Autopsy  4.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
EventCluster.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2013-15 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.timeline.datamodel;
20 
21 import com.google.common.collect.ImmutableSet;
22 import com.google.common.collect.ImmutableSortedSet;
23 import com.google.common.collect.Sets;
24 import java.util.Comparator;
25 import java.util.Objects;
26 import java.util.Optional;
27 import java.util.Set;
28 import java.util.SortedSet;
29 import javax.annotation.concurrent.Immutable;
30 import org.joda.time.Interval;
34 
40 @Immutable
41 public class EventCluster implements EventBundle<EventStripe> {
42 
52  public static EventCluster merge(EventCluster cluster1, EventCluster cluster2) {
53  if (cluster1.getEventType() != cluster2.getEventType()) {
54  throw new IllegalArgumentException("event clusters are not compatible: they have different types");
55  }
56 
57  if (!cluster1.getDescription().equals(cluster2.getDescription())) {
58  throw new IllegalArgumentException("event clusters are not compatible: they have different descriptions");
59  }
60  Sets.SetView<Long> idsUnion = Sets.union(cluster1.getEventIDs(), cluster2.getEventIDs());
61  Sets.SetView<Long> hashHitsUnion = Sets.union(cluster1.getEventIDsWithHashHits(), cluster2.getEventIDsWithHashHits());
62  Sets.SetView<Long> taggedUnion = Sets.union(cluster1.getEventIDsWithTags(), cluster2.getEventIDsWithTags());
63 
64  return new EventCluster(IntervalUtils.span(cluster1.span, cluster2.span), cluster1.getEventType(), idsUnion, hashHitsUnion, taggedUnion, cluster1.getDescription(), cluster1.lod);
65  }
66 
67  final private EventStripe parent;
68 
72  final private Interval span;
73 
77  final private EventType type;
78 
82  final private String description;
83 
87  private final DescriptionLoD lod;
88 
92  final private ImmutableSet<Long> eventIDs;
93 
98  private final ImmutableSet<Long> tagged;
99 
104  private final ImmutableSet<Long> hashHits;
105 
106  private EventCluster(Interval spanningInterval, EventType type, Set<Long> eventIDs, Set<Long> hashHits, Set<Long> tagged, String description, DescriptionLoD lod, EventStripe parent) {
107 
108  this.span = spanningInterval;
109  this.type = type;
110  this.hashHits = ImmutableSet.copyOf(hashHits);
111  this.tagged = ImmutableSet.copyOf(tagged);
112  this.description = description;
113  this.eventIDs = ImmutableSet.copyOf(eventIDs);
114  this.lod = lod;
115  this.parent = parent;
116  }
117 
118  public EventCluster(Interval spanningInterval, EventType type, Set<Long> eventIDs, Set<Long> hashHits, Set<Long> tagged, String description, DescriptionLoD lod) {
119  this(spanningInterval, type, eventIDs, hashHits, tagged, description, lod, null);
120  }
121 
122  @Override
123  public Optional<EventStripe> getParentBundle() {
124  return Optional.ofNullable(parent);
125  }
126 
127  public Interval getSpan() {
128  return span;
129  }
130 
131  @Override
132  public long getStartMillis() {
133  return span.getStartMillis();
134  }
135 
136  @Override
137  public long getEndMillis() {
138  return span.getEndMillis();
139  }
140 
141  @Override
142  @SuppressWarnings("ReturnOfCollectionOrArrayField")
143  public ImmutableSet<Long> getEventIDs() {
144  return eventIDs;
145  }
146 
147  @Override
148  @SuppressWarnings("ReturnOfCollectionOrArrayField")
149  public ImmutableSet<Long> getEventIDsWithHashHits() {
150  return hashHits;
151  }
152 
153  @Override
154  @SuppressWarnings("ReturnOfCollectionOrArrayField")
155  public ImmutableSet<Long> getEventIDsWithTags() {
156  return tagged;
157  }
158 
159  @Override
160  public String getDescription() {
161  return description;
162  }
163 
164  @Override
166  return type;
167  }
168 
169  @Override
171  return lod;
172  }
173 
184  if (Objects.nonNull(this.parent)) {
185  throw new IllegalStateException("Event Cluster already has a parent!");
186  }
187  return new EventCluster(span, type, eventIDs, hashHits, tagged, description, lod, parent);
188  }
189 
190  @Override
191  public SortedSet< EventCluster> getClusters() {
192  return ImmutableSortedSet.orderedBy(Comparator.comparing(EventCluster::getStartMillis)).add(this).build();
193  }
194 
195 }
static Interval span(Interval range, final Interval range2)
EventCluster(Interval spanningInterval, EventType type, Set< Long > eventIDs, Set< Long > hashHits, Set< Long > tagged, String description, DescriptionLoD lod, EventStripe parent)
static EventCluster merge(EventCluster cluster1, EventCluster cluster2)
EventCluster(Interval spanningInterval, EventType type, Set< Long > eventIDs, Set< Long > hashHits, Set< Long > tagged, String description, DescriptionLoD lod)

Copyright © 2012-2015 Basis Technology. Generated on: Wed Apr 6 2016
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.