19 package org.sleuthkit.autopsy.datasourcesummary.datamodel;
21 import java.util.ArrayList;
22 import java.util.Collections;
23 import java.util.HashSet;
24 import java.util.List;
27 import java.util.function.Function;
28 import java.util.stream.Collectors;
29 import org.apache.commons.lang3.StringUtils;
30 import org.apache.commons.lang3.tuple.Pair;
34 import org.
sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
36 import org.
sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
46 private static final BlackboardAttribute.Type
TYPE_SET_NAME =
new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_SET_NAME);
91 public List<Pair<String, Long>>
getKeywordCounts(DataSource dataSource)
throws SleuthkitCaseProviderException, TskCoreException {
94 .filter((pair) -> pair != null && pair.getKey() != null && !EXCLUDED_KEYWORD_SEARCH_ITEMS.contains(pair.getKey().toUpperCase().trim()))
95 .collect(Collectors.toList());
113 @SuppressWarnings(
"deprecation")
114 public List<Pair<String, Long>>
getInterestingItemCounts(DataSource dataSource) throws SleuthkitCaseProviderException, TskCoreException {
115 return getCountsData(dataSource,
TYPE_SET_NAME, ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT, ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT, ARTIFACT_TYPE.TSK_INTERESTING_ITEM);
132 private List<Pair<String, Long>>
getCountsData(DataSource dataSource, BlackboardAttribute.Type keyType, ARTIFACT_TYPE... artifactTypes)
133 throws SleuthkitCaseProviderException, TskCoreException {
135 if (dataSource == null) {
136 return Collections.emptyList();
139 List<BlackboardArtifact> artifacts =
new ArrayList<>();
140 SleuthkitCase skCase = provider.
get();
143 for (ARTIFACT_TYPE type : artifactTypes) {
144 artifacts.addAll(skCase.getBlackboard().getArtifacts(type.getTypeID(), dataSource.getId()));
148 Map<String, Long> countedKeys = artifacts.stream()
151 return (StringUtils.isBlank(key)) ? null : key;
153 .filter((key) -> key != null)
154 .collect(Collectors.groupingBy(Function.identity(), Collectors.counting()));
157 return countedKeys.entrySet().stream()
158 .map((e) -> Pair.of(e.getKey(), e.getValue()))
159 .sorted((a, b) -> -a.getValue().compareTo(b.getValue()))
160 .collect(Collectors.toList());
List< Pair< String, Long > > getInterestingItemCounts(DataSource dataSource)
SleuthkitCaseProvider DEFAULT
List< Pair< String, Long > > getCountsData(DataSource dataSource, BlackboardAttribute.Type keyType, ARTIFACT_TYPE...artifactTypes)
static final Set< String > EXCLUDED_KEYWORD_SEARCH_ITEMS
final SleuthkitCaseProvider provider
AnalysisSummary(SleuthkitCaseProvider provider)
List< Pair< String, Long > > getHashsetCounts(DataSource dataSource)
static final BlackboardAttribute.Type TYPE_SET_NAME
List< Pair< String, Long > > getKeywordCounts(DataSource dataSource)
static String getStringOrNull(BlackboardArtifact artifact, Type attributeType)