting case directory: {0}", casePath.getAbsolutePath()); //NON-NLS
        return FileUtil.deleteDir(casePath);
    }

    static public void invokeStartupDialog() {
        StartupWindowProvider.getInstance().open();
    }

    static public boolean isValidName(String caseName) {
        return !(caseName.contains("\\") || caseName.contains("/") || caseName.contains(":")
                || caseName.contains("*") || caseName.contains("?") || caseName.contains("\"")
                || caseName.contains("<") || caseName.contains(">") || caseName.contains("|"));
    }

    static private void clearTempFolder() {
        File tempFolder = new File(currentCase.getTempDirectory());
        if (tempFolder.isDirectory()) {
            File[] files = tempFolder.listFiles();
            if (files.length > 0) {
                for (File file : files) {
                    if (file.isDirectory()) {
                        deleteCaseDirectory(file);
                    } else {
                        file.delete();
                    }
                }
            }
        }
    }

    private static void checkSubFolders(Case openedCase) {
        String modulesOutputDir = openedCase.getModuleDirectory();
        File modulesOutputDirF = new File(modulesOutputDir);
        if (!modulesOutputDirF.exists()) {
            logger.log(Level.INFO, "Creating modules output dir for the case."); //NON-NLS

            try {
                if (!modulesOutputDirF.mkdir()) {
                    logger.log(Level.SEVERE, "Error creating modules output dir for the case, dir: {0}", modulesOutputDir); //NON-NLS
                }
            } catch (SecurityException e) {
                logger.log(Level.SEVERE, "Error creating modules output dir for the case, dir: " + modulesOutputDir, e); //NON-NLS
            }
        }
    }

    //case change helper
    private static void doCaseChange(Case toChangeTo) {
        logger.log(Level.INFO, "Changing Case to: {0}", toChangeTo); //NON-NLS
        if (toChangeTo != null) { // new case is open

            // clear the temp folder when the case is created / opened
            Case.clearTempFolder();
            checkSubFolders(toChangeTo);

            if (RuntimeProperties.coreComponentsAreActive()) {
                // enable these menus
                CallableSystemAction.get(AddImageAction.class).setEnabled(true);
                CallableSystemAction.get(CaseCloseAction.class).setEnabled(true);
                CallableSystemAction.get(CasePropertiesAction.class).setEnabled(true);
                CallableSystemAction.get(CaseDeleteAction.class).setEnabled(true); // Delete Case menu

                if (toChangeTo.hasData()) {
                    // open all top components
                    SwingUtilities.invokeLater(() -> {
                        CoreComponentControl.openCoreWindows();
                    });
                } else {
                    // close all top components
                    SwingUtilities.invokeLater(() -> {
                        CoreComponentControl.closeCoreWindows();
                    });
                }
            }

            if (RuntimeProperties.coreComponentsAreActive()) {
                SwingUtilities.invokeLater(() -> {
                    updateMainWindowTitle(currentCase.name);
                });
            } else {
                SwingUtilities.invokeLater(() -> {
                    Frame f = WindowManager.getDefault().getMainWindow();
                    f.setTitle(Case.getAppName()); // set the window name to just application name           
                });
            }

        } else { // case is closed
            if (RuntimeProperties.coreComponentsAreActive()) {

                SwingUtilities.invokeLater(() -> {
                    // close all top components first
                    CoreComponentControl.closeCoreWindows();

                    // disable these menus
                    CallableSystemAction.get(AddImageAction.class).setEnabled(false); // Add Image menu
                    CallableSystemAction.get(CaseCloseAction.class).setEnabled(false); // Case Close menu
                    CallableSystemAction.get(CasePropertiesAction.class).setEnabled(false); // Case Properties menu
                    CallableSystemAction.get(CaseDeleteAction.class).setEnabled(false); // Delete Case menu
                });
            }

            //clear pending notifications
            SwingUtilities.invokeLater(() -> {
                MessageNotifyUtil.Notify.clear();
            });

            SwingUtilities.invokeLater(() -> {
                Frame f = WindowManager.getDefault().getMainWindow();
                f.setTitle(Case.getAppName()); // set the window name to just application name
            });

            //try to force gc to happen
            System.gc();
            System.gc();
        }

        //log memory usage after case changed
        logger.log(Level.INFO, PlatformUtil.getAllMemUsageInfo());

    }

    //case name change helper
    private static void updateMainWindowTitle(String newCaseName) {
        // update case name
        if (!newCaseName.equals("")) {
            Frame f = WindowManager.getDefault().getMainWindow();
            f.setTitle(newCaseName + " - " + Case.getAppName()); // set the window name to the new value
        }
    }

    public void addReport(String localPath, String srcModuleName, String reportName) throws TskCoreException {
        String normalizedLocalPath;
        try {
            normalizedLocalPath = Paths.get(localPath).normalize().toString();
        } catch (InvalidPathException ex) {
            String errorMsg = "Invalid local path provided: " + localPath; // NON-NLS
            throw new TskCoreException(errorMsg, ex);
        }
        Report report = this.db.addReport(normalizedLocalPath, srcModuleName, reportName);
        eventPublisher.publish(new ReportAddedEvent(report));
    }

    public List<Report> getAllReports() throws TskCoreException {
        return this.db.getAllReports();
    }

    public void deleteReports(Collection<? extends Report> reports, boolean deleteFromDisk) throws TskCoreException {

        String pathToReportsFolder = Paths.get(this.db.getDbDirPath(), "Reports").normalize().toString(); // NON-NLS
        for (Report report : reports) {

            // delete from the database.
            this.db.deleteReport(report);

            if (deleteFromDisk) {
                // traverse to the root directory of Report report.
                String reportPath = report.getPath();
                while (!Paths.get(reportPath, "..").normalize().toString().equals(pathToReportsFolder)) { // NON-NLS
                    reportPath = Paths.get(reportPath, "..").normalize().toString(); // NON-NLS
                }

                // delete from the disk.
                try {
                    FileUtils.deleteDirectory(new File(reportPath));
                } catch (IOException | SecurityException ex) {
                    logger.log(Level.WARNING, NbBundle.getMessage(Case.class, "Case.deleteReports.deleteFromDiskException.log.msg"), ex);
                    JOptionPane.showMessageDialog(null, NbBundle.getMessage(Case.class, "Case.deleteReports.deleteFromDiskException.msg", report.getReportName(), reportPath));
                }
            }

            eventPublisher.publish(new AutopsyEvent(Events.REPORT_DELETED.toString(), null, null));
        }
    }

    public boolean hasData() {
        // false is also the initial value, so make the DB trip if it is still false
        if (!hasData) {
            try {
                hasData = (getDataSources().size() > 0);
            } catch (TskCoreException ex) {
            }
        }
        return hasData;
    }

}