Autopsy  4.19.3
Graphical digital forensics platform for The Sleuth Kit and other tools.
Classes | Public Member Functions | Private Member Functions | Static Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary Class Reference

Classes

class  PastCasesResult
 

Public Member Functions

 PastCasesSummary ()
 
 PastCasesSummary (SleuthkitCaseProvider provider, java.util.logging.Logger logger)
 
PastCasesResult getPastCasesData (DataSource dataSource) throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException
 

Private Member Functions

BlackboardArtifact getParentArtifact (BlackboardArtifact artifact) throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException
 
boolean hasDeviceAssociatedArtifact (BlackboardArtifact artifact) throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException
 

Static Private Member Functions

static List< Pair< String, Long > > getCaseCounts (Stream< String > cases)
 
static List< Pair< String, Long > > getCaseCountsFromArtifacts (List< BlackboardArtifact > artifacts)
 
static List< String > getCasesFromArtifact (BlackboardArtifact artifact)
 
static List< String > getCasesFromAttr (BlackboardAttribute commentAttr)
 
static boolean isCentralRepoGenerated (List< String > sources)
 

Private Attributes

final SleuthkitCaseProvider caseProvider
 
final java.util.logging.Logger logger
 

Static Private Attributes

static final Set< Integer > ARTIFACT_UPDATE_TYPE_IDS
 
static final String CASE_SEPARATOR = ","
 
static final String CENTRAL_REPO_INGEST_NAME = CentralRepoIngestModuleFactory.getModuleName().toUpperCase().trim()
 
static final Set< Integer > CR_DEVICE_TYPE_IDS
 

Detailed Description

Provides information about how a data source relates to a previous case. NOTE: This code is fragile and has certain expectations about how the central repository handles creating artifacts. So, if the central repository changes ingest process, this code could break. This code expects that the central repository ingest module:

a) Creates a TSK_PREVIOUSLY_NOTABLE artifact for a file whose hash is in the central repository as a notable file.

b) Creates a TSK_PREVIOUSLY_SEEN artifact for a matching id in the central repository.

c) The created artifact will have a TSK_OTHER_CASES attribute attached where one of the sources for the attribute matches CentralRepoIngestModuleFactory.getModuleName(). The module display name at time of ingest will match CentralRepoIngestModuleFactory.getModuleName() as well.

d) The content of that TSK_OTHER_CASES attribute will be of the form "case1,case2...caseN"

Definition at line 65 of file PastCasesSummary.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.PastCasesSummary ( )
org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.PastCasesSummary ( SleuthkitCaseProvider  provider,
java.util.logging.Logger  logger 
)

Main constructor with external dependencies specified. This constructor is designed with unit testing in mind since mocked dependencies can be utilized.

Parameters
providerThe object providing the current SleuthkitCase.
loggerThe logger to use.

Definition at line 149 of file PastCasesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.logger.

Member Function Documentation

static List<Pair<String, Long> > org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCaseCounts ( Stream< String >  cases)
staticprivate

Given a stream of case ids, groups the strings in a case-insensitive manner, and then provides a list of cases and the occurrence count sorted from max to min.

Parameters
casesA stream of cases.
Returns
The list of unique cases and their occurrences sorted from max to min.

Definition at line 233 of file PastCasesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCaseCountsFromArtifacts().

static List<Pair<String, Long> > org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCaseCountsFromArtifacts ( List< BlackboardArtifact >  artifacts)
staticprivate

Determines a list of counts for most populated cases based on comment attribute.

Parameters
artifactsThe list of artifacts.
Returns
The key value pairs mapping case to counts.

Definition at line 258 of file PastCasesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCaseCounts(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCasesFromArtifact().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getPastCasesData().

static List<String> org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCasesFromArtifact ( BlackboardArtifact  artifact)
staticprivate

Gets a list of cases from the TSK_OTHER_CASES of an artifact. The cases string is expected to be of a form of "case1,case2...caseN".

Parameters
artifactThe artifact.
Returns
The list of cases if found or empty list if not.

Definition at line 184 of file PastCasesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCasesFromAttr().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCaseCountsFromArtifacts().

static List<String> org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCasesFromAttr ( BlackboardAttribute  commentAttr)
staticprivate

Gets a list of cases from the TSK_OTHER_CASES attribute. The cases string is expected to be of a form of "case1,case2...caseN".

Parameters
artifactThe attribute.
Returns
The list of cases if found or empty list if not.

Definition at line 208 of file PastCasesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.isCentralRepoGenerated().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCasesFromArtifact().

BlackboardArtifact org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getParentArtifact ( BlackboardArtifact  artifact) throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException
private

Given a TSK_PREVIOUSLY_SEEN or TSK_PREVIOUSLY_NOTABLE artifact, retrieves it's parent artifact.

Parameters
artifactThe input artifact.
Returns
The artifact if found or null if not.
Exceptions
TskCoreException
NoCurrentCaseException

Definition at line 278 of file PastCasesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.hasDeviceAssociatedArtifact().

PastCasesResult org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getPastCasesData ( DataSource  dataSource) throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException

Returns the past cases data to be shown in the past cases tab.

Parameters
dataSourceThe data source.
Returns
The retrieved data or null if null dataSource.
Exceptions
SleuthkitCaseProviderException
TskCoreException
NoCurrentCaseException

Definition at line 319 of file PastCasesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.SleuthkitCaseProvider.get(), org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCaseCountsFromArtifacts(), and org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.hasDeviceAssociatedArtifact().

Referenced by org.sleuthkit.autopsy.datasourcesummary.ui.PastCasesSummaryGetter.getPastCasesData().

boolean org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.hasDeviceAssociatedArtifact ( BlackboardArtifact  artifact) throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException
private

Returns true if the artifact has an associated artifact of a device type.

Parameters
artifactThe artifact.
Returns
True if there is a device associated artifact.
Exceptions
TskCoreException
NoCurrentCaseException

Definition at line 299 of file PastCasesSummary.java.

References org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getParentArtifact().

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getPastCasesData().

static boolean org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.isCentralRepoGenerated ( List< String >  sources)
staticprivate

Given the provided sources for an attribute, aims to determine if one of those sources is the Central Repository Ingest Module.

Parameters
sourcesThe list of sources found on an attribute.
Returns
Whether or not this attribute (and subsequently the parent artifact) is created by the Central Repository Ingest Module.

Definition at line 166 of file PastCasesSummary.java.

Referenced by org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.getCasesFromAttr().

Member Data Documentation

final Set<Integer> org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.ARTIFACT_UPDATE_TYPE_IDS
staticprivate
Initial value:
= new HashSet<>(Arrays.asList(
ARTIFACT_TYPE.TSK_PREVIOUSLY_SEEN.getTypeID(),
ARTIFACT_TYPE.TSK_PREVIOUSLY_NOTABLE.getTypeID()
))

Definition at line 111 of file PastCasesSummary.java.

final String org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.CASE_SEPARATOR = ","
staticprivate

Definition at line 125 of file PastCasesSummary.java.

final SleuthkitCaseProvider org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.caseProvider
private

Definition at line 127 of file PastCasesSummary.java.

final String org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.CENTRAL_REPO_INGEST_NAME = CentralRepoIngestModuleFactory.getModuleName().toUpperCase().trim()
staticprivate

Definition at line 116 of file PastCasesSummary.java.

final Set<Integer> org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.CR_DEVICE_TYPE_IDS
staticprivate
Initial value:
= new HashSet<>(Arrays.asList(
ARTIFACT_TYPE.TSK_DEVICE_ATTACHED.getTypeID(),
ARTIFACT_TYPE.TSK_DEVICE_INFO.getTypeID(),
ARTIFACT_TYPE.TSK_SIM_ATTACHED.getTypeID(),
ARTIFACT_TYPE.TSK_WIFI_NETWORK_ADAPTER.getTypeID()
))

Definition at line 118 of file PastCasesSummary.java.

final java.util.logging.Logger org.sleuthkit.autopsy.datasourcesummary.datamodel.PastCasesSummary.logger
private

The documentation for this class was generated from the following file:

Copyright © 2012-2022 Basis Technology. Generated on: Tue Jun 27 2023
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.