Autopsy  4.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
EventNode.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2016 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.timeline.explorernodes;
20 
21 import java.lang.reflect.InvocationTargetException;
22 import java.text.MessageFormat;
23 import java.util.ArrayList;
24 import java.util.Arrays;
25 import java.util.List;
26 import java.util.logging.Level;
27 import javax.swing.Action;
28 import org.joda.time.DateTime;
29 import org.joda.time.DateTimeZone;
30 import org.openide.nodes.Children;
31 import org.openide.nodes.PropertySupport;
32 import org.openide.nodes.Sheet;
33 import org.openide.util.NbBundle;
34 import org.openide.util.lookup.Lookups;
46 import org.sleuthkit.datamodel.AbstractFile;
47 import org.sleuthkit.datamodel.BlackboardArtifact;
48 import org.sleuthkit.datamodel.BlackboardAttribute;
49 import org.sleuthkit.datamodel.SleuthkitCase;
50 import org.sleuthkit.datamodel.TskCoreException;
51 
55 public class EventNode extends DisplayableItemNode {
56 
57  private static final long serialVersionUID = 1L;
58 
59  private static final Logger LOGGER = Logger.getLogger(EventNode.class.getName());
60 
61  private final SingleEvent event;
62 
63  EventNode(SingleEvent event, AbstractFile file, BlackboardArtifact artifact) {
64  super(Children.LEAF, Lookups.fixed(event, file, artifact));
65  this.event = event;
66  this.setIconBaseWithExtension("org/sleuthkit/autopsy/timeline/images/" + event.getEventType().getIconBase()); // NON-NLS
67  }
68 
69  EventNode(SingleEvent event, AbstractFile file) {
70  super(Children.LEAF, Lookups.fixed(event, file));
71  this.event = event;
72  this.setIconBaseWithExtension("org/sleuthkit/autopsy/timeline/images/" + event.getEventType().getIconBase()); // NON-NLS
73  }
74 
75  @Override
76  @NbBundle.Messages({
77  "NodeProperty.displayName.icon=Icon",
78  "NodeProperty.displayName.description=Description",
79  "NodeProperty.displayName.baseType=Base Type",
80  "NodeProperty.displayName.subType=Sub Type",
81  "NodeProperty.displayName.known=Known",
82  "NodeProperty.displayName.dateTime=Date/Time"})
83  protected Sheet createSheet() {
84  Sheet s = super.createSheet();
85  Sheet.Set properties = s.get(Sheet.PROPERTIES);
86  if (properties == null) {
87  properties = Sheet.createPropertiesSet();
88  s.put(properties);
89  }
90 
91  properties.put(new NodeProperty<>("icon", Bundle.NodeProperty_displayName_icon(), "icon", true)); // NON-NLS //gets overridden with icon
92  properties.put(new TimeProperty("time", Bundle.NodeProperty_displayName_dateTime(), "time ", getDateTimeString()));// NON-NLS
93  properties.put(new NodeProperty<>("description", Bundle.NodeProperty_displayName_description(), "description", event.getFullDescription())); // NON-NLS
94  properties.put(new NodeProperty<>("eventBaseType", Bundle.NodeProperty_displayName_baseType(), "base type", event.getEventType().getSuperType().getDisplayName())); // NON-NLS
95  properties.put(new NodeProperty<>("eventSubType", Bundle.NodeProperty_displayName_subType(), "sub type", event.getEventType().getDisplayName())); // NON-NLS
96  properties.put(new NodeProperty<>("Known", Bundle.NodeProperty_displayName_known(), "known", event.getKnown().toString())); // NON-NLS
97 
98  return s;
99  }
100 
108  private String getDateTimeString() {
109  return new DateTime(event.getStartMillis(), DateTimeZone.UTC).toString(TimeLineController.getZonedFormatter());
110  }
111 
112  @Override
113  @NbBundle.Messages({
114  "EventNode.getAction.errorTitle=Error getting actions",
115  "EventNode.getAction.linkedFileMessage=There was a problem getting actions for the selected result. "
116  + " The 'View File in Timeline' action will not be available."})
117  public Action[] getActions(boolean context) {
118  Action[] superActions = super.getActions(context);
119  List<Action> actionsList = new ArrayList<>();
120  actionsList.addAll(Arrays.asList(superActions));
121 
122  final AbstractFile sourceFile = getLookup().lookup(AbstractFile.class);
123 
124  /*
125  * if this event is derived from an artifact, add actions to view the
126  * source file and a "linked" file, if present.
127  */
128  final BlackboardArtifact artifact = getLookup().lookup(BlackboardArtifact.class);
129  if (artifact != null) {
130  try {
131  AbstractFile linkedfile = findLinked(artifact);
132  if (linkedfile != null) {
133  actionsList.add(ViewFileInTimelineAction.createViewFileAction(linkedfile));
134  }
135  } catch (TskCoreException ex) {
136  LOGGER.log(Level.SEVERE, MessageFormat.format("Error getting linked file from blackboard artifact{0}.", artifact.getArtifactID()), ex); //NON-NLS
137  MessageNotifyUtil.Notify.error(Bundle.EventNode_getAction_errorTitle(), Bundle.EventNode_getAction_linkedFileMessage());
138  }
139 
140  //if this event has associated content, add the action to view the content in the timeline
141  if (null != sourceFile) {
142  actionsList.add(ViewFileInTimelineAction.createViewSourceFileAction(sourceFile));
143  }
144  }
145 
146  //get default actions for the source file
147  final List<Action> factoryActions = DataModelActionsFactory.getActions(sourceFile, artifact != null);
148 
149  actionsList.addAll(factoryActions);
150  return actionsList.toArray(new Action[actionsList.size()]);
151  }
152 
153  @Override
154  public boolean isLeafTypeNode() {
155  return true;
156  }
157 
158  @Override
159  public <T> T accept(DisplayableItemNodeVisitor<T> dinv) {
160  throw new UnsupportedOperationException("Not supported yet."); // NON-NLS
161  }
162 
163  /*
164  * TODO (AUT-1849): Correct or remove peristent column reordering code
165  *
166  * Added to support this feature.
167  */
168 // @Override
169 // public String getItemType() {
170 // return "Event";
171 // }
176  final private class TimeProperty extends PropertySupport.ReadWrite<String> {
177 
178  private String value;
179 
180  @Override
181  public boolean canWrite() {
182  return false;
183  }
184 
185  TimeProperty(String name, String displayName, String shortDescription, String value) {
186  super(name, String.class, displayName, shortDescription);
187  setValue("suppressCustomEditor", Boolean.TRUE); // remove the "..." (editing) button NON-NLS
188  this.value = value;
189  TimeLineController.getTimeZone().addListener(timeZone -> {
190  try {
192  } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex) {
193  LOGGER.log(Level.SEVERE, "Unexpected error setting date/time property on EventNode explorer node", ex); //NON-NLS
194  }
195  });
196 
197  }
198 
199  @Override
200  public String getValue() throws IllegalAccessException, InvocationTargetException {
201  return value;
202  }
203 
204  @Override
205  public void setValue(String t) throws IllegalAccessException, IllegalArgumentException, InvocationTargetException {
206  String oldValue = getValue();
207  value = t;
208  firePropertyChange("time", oldValue, t); // NON-NLS
209  }
210  }
211 
222  public static EventNode createEventNode(final Long eventID, FilteredEventsModel eventsModel) throws TskCoreException, IllegalStateException {
223  /*
224  * Look up the event by id and creata an EventNode with the appropriate
225  * data in the lookup.
226  */
227  final SingleEvent eventById = eventsModel.getEventById(eventID);
228 
229  SleuthkitCase sleuthkitCase = Case.getCurrentCase().getSleuthkitCase();
230  AbstractFile file = sleuthkitCase.getAbstractFileById(eventById.getFileID());
231 
232  if (eventById.getArtifactID().isPresent()) {
233  BlackboardArtifact blackboardArtifact = sleuthkitCase.getBlackboardArtifact(eventById.getArtifactID().get());
234  return new EventNode(eventById, file, blackboardArtifact);
235  } else {
236  return new EventNode(eventById, file);
237  }
238  }
239 
252  static AbstractFile findLinked(BlackboardArtifact artifact) throws TskCoreException {
253 
254  BlackboardAttribute pathIDAttribute = artifact.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID));
255 
256  if (pathIDAttribute != null) {
257  long contentID = pathIDAttribute.getValueLong();
258  if (contentID != -1) {
259  return artifact.getSleuthkitCase().getAbstractFileById(contentID);
260  }
261  }
262 
263  return null;
264  }
265 }
static EventNode createEventNode(final Long eventID, FilteredEventsModel eventsModel)
Definition: EventNode.java:222
static ReadOnlyObjectProperty< TimeZone > getTimeZone()
static List< Action > getActions(File file, boolean isArtifactSource)
static ViewFileInTimelineAction createViewSourceFileAction(AbstractFile file)
static void error(String title, String message)
synchronized static Logger getLogger(String name)
Definition: Logger.java:161
static ViewFileInTimelineAction createViewFileAction(AbstractFile file)

Copyright © 2012-2016 Basis Technology. Generated on: Tue Oct 25 2016
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.