19 package org.sleuthkit.autopsy.centralrepository.contentviewer;
21 import java.util.ArrayList;
22 import java.util.Collection;
23 import java.util.HashMap;
24 import java.util.HashSet;
27 import java.util.logging.Level;
28 import javax.swing.SwingWorker;
29 import org.openide.nodes.Node;
54 class OtherOccurrencesNodeWorker
extends SwingWorker<OtherOccurrencesData, Void> {
56 private static final Logger logger = Logger.getLogger(OtherOccurrencesNodeWorker.class.getName());
58 private final Node node;
65 OtherOccurrencesNodeWorker(Node node) {
70 protected OtherOccurrencesData doInBackground() throws Exception {
71 OtherOccurrencesData data = null;
72 if (CentralRepository.isEnabled()) {
73 OsAccount osAccount = node.getLookup().lookup(OsAccount.class);
75 String dataSourceName =
"";
76 Map<String, CorrelationCase> caseNames =
new HashMap<>();
77 Case currentCase = Case.getCurrentCaseThrows();
80 AbstractFile file = node.getLookup().lookup(AbstractFile.class);
83 Content dataSource = file.getDataSource();
84 deviceId = currentCase.getSleuthkitCase().getDataSource(dataSource.getId()).getDeviceId();
85 dataSourceName = dataSource.getName();
87 }
catch (TskException ex) {
88 logger.log(Level.WARNING,
"Exception occurred while trying to get the data source, current case, and device id for an AbstractFile in the other occurrences viewer", ex);
91 Collection<CorrelationAttributeInstance> correlationAttributes =
new ArrayList<>();
92 if (osAccount != null) {
93 correlationAttributes.addAll(OtherOccurrences.getCorrelationAttributeFromOsAccount(node, osAccount));
95 TskContentItem<?> contentItem = node.getLookup().lookup(TskContentItem.class);
96 Content content = null;
97 if (contentItem != null) {
98 content = contentItem.getTskContent();
100 ContentTag nodeContentTag = node.getLookup().lookup(ContentTag.class);
101 BlackboardArtifactTag nodeBbArtifactTag = node.getLookup().lookup(BlackboardArtifactTag.class);
102 if (nodeBbArtifactTag != null) {
103 content = nodeBbArtifactTag.getArtifact();
104 }
else if (nodeContentTag != null) {
105 content = nodeContentTag.getContent();
108 if (content != null) {
109 if (content instanceof AbstractFile) {
110 correlationAttributes.addAll(CorrelationAttributeUtil.makeCorrAttrsForSearch((AbstractFile) content));
111 }
else if (content instanceof AnalysisResult) {
112 correlationAttributes.addAll(CorrelationAttributeUtil.makeCorrAttrsForSearch((AnalysisResult) content));
113 }
else if (content instanceof DataArtifact) {
114 correlationAttributes.addAll(CorrelationAttributeUtil.makeCorrAttrsForSearch((DataArtifact) content));
119 Set<String> dataSources =
new HashSet<>();
120 String currentCaseName = Case.getCurrentCase().getName();
121 for (CorrelationAttributeInstance corAttr : correlationAttributes) {
122 for (NodeData nodeData : OtherOccurrences.getCorrelatedInstances(deviceId, dataSourceName, corAttr).values()) {
124 if(!currentCaseName.equals(nodeData.getCorrelationAttributeInstance().getCorrelationCase().getCaseUUID())) {
125 dataSources.add(OtherOccurrences.makeDataSourceString(nodeData.getCorrelationAttributeInstance().getCorrelationCase().getCaseUUID(), nodeData.getDeviceID(), nodeData.getDataSourceName()));
126 caseNames.put(nodeData.getCorrelationAttributeInstance().getCorrelationCase().getCaseUUID(), nodeData.getCorrelationAttributeInstance().getCorrelationCase());
128 }
catch (CentralRepoException ex) {
129 logger.log(Level.WARNING,
"Unable to get correlation case for displaying other occurrence for case: " + nodeData.getCaseName(), ex);
137 if (!isCancelled()) {
138 data =
new OtherOccurrencesData(correlationAttributes, file, dataSourceName, deviceId, caseNames, totalCount, dataSources.size(), OtherOccurrences.getEarliestCaseDate());
148 static class OtherOccurrencesData {
150 private final String deviceId;
151 private final AbstractFile file;
152 private final String dataSourceName;
153 private final Map<String, CorrelationCase> caseMap;
154 private final int instanceDataCount;
155 private final int dataSourceCount;
156 private final String earliestCaseDate;
157 private final Collection<CorrelationAttributeInstance> correlationAttributes;
159 private OtherOccurrencesData(Collection<CorrelationAttributeInstance> correlationAttributes, AbstractFile file, String dataSourceName, String deviceId, Map<String, CorrelationCase> caseMap,
int instanceCount,
int dataSourceCount, String earliestCaseDate) {
161 this.deviceId = deviceId;
162 this.dataSourceName = dataSourceName;
163 this.caseMap = caseMap;
164 this.instanceDataCount = instanceCount;
165 this.dataSourceCount = dataSourceCount;
166 this.earliestCaseDate = earliestCaseDate;
167 this.correlationAttributes = correlationAttributes;
170 public String getDeviceId() {
174 public AbstractFile getFile() {
178 public String getDataSourceName() {
179 return dataSourceName;
182 public Map<String, CorrelationCase> getCaseMap() {
186 public int getInstanceDataCount() {
187 return instanceDataCount;
190 public int getDataSourceCount() {
191 return dataSourceCount;
199 public String getEarliestCaseDate() {
200 return earliestCaseDate;
203 public Collection<CorrelationAttributeInstance> getCorrelationAttributes() {
204 return correlationAttributes;