Autopsy  4.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.timeline.db.EventsRepository Class Reference


enum  DBPopulationMode
class  DBPopulationWorker

Public Member Functions

 EventsRepository (Case autoCase, ReadOnlyObjectProperty< ZoomParams > currentStateProperty)
synchronized Set< Long > addTag (long objID, Long artifactID, Tag tag, EventDB.EventTransaction trans)
boolean areFiltersEquivalent (RootFilter f1, RootFilter f2)
synchronized int countAllEvents ()
synchronized Map< EventType, Long > countEvents (ZoomParams params)
synchronized Set< Long > deleteTag (long objID, Long artifactID, long tagID, boolean tagged)
Case getAutoCase ()
Interval getBoundingEventsInterval (Interval timeRange, RootFilter filter)
synchronized ObservableMap< Long, String > getDatasourcesMap ()
TimeLineEvent getEventById (Long eventID)
Set< Long > getEventIDs (Interval timeRange, RootFilter filter)
synchronized Set< TimeLineEventgetEventsById (Collection< Long > eventIDs)
FilteredEventsModel getEventsModel ()
synchronized List< EventStripegetEventStripes (ZoomParams params)
synchronized ObservableMap< Long, String > getHashSetMap ()
Long getMaxTime ()
Long getMinTime ()
Interval getSpanningInterval (Collection< Long > eventIDs)
Map< String, Long > getTagCountsByTagName (Set< Long > eventIDsWithTags)
ObservableList< TagName > getTagNames ()
boolean hasNewColumns ()
boolean isRebuilding ()
CancellationProgressTask< Void > rebuildRepository (Consumer< Worker.State > onStateChange)
CancellationProgressTask< Void > rebuildTags (Consumer< Worker.State > onStateChange)
void syncTagsFilter (TagsFilter tagsFilter)

Private Member Functions

void invalidateCaches ()
synchronized void invalidateCaches (Set< Long > updatedEventIDs)
synchronized void populateFilterData (SleuthkitCase skCase)
CancellationProgressTask< Void > rebuildRepository (final DBPopulationMode mode, Consumer< Worker.State > onStateChange)

Private Attributes

final Case autoCase
final ObservableMap< Long, String > datasourcesMap = FXCollections.observableHashMap()
DBPopulationWorker dbWorker
final LoadingCache< ZoomParams, Map< EventType, Long > > eventCountsCache
final EventDB eventDB
final LoadingCache< ZoomParams, List< EventStripe > > eventStripeCache
final ObservableMap< Long, String > hashSetMap = FXCollections.observableHashMap()
final LoadingCache< Long, TimeLineEventidToEventCache
final LoadingCache< Object, Long > maxCache
final LoadingCache< Object, Long > minCache
final FilteredEventsModel modelInstance
final ObservableList< TagName > tagNames = FXCollections.observableArrayList()
final Executor workerExecutor = Executors.newSingleThreadExecutor(new ThreadFactoryBuilder().setNameFormat("eventrepository-worker-%d").build())

Static Private Attributes

static final Logger LOGGER = Logger.getLogger(EventsRepository.class.getName())

Detailed Description

Provides higher-level public API (over EventsDB) to access events. In theory this insulates the rest of the timeline module form the details of the db implementation. Since there are no other implementations of the database or clients of this class, and no Java Interface defined yet, in practice this just delegates everything to the eventDB. Some results are also cached by this layer.

Concurrency Policy:

Since almost everything just delegates to the EventDB, which is internally synchronized, we only have to worry about rebuildRepository() which we synchronize on our intrinsic lock.

Definition at line 96 of file

Constructor & Destructor Documentation

org.sleuthkit.autopsy.timeline.db.EventsRepository.EventsRepository ( Case  autoCase,
ReadOnlyObjectProperty< ZoomParams currentStateProperty 

Member Function Documentation

synchronized Set<Long> org.sleuthkit.autopsy.timeline.db.EventsRepository.addTag ( long  objID,
Long  artifactID,
Tag  tag,
EventDB.EventTransaction  trans 
boolean org.sleuthkit.autopsy.timeline.db.EventsRepository.areFiltersEquivalent ( RootFilter  f1,
RootFilter  f2 

Definition at line 314 of file

synchronized int org.sleuthkit.autopsy.timeline.db.EventsRepository.countAllEvents ( )

Definition at line 206 of file

synchronized Map<EventType, Long> org.sleuthkit.autopsy.timeline.db.EventsRepository.countEvents ( ZoomParams  params)
synchronized Set<Long> org.sleuthkit.autopsy.timeline.db.EventsRepository.deleteTag ( long  objID,
Long  artifactID,
long  tagID,
boolean  tagged 
Case org.sleuthkit.autopsy.timeline.db.EventsRepository.getAutoCase ( )
Interval org.sleuthkit.autopsy.timeline.db.EventsRepository.getBoundingEventsInterval ( Interval  timeRange,
RootFilter  filter 
synchronized ObservableMap<Long, String> org.sleuthkit.autopsy.timeline.db.EventsRepository.getDatasourcesMap ( )
TimeLineEvent org.sleuthkit.autopsy.timeline.db.EventsRepository.getEventById ( Long  eventID)
Set<Long> org.sleuthkit.autopsy.timeline.db.EventsRepository.getEventIDs ( Interval  timeRange,
RootFilter  filter 
synchronized Set<TimeLineEvent> org.sleuthkit.autopsy.timeline.db.EventsRepository.getEventsById ( Collection< Long >  eventIDs)
FilteredEventsModel org.sleuthkit.autopsy.timeline.db.EventsRepository.getEventsModel ( )
a FilteredEvetns object with this repository as underlying source of events

Definition at line 140 of file

References org.sleuthkit.autopsy.timeline.db.EventsRepository.modelInstance.

Referenced by org.sleuthkit.autopsy.timeline.TimeLineController.TimeLineController().

synchronized List<EventStripe> org.sleuthkit.autopsy.timeline.db.EventsRepository.getEventStripes ( ZoomParams  params)
synchronized ObservableMap<Long, String> org.sleuthkit.autopsy.timeline.db.EventsRepository.getHashSetMap ( )
Long org.sleuthkit.autopsy.timeline.db.EventsRepository.getMaxTime ( )
min time (in seconds from unix epoch)

Definition at line 169 of file

Referenced by org.sleuthkit.autopsy.timeline.datamodel.FilteredEventsModel.getMaxTime().

Long org.sleuthkit.autopsy.timeline.db.EventsRepository.getMinTime ( )
max tie (in seconds from unix epoch)

Definition at line 177 of file

Referenced by org.sleuthkit.autopsy.timeline.datamodel.FilteredEventsModel.getMinTime().

Interval org.sleuthkit.autopsy.timeline.db.EventsRepository.getSpanningInterval ( Collection< Long >  eventIDs)
Map<String, Long> org.sleuthkit.autopsy.timeline.db.EventsRepository.getTagCountsByTagName ( Set< Long >  eventIDsWithTags)

get a count of tagnames applied to the given event ids as a map from tagname displayname to count of tag applications

eventIDsWithTagsthe event ids to get the tag counts map for
a map from tagname displayname to count of applications

Definition at line 238 of file

Referenced by org.sleuthkit.autopsy.timeline.datamodel.FilteredEventsModel.getTagCountsByTagName().

ObservableList<TagName> org.sleuthkit.autopsy.timeline.db.EventsRepository.getTagNames ( )
boolean org.sleuthkit.autopsy.timeline.db.EventsRepository.hasNewColumns ( )

Definition at line 226 of file

void org.sleuthkit.autopsy.timeline.db.EventsRepository.invalidateCaches ( )
synchronized void org.sleuthkit.autopsy.timeline.db.EventsRepository.invalidateCaches ( Set< Long >  updatedEventIDs)
boolean org.sleuthkit.autopsy.timeline.db.EventsRepository.isRebuilding ( )

Definition at line 319 of file

synchronized void org.sleuthkit.autopsy.timeline.db.EventsRepository.populateFilterData ( SleuthkitCase  skCase)

use the given SleuthkitCase to update the data used to determine the available filters.


Definition at line 248 of file

Referenced by, and org.sleuthkit.autopsy.timeline.db.EventsRepository.EventsRepository().

CancellationProgressTask<Void> org.sleuthkit.autopsy.timeline.db.EventsRepository.rebuildRepository ( Consumer< Worker.State >  onStateChange)

rebuild the entire repo.

onStateChangecalled when he background task changes state. Clients can use this to handle failure, or cleanup operations for example.
the task that will rebuild the repo in a background thread. The task has already been started.

Definition at line 335 of file

References org.sleuthkit.autopsy.timeline.db.EventsRepository.DBPopulationMode.FULL.

Referenced by org.sleuthkit.autopsy.timeline.db.EventsRepository.rebuildTags().

CancellationProgressTask<Void> org.sleuthkit.autopsy.timeline.db.EventsRepository.rebuildRepository ( final DBPopulationMode  mode,
Consumer< Worker.State >  onStateChange 

rebuild the repo.

modethe rebuild mode to use.
onStateChangecalled when he background task changes state. Clients can use this to handle failure, or cleanup operations for example.
the task that will rebuild the repo in a background thread. The task has already been started.

Definition at line 367 of file

References org.sleuthkit.autopsy.timeline.db.EventsRepository.dbWorker.

CancellationProgressTask<Void> org.sleuthkit.autopsy.timeline.db.EventsRepository.rebuildTags ( Consumer< Worker.State >  onStateChange)

drop and rebuild the tags in the repo.

onStateChangecalled when he background task changes state. Clients can use this to handle failure, or cleanup operations for example.
the task that will rebuild the repo in a background thread. The task has already been started.

Definition at line 351 of file

References org.sleuthkit.autopsy.timeline.db.EventsRepository.rebuildRepository(), and org.sleuthkit.autopsy.timeline.db.EventsRepository.DBPopulationMode.TAGS_ONLY.

void org.sleuthkit.autopsy.timeline.db.EventsRepository.syncTagsFilter ( TagsFilter  tagsFilter)

"sync" the given tags filter with the tagnames in use: Disable filters for tags that are not in use in the case, and add new filters for tags that don't have them. New filters are selected by default.

tagsFilterthe tags filter to modify so it is consistent with the tags in use in the case

Definition at line 305 of file

References org.sleuthkit.autopsy.timeline.filters.TagsFilter.addSubFilter().

Member Data Documentation

final Case org.sleuthkit.autopsy.timeline.db.EventsRepository.autoCase
final ObservableMap<Long, String> org.sleuthkit.autopsy.timeline.db.EventsRepository.datasourcesMap = FXCollections.observableHashMap()
DBPopulationWorker org.sleuthkit.autopsy.timeline.db.EventsRepository.dbWorker
final LoadingCache<ZoomParams, Map<EventType, Long> > org.sleuthkit.autopsy.timeline.db.EventsRepository.eventCountsCache

Definition at line 109 of file

final EventDB org.sleuthkit.autopsy.timeline.db.EventsRepository.eventDB

Definition at line 102 of file

final LoadingCache<ZoomParams, List<EventStripe> > org.sleuthkit.autopsy.timeline.db.EventsRepository.eventStripeCache

Definition at line 110 of file

final ObservableMap<Long, String> org.sleuthkit.autopsy.timeline.db.EventsRepository.hashSetMap = FXCollections.observableHashMap()
final LoadingCache<Long, TimeLineEvent> org.sleuthkit.autopsy.timeline.db.EventsRepository.idToEventCache

Definition at line 108 of file

final Logger org.sleuthkit.autopsy.timeline.db.EventsRepository.LOGGER = Logger.getLogger(EventsRepository.class.getName())

Definition at line 98 of file

final LoadingCache<Object, Long> org.sleuthkit.autopsy.timeline.db.EventsRepository.maxCache

Definition at line 106 of file

final LoadingCache<Object, Long> org.sleuthkit.autopsy.timeline.db.EventsRepository.minCache

Definition at line 107 of file

final FilteredEventsModel org.sleuthkit.autopsy.timeline.db.EventsRepository.modelInstance
final ObservableList<TagName> org.sleuthkit.autopsy.timeline.db.EventsRepository.tagNames = FXCollections.observableArrayList()
final Executor org.sleuthkit.autopsy.timeline.db.EventsRepository.workerExecutor = Executors.newSingleThreadExecutor(new ThreadFactoryBuilder().setNameFormat("eventrepository-worker-%d").build())

Definition at line 100 of file

The documentation for this class was generated from the following file:

Copyright © 2012-2015 Basis Technology. Generated on: Wed Apr 6 2016
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.