Autopsy  4.19.3
Graphical digital forensics platform for The Sleuth Kit and other tools.
OtherOccurrenceOneTypeWorker.java
Go to the documentation of this file.
1 /*
2  * Central Repository
3  *
4  * Copyright 2021 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.centralrepository.contentviewer;
20 
21 import java.util.ArrayList;
22 import java.util.Collection;
23 import java.util.HashMap;
24 import java.util.HashSet;
25 import java.util.List;
26 import java.util.Map;
27 import java.util.Set;
28 import java.util.logging.Level;
29 import javax.swing.SwingWorker;
30 import org.apache.commons.lang3.StringUtils;
41 import org.sleuthkit.datamodel.AbstractFile;
42 
49 class OtherOccurrenceOneTypeWorker extends SwingWorker<OneTypeData, Void> {
50 
51  private static final Logger logger = Logger.getLogger(OtherOccurrenceOneTypeWorker.class.getName());
52 
53  private final CorrelationAttributeInstance.Type aType;
54  private final String value;
55  private final AbstractFile file;
56  private final String deviceId;
57  private final String dataSourceName;
58 
68  OtherOccurrenceOneTypeWorker(CorrelationAttributeInstance.Type aType, String value, AbstractFile file, String deviceId, String dataSourceName) {
69  this.aType = aType;
70  this.value = value;
71  this.file = file;
72  this.deviceId = deviceId;
73  this.dataSourceName = dataSourceName;
74  }
75 
76  @Override
77  protected OneTypeData doInBackground() throws Exception {
78  Map<String, CorrelationCase> caseNames = new HashMap<>();
79  int totalCount = 0;
80  Set<String> dataSources = new HashSet<>();
81  Collection<CorrelationAttributeInstance> correlationAttributesToAdd = new ArrayList<>();
82  String earliestDate = OtherOccurrences.getEarliestCaseDate();
83  OneTypeData results = null;
84 
85  if (CentralRepository.isEnabled()) {
86  List<CorrelationAttributeInstance> instances;
87  instances = CentralRepository.getInstance().getArtifactInstancesByTypeValue(aType, value);
88  HashMap<UniquePathKey, NodeData> nodeDataMap = new HashMap<>();
89  String caseUUID = Case.getCurrentCase().getName();
90  for (CorrelationAttributeInstance artifactInstance : instances) {
91  if (isCancelled()) {
92  break;
93  }
94 
95  // Only add the attribute if it isn't the object the user selected.
96  // We consider it to be a different object if at least one of the following is true:
97  // - the case UUID is different
98  // - the data source name is different
99  // - the data source device ID is different
100  // - the file path is different
101  if (artifactInstance.getCorrelationCase().getCaseUUID().equals(caseUUID)
102  && (!StringUtils.isBlank(dataSourceName) && artifactInstance.getCorrelationDataSource().getName().equals(dataSourceName))
103  && (!StringUtils.isBlank(deviceId) && artifactInstance.getCorrelationDataSource().getDeviceID().equals(deviceId))
104  && (file != null && artifactInstance.getFilePath().equalsIgnoreCase(file.getParentPath() + file.getName()))) {
105 
106  continue;
107  }
108  correlationAttributesToAdd.add(artifactInstance);
109  NodeData newNode = new NodeData(artifactInstance, aType, value);
110  UniquePathKey uniquePathKey = new UniquePathKey(newNode);
111  nodeDataMap.put(uniquePathKey, newNode);
112  }
113 
114  for (NodeData nodeData : nodeDataMap.values()) {
115  if (isCancelled()) {
116  break;
117  }
118  try {
119  dataSources.add(OtherOccurrences.makeDataSourceString(nodeData.getCorrelationAttributeInstance().getCorrelationCase().getCaseUUID(), nodeData.getDeviceID(), nodeData.getDataSourceName()));
120  caseNames.put(nodeData.getCorrelationAttributeInstance().getCorrelationCase().getCaseUUID(), nodeData.getCorrelationAttributeInstance().getCorrelationCase());
121  } catch (CentralRepoException ex) {
122  logger.log(Level.WARNING, "Unable to get correlation case for displaying other occurrence for case: " + nodeData.getCaseName(), ex);
123  }
124  totalCount++;
125  }
126  }
127 
128  if (!isCancelled()) {
129  results = new OneTypeData(caseNames, totalCount, dataSources.size(), earliestDate, correlationAttributesToAdd);
130  }
131 
132  return results;
133  }
134 
138  static final class OneTypeData {
139 
140  private final Map<String, CorrelationCase> caseNames;
141  private final int totalCount;
142  private final int dataSourceCount;
143  private final Collection<CorrelationAttributeInstance> correlationAttributesToAdd;
144  private final String earliestCaseDate;
145 
157  OneTypeData(Map<String, CorrelationCase> caseNames, int totalCount, int dataSourceCount, String earliestCaseDate, Collection<CorrelationAttributeInstance> correlationAttributesToAdd) {
158  this.caseNames = caseNames;
159  this.totalCount = totalCount;
160  this.dataSourceCount = dataSourceCount;
161  this.correlationAttributesToAdd = correlationAttributesToAdd;
162  this.earliestCaseDate = earliestCaseDate;
163  }
164 
165  public Map<String, CorrelationCase> getCaseNames() {
166  return caseNames;
167  }
168 
169  public int getTotalCount() {
170  return totalCount;
171  }
172 
173  public int getDataSourceCount() {
174  return dataSourceCount;
175  }
176 
177  public Collection<CorrelationAttributeInstance> getCorrelationAttributesToAdd() {
178  return correlationAttributesToAdd;
179  }
180 
181  public String getEarliestCaseDate() {
182  return earliestCaseDate;
183  }
184  }
185 }

Copyright © 2012-2022 Basis Technology. Generated on: Tue Jun 27 2023
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.