Autopsy  4.21.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
BlackboardPostEvent.java
Go to the documentation of this file.
1 /*
2  * Autopsy Forensic Browser
3  *
4  * Copyright 2015-2021 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.ingest.events;
20 
21 import java.io.Serializable;
22 import java.util.ArrayList;
23 import java.util.Collection;
24 import java.util.Collections;
25 import java.util.logging.Level;
26 import java.util.stream.Collectors;
27 import javax.annotation.concurrent.Immutable;
34 import org.sleuthkit.datamodel.BlackboardArtifact;
35 import org.sleuthkit.datamodel.TskCoreException;
36 
42 public final class BlackboardPostEvent extends AutopsyEvent implements Serializable {
43 
44  private static final long serialVersionUID = 1L;
45  private static final Logger logger = Logger.getLogger(BlackboardPostEvent.class.getName());
46  private transient ModuleDataEvent eventData;
47 
57  /*
58  * Putting a serializable data holding object into oldValue to allow for
59  * lazy loading of the ModuleDataEvent object for remote events. This
60  * bypasses the issues related to the serialization and de-serialization
61  * of BlackboardArtifact objects when the event is published over a
62  * network.
63  */
64  super(
66  new SerializableEventData(eventData.getModuleName(), eventData.getBlackboardArtifactType(), eventData.getArtifacts() != null
67  ? eventData.getArtifacts()
68  .stream()
69  .map(BlackboardArtifact::getArtifactID)
70  .collect(Collectors.toList()) : Collections.emptyList()),
71  null
72  );
73  this.eventData = eventData;
74  }
75 
81  @Override
82  public Object getOldValue() {
83  /*
84  * The eventData field is set in the constructor, but it is transient,
85  * so it will become null when the event is serialized for publication
86  * over a network. Doing a lazy load of the ModuleDataEvent object
87  * bypasses the issues related to the serialization and de-serialization
88  * of BlackboardArtifact objects and may also save database round trips
89  * from other hosts since subscribers to this event are often not
90  * interested in the event data.
91  */
92  if (null != eventData) {
93  return eventData;
94  }
95  try {
96  SerializableEventData data = (SerializableEventData) super.getOldValue();
97  Collection<BlackboardArtifact> artifacts = new ArrayList<>();
98  for (Long id : data.artifactIds) {
99  artifacts.add(Case.getCurrentCaseThrows().getSleuthkitCase().getBlackboardArtifact(id));
100  }
101  eventData = new ModuleDataEvent(data.moduleName, data.artifactTypeId, !artifacts.isEmpty() ? artifacts : null);
102  return eventData;
103  } catch (NoCurrentCaseException | TskCoreException ex) {
104  logger.log(Level.SEVERE, "Error doing lazy load for remote event", ex); //NON-NLS
105  return null;
106  }
107  }
108 
112  @Immutable
113  private static final class SerializableEventData implements Serializable {
114 
115  private static final long serialVersionUID = 1L;
116  private final String moduleName;
117  private BlackboardArtifact.Type artifactTypeId;
118  private Collection<Long> artifactIds;
119 
120  private SerializableEventData(String moduleName, BlackboardArtifact.Type artifactTypeId, Collection<Long> artifactIds) {
121  this.moduleName = moduleName;
123  this.artifactIds = new ArrayList<>(artifactIds);
124  }
125 
126  }
127 
128 }
Collection< BlackboardArtifact > getArtifacts()
BlackboardArtifact.Type getBlackboardArtifactType()
static final long serialVersionUID
BlackboardArtifact.Type artifactTypeId
transient ModuleDataEvent eventData
Object getOldValue()
final String moduleName
synchronized static Logger getLogger(String name)
Definition: Logger.java:124
SerializableEventData(String moduleName, BlackboardArtifact.Type artifactTypeId, Collection< Long > artifactIds)
Collection< Long > artifactIds
static final Logger logger
BlackboardPostEvent(ModuleDataEvent eventData)

Copyright © 2012-2022 Basis Technology. Generated on: Tue Feb 6 2024
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.