Autopsy  4.10.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
DataResultFilterNode.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2011-2019 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.directorytree;
20 
21 import java.awt.event.ActionEvent;
22 import java.beans.PropertyVetoException;
23 import java.text.MessageFormat;
24 import java.util.ArrayList;
25 import java.util.Collection;
26 import java.util.HashSet;
27 import java.util.List;
28 import java.util.logging.Level;
29 import java.util.prefs.PreferenceChangeEvent;
30 import java.util.prefs.PreferenceChangeListener;
31 import javax.swing.AbstractAction;
32 import javax.swing.Action;
33 import org.openide.explorer.ExplorerManager;
34 import org.openide.nodes.AbstractNode;
35 import org.openide.nodes.FilterNode;
36 import org.openide.nodes.Node;
37 import org.openide.nodes.Sheet;
38 import org.openide.util.NbBundle;
39 import org.openide.util.Utilities;
72 import org.sleuthkit.datamodel.AbstractFile;
73 import org.sleuthkit.datamodel.BlackboardArtifact;
74 import org.sleuthkit.datamodel.BlackboardAttribute;
75 import org.sleuthkit.datamodel.Content;
76 import org.sleuthkit.datamodel.DerivedFile;
77 import org.sleuthkit.datamodel.Directory;
78 import org.sleuthkit.datamodel.File;
79 import org.sleuthkit.datamodel.LayoutFile;
80 import org.sleuthkit.datamodel.LocalFile;
81 import org.sleuthkit.datamodel.LocalDirectory;
82 import org.sleuthkit.datamodel.SlackFile;
83 import org.sleuthkit.datamodel.TskData;
84 import org.sleuthkit.datamodel.TskException;
85 import org.sleuthkit.datamodel.VirtualDirectory;
86 import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
87 import org.sleuthkit.datamodel.Report;
88 import org.sleuthkit.datamodel.TskCoreException;
89 
95 public class DataResultFilterNode extends FilterNode {
96 
97  private static final Logger LOGGER = Logger.getLogger(DataResultFilterNode.class.getName());
98 
103 
104  static {
105  UserPreferences.addChangeListener(new PreferenceChangeListener() {
106  @Override
107  public void preferenceChange(PreferenceChangeEvent evt) {
108  switch (evt.getKey()) {
110  filterKnownFromDataSources = UserPreferences.hideKnownFilesInDataSourcesTree();
111  break;
113  filterKnownFromViews = UserPreferences.hideKnownFilesInViewsTree();
114  break;
116  filterSlackFromDataSources = UserPreferences.hideSlackFilesInDataSourcesTree();
117  break;
119  filterSlackFromViews = UserPreferences.hideSlackFilesInViewsTree();
120  break;
121  }
122  }
123  });
124  }
125 
128 
129  private final ExplorerManager sourceEm;
130 
140  public DataResultFilterNode(Node node, ExplorerManager em) {
141  super(node, new DataResultFilterChildren(node, em));
142  this.sourceEm = em;
143  }
144 
158  private DataResultFilterNode(Node node, ExplorerManager em, boolean filterKnown, boolean filterSlack) {
159  super(node, new DataResultFilterChildren(node, em, filterKnown, filterSlack));
160  this.sourceEm = em;
161  }
162 
171  @Override
172  public Action[] getActions(boolean popup) {
173 
174  List<Action> actions = new ArrayList<>();
175 
176  final DisplayableItemNode originalNode = (DisplayableItemNode) this.getOriginal();
177  List<Action> accept = originalNode.accept(getActionsDIV);
178  if (accept != null) {
179  actions.addAll(accept);
180  }
181 
182  //actions.add(new IndexContentFilesAction(nodeContent, "Index"));
183  return actions.toArray(new Action[actions.size()]);
184  }
185 
192  @Override
193  public Action getPreferredAction() {
194  final Node original = this.getOriginal();
195  // Once had a org.openide.nodes.ChildFactory$WaitFilterNode passed in
196  if ((original instanceof DisplayableItemNode) == false) {
197  return null;
198  }
199 
200  final DisplayableItemNode originalNode = (DisplayableItemNode) this.getOriginal();
201  return originalNode.accept(getPreferredActionsDIV);
202  }
203 
204  @Override
205  public Node.PropertySet[] getPropertySets() {
206  Node.PropertySet[] propertySets = super.getPropertySets();
207 
208  for (int i = 0; i < propertySets.length; i++) {
209  Node.PropertySet ps = propertySets[i];
210 
211  if (ps.getName().equals(Sheet.PROPERTIES)) {
212  Sheet.Set newPs = new Sheet.Set();
213  newPs.setName(ps.getName());
214  newPs.setDisplayName(ps.getDisplayName());
215  newPs.setShortDescription(ps.getShortDescription());
216 
217  newPs.put(ps.getProperties());
218  if (newPs.remove(AbstractFsContentNode.HIDE_PARENT) != null) {
219  newPs.remove(AbstractFilePropertyType.LOCATION.toString());
220  }
221  propertySets[i] = newPs;
222  }
223  }
224 
225  return propertySets;
226  }
227 
239  @Override
240  public String getDisplayName() {
241  final Node orig = getOriginal();
242  String name = orig.getDisplayName();
243  if ((orig instanceof BlackboardArtifactNode)) {
244  name = ((BlackboardArtifactNode) orig).getSourceName();
245  }
246  return name;
247  }
248 
255  public void setChildNodeSelectionInfo(NodeSelectionInfo selectedChildNodeInfo) {
256  if (getOriginal() instanceof DisplayableItemNode) {
257  ((DisplayableItemNode) getOriginal()).setChildNodeSelectionInfo(selectedChildNodeInfo);
258  }
259  }
260 
269  if (getOriginal() instanceof DisplayableItemNode) {
270  return ((DisplayableItemNode) getOriginal()).getChildNodeSelectionInfo();
271  } else {
272  return null;
273  }
274  }
275 
281  private static class DataResultFilterChildren extends FilterNode.Children {
282 
283  private final ExplorerManager sourceEm;
284 
285  private boolean filterKnown;
286  private boolean filterSlack;
287  private boolean filterArtifacts; // display message artifacts in the DataSource subtree
288 
292  private DataResultFilterChildren(Node arg, ExplorerManager sourceEm) {
293  super(arg);
294 
295  this.filterArtifacts = false;
296  switch (SelectionContext.getSelectionContext(arg)) {
297  case DATA_SOURCES:
298  filterSlack = filterSlackFromDataSources;
299  filterKnown = filterKnownFromDataSources;
300  filterArtifacts = true;
301  break;
302  case VIEWS:
303  filterSlack = filterSlackFromViews;
304  filterKnown = filterKnownFromViews;
305  break;
306  default:
307  filterSlack = false;
308  filterKnown = false;
309  break;
310  }
311  this.sourceEm = sourceEm;
312  }
313 
314  private DataResultFilterChildren(Node arg, ExplorerManager sourceEm, boolean filterKnown, boolean filterSlack) {
315  super(arg);
316  this.filterKnown = filterKnown;
317  this.filterSlack = filterSlack;
318  this.sourceEm = sourceEm;
319  }
320 
321  @Override
322  protected Node[] createNodes(Node key) {
323  AbstractFile file = key.getLookup().lookup(AbstractFile.class);
324  if (file != null) {
325  if (filterKnown && (file.getKnown() == TskData.FileKnown.KNOWN)) {
326  // Filter out child nodes that represent known files
327  return new Node[]{};
328  }
329  if (filterSlack && file.getType().equals(TskData.TSK_DB_FILES_TYPE_ENUM.SLACK)) {
330  // Filter out child nodes that represent slack files
331  return new Node[]{};
332  }
333  }
334 
335  // filter out all non-message artifacts, if displaying the results from the Data Source tree
336  BlackboardArtifact art = key.getLookup().lookup(BlackboardArtifact.class);
337  if (art != null
338  && filterArtifacts
339  && art.getArtifactTypeID() != BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID()
340  && art.getArtifactTypeID() != BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE.getTypeID()) {
341  return new Node[]{};
342  }
343 
344  return new Node[]{new DataResultFilterNode(key, sourceEm, filterKnown, filterSlack)};
345  }
346 
347  }
348 
349  @NbBundle.Messages("DataResultFilterNode.viewSourceArtifact.text=View Source Result")
354  private static class GetPopupActionsDisplayableItemNodeVisitor extends DisplayableItemNodeVisitor.Default<List<Action>> {
355 
356  @Override
357  public List<Action> visit(BlackboardArtifactNode ban) {
358  //set up actions for artifact node based on its Content object
359  //TODO all actions need to be consolidated in single place!
360  //they should be set in individual Node subclass and using a utility to get Actions per Content sub-type
361  // TODO UPDATE: There is now a DataModelActionsFactory utility;
362 
363  List<Action> actionsList = new ArrayList<>();
364 
365  //merge predefined specific node actions if bban subclasses have their own
366  for (Action a : ban.getActions(true)) {
367  actionsList.add(a);
368  }
369  BlackboardArtifact ba = ban.getLookup().lookup(BlackboardArtifact.class);
370  final int artifactTypeID = ba.getArtifactTypeID();
371 
372  if (artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID()
373  || artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
374  if (ban.getLookup().lookup(AbstractFile.class) != null) {
375  // We only want the "View File in Directory" actions if we have a file...it is
376  // possible that we have a keyword hit on a Report.
377  actionsList.add(new ViewContextAction(
378  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewFileInDir.text"), ban));
379  }
380  } else if (artifactTypeID == BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID()) {
381  //action to go to the source artifact
382  actionsList.add(new ViewSourceArtifactAction(DataResultFilterNode_viewSourceArtifact_text(), ba));
383  // action to go to the source file of the artifact
384  actionsList.add(new ViewContextAction(
385  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewSrcFileInDir.text"), ban));
386  } else {
387  // if the artifact links to another file, add an action to go to
388  // that file
389  Content c = findLinked(ban);
390  if (c != null) {
391  actionsList.add(new ViewContextAction(
392  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewFileInDir.text"), c));
393  }
394  // action to go to the source file of the artifact
395  // action to go to the source file of the artifact
396  Content fileContent = ban.getLookup().lookup(AbstractFile.class);
397  if (fileContent == null) {
398  Content content = ban.getLookup().lookup(Content.class);
399  actionsList.add(new ViewContextAction("View Source Content in Directory", content));
400  } else {
401  actionsList.add(new ViewContextAction(
402  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewSrcFileInDir.text"), ban));
403  }
404  }
405  Content c = ban.getLookup().lookup(File.class);
406  Node n = null;
407  if (c != null) {
408  n = new FileNode((AbstractFile) c);
409  } else if ((c = ban.getLookup().lookup(Directory.class)) != null) {
410  n = new DirectoryNode((Directory) c);
411  } else if ((c = ban.getLookup().lookup(VirtualDirectory.class)) != null) {
412  n = new VirtualDirectoryNode((VirtualDirectory) c);
413  } else if ((c = ban.getLookup().lookup(LocalDirectory.class)) != null) {
414  n = new LocalDirectoryNode((LocalDirectory) c);
415  } else if ((c = ban.getLookup().lookup(LayoutFile.class)) != null) {
416  n = new LayoutFileNode((LayoutFile) c);
417  } else if ((c = ban.getLookup().lookup(LocalFile.class)) != null
418  || (c = ban.getLookup().lookup(DerivedFile.class)) != null) {
419  n = new LocalFileNode((AbstractFile) c);
420  if (FileTypeExtensions.getArchiveExtensions().contains("." + ((AbstractFile) c).getNameExtension().toLowerCase())) {
421  try {
422  if (c.getArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED).size() > 0) {
423  actionsList.add(new ExtractArchiveWithPasswordAction((AbstractFile) c));
424  }
425  } catch (TskCoreException ex) {
426  LOGGER.log(Level.WARNING, "Unable to add unzip with password action to context menus", ex);
427  }
428  }
429  } else if ((c = ban.getLookup().lookup(SlackFile.class)) != null) {
430  n = new SlackFileNode((SlackFile) c);
431  } else if ((c = ban.getLookup().lookup(Report.class)) != null) {
432  actionsList.addAll(DataModelActionsFactory.getActions(c, false));
433  }
434  if (n != null) {
435  final Collection<AbstractFile> selectedFilesList
436  = new HashSet<>(Utilities.actionsGlobalContext().lookupAll(AbstractFile.class));
437  actionsList.add(null); // creates a menu separator
438  actionsList.add(new NewWindowViewAction(
439  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewInNewWin.text"), n));
440  if (selectedFilesList.size() == 1) {
441  actionsList.add(new ExternalViewerAction(
442  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.openInExtViewer.text"), n));
443  } else {
444  actionsList.add(ExternalViewerShortcutAction.getInstance());
445  }
446  actionsList.add(null); // creates a menu separator
447  actionsList.add(ExtractAction.getInstance());
448  actionsList.add(null); // creates a menu separator
449  actionsList.add(AddContentTagAction.getInstance());
450  actionsList.add(AddBlackboardArtifactTagAction.getInstance());
451 
452  if (selectedFilesList.size() == 1) {
453  actionsList.add(DeleteFileContentTagAction.getInstance());
454  }
455  } else {
456  // There's no specific file associated with the artifact, but
457  // we can still tag the artifact itself
458  actionsList.add(null);
459  actionsList.add(AddBlackboardArtifactTagAction.getInstance());
460  }
461 
462  final Collection<BlackboardArtifact> selectedArtifactsList
463  = new HashSet<>(Utilities.actionsGlobalContext().lookupAll(BlackboardArtifact.class));
464  if (selectedArtifactsList.size() == 1) {
466  }
467 
468  if (n != null) {
469  actionsList.addAll(ContextMenuExtensionPoint.getActions());
470  }
471 
472  return actionsList;
473  }
474 
475  @Override
476  public List<Action> visit(Reports.ReportsListNode ditem) {
477  // The base class Action is "Collapse All", inappropriate.
478  return null;
479  }
480 
481  @Override
482  public List<Action> visit(FileTypesNode fileTypes) {
483  return defaultVisit(fileTypes);
484  }
485 
486  @Override
487  protected List<Action> defaultVisit(DisplayableItemNode ditem) {
488  //preserve the default node's actions
489  List<Action> actions = new ArrayList<>();
490 
491  for (Action action : ditem.getActions(true)) {
492  actions.add(action);
493  }
494 
495  return actions;
496  }
497 
498  private Content findLinked(BlackboardArtifactNode ba) {
499  BlackboardArtifact art = ba.getLookup().lookup(BlackboardArtifact.class);
500  Content c = null;
501  try {
502  for (BlackboardAttribute attr : art.getAttributes()) {
503  if (attr.getAttributeType().getTypeID() == BlackboardAttribute.ATTRIBUTE_TYPE.TSK_PATH_ID.getTypeID()) {
504  switch (attr.getAttributeType().getValueType()) {
505  case INTEGER:
506  int i = attr.getValueInt();
507  if (i != -1) {
508  c = art.getSleuthkitCase().getContentById(i);
509  }
510  break;
511  case LONG:
512  long l = attr.getValueLong();
513  if (l != -1) {
514  c = art.getSleuthkitCase().getContentById(l);
515  }
516  break;
517  }
518  }
519  }
520  } catch (TskException ex) {
521  Logger.getLogger(this.getClass().getName()).log(Level.WARNING, "Error getting linked file", ex); //NON-NLS
522  }
523  return c;
524  }
525 
526  }
527 
528  /*
529  * Action for double-click / preferred action on nodes.
530  */
531  private class GetPreferredActionsDisplayableItemNodeVisitor extends DisplayableItemNodeVisitor.Default<AbstractAction> {
532 
533  @Override
534  public AbstractAction visit(InstanceCountNode icn) {
535  return null;
536  }
537 
538  @Override
539  public AbstractAction visit(InstanceCaseNode icn) {
540  return null;
541  }
542 
543  @Override
544  public AbstractAction visit(InstanceDataSourceNode icn) {
545  return null;
546  }
547 
548  @Override
549  public AbstractAction visit(CommonAttributeValueNode md5n) {
550  return null;
551  }
552 
553  @Override
554  public AbstractAction visit(CaseDBCommonAttributeInstanceNode fin) {
555  return null;
556  }
557 
558  @Override
559  public AbstractAction visit(CentralRepoCommonAttributeInstanceNode iccan) {
560  return null;
561  }
562 
563  @Override
564  public AbstractAction visit(BlackboardArtifactNode ban) {
565  BlackboardArtifact artifact = ban.getArtifact();
566  try {
567  if ((artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_EMAIL_MSG.getTypeID())
568  || (artifact.getArtifactTypeID() == ARTIFACT_TYPE.TSK_MESSAGE.getTypeID())) {
569  if (artifact.hasChildren()) {
570  return openChild(ban);
571  }
572  }
573  } catch (TskCoreException ex) {
574  LOGGER.log(Level.SEVERE, MessageFormat.format("Error getting children from blackboard artifact{0}.", artifact.getArtifactID()), ex); //NON-NLS
575  }
576  return new ViewContextAction(
577  NbBundle.getMessage(this.getClass(), "DataResultFilterNode.action.viewInDir.text"), ban);
578  }
579 
580  @Override
581  public AbstractAction visit(DirectoryNode dn) {
582  if (dn.getDisplayName().equals(DirectoryNode.DOTDOTDIR)) {
583  return openParent(dn);
584  } else if (dn.getDisplayName().equals(DirectoryNode.DOTDIR) == false) {
585  return openChild(dn);
586  } else {
587  return null;
588  }
589  }
590 
591  @Override
592  public AbstractAction visit(FileNode fn) {
593  if (fn.hasContentChildren()) {
594  return openChild(fn);
595  } else {
596  return null;
597  }
598  }
599 
600  @Override
601  public AbstractAction visit(LocalFileNode dfn) {
602  if (dfn.hasContentChildren()) {
603  return openChild(dfn);
604  } else {
605  return null;
606  }
607  }
608 
609  @Override
610  public AbstractAction visit(Reports.ReportNode reportNode) {
611  return reportNode.getPreferredAction();
612  }
613 
614  @Override
615  protected AbstractAction defaultVisit(DisplayableItemNode c) {
616  return openChild(c);
617  }
618 
619  @Override
620  public AbstractAction visit(FileTypesNode fileTypes) {
621  return openChild(fileTypes);
622  }
623 
632  private AbstractAction openChild(final AbstractNode dataModelNode) {
633  // get the current selection from the directory tree explorer manager,
634  // which is a DirectoryTreeFilterNode. One of that node's children
635  // is a DirectoryTreeFilterNode that wraps the dataModelNode. We need
636  // to set that wrapped node as the selection and root context of the
637  // directory tree explorer manager (sourceEm)
638  final Node currentSelectionInDirectoryTree = sourceEm.getSelectedNodes()[0];
639 
640  return new AbstractAction() {
641  @Override
642  public void actionPerformed(ActionEvent e) {
643  if (currentSelectionInDirectoryTree != null) {
644  // Find the filter version of the passed in dataModelNode.
645  final org.openide.nodes.Children children = currentSelectionInDirectoryTree.getChildren();
646  // This call could break if the DirectoryTree is re-implemented with lazy ChildFactory objects.
647  Node newSelection = children.findChild(dataModelNode.getName());
648 
649  /*
650  * We got null here when we were viewing a ZIP file in
651  * the Views -> Archives area and double clicking on it
652  * got to this code. It tried to find the child in the
653  * tree and didn't find it. An exception was then thrown
654  * from setting the selected node to be null.
655  */
656  if (newSelection != null) {
657  try {
658  sourceEm.setExploredContextAndSelection(newSelection, new Node[]{newSelection});
659  } catch (PropertyVetoException ex) {
660  Logger logger = Logger.getLogger(DataResultFilterNode.class.getName());
661  logger.log(Level.WARNING, "Error: can't open the selected directory.", ex); //NON-NLS
662  }
663  }
664  }
665  }
666  };
667  }
668 
677  private AbstractAction openParent(AbstractNode node) {
678  // @@@ Why do we ignore node?
679  Node[] selectedFilterNodes = sourceEm.getSelectedNodes();
680  Node selectedFilterNode = selectedFilterNodes[0];
681  final Node parentNode = selectedFilterNode.getParentNode();
682 
683  return new AbstractAction() {
684  @Override
685  public void actionPerformed(ActionEvent e) {
686  try {
687  sourceEm.setSelectedNodes(new Node[]{parentNode});
688  } catch (PropertyVetoException ex) {
689  Logger logger = Logger.getLogger(DataResultFilterNode.class.getName());
690  logger.log(Level.WARNING, "Error: can't open the parent directory.", ex); //NON-NLS
691  }
692  }
693  };
694  }
695  }
696 }
abstract< T > T accept(DisplayableItemNodeVisitor< T > visitor)
static List< Action > getActions(File file, boolean isArtifactSource)
static final DisplayableItemNodeVisitor< List< Action > > getActionsDIV
static synchronized AddBlackboardArtifactTagAction getInstance()
static synchronized DeleteFileBlackboardArtifactTagAction getInstance()
DataResultFilterChildren(Node arg, ExplorerManager sourceEm, boolean filterKnown, boolean filterSlack)
static synchronized ExtractAction getInstance()
void setChildNodeSelectionInfo(NodeSelectionInfo selectedChildNodeInfo)
static synchronized DeleteFileContentTagAction getInstance()
final DisplayableItemNodeVisitor< AbstractAction > getPreferredActionsDIV
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
static void addChangeListener(PreferenceChangeListener listener)
static synchronized AddContentTagAction getInstance()
DataResultFilterNode(Node node, ExplorerManager em, boolean filterKnown, boolean filterSlack)

Copyright © 2012-2018 Basis Technology. Generated on: Fri Mar 22 2019
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.