Autopsy  4.21.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
DomainSearch.java
Go to the documentation of this file.
1 /*
2  * Autopsy
3  *
4  * Copyright 2020-2021 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.autopsy.discovery.search;
20 
21 import java.awt.Image;
22 import java.util.ArrayList;
23 import java.util.HashMap;
24 import java.util.LinkedHashMap;
25 import java.util.List;
26 import java.util.Map;
27 import org.apache.commons.lang3.StringUtils;
31 import org.sleuthkit.datamodel.BlackboardArtifact;
32 import org.sleuthkit.datamodel.BlackboardAttribute;
33 import org.sleuthkit.datamodel.SleuthkitCase;
34 import org.sleuthkit.datamodel.TskCoreException;
35 
39 public class DomainSearch {
40 
41  private final DomainSearchCache searchCache;
44 
48  public DomainSearch() {
49  this(new DomainSearchCache(), new DomainSearchThumbnailCache(),
51  }
52 
61  DomainSearch(DomainSearchCache cache, DomainSearchThumbnailCache thumbnailCache,
62  DomainSearchArtifactsCache artifactsCache) {
63  this.searchCache = cache;
64  this.thumbnailCache = thumbnailCache;
65  this.artifactsCache = artifactsCache;
66  }
67 
89  public Map<GroupKey, Integer> getGroupSizes(String userName,
90  List<AbstractFilter> filters,
91  DiscoveryAttributes.AttributeType groupAttributeType,
92  Group.GroupSortingAlgorithm groupSortingType,
93  ResultsSorter.SortingMethod domainSortingMethod,
94  SleuthkitCase caseDb, CentralRepository centralRepoDb, SearchContext context) throws DiscoveryException, SearchCancellationException {
95 
96  final Map<GroupKey, List<Result>> searchResults = searchCache.get(
97  userName, filters, groupAttributeType, groupSortingType,
98  domainSortingMethod, caseDb, centralRepoDb, context);
99 
100  // Transform the cached results into a map of group key to group size.
101  final LinkedHashMap<GroupKey, Integer> groupSizes = new LinkedHashMap<>();
102  for (GroupKey groupKey : searchResults.keySet()) {
103  if (context.searchIsCancelled()) {
104  throw new SearchCancellationException("The search was cancelled before group sizes were finished being calculated");
105  }
106  groupSizes.put(groupKey, searchResults.get(groupKey).size());
107  }
108 
109  return groupSizes;
110  }
111 
135  public List<Result> getDomainsInGroup(String userName,
136  List<AbstractFilter> filters,
137  DiscoveryAttributes.AttributeType groupAttributeType,
138  Group.GroupSortingAlgorithm groupSortingType,
139  ResultsSorter.SortingMethod domainSortingMethod,
140  GroupKey groupKey, int startingEntry, int numberOfEntries,
141  SleuthkitCase caseDb, CentralRepository centralRepoDb, SearchContext context) throws DiscoveryException, SearchCancellationException {
142 
143  final Map<GroupKey, List<Result>> searchResults = searchCache.get(
144  userName, filters, groupAttributeType, groupSortingType,
145  domainSortingMethod, caseDb, centralRepoDb, context);
146  final List<Result> domainsInGroup = searchResults.get(groupKey);
147  final List<Result> page = new ArrayList<>();
148  for (int i = startingEntry; (i < startingEntry + numberOfEntries)
149  && (i < domainsInGroup.size()); i++) {
150  page.add(domainsInGroup.get(i));
151  }
152 
153  return page;
154  }
155 
173  public Image getThumbnail(DomainSearchThumbnailRequest thumbnailRequest) throws DiscoveryException {
174  return thumbnailCache.get(thumbnailRequest);
175  }
176 
192  public List<BlackboardArtifact> getArtifacts(DomainSearchArtifactsRequest artifactsRequest) throws DiscoveryException {
193  return artifactsCache.get(artifactsRequest);
194  }
195 
208  public List<MiniTimelineResult> getAllArtifactsForDomain(SleuthkitCase sleuthkitCase, String domain) throws DiscoveryException {
209  List<BlackboardArtifact> artifacts = new ArrayList<>();
210  Map<String, List<BlackboardArtifact>> dateMap = new HashMap<>();
211  if (!StringUtils.isBlank(domain)) {
212  for (BlackboardArtifact.ARTIFACT_TYPE type : SearchData.Type.DOMAIN.getArtifactTypes()) {
213 
214  artifacts.addAll(getArtifacts(new DomainSearchArtifactsRequest(sleuthkitCase, domain, type)));
215  }
216 
217  for (BlackboardArtifact artifact : artifacts) {
218  String date;
219  try {
220  date = getDate(artifact);
221  } catch (TskCoreException ex) {
222  throw new DiscoveryException("Unable to get date for artifact with ID: " + artifact.getArtifactID(), ex);
223  }
224  if (!StringUtils.isBlank(date)) {
225  List<BlackboardArtifact> artifactList = dateMap.get(date);
226  if (artifactList == null) {
227  artifactList = new ArrayList<>();
228  }
229  artifactList.add(artifact);
230  dateMap.put(date, artifactList);
231  }
232  }
233  }
234  List<MiniTimelineResult> dateArtifactList = new ArrayList<>();
235 
236  for (String date : dateMap.keySet()) {
237  dateArtifactList.add(new MiniTimelineResult(date, dateMap.get(date)));
238  }
239  return dateArtifactList;
240  }
241 
252  private String getDate(BlackboardArtifact artifact) throws TskCoreException {
253  for (BlackboardAttribute attribute : artifact.getAttributes()) {
254  if (attribute.getAttributeType().getTypeName().startsWith("TSK_DATETIME")) {
255  String dateString = TimeZoneUtils.getFormattedTime(attribute.getValueLong());
256  if (dateString.length() >= 10) {
257  return dateString.substring(0, 10);
258  }
259  }
260  }
261  return "";
262  }
263 
264 }
List< BlackboardArtifact > get(DomainSearchArtifactsRequest request)
List< Result > getDomainsInGroup(String userName, List< AbstractFilter > filters, DiscoveryAttributes.AttributeType groupAttributeType, Group.GroupSortingAlgorithm groupSortingType, ResultsSorter.SortingMethod domainSortingMethod, GroupKey groupKey, int startingEntry, int numberOfEntries, SleuthkitCase caseDb, CentralRepository centralRepoDb, SearchContext context)
Map< GroupKey, Integer > getGroupSizes(String userName, List< AbstractFilter > filters, DiscoveryAttributes.AttributeType groupAttributeType, Group.GroupSortingAlgorithm groupSortingType, ResultsSorter.SortingMethod domainSortingMethod, SleuthkitCase caseDb, CentralRepository centralRepoDb, SearchContext context)
static String getFormattedTime(long epochTime)
List< BlackboardArtifact > getArtifacts(DomainSearchArtifactsRequest artifactsRequest)
final DomainSearchArtifactsCache artifactsCache
final DomainSearchThumbnailCache thumbnailCache
List< MiniTimelineResult > getAllArtifactsForDomain(SleuthkitCase sleuthkitCase, String domain)
String getDate(BlackboardArtifact artifact)
Image getThumbnail(DomainSearchThumbnailRequest thumbnailRequest)

Copyright © 2012-2022 Basis Technology. Generated on: Tue Feb 6 2024
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.