Autopsy  4.19.3
Graphical digital forensics platform for The Sleuth Kit and other tools.
DataSourceInfoUtilities.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2019 - 2021 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.datasourcesummary.datamodel;
20 
21 import java.sql.ResultSet;
22 import java.sql.SQLException;
23 import java.text.DecimalFormat;
24 import java.util.ArrayList;
25 import java.util.Comparator;
26 import java.util.Date;
27 import java.util.List;
28 import java.util.SortedMap;
29 import java.util.TreeMap;
30 import org.sleuthkit.datamodel.SleuthkitCase;
31 import org.sleuthkit.datamodel.TskCoreException;
32 import org.apache.commons.lang.StringUtils;
33 import org.sleuthkit.datamodel.BlackboardArtifact;
34 import org.sleuthkit.datamodel.BlackboardAttribute;
35 import org.sleuthkit.datamodel.BlackboardAttribute.Type;
36 import org.sleuthkit.datamodel.DataSource;
37 import org.sleuthkit.datamodel.TskData.TSK_DB_FILES_TYPE_ENUM;
38 import org.sleuthkit.datamodel.TskData.TSK_FS_META_FLAG_ENUM;
39 import org.sleuthkit.datamodel.TskData.TSK_FS_META_TYPE_ENUM;
40 
45 public final class DataSourceInfoUtilities {
46 
47  public static final String COMMA_FORMAT_STR = "#,###";
48  public static final DecimalFormat COMMA_FORMATTER = new DecimalFormat(COMMA_FORMAT_STR);
49 
62  static Long getCountOfTskFiles(SleuthkitCase skCase, DataSource currentDataSource, String additionalWhere)
63  throws TskCoreException, SQLException {
64  if (currentDataSource != null) {
65  return skCase.countFilesWhere(
66  "data_source_obj_id=" + currentDataSource.getId()
67  + (StringUtils.isBlank(additionalWhere) ? "" : (" AND " + additionalWhere)));
68  }
69  return null;
70  }
71 
84  static Long getCountOfRegularFiles(SleuthkitCase skCase, DataSource currentDataSource, String additionalWhere)
85  throws TskCoreException, SQLException {
86  String whereClause = "meta_type=" + TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG.getValue();
87 
88  if (StringUtils.isNotBlank(additionalWhere)) {
89  whereClause += " AND " + additionalWhere;
90  }
91 
92  return getCountOfTskFiles(skCase, currentDataSource, whereClause);
93  }
94 
107  public static Long getCountOfRegNonSlackFiles(SleuthkitCase skCase, DataSource currentDataSource, String additionalWhere)
108  throws TskCoreException, SQLException {
109  String whereClause = "meta_type=" + TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_REG.getValue()
110  + " AND type<>" + TSK_DB_FILES_TYPE_ENUM.SLACK.getFileType();
111 
112  if (StringUtils.isNotBlank(additionalWhere)) {
113  whereClause += " AND " + additionalWhere;
114  }
115 
116  return getCountOfTskFiles(skCase, currentDataSource, whereClause);
117  }
118 
122  public interface ResultSetHandler<T> {
123 
124  T process(ResultSet resultset) throws SQLException;
125  }
126 
140  static <T> T getBaseQueryResult(SleuthkitCase skCase, String query, ResultSetHandler<T> processor)
141  throws TskCoreException, SQLException {
142  try (SleuthkitCase.CaseDbQuery dbQuery = skCase.executeQuery(query)) {
143  ResultSet resultSet = dbQuery.getResultSet();
144  return processor.process(resultSet);
145  }
146  }
147 
156  public static String getMetaFlagsContainsStatement(TSK_FS_META_FLAG_ENUM flag) {
157  return "meta_flags & " + flag.getValue() + " > 0";
158  }
159 
163  public enum SortOrder {
165  ASCENDING
166  }
167 
188  public static List<BlackboardArtifact> getArtifacts(SleuthkitCase skCase, BlackboardArtifact.Type artifactType, DataSource dataSource, BlackboardAttribute.Type attributeType, SortOrder sortOrder) throws TskCoreException {
189  return getArtifacts(skCase, artifactType, dataSource, attributeType, sortOrder, 0);
190  }
191 
214  public static List<BlackboardArtifact> getArtifacts(SleuthkitCase skCase, BlackboardArtifact.Type artifactType, DataSource dataSource, BlackboardAttribute.Type attributeType, SortOrder sortOrder, int maxCount) throws TskCoreException {
215  if (maxCount < 0) {
216  throw new IllegalArgumentException("Invalid maxCount passed to getArtifacts, value must be equal to or greater than 0");
217  }
218 
219  return createListFromMap(getArtifactMap(skCase, artifactType, dataSource, attributeType, sortOrder), maxCount);
220  }
221 
226  }
227 
244  static private SortedMap<BlackboardAttribute, List<BlackboardArtifact>> getArtifactMap(SleuthkitCase skCase, BlackboardArtifact.Type artifactType, DataSource dataSource, BlackboardAttribute.Type attributeType, SortOrder sortOrder) throws TskCoreException {
245  SortedMap<BlackboardAttribute, List<BlackboardArtifact>> sortedMap = new TreeMap<>(new AttributeComparator(sortOrder));
246  List<BlackboardArtifact> artifactList = skCase.getBlackboard().getArtifacts(artifactType.getTypeID(), dataSource.getId());
247 
248  for (BlackboardArtifact artifact : artifactList) {
249  BlackboardAttribute attribute = artifact.getAttribute(attributeType);
250  if (attribute == null) {
251  continue;
252  }
253 
254  List<BlackboardArtifact> mapArtifactList = sortedMap.get(attribute);
255  if (mapArtifactList == null) {
256  mapArtifactList = new ArrayList<>();
257  sortedMap.put(attribute, mapArtifactList);
258  }
259 
260  mapArtifactList.add(artifact);
261  }
262 
263  return sortedMap;
264  }
265 
274  static private List<BlackboardArtifact> createListFromMap(SortedMap<BlackboardAttribute, List<BlackboardArtifact>> sortedMap, int maxCount) {
275  List<BlackboardArtifact> artifactList = new ArrayList<>();
276 
277  for (List<BlackboardArtifact> mapArtifactList : sortedMap.values()) {
278 
279  if (maxCount == 0 || (artifactList.size() + mapArtifactList.size()) <= maxCount) {
280  artifactList.addAll(mapArtifactList);
281  continue;
282  }
283 
284  if (maxCount == artifactList.size()) {
285  break;
286  }
287 
288  for (BlackboardArtifact artifact : mapArtifactList) {
289  if (artifactList.size() < maxCount) {
290  artifactList.add(artifact);
291  } else {
292  break;
293  }
294  }
295  }
296  return artifactList;
297  }
298 
308  private static class AttributeComparator implements Comparator<BlackboardAttribute> {
309 
310  private final SortOrder direction;
311 
312  AttributeComparator(SortOrder direction) {
313  this.direction = direction;
314  }
315 
316  @Override
317  public int compare(BlackboardAttribute attribute1, BlackboardAttribute attribute2) {
318  if (!attribute1.getAttributeType().equals(attribute2.getAttributeType())) {
319  throw new IllegalArgumentException("Unable to compare attributes of different types");
320  }
321 
322  int result = compare(attribute1.getAttributeType(), attribute1, attribute2);
323 
324  if (direction == SortOrder.DESCENDING) {
325  result *= -1;
326  }
327 
328  return result;
329  }
330 
342  private int compare(BlackboardAttribute.Type type, BlackboardAttribute attribute1, BlackboardAttribute attribute2) {
343  switch (type.getValueType()) {
344  case STRING:
345  return attribute1.getValueString().compareToIgnoreCase(attribute2.getValueString());
346  case INTEGER:
347  return Integer.compare(attribute1.getValueInt(), attribute2.getValueInt());
348  case LONG:
349  case DATETIME:
350  return Long.compare(attribute1.getValueLong(), attribute2.getValueLong());
351  case DOUBLE:
352  return Double.compare(attribute1.getValueDouble(), attribute2.getValueDouble());
353  case BYTE:
354  case JSON:
355  default:
356  throw new IllegalArgumentException("Unable to compare attributes of type " + attribute1.getAttributeType().getTypeName());
357  }
358  }
359  }
360 
370  private static BlackboardAttribute getAttributeOrNull(BlackboardArtifact artifact, Type attributeType) {
371  try {
372  return artifact.getAttribute(attributeType);
373  } catch (TskCoreException ex) {
374  return null;
375  }
376  }
377 
387  public static String getStringOrNull(BlackboardArtifact artifact, Type attributeType) {
388  BlackboardAttribute attr = getAttributeOrNull(artifact, attributeType);
389  return (attr == null) ? null : attr.getValueString();
390  }
391 
401  public static Long getLongOrNull(BlackboardArtifact artifact, Type attributeType) {
402  BlackboardAttribute attr = getAttributeOrNull(artifact, attributeType);
403  return (attr == null) ? null : attr.getValueLong();
404  }
405 
415  public static Integer getIntOrNull(BlackboardArtifact artifact, Type attributeType) {
416  BlackboardAttribute attr = getAttributeOrNull(artifact, attributeType);
417  return (attr == null) ? null : attr.getValueInt();
418  }
419 
430  public static Date getDateOrNull(BlackboardArtifact artifact, Type attributeType) {
431  Long longVal = getLongOrNull(artifact, attributeType);
432  return (longVal == null || longVal == 0) ? null : new Date(longVal * 1000);
433  }
434 
442  public static long getLongOrZero(Long longVal) {
443  return longVal == null ? 0 : longVal;
444  }
445 
454  public static String getStringOrZero(Long longVal) {
455  return longVal == null ? "0" : COMMA_FORMATTER.format(longVal);
456  }
457 }
static List< BlackboardArtifact > getArtifacts(SleuthkitCase skCase, BlackboardArtifact.Type artifactType, DataSource dataSource, BlackboardAttribute.Type attributeType, SortOrder sortOrder, int maxCount)
static Long getCountOfRegNonSlackFiles(SleuthkitCase skCase, DataSource currentDataSource, String additionalWhere)
static List< BlackboardArtifact > createListFromMap(SortedMap< BlackboardAttribute, List< BlackboardArtifact >> sortedMap, int maxCount)
static SortedMap< BlackboardAttribute, List< BlackboardArtifact > > getArtifactMap(SleuthkitCase skCase, BlackboardArtifact.Type artifactType, DataSource dataSource, BlackboardAttribute.Type attributeType, SortOrder sortOrder)
static List< BlackboardArtifact > getArtifacts(SleuthkitCase skCase, BlackboardArtifact.Type artifactType, DataSource dataSource, BlackboardAttribute.Type attributeType, SortOrder sortOrder)
static Long getLongOrNull(BlackboardArtifact artifact, Type attributeType)
static Integer getIntOrNull(BlackboardArtifact artifact, Type attributeType)
static BlackboardAttribute getAttributeOrNull(BlackboardArtifact artifact, Type attributeType)
static Date getDateOrNull(BlackboardArtifact artifact, Type attributeType)
static String getStringOrNull(BlackboardArtifact artifact, Type attributeType)
int compare(BlackboardAttribute.Type type, BlackboardAttribute attribute1, BlackboardAttribute attribute2)

Copyright © 2012-2022 Basis Technology. Generated on: Tue Jun 27 2023
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.