19 package org.sleuthkit.autopsy.centralrepository.contentviewer;
21 import java.util.ArrayList;
22 import java.util.Collection;
23 import java.util.HashMap;
24 import java.util.HashSet;
25 import java.util.List;
28 import java.util.logging.Level;
29 import javax.swing.SwingWorker;
30 import org.apache.commons.lang3.StringUtils;
49 class OtherOccurrenceOneTypeWorker
extends SwingWorker<OneTypeData, Void> {
51 private static final Logger logger = Logger.getLogger(OtherOccurrenceOneTypeWorker.class.getName());
53 private final CorrelationAttributeInstance.Type aType;
54 private final String value;
55 private final AbstractFile file;
56 private final String deviceId;
57 private final String dataSourceName;
68 OtherOccurrenceOneTypeWorker(CorrelationAttributeInstance.Type aType, String value, AbstractFile file, String deviceId, String dataSourceName) {
72 this.deviceId = deviceId;
73 this.dataSourceName = dataSourceName;
77 protected OneTypeData doInBackground() throws Exception {
78 Map<String, CorrelationCase> caseNames =
new HashMap<>();
80 Set<String> dataSources =
new HashSet<>();
81 Collection<CorrelationAttributeInstance> correlationAttributesToAdd =
new ArrayList<>();
82 String earliestDate = OtherOccurrences.getEarliestCaseDate();
83 OneTypeData results = null;
85 if (CentralRepository.isEnabled()) {
86 List<CorrelationAttributeInstance> instances;
87 instances = CentralRepository.getInstance().getArtifactInstancesByTypeValue(aType, value);
88 HashMap<UniquePathKey, NodeData> nodeDataMap =
new HashMap<>();
89 String caseUUID = Case.getCurrentCase().getName();
90 for (CorrelationAttributeInstance artifactInstance : instances) {
101 if (artifactInstance.getCorrelationCase().getCaseUUID().equals(caseUUID)
102 && (!StringUtils.isBlank(dataSourceName) && artifactInstance.getCorrelationDataSource().getName().equals(dataSourceName))
103 && (!StringUtils.isBlank(deviceId) && artifactInstance.getCorrelationDataSource().getDeviceID().equals(deviceId))
104 && (file != null && artifactInstance.getFilePath().equalsIgnoreCase(file.getParentPath() + file.getName()))) {
108 correlationAttributesToAdd.add(artifactInstance);
109 NodeData newNode =
new NodeData(artifactInstance, aType, value);
110 UniquePathKey uniquePathKey =
new UniquePathKey(newNode);
111 nodeDataMap.put(uniquePathKey, newNode);
114 for (NodeData nodeData : nodeDataMap.values()) {
119 dataSources.add(OtherOccurrences.makeDataSourceString(nodeData.getCorrelationAttributeInstance().getCorrelationCase().getCaseUUID(), nodeData.getDeviceID(), nodeData.getDataSourceName()));
120 caseNames.put(nodeData.getCorrelationAttributeInstance().getCorrelationCase().getCaseUUID(), nodeData.getCorrelationAttributeInstance().getCorrelationCase());
121 }
catch (CentralRepoException ex) {
122 logger.log(Level.WARNING,
"Unable to get correlation case for displaying other occurrence for case: " + nodeData.getCaseName(), ex);
128 if (!isCancelled()) {
129 results =
new OneTypeData(caseNames, totalCount, dataSources.size(), earliestDate, correlationAttributesToAdd);
138 static final class OneTypeData {
140 private final Map<String, CorrelationCase> caseNames;
141 private final int totalCount;
142 private final int dataSourceCount;
143 private final Collection<CorrelationAttributeInstance> correlationAttributesToAdd;
144 private final String earliestCaseDate;
157 OneTypeData(Map<String, CorrelationCase> caseNames,
int totalCount,
int dataSourceCount, String earliestCaseDate, Collection<CorrelationAttributeInstance> correlationAttributesToAdd) {
158 this.caseNames = caseNames;
159 this.totalCount = totalCount;
160 this.dataSourceCount = dataSourceCount;
161 this.correlationAttributesToAdd = correlationAttributesToAdd;
162 this.earliestCaseDate = earliestCaseDate;
165 public Map<String, CorrelationCase> getCaseNames() {
169 public int getTotalCount() {
173 public int getDataSourceCount() {
174 return dataSourceCount;
177 public Collection<CorrelationAttributeInstance> getCorrelationAttributesToAdd() {
178 return correlationAttributesToAdd;
181 public String getEarliestCaseDate() {
182 return earliestCaseDate;