Autopsy  4.20.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
MessagesChildNodeFactory.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2019 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.communications.relationships;
20 
21 import java.util.Comparator;
22 import java.util.List;
23 import java.util.Set;
24 import java.util.logging.Level;
25 import org.openide.nodes.ChildFactory;
26 import org.openide.nodes.Node;
28 import org.sleuthkit.datamodel.BlackboardArtifact;
29 import org.sleuthkit.datamodel.BlackboardAttribute;
30 import org.sleuthkit.datamodel.Content;
31 import org.sleuthkit.datamodel.TskCoreException;
32 
38 public class MessagesChildNodeFactory extends ChildFactory<BlackboardArtifact>{
39 
40  private static final Logger logger = Logger.getLogger(MessagesChildNodeFactory.class.getName());
41 
43 
44  private List<String> threadIDs;
45 
46  MessagesChildNodeFactory(SelectionInfo selectionInfo, List<String> threadIDs) {
47  this.selectionInfo = selectionInfo;
48  this.threadIDs = threadIDs;
49  }
50 
52  this(null, null);
53  }
54 
62  public void refresh(SelectionInfo selectionInfo, List<String> threadIDs) {
63  this.threadIDs = threadIDs;
64  this.selectionInfo = selectionInfo;
65  refresh(true);
66 
67  }
68 
69  @Override
70  protected boolean createKeys(List<BlackboardArtifact> list) {
71 
72  if(selectionInfo == null) {
73  return true;
74  }
75 
76  final Set<Content> relationshipSources;
77  try {
78  relationshipSources = selectionInfo.getRelationshipSources();
79  } catch (TskCoreException ex) {
80  logger.log(Level.SEVERE, "Failed to load relationship sources.", ex); //NON-NLS
81  return false;
82  }
83 
84  try {
85  for(Content content: relationshipSources) {
86  if( !(content instanceof BlackboardArtifact)){
87  continue;
88  }
89 
90  BlackboardArtifact bba = (BlackboardArtifact) content;
91  BlackboardArtifact.ARTIFACT_TYPE fromID = BlackboardArtifact.ARTIFACT_TYPE.fromID(bba.getArtifactTypeID());
92 
93  if (fromID != BlackboardArtifact.ARTIFACT_TYPE.TSK_EMAIL_MSG
94  && fromID != BlackboardArtifact.ARTIFACT_TYPE.TSK_MESSAGE) {
95  continue;
96  }
97 
98  // We want email and message artifacts that do not have "threadIDs" to appear as one thread in the UI
99  // To achive this assign any artifact that does not have a threadID
100  // the "UNTHREADED_ID"
101  // All call logs will default to a single call logs thread
102  String artifactThreadID = MessageNode.UNTHREADED_ID;
103 
104  BlackboardAttribute attribute = bba.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_THREAD_ID));
105 
106  if(attribute != null) {
107  artifactThreadID = attribute.getValueString();
108  }
109 
110  if(threadIDs == null || threadIDs.contains(artifactThreadID)) {
111  list.add(bba);
112  }
113  }
114 
115  } catch (TskCoreException ex) {
116  logger.log(Level.SEVERE, "Failed to load artifacts for relationship sources.", ex); //NON-NLS
117  }
118 
119  list.sort(new DateComparator());
120 
121  return true;
122  }
123 
124  @Override
125  protected Node createNodeForKey(BlackboardArtifact key) {
126  return new MessageNode(key, null, null);
127  }
128 
134  class DateComparator implements Comparator<BlackboardArtifact> {
135  @Override
136  public int compare(BlackboardArtifact bba1, BlackboardArtifact bba2) {
137 
138  BlackboardAttribute attribute1 = null;
139  BlackboardAttribute attribute2 = null;
140  // Inializing to Long.MAX_VALUE so that if a BlackboardArtifact of
141  // any unexpected type is passed in, it will bubble to the top of
142  // the list.
143  long dateTime1 = Long.MAX_VALUE;
144  long dateTime2 = Long.MAX_VALUE;
145 
146  if (bba1 != null) {
147  BlackboardArtifact.ARTIFACT_TYPE fromID = BlackboardArtifact.ARTIFACT_TYPE.fromID(bba1.getArtifactTypeID());
148  if (fromID != null) {
149  try {
150  switch (fromID) {
151  case TSK_EMAIL_MSG:
152  attribute1 = bba1.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT));
153  break;
154  case TSK_MESSAGE:
155  attribute1 = bba1.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME));
156  break;
157  case TSK_CALLLOG:
158  attribute1 = bba1.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START));
159  break;
160  default:
161  attribute1 = null;
162  break;
163  }
164  } catch (TskCoreException ex) {
165  logger.log(Level.WARNING, String.format("Unable to compare attributes for artifact %d", bba1.getArtifactID()), ex);
166  }
167  }
168  }
169 
170  if (bba2 != null) {
171  BlackboardArtifact.ARTIFACT_TYPE fromID = BlackboardArtifact.ARTIFACT_TYPE.fromID(bba2.getArtifactTypeID());
172  if (fromID != null) {
173  try {
174  switch (fromID) {
175  case TSK_EMAIL_MSG:
176  attribute2 = bba2.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_SENT));
177  break;
178  case TSK_MESSAGE:
179  attribute2 = bba2.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME));
180  break;
181  case TSK_CALLLOG:
182  attribute2 = bba2.getAttribute(new BlackboardAttribute.Type(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_DATETIME_START));
183  break;
184  default:
185  attribute2 = null;
186  break;
187  }
188  } catch (TskCoreException ex) {
189  logger.log(Level.WARNING, String.format("Unable to compare attributes for artifact %d", bba2.getArtifactID()), ex);
190  }
191  }
192  }
193 
194  if (attribute1 != null) {
195  dateTime1 = attribute1.getValueLong();
196  }
197 
198  if (attribute2 != null) {
199  dateTime2 = attribute2.getValueLong();
200  }
201 
202  return Long.compare(dateTime1, dateTime2);
203  }
204  }
205 }
void refresh(SelectionInfo selectionInfo, List< String > threadIDs)
synchronized static Logger getLogger(String name)
Definition: Logger.java:124

Copyright © 2012-2022 Basis Technology. Generated on: Tue Aug 1 2023
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.