Sleuth Kit Java Bindings (JNI)  4.10.0
Java bindings for using The Sleuth Kit
Report.java
Go to the documentation of this file.
1 /*
2  * Sleuth Kit Data Model
3  *
4  * Copyright 2014-2018 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.io.IOException;
22 import java.nio.ByteBuffer;
23 import java.nio.channels.FileChannel;
24 import java.nio.file.Files;
25 import java.nio.file.Path;
26 import java.nio.file.Paths;
27 import static java.nio.file.StandardOpenOption.READ;
28 import java.util.ArrayList;
29 import java.util.Collections;
30 import java.util.List;
31 import java.util.Set;
32 import java.util.logging.Level;
33 import java.util.logging.Logger;
34 
38 public class Report implements Content {
39 
40  static long ID_NOT_SET = -1;
41  private long objectId = ID_NOT_SET;
42  private final String pathAsString;
43  private final Path pathAsPath; // NULL if path is for a URL
44  private final long createdTime;
45  private final String sourceModuleName;
46  private final String reportName;
47 
48  private Content parent; // The object from which the report was generated.
49 
50  private final SleuthkitCase db; // A reference to the database instance.
51  private FileChannel fileChannel = null; // Used to read report content.
52 
53  private static final Logger LOGGER = Logger.getLogger(Report.class.getName());
54 
64  Report(SleuthkitCase db, long id, String path, long createdTime, String sourceModuleName, String reportName, Content parent) {
65  this.db = db;
66  this.objectId = id;
67  this.pathAsString = path;
68  if (path.startsWith("http")) {
69  this.pathAsPath = null;
70  }
71  else {
72  this.pathAsPath = Paths.get(path);
73  }
74 
75  this.createdTime = createdTime;
76  this.sourceModuleName = sourceModuleName;
77  this.reportName = reportName;
78  this.parent = parent;
79  }
80 
81  @Override
82  public long getId() {
83  return objectId;
84  }
85 
91  public String getPath() {
92  return (pathAsPath != null ? pathAsPath.toString() : pathAsString);
93  }
94 
100  public long getCreatedTime() {
101  return createdTime;
102  }
103 
110  public String getSourceModuleName() {
111  return this.sourceModuleName;
112  }
113 
119  public String getReportName() {
120  return reportName;
121  }
122 
123  @Override
124  public int read(byte[] buf, long offset, long len) throws TskCoreException {
125  if (pathAsPath == null || Files.isDirectory(pathAsPath)) {
126  return 0;
127  }
128 
129  int totalBytesRead = 0;
130  ByteBuffer data = ByteBuffer.wrap(buf);
131  try {
132  if (fileChannel == null) {
133  fileChannel = FileChannel.open(pathAsPath, READ);
134  }
135  fileChannel.position(offset);
136  int bytesRead = 0;
137  do {
138  bytesRead = fileChannel.read(data);
139  if (bytesRead != -1) {
140  totalBytesRead += bytesRead;
141  }
142  } while (bytesRead != -1 && data.hasRemaining());
143  } catch (IOException ex) {
144  LOGGER.log(Level.SEVERE, "Failed to read report file.", ex);
145  }
146 
147  return totalBytesRead;
148  }
149 
150  @Override
151  public void close() {
152  try {
153  if (fileChannel != null)
154  fileChannel.close();
155  } catch (IOException ex) {
156  LOGGER.log(Level.WARNING, "Failed to close report file.", ex);
157  }
158  }
159 
160  @Override
161  public long getSize() {
162  try {
163  return (pathAsPath != null ? Files.size(pathAsPath) : 0);
164  } catch (IOException ex) {
165  LOGGER.log(Level.SEVERE, "Failed to get size of report.", ex);
166  // If we cannot determine the size of the report, return zero
167  // to prevent attempts to read content.
168  return 0;
169  }
170  }
171 
172  @Override
173  public <T> T accept(ContentVisitor<T> v) {
174  return v.visit(this);
175  }
176 
177  @Override
178  public String getName() {
179  return reportName;
180  }
181 
182  @Override
183  public String getUniquePath() throws TskCoreException {
184  // @@@ This is wrong... we need to use the same logic is in AbstractContent.getUniquePath().
185  return getPath();
186  }
187 
188  @Override
190  if (null == parent) {
191  return null;
192  } else {
193  return parent.getDataSource();
194  }
195  }
196 
197  @Override
198  public List<Content> getChildren() throws TskCoreException {
199  return Collections.<Content>emptyList();
200  }
201 
202  @Override
203  public boolean hasChildren() throws TskCoreException {
204  return false;
205  }
206 
207  @Override
208  public int getChildrenCount() throws TskCoreException {
209  return 0;
210  }
211 
212  @Override
214  if (parent == null) {
215  SleuthkitCase.ObjectInfo parentInfo;
216  parentInfo = db.getParentInfo(this);
217  if (parentInfo == null) {
218  parent = null;
219  } else {
220  parent = db.getContentById(parentInfo.getId());
221  }
222  }
223  return parent;
224  }
225 
226  @Override
227  public List<Long> getChildrenIds() throws TskCoreException {
228  return Collections.<Long>emptyList();
229  }
230 
231  @Override
232  public BlackboardArtifact newArtifact(int artifactTypeID) throws TskCoreException {
233  if (artifactTypeID != BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
234  throw new TskCoreException("Reports can only have keyword hit artifacts.");
235  }
236  return db.newBlackboardArtifact(artifactTypeID, objectId);
237  }
238 
239  @Override
241  return newArtifact(type.getTypeID());
242  }
243 
244  @Override
245  public ArrayList<BlackboardArtifact> getArtifacts(String artifactTypeName) throws TskCoreException {
246  return getArtifacts(db.getArtifactType(artifactTypeName).getTypeID());
247  }
248 
249  @Override
251  // TSK_GEN_INFO artifact is obsolete.
252  return null;
253  }
254 
255  @Override
257  // TSK_GEN_INFO artifact is obsolete.
258  return null;
259  }
260 
261  @Override
262  public ArrayList<BlackboardAttribute> getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE attr_type) throws TskCoreException {
263  // TSK_GEN_INFO artifact is obsolete.
264  return null;
265  }
266 
267  @Override
268  public ArrayList<BlackboardArtifact> getArtifacts(int artifactTypeID) throws TskCoreException {
269  if (artifactTypeID != BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
270  throw new TskCoreException("Reports can only have keyword hit artifacts.");
271  }
272  return db.getBlackboardArtifacts(artifactTypeID, objectId);
273  }
274 
275  @Override
276  public ArrayList<BlackboardArtifact> getArtifacts(BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException {
277  return getArtifacts(type.getTypeID());
278  }
279 
280  @Override
281  public ArrayList<BlackboardArtifact> getAllArtifacts() throws TskCoreException {
282  return db.getMatchingArtifacts("WHERE obj_id = " + objectId); //NON-NLS
283  }
284 
285  @Override
286  public Set<String> getHashSetNames() throws TskCoreException {
287  return Collections.<String>emptySet();
288  }
289 
290  @Override
291  public long getArtifactsCount(String artifactTypeName) throws TskCoreException {
292  return getArtifactsCount(db.getArtifactType(artifactTypeName).getTypeID());
293  }
294 
295  @Override
296  public long getArtifactsCount(int artifactTypeID) throws TskCoreException {
297  if (artifactTypeID != BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID()) {
298  throw new TskCoreException("Reports can only have keyword hit artifacts.");
299  }
300  return db.getBlackboardArtifactsCount(artifactTypeID, objectId);
301  }
302 
303  @Override
305  return getArtifactsCount(type.getTypeID());
306  }
307 
308  @Override
309  public long getAllArtifactsCount() throws TskCoreException {
310  return db.getBlackboardArtifactsCount(objectId);
311  }
312 
313  @Override
314  public <T> T accept(SleuthkitItemVisitor<T> v) {
315  return v.visit(this);
316  }
317 }
List< Content > getChildren()
Definition: Report.java:198
Set< String > getHashSetNames()
Definition: Report.java:286
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID)
long getArtifactsCount(int artifactTypeID)
Definition: Report.java:296
long getArtifactsCount(String artifactTypeName)
Definition: Report.java:291
ArrayList< BlackboardAttribute > getGenInfoAttributes(BlackboardAttribute.ATTRIBUTE_TYPE attr_type)
Definition: Report.java:262
List< Long > getChildrenIds()
Definition: Report.java:227
ArrayList< BlackboardArtifact > getArtifacts(BlackboardArtifact.ARTIFACT_TYPE type)
Definition: Report.java:276
ArrayList< BlackboardArtifact > getMatchingArtifacts(String whereClause)
BlackboardArtifact newArtifact(BlackboardArtifact.ARTIFACT_TYPE type)
Definition: Report.java:240
BlackboardArtifact newBlackboardArtifact(int artifactTypeID, long obj_id)
ArrayList< BlackboardArtifact > getArtifacts(String artifactTypeName)
Definition: Report.java:245
BlackboardArtifact newArtifact(int artifactTypeID)
Definition: Report.java:232
int read(byte[] buf, long offset, long len)
Definition: Report.java:124
BlackboardArtifact.Type getArtifactType(String artTypeName)
BlackboardArtifact getGenInfoArtifact()
Definition: Report.java:250
long getArtifactsCount(BlackboardArtifact.ARTIFACT_TYPE type)
Definition: Report.java:304
ArrayList< BlackboardArtifact > getAllArtifacts()
Definition: Report.java:281
ArrayList< BlackboardArtifact > getArtifacts(int artifactTypeID)
Definition: Report.java:268
BlackboardArtifact getGenInfoArtifact(boolean create)
Definition: Report.java:256

Copyright © 2011-2020 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.