19 package org.sleuthkit.datamodel;
21 import com.google.common.cache.Cache;
22 import com.google.common.cache.CacheBuilder;
23 import com.google.common.collect.ImmutableSet;
24 import com.google.common.eventbus.EventBus;
25 import com.mchange.v2.c3p0.ComboPooledDataSource;
26 import com.mchange.v2.c3p0.DataSources;
27 import com.mchange.v2.c3p0.PooledDataSource;
28 import com.zaxxer.sparsebits.SparseBitSet;
29 import java.beans.PropertyVetoException;
30 import java.io.BufferedInputStream;
31 import java.io.BufferedOutputStream;
33 import java.io.FileInputStream;
34 import java.io.FileOutputStream;
35 import java.io.IOException;
36 import java.io.InputStream;
37 import java.io.OutputStream;
38 import java.io.UnsupportedEncodingException;
39 import java.net.InetAddress;
40 import java.net.URLEncoder;
41 import java.nio.charset.StandardCharsets;
42 import java.nio.file.Paths;
43 import java.sql.Connection;
44 import java.sql.DriverManager;
45 import java.sql.PreparedStatement;
46 import java.sql.ResultSet;
47 import java.sql.SQLException;
48 import java.sql.Statement;
49 import java.text.SimpleDateFormat;
50 import java.util.ArrayList;
51 import java.util.Arrays;
52 import java.util.Collection;
53 import java.util.Collections;
54 import java.util.Date;
55 import java.util.EnumMap;
56 import java.util.HashMap;
57 import java.util.HashSet;
58 import java.util.LinkedHashMap;
59 import java.util.List;
61 import java.util.MissingResourceException;
62 import java.util.Objects;
63 import java.util.Properties;
64 import java.util.ResourceBundle;
66 import java.util.UUID;
67 import java.util.concurrent.ConcurrentHashMap;
68 import java.util.concurrent.TimeUnit;
69 import java.util.concurrent.locks.ReentrantReadWriteLock;
70 import java.util.logging.Level;
71 import java.util.logging.Logger;
72 import java.util.stream.Collectors;
73 import org.apache.commons.lang3.StringUtils;
74 import org.postgresql.util.PSQLState;
91 import org.sqlite.SQLiteConfig;
92 import org.sqlite.SQLiteDataSource;
93 import org.sqlite.SQLiteJDBCLoader;
101 private static final int MAX_DB_NAME_LEN_BEFORE_TIMESTAMP = 47;
110 private static final long BASE_ARTIFACT_ID = Long.MIN_VALUE;
111 private static final Logger logger = Logger.getLogger(
SleuthkitCase.class.getName());
112 private static final ResourceBundle bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
113 private static final int IS_REACHABLE_TIMEOUT_MS = 1000;
114 private static final String SQL_ERROR_CONNECTION_GROUP =
"08";
115 private static final String SQL_ERROR_AUTHENTICATION_GROUP =
"28";
116 private static final String SQL_ERROR_PRIVILEGE_GROUP =
"42";
117 private static final String SQL_ERROR_RESOURCE_GROUP =
"53";
118 private static final String SQL_ERROR_LIMIT_GROUP =
"54";
119 private static final String SQL_ERROR_INTERNAL_GROUP =
"xx";
120 private static final int MIN_USER_DEFINED_TYPE_ID = 10000;
122 private static final Set<String> CORE_TABLE_NAMES = ImmutableSet.of(
124 "tsk_event_descriptions",
137 "tsk_files_derived_method",
140 "blackboard_artifact_tags",
141 "blackboard_artifacts",
142 "blackboard_attributes",
143 "blackboard_artifact_types",
144 "blackboard_attribute_types",
146 "file_encoding_types",
147 "ingest_module_types",
148 "ingest_job_status_types",
151 "ingest_job_modules",
154 "account_relationships",
158 private static final Set<String> CORE_INDEX_NAMES = ImmutableSet.of(
162 "artifact_artifact_objID",
167 "relationships_account1",
168 "relationships_account2",
169 "relationships_relationship_source_obj_id",
170 "relationships_date_time",
171 "relationships_relationship_type",
172 "relationships_data_source_obj_id",
175 "events_data_source_obj_id",
176 "events_file_obj_id",
177 "events_artifact_id");
179 private static final String TSK_VERSION_KEY =
"TSK_VER";
180 private static final String SCHEMA_MAJOR_VERSION_KEY =
"SCHEMA_MAJOR_VERSION";
181 private static final String SCHEMA_MINOR_VERSION_KEY =
"SCHEMA_MINOR_VERSION";
182 private static final String CREATION_SCHEMA_MAJOR_VERSION_KEY =
"CREATION_SCHEMA_MAJOR_VERSION";
183 private static final String CREATION_SCHEMA_MINOR_VERSION_KEY =
"CREATION_SCHEMA_MINOR_VERSION";
185 private final ConnectionPool connections;
186 private final Object carvedFileDirsLock =
new Object();
187 private final Map<Long, VirtualDirectory> rootIdsToCarvedFileDirs =
new HashMap<>();
188 private final Map<Long, FileSystem> fileSystemIdMap =
new HashMap<>();
189 private final List<ErrorObserver> sleuthkitCaseErrorObservers =
new ArrayList<>();
190 private final String databaseName;
191 private final String dbPath;
192 private final DbType dbType;
193 private final String caseDirPath;
195 private final String caseHandleIdentifier;
196 private String dbBackupPath;
204 private final Object rootDirectoryMapLock =
new Object();
205 private final Map<RootDirectoryKey, Long> rootDirectoryMap =
new HashMap<>();
206 private final Cache<Long, Boolean> isRootDirectoryCache
207 = CacheBuilder.newBuilder().maximumSize(200000).expireAfterAccess(5, TimeUnit.MINUTES).build();
213 private final Map<Long, SparseBitSet> hasChildrenBitSetMap =
new HashMap<>();
215 private long nextArtifactId;
220 private final ReentrantReadWriteLock rwLock =
new ReentrantReadWriteLock(
true);
235 private final Map<String, Set<Long>> deviceIdToDatasourceObjIdMap =
new HashMap<>();
237 private final EventBus eventBus =
new EventBus(
"SleuthkitCase-EventBus");
240 eventBus.register(listener);
244 eventBus.unregister(listener);
247 void fireTSKEvent(Object event) {
248 eventBus.post(event);
252 private final Map<Long, Content> frequentlyUsedContentMap =
new HashMap<>();
254 private Examiner cachedCurrentExaminer = null;
257 Properties p =
new Properties(System.getProperties());
258 p.put(
"com.mchange.v2.log.MLog",
"com.mchange.v2.log.FallbackMLog");
259 p.put(
"com.mchange.v2.log.FallbackMLog.DEFAULT_CUTOFF_LEVEL",
"SEVERE");
260 System.setProperties(p);
279 if (info.getHost() == null || info.getHost().isEmpty()) {
280 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingHostname"));
281 }
else if (info.getPort() == null || info.getPort().isEmpty()) {
282 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPort"));
283 }
else if (info.getUserName() == null || info.getUserName().isEmpty()) {
284 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingUsername"));
285 }
else if (info.getPassword() == null || info.getPassword().isEmpty()) {
286 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPassword"));
290 Class.forName(
"org.postgresql.Driver");
291 Connection conn = DriverManager.getConnection(
"jdbc:postgresql://" + info.getHost() +
":" + info.getPort() +
"/postgres", info.getUserName(), info.getPassword());
295 }
catch (SQLException ex) {
297 String sqlState = ex.getSQLState().toLowerCase();
298 if (sqlState.startsWith(SQL_ERROR_CONNECTION_GROUP)) {
300 if (InetAddress.getByName(info.getHost()).isReachable(IS_REACHABLE_TIMEOUT_MS)) {
302 result = bundle.getString(
"DatabaseConnectionCheck.Port");
304 result = bundle.getString(
"DatabaseConnectionCheck.HostnameOrPort");
306 }
catch (IOException | MissingResourceException any) {
308 result = bundle.getString(
"DatabaseConnectionCheck.Everything");
310 }
else if (sqlState.startsWith(SQL_ERROR_AUTHENTICATION_GROUP)) {
311 result = bundle.getString(
"DatabaseConnectionCheck.Authentication");
312 }
else if (sqlState.startsWith(SQL_ERROR_PRIVILEGE_GROUP)) {
313 result = bundle.getString(
"DatabaseConnectionCheck.Access");
314 }
else if (sqlState.startsWith(SQL_ERROR_RESOURCE_GROUP)) {
315 result = bundle.getString(
"DatabaseConnectionCheck.ServerDiskSpace");
316 }
else if (sqlState.startsWith(SQL_ERROR_LIMIT_GROUP)) {
317 result = bundle.getString(
"DatabaseConnectionCheck.ServerRestart");
318 }
else if (sqlState.startsWith(SQL_ERROR_INTERNAL_GROUP)) {
319 result = bundle.getString(
"DatabaseConnectionCheck.InternalServerIssue");
321 result = bundle.getString(
"DatabaseConnectionCheck.Connection");
324 }
catch (ClassNotFoundException ex) {
325 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.Installation"));
341 Class.forName(
"org.sqlite.JDBC");
342 this.dbPath = dbPath;
343 this.dbType = dbType;
345 this.caseDirPath = dbFile.getParentFile().getAbsolutePath();
346 this.databaseName = dbFile.
getName();
347 this.connections =
new SQLiteConnections(dbPath);
348 this.caseHandle = caseHandle;
349 this.caseHandleIdentifier = caseHandle.getCaseDbIdentifier();
351 logSQLiteJDBCDriverInfo();
371 private SleuthkitCase(String host,
int port, String dbName, String userName, String password, SleuthkitJNI.CaseDbHandle caseHandle, String caseDirPath, DbType dbType)
throws Exception {
373 this.databaseName = dbName;
374 this.dbType = dbType;
375 this.caseDirPath = caseDirPath;
376 this.connections =
new PostgreSQLConnections(host, port, dbName, userName, password);
377 this.caseHandle = caseHandle;
378 this.caseHandleIdentifier = caseHandle.getCaseDbIdentifier();
382 private void init() throws Exception {
383 typeIdToArtifactTypeMap =
new ConcurrentHashMap<>();
384 typeIdToAttributeTypeMap =
new ConcurrentHashMap<>();
385 typeNameToArtifactTypeMap =
new ConcurrentHashMap<>();
386 typeNameToAttributeTypeMap =
new ConcurrentHashMap<>();
392 updateDatabaseSchema(null);
393 initBlackboardArtifactTypes();
394 initBlackboardAttributeTypes();
395 initNextArtifactId();
397 try (CaseDbConnection connection = connections.getConnection()) {
398 initIngestModuleTypes(connection);
399 initIngestStatusTypes(connection);
400 initReviewStatuses(connection);
401 initEncodingTypes(connection);
402 populateHasChildrenMap(connection);
403 updateExaminers(connection);
404 initDBSchemaCreationVersion(connection);
407 blackboard =
new Blackboard(
this);
408 fileManager =
new FileManager(
this);
409 communicationsMgr =
new CommunicationsManager(
this);
410 timelineMgr =
new TimelineManager(
this);
411 dbAccessManager =
new CaseDbAccessManager(
this);
412 taggingMgr =
new TaggingManager(
this);
413 scoringManager =
new ScoringManager(
this);
414 osAccountRealmManager =
new OsAccountRealmManager(
this);
415 osAccountManager =
new OsAccountManager(
this);
416 hostManager =
new HostManager(
this);
417 personManager =
new PersonManager(
this);
418 hostAddressManager =
new HostAddressManager(
this);
426 static Set<String> getCoreTableNames() {
427 return CORE_TABLE_NAMES;
435 static Set<String> getCoreIndexNames() {
436 return CORE_INDEX_NAMES;
447 boolean getHasChildren(Content content) {
448 long objId = content.getId();
449 long mapIndex = objId / Integer.MAX_VALUE;
450 int mapValue = (int) (objId % Integer.MAX_VALUE);
452 synchronized (hasChildrenBitSetMap) {
453 if (hasChildrenBitSetMap.containsKey(mapIndex)) {
454 return hasChildrenBitSetMap.get(mapIndex).get(mapValue);
465 private void setHasChildren(Long objId) {
466 long mapIndex = objId / Integer.MAX_VALUE;
467 int mapValue = (int) (objId % Integer.MAX_VALUE);
469 synchronized (hasChildrenBitSetMap) {
470 if (hasChildrenBitSetMap.containsKey(mapIndex)) {
471 hasChildrenBitSetMap.get(mapIndex).set(mapValue);
473 SparseBitSet bitSet =
new SparseBitSet();
474 bitSet.set(mapValue);
475 hasChildrenBitSetMap.put(mapIndex, bitSet);
488 return communicationsMgr;
528 return dbAccessManager;
548 return scoringManager;
559 return osAccountRealmManager;
570 return osAccountManager;
592 return personManager;
603 return hostAddressManager;
612 private void initBlackboardArtifactTypes() throws SQLException,
TskCoreException {
614 try (CaseDbConnection connection = connections.getConnection();
615 Statement statement = connection.createStatement();) {
618 statement.execute(
"INSERT INTO blackboard_artifact_types (artifact_type_id, type_name, display_name, category_type) VALUES (" + type.getTypeID() +
" , '" + type.getLabel() +
"', '" + type.getDisplayName() +
"' , " + type.getCategory().getID() +
")");
619 }
catch (SQLException ex) {
620 try (ResultSet resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM blackboard_artifact_types WHERE artifact_type_id = '" + type.getTypeID() +
"'")) {
622 if (resultSet.getLong(
"count") == 0) {
627 this.typeIdToArtifactTypeMap.put(type.getTypeID(),
new BlackboardArtifact.Type(type));
628 this.typeNameToArtifactTypeMap.put(type.getLabel(),
new BlackboardArtifact.Type(type));
631 int newPrimaryKeyIndex = Collections.max(Arrays.asList(ARTIFACT_TYPE.values())).getTypeID() + 1;
632 statement.execute(
"ALTER SEQUENCE blackboard_artifact_types_artifact_type_id_seq RESTART WITH " + newPrimaryKeyIndex);
646 private void initBlackboardAttributeTypes() throws SQLException, TskCoreException {
648 try (CaseDbConnection connection = connections.getConnection();
649 Statement statement = connection.createStatement();) {
650 for (ATTRIBUTE_TYPE type : ATTRIBUTE_TYPE.values()) {
652 statement.execute(
"INSERT INTO blackboard_attribute_types (attribute_type_id, type_name, display_name, value_type) VALUES (" + type.getTypeID() +
", '" + type.getLabel() +
"', '" + type.getDisplayName() +
"', '" + type.getValueType().getType() +
"')");
653 }
catch (SQLException ex) {
654 try (ResultSet resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM blackboard_attribute_types WHERE attribute_type_id = '" + type.getTypeID() +
"'")) {
656 if (resultSet.getLong(
"count") == 0) {
661 this.typeIdToAttributeTypeMap.put(type.getTypeID(),
new BlackboardAttribute.Type(type));
662 this.typeNameToAttributeTypeMap.put(type.getLabel(),
new BlackboardAttribute.Type(type));
665 int newPrimaryKeyIndex = Collections.max(Arrays.asList(ATTRIBUTE_TYPE.values())).getTypeID() + 1;
666 statement.execute(
"ALTER SEQUENCE blackboard_attribute_types_attribute_type_id_seq RESTART WITH " + newPrimaryKeyIndex);
682 private void initNextArtifactId() throws SQLException, TskCoreException {
683 CaseDbConnection connection = null;
684 Statement statement = null;
685 ResultSet resultSet = null;
688 connection = connections.getConnection();
689 statement = connection.createStatement();
690 resultSet = connection.executeQuery(statement,
"SELECT MAX(artifact_id) AS max_artifact_id FROM blackboard_artifacts");
692 this.nextArtifactId = resultSet.getLong(
"max_artifact_id") + 1;
693 if (this.nextArtifactId == 1) {
694 this.nextArtifactId = BASE_ARTIFACT_ID;
697 closeResultSet(resultSet);
698 closeStatement(statement);
699 closeConnection(connection);
711 private void initIngestModuleTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
712 Statement statement = null;
713 ResultSet resultSet = null;
716 statement = connection.createStatement();
717 for (IngestModuleType type : IngestModuleType.values()) {
719 statement.execute(
"INSERT INTO ingest_module_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"');");
720 }
catch (SQLException ex) {
721 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_module_types WHERE type_id = " + type.ordinal() +
";");
723 if (resultSet.getLong(
"count") == 0) {
731 closeResultSet(resultSet);
732 closeStatement(statement);
744 private void initIngestStatusTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
745 Statement statement = null;
746 ResultSet resultSet = null;
749 statement = connection.createStatement();
750 for (IngestJobStatusType type : IngestJobStatusType.values()) {
752 statement.execute(
"INSERT INTO ingest_job_status_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"');");
753 }
catch (SQLException ex) {
754 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_job_status_types WHERE type_id = " + type.ordinal() +
";");
756 if (resultSet.getLong(
"count") == 0) {
764 closeResultSet(resultSet);
765 closeStatement(statement);
776 private void initReviewStatuses(CaseDbConnection connection)
throws SQLException, TskCoreException {
777 Statement statement = null;
778 ResultSet resultSet = null;
781 statement = connection.createStatement();
782 for (BlackboardArtifact.ReviewStatus status : BlackboardArtifact.ReviewStatus.values()) {
784 statement.execute(
"INSERT INTO review_statuses (review_status_id, review_status_name, display_name) "
785 +
"VALUES (" + status.getID() +
",'" + status.getName() +
"','" + status.getDisplayName() +
"')");
786 }
catch (SQLException ex) {
787 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM review_statuses WHERE review_status_id = " + status.getID());
789 if (resultSet.getLong(
"count") == 0) {
797 closeResultSet(resultSet);
798 closeStatement(statement);
810 private void initEncodingTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
811 Statement statement = null;
812 ResultSet resultSet = null;
815 statement = connection.createStatement();
816 for (TskData.EncodingType type : TskData.EncodingType.values()) {
818 statement.execute(
"INSERT INTO file_encoding_types (encoding_type, name) VALUES (" + type.getType() +
" , '" + type.name() +
"')");
819 }
catch (SQLException ex) {
820 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM file_encoding_types WHERE encoding_type = " + type.getType());
822 if (resultSet.getLong(
"count") == 0) {
830 closeResultSet(resultSet);
831 closeStatement(statement);
844 private void updateExaminers(CaseDbConnection connection)
throws SQLException, TskCoreException {
846 String loginName = System.getProperty(
"user.name");
847 if (loginName.isEmpty()) {
848 logger.log(Level.SEVERE,
"Cannot determine logged in user name");
854 PreparedStatement statement;
857 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_EXAMINER_POSTGRESQL);
860 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_EXAMINER_SQLITE);
863 throw new TskCoreException(
"Unknown DB Type: " +
getDatabaseType().name());
865 statement.clearParameters();
866 statement.setString(1, loginName);
867 connection.executeUpdate(statement);
868 }
catch (SQLException ex) {
869 throw new TskCoreException(
"Error inserting row in tsk_examiners. login name: " + loginName, ex);
882 private void populateHasChildrenMap(CaseDbConnection connection)
throws TskCoreException {
883 long timestamp = System.currentTimeMillis();
885 Statement statement = null;
886 ResultSet resultSet = null;
889 statement = connection.createStatement();
890 resultSet = statement.executeQuery(
"select distinct par_obj_id from tsk_objects");
892 synchronized (hasChildrenBitSetMap) {
893 while (resultSet.next()) {
894 setHasChildren(resultSet.getLong(
"par_obj_id"));
897 long delay = System.currentTimeMillis() - timestamp;
898 logger.log(Level.INFO,
"Time to initialize parent node cache: {0} ms", delay);
899 }
catch (SQLException ex) {
900 throw new TskCoreException(
"Error populating parent node cache", ex);
902 closeResultSet(resultSet);
903 closeStatement(statement);
914 void addDataSourceToHasChildrenMap() throws TskCoreException {
916 CaseDbConnection connection = connections.getConnection();
918 populateHasChildrenMap(connection);
920 closeConnection(connection);
933 private void updateDatabaseSchema(String dbPath)
throws Exception {
934 CaseDbConnection connection = null;
935 ResultSet resultSet = null;
936 Statement statement = null;
939 connection = connections.getConnection();
940 connection.beginTransaction();
942 boolean hasMinorVersion =
false;
943 ResultSet columns = connection.getConnection().getMetaData().getColumns(null, null,
"tsk_db_info",
"schema%");
944 while (columns.next()) {
945 if (columns.getString(
"COLUMN_NAME").equals(
"schema_minor_ver")) {
946 hasMinorVersion =
true;
951 int dbSchemaMajorVersion;
952 int dbSchemaMinorVersion = 0;
954 statement = connection.createStatement();
955 resultSet = connection.executeQuery(statement,
"SELECT schema_ver"
956 + (hasMinorVersion ?
", schema_minor_ver" :
"")
957 +
" FROM tsk_db_info");
958 if (resultSet.next()) {
959 dbSchemaMajorVersion = resultSet.getInt(
"schema_ver");
960 if (hasMinorVersion) {
962 dbSchemaMinorVersion = resultSet.getInt(
"schema_minor_ver");
965 throw new TskCoreException();
967 CaseDbSchemaVersionNumber dbSchemaVersion =
new CaseDbSchemaVersionNumber(dbSchemaMajorVersion, dbSchemaMinorVersion);
974 if (
false == CURRENT_DB_SCHEMA_VERSION.
isCompatible(dbSchemaVersion)) {
976 throw new TskUnsupportedSchemaVersionException(
977 "Unsupported DB schema version " + dbSchemaVersion +
", the highest supported schema version is " + CURRENT_DB_SCHEMA_VERSION.
getMajor() +
".X");
978 }
else if (dbSchemaVersion.compareTo(CURRENT_DB_SCHEMA_VERSION) < 0) {
981 if (null != dbPath) {
984 String backupFilePath = dbPath +
".schemaVer" + dbSchemaVersion.toString() +
".backup";
986 dbBackupPath = backupFilePath;
993 dbSchemaVersion = updateFromSchema2toSchema3(dbSchemaVersion, connection);
994 dbSchemaVersion = updateFromSchema3toSchema4(dbSchemaVersion, connection);
995 dbSchemaVersion = updateFromSchema4toSchema5(dbSchemaVersion, connection);
996 dbSchemaVersion = updateFromSchema5toSchema6(dbSchemaVersion, connection);
997 dbSchemaVersion = updateFromSchema6toSchema7(dbSchemaVersion, connection);
998 dbSchemaVersion = updateFromSchema7toSchema7dot1(dbSchemaVersion, connection);
999 dbSchemaVersion = updateFromSchema7dot1toSchema7dot2(dbSchemaVersion, connection);
1000 dbSchemaVersion = updateFromSchema7dot2toSchema8dot0(dbSchemaVersion, connection);
1001 dbSchemaVersion = updateFromSchema8dot0toSchema8dot1(dbSchemaVersion, connection);
1002 dbSchemaVersion = updateFromSchema8dot1toSchema8dot2(dbSchemaVersion, connection);
1003 dbSchemaVersion = updateFromSchema8dot2toSchema8dot3(dbSchemaVersion, connection);
1004 dbSchemaVersion = updateFromSchema8dot3toSchema8dot4(dbSchemaVersion, connection);
1005 dbSchemaVersion = updateFromSchema8dot4toSchema8dot5(dbSchemaVersion, connection);
1006 dbSchemaVersion = updateFromSchema8dot5toSchema8dot6(dbSchemaVersion, connection);
1007 dbSchemaVersion = updateFromSchema8dot6toSchema9dot0(dbSchemaVersion, connection);
1008 dbSchemaVersion = updateFromSchema9dot0toSchema9dot1(dbSchemaVersion, connection);
1010 statement = connection.createStatement();
1011 connection.executeUpdate(statement,
"UPDATE tsk_db_info SET schema_ver = " + dbSchemaVersion.getMajor() +
", schema_minor_ver = " + dbSchemaVersion.getMinor());
1012 connection.executeUpdate(statement,
"UPDATE tsk_db_info_extended SET value = " + dbSchemaVersion.getMajor() +
" WHERE name = '" + SCHEMA_MAJOR_VERSION_KEY +
"'");
1013 connection.executeUpdate(statement,
"UPDATE tsk_db_info_extended SET value = " + dbSchemaVersion.getMinor() +
" WHERE name = '" + SCHEMA_MINOR_VERSION_KEY +
"'");
1018 connection.commitTransaction();
1019 }
catch (Exception ex) {
1020 rollbackTransaction(connection);
1023 closeResultSet(resultSet);
1024 closeStatement(statement);
1025 closeConnection(connection);
1037 private void initDBSchemaCreationVersion(CaseDbConnection connection)
throws SQLException {
1039 Statement statement = null;
1040 ResultSet resultSet = null;
1041 String createdSchemaMajorVersion =
"0";
1042 String createdSchemaMinorVersion =
"0";
1045 statement = connection.createStatement();
1046 resultSet = connection.executeQuery(statement,
"SELECT name, value FROM tsk_db_info_extended");
1047 while (resultSet.next()) {
1048 String name = resultSet.getString(
"name");
1049 if (name.equals(CREATION_SCHEMA_MAJOR_VERSION_KEY) || name.equals(
"CREATED_SCHEMA_MAJOR_VERSION")) {
1050 createdSchemaMajorVersion = resultSet.getString(
"value");
1051 }
else if (name.equals(CREATION_SCHEMA_MINOR_VERSION_KEY) || name.equals(
"CREATED_SCHEMA_MINOR_VERSION")) {
1052 createdSchemaMinorVersion = resultSet.getString(
"value");
1057 closeResultSet(resultSet);
1058 closeStatement(statement);
1062 caseDBSchemaCreationVersion =
new CaseDbSchemaVersionNumber(Integer.parseInt(createdSchemaMajorVersion), Integer.parseInt(createdSchemaMinorVersion));
1075 if (dbPath.isEmpty()) {
1076 throw new IOException(
"Copying case database files is not supported for this type of case database");
1078 InputStream in = null;
1079 OutputStream out = null;
1082 InputStream inFile =
new FileInputStream(dbPath);
1083 in =
new BufferedInputStream(inFile);
1084 OutputStream outFile =
new FileOutputStream(newDBPath);
1085 out =
new BufferedOutputStream(outFile);
1086 int bytesRead = in.read();
1087 while (bytesRead != -1) {
1088 out.write(bytesRead);
1089 bytesRead = in.read();
1100 }
catch (IOException e) {
1101 logger.log(Level.WARNING,
"Could not close streams after db copy", e);
1110 private void logSQLiteJDBCDriverInfo() {
1112 SleuthkitCase.logger.info(String.format(
"sqlite-jdbc version %s loaded in %s mode",
1113 SQLiteJDBCLoader.getVersion(), SQLiteJDBCLoader.isNativeMode()
1114 ?
"native" :
"pure-java"));
1115 }
catch (Exception ex) {
1116 SleuthkitCase.logger.log(Level.SEVERE,
"Error querying case database mode", ex);
1133 @SuppressWarnings(
"deprecation")
1134 private CaseDbSchemaVersionNumber updateFromSchema2toSchema3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) throws SQLException, TskCoreException {
1135 if (schemaVersion.getMajor() != 2) {
1136 return schemaVersion;
1138 Statement statement = null;
1139 Statement statement2 = null;
1140 Statement updateStatement = null;
1141 ResultSet resultSet = null;
1144 statement = connection.createStatement();
1145 statement2 = connection.createStatement();
1148 statement.execute(
"CREATE TABLE tag_names (tag_name_id INTEGER PRIMARY KEY, display_name TEXT UNIQUE, description TEXT NOT NULL, color TEXT NOT NULL)");
1149 statement.execute(
"CREATE TABLE content_tags (tag_id INTEGER PRIMARY KEY, obj_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL, begin_byte_offset INTEGER NOT NULL, end_byte_offset INTEGER NOT NULL)");
1150 statement.execute(
"CREATE TABLE blackboard_artifact_tags (tag_id INTEGER PRIMARY KEY, artifact_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL)");
1153 statement.execute(
"CREATE TABLE reports (report_id INTEGER PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL)");
1156 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN size INTEGER;");
1157 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN md5 TEXT;");
1158 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN display_name TEXT;");
1161 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN display_name TEXT;");
1164 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN meta_seq INTEGER;");
1169 statement.execute(
"ALTER TABLE blackboard_attributes ADD COLUMN artifact_type_id INTEGER NULL NOT NULL DEFAULT -1;");
1170 statement.execute(
"CREATE INDEX attribute_artifactTypeId ON blackboard_attributes(artifact_type_id);");
1171 statement.execute(
"CREATE INDEX attribute_valueText ON blackboard_attributes(value_text);");
1172 statement.execute(
"CREATE INDEX attribute_valueInt32 ON blackboard_attributes(value_int32);");
1173 statement.execute(
"CREATE INDEX attribute_valueInt64 ON blackboard_attributes(value_int64);");
1174 statement.execute(
"CREATE INDEX attribute_valueDouble ON blackboard_attributes(value_double);");
1175 resultSet = statement.executeQuery(
"SELECT attrs.artifact_id AS artifact_id, "
1176 +
"arts.artifact_type_id AS artifact_type_id "
1177 +
"FROM blackboard_attributes AS attrs "
1178 +
"INNER JOIN blackboard_artifacts AS arts "
1179 +
"WHERE attrs.artifact_id = arts.artifact_id;");
1180 updateStatement = connection.createStatement();
1181 while (resultSet.next()) {
1182 long artifactId = resultSet.getLong(
"artifact_id");
1183 int artifactTypeId = resultSet.getInt(
"artifact_type_id");
1184 updateStatement.executeUpdate(
1185 "UPDATE blackboard_attributes "
1186 +
"SET artifact_type_id = " + artifactTypeId
1187 +
" WHERE blackboard_attributes.artifact_id = " + artifactId +
";");
1192 Map<String, Long> tagNames =
new HashMap<>();
1193 long tagNameCounter = 1;
1197 resultSet = statement.executeQuery(
"SELECT * FROM \n"
1198 +
"(SELECT blackboard_artifacts.obj_id AS objId, blackboard_attributes.artifact_id AS artifactId, blackboard_attributes.value_text AS name\n"
1199 +
"FROM blackboard_artifacts INNER JOIN blackboard_attributes \n"
1200 +
"ON blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id \n"
1201 +
"WHERE blackboard_artifacts.artifact_type_id = "
1202 + BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
1203 +
" AND blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TAG_NAME.getTypeID()
1204 +
") AS tagNames \n"
1206 +
"(SELECT tsk_files.obj_id as objId2, tsk_files.size AS fileSize \n"
1207 +
"FROM blackboard_artifacts INNER JOIN tsk_files \n"
1208 +
"ON blackboard_artifacts.obj_id = tsk_files.obj_id) AS fileData \n"
1209 +
"ON tagNames.objId = fileData.objId2 \n"
1211 +
"(SELECT value_text AS comment, artifact_id AS tagArtifactId FROM blackboard_attributes WHERE attribute_type_id = "
1212 + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID() +
") AS tagComments \n"
1213 +
"ON tagNames.artifactId = tagComments.tagArtifactId");
1215 while (resultSet.next()) {
1216 long objId = resultSet.getLong(
"objId");
1217 long fileSize = resultSet.getLong(
"fileSize");
1218 String tagName = resultSet.getString(
"name");
1219 String tagComment = resultSet.getString(
"comment");
1220 if (tagComment == null) {
1224 if (tagName != null && !tagName.isEmpty()) {
1227 if (tagNames.containsKey(tagName)) {
1228 tagNameIndex = tagNames.get(tagName);
1230 statement2.execute(
"INSERT INTO tag_names (display_name, description, color) "
1231 +
"VALUES(\"" + tagName +
"\", \"\", \"None\")");
1232 tagNames.put(tagName, tagNameCounter);
1233 tagNameIndex = tagNameCounter;
1237 statement2.execute(
"INSERT INTO content_tags (obj_id, tag_name_id, comment, begin_byte_offset, end_byte_offset) "
1238 +
"VALUES(" + objId +
", " + tagNameIndex +
", \"" + tagComment +
"\", 0, " + fileSize +
")");
1245 resultSet = statement.executeQuery(
"SELECT * FROM \n"
1246 +
"(SELECT blackboard_artifacts.obj_id AS objId, blackboard_attributes.artifact_id AS artifactId, "
1247 +
"blackboard_attributes.value_text AS name\n"
1248 +
"FROM blackboard_artifacts INNER JOIN blackboard_attributes \n"
1249 +
"ON blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id \n"
1250 +
"WHERE blackboard_artifacts.artifact_type_id = "
1251 + BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID()
1252 +
" AND blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TAG_NAME.getTypeID()
1253 +
") AS tagNames \n"
1255 +
"(SELECT value_int64 AS taggedArtifactId, artifact_id AS associatedArtifactId FROM blackboard_attributes WHERE attribute_type_id = "
1256 + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TAGGED_ARTIFACT.getTypeID() +
") AS tagArtifacts \n"
1257 +
"ON tagNames.artifactId = tagArtifacts.associatedArtifactId \n"
1259 +
"(SELECT value_text AS comment, artifact_id AS commentArtifactId FROM blackboard_attributes WHERE attribute_type_id = "
1260 + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID() +
") AS tagComments \n"
1261 +
"ON tagNames.artifactId = tagComments.commentArtifactId");
1263 while (resultSet.next()) {
1264 long artifactId = resultSet.getLong(
"taggedArtifactId");
1265 String tagName = resultSet.getString(
"name");
1266 String tagComment = resultSet.getString(
"comment");
1267 if (tagComment == null) {
1270 if (tagName != null && !tagName.isEmpty()) {
1273 if (tagNames.containsKey(tagName)) {
1274 tagNameIndex = tagNames.get(tagName);
1276 statement2.execute(
"INSERT INTO tag_names (display_name, description, color) "
1277 +
"VALUES(\"" + tagName +
"\", \"\", \"None\")");
1278 tagNames.put(tagName, tagNameCounter);
1279 tagNameIndex = tagNameCounter;
1283 statement2.execute(
"INSERT INTO blackboard_artifact_tags (artifact_id, tag_name_id, comment) "
1284 +
"VALUES(" + artifactId +
", " + tagNameIndex +
", \"" + tagComment +
"\")");
1290 "DELETE FROM blackboard_attributes WHERE artifact_id IN "
1291 +
"(SELECT artifact_id FROM blackboard_artifacts WHERE artifact_type_id = "
1292 + ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
1293 +
" OR artifact_type_id = " + ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() +
");");
1295 "DELETE FROM blackboard_artifacts WHERE artifact_type_id = "
1296 + ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
1297 +
" OR artifact_type_id = " + ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() +
";");
1299 return new CaseDbSchemaVersionNumber(3, 0);
1301 closeStatement(updateStatement);
1302 closeResultSet(resultSet);
1303 closeStatement(statement);
1304 closeStatement(statement2);
1322 private CaseDbSchemaVersionNumber updateFromSchema3toSchema4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1323 if (schemaVersion.getMajor() != 3) {
1324 return schemaVersion;
1327 Statement statement = null;
1328 ResultSet resultSet = null;
1329 Statement queryStatement = null;
1330 ResultSet queryResultSet = null;
1331 Statement updateStatement = null;
1336 statement = connection.createStatement();
1337 updateStatement = connection.createStatement();
1338 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN mime_type TEXT;");
1339 resultSet = statement.executeQuery(
"SELECT files.obj_id AS obj_id, attrs.value_text AS value_text "
1340 +
"FROM tsk_files AS files, blackboard_attributes AS attrs, blackboard_artifacts AS arts "
1341 +
"WHERE files.obj_id = arts.obj_id AND "
1342 +
"arts.artifact_id = attrs.artifact_id AND "
1343 +
"arts.artifact_type_id = 1 AND "
1344 +
"attrs.attribute_type_id = 62");
1345 while (resultSet.next()) {
1346 updateStatement.executeUpdate(
1348 +
"SET mime_type = '" + resultSet.getString(
"value_text") +
"' "
1349 +
"WHERE tsk_files.obj_id = " + resultSet.getInt(
"obj_id") +
";");
1354 statement.execute(
"ALTER TABLE blackboard_attribute_types ADD COLUMN value_type INTEGER NOT NULL DEFAULT -1;");
1355 resultSet = statement.executeQuery(
"SELECT * FROM blackboard_attribute_types AS types");
1356 while (resultSet.next()) {
1357 int attributeTypeId = resultSet.getInt(
"attribute_type_id");
1358 String attributeLabel = resultSet.getString(
"type_name");
1359 if (attributeTypeId < MIN_USER_DEFINED_TYPE_ID) {
1360 updateStatement.executeUpdate(
1361 "UPDATE blackboard_attribute_types "
1362 +
"SET value_type = " + ATTRIBUTE_TYPE.fromLabel(attributeLabel).getValueType().getType() +
" "
1363 +
"WHERE blackboard_attribute_types.attribute_type_id = " + attributeTypeId +
";");
1369 queryStatement = connection.createStatement();
1370 statement.execute(
"CREATE TABLE data_source_info (obj_id INTEGER PRIMARY KEY, device_id TEXT NOT NULL, time_zone TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id));");
1371 resultSet = statement.executeQuery(
"SELECT * FROM tsk_objects WHERE par_obj_id IS NULL");
1372 while (resultSet.next()) {
1373 long objectId = resultSet.getLong(
"obj_id");
1374 String timeZone =
"";
1375 queryResultSet = queryStatement.executeQuery(
"SELECT tzone FROM tsk_image_info WHERE obj_id = " + objectId);
1376 if (queryResultSet.next()) {
1377 timeZone = queryResultSet.getString(
"tzone");
1379 queryResultSet.close();
1380 updateStatement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) "
1381 +
"VALUES(" + objectId +
", '" + UUID.randomUUID().toString() +
"' , '" + timeZone +
"');");
1395 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN data_source_obj_id BIGINT NOT NULL DEFAULT -1;");
1396 resultSet = statement.executeQuery(
"SELECT tsk_files.obj_id AS obj_id, par_obj_id FROM tsk_files, tsk_objects WHERE tsk_files.obj_id = tsk_objects.obj_id");
1397 while (resultSet.next()) {
1398 long fileId = resultSet.getLong(
"obj_id");
1399 long dataSourceId = getDataSourceObjectId(connection, fileId);
1400 updateStatement.executeUpdate(
"UPDATE tsk_files SET data_source_obj_id = " + dataSourceId +
" WHERE obj_id = " + fileId +
";");
1403 statement.execute(
"CREATE TABLE ingest_module_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
1404 statement.execute(
"CREATE TABLE ingest_job_status_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
1405 if (this.dbType.equals(DbType.SQLITE)) {
1406 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id INTEGER PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
1407 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id INTEGER PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
1409 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id BIGSERIAL PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
1410 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id BIGSERIAL PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
1413 statement.execute(
"CREATE TABLE ingest_job_modules (ingest_job_id INTEGER, ingest_module_id INTEGER, pipeline_position INTEGER, PRIMARY KEY(ingest_job_id, ingest_module_id), FOREIGN KEY(ingest_job_id) REFERENCES ingest_jobs(ingest_job_id), FOREIGN KEY(ingest_module_id) REFERENCES ingest_modules(ingest_module_id));");
1414 initIngestModuleTypes(connection);
1415 initIngestStatusTypes(connection);
1417 return new CaseDbSchemaVersionNumber(4, 0);
1420 closeResultSet(queryResultSet);
1421 closeStatement(queryStatement);
1422 closeStatement(updateStatement);
1423 closeResultSet(resultSet);
1424 closeStatement(statement);
1442 private CaseDbSchemaVersionNumber updateFromSchema4toSchema5(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1443 if (schemaVersion.getMajor() != 4) {
1444 return schemaVersion;
1447 Statement statement = null;
1451 statement = connection.createStatement();
1452 statement.execute(
"CREATE TABLE review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
1462 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN review_status_id INTEGER NOT NULL DEFAULT " + BlackboardArtifact.ReviewStatus.UNDECIDED.getID());
1465 statement.execute(
"CREATE TABLE file_encoding_types (encoding_type INTEGER PRIMARY KEY, name TEXT NOT NULL);");
1466 initEncodingTypes(connection);
1473 initReviewStatuses(connection);
1478 statement.execute(
"ALTER TABLE tsk_files_path ADD COLUMN encoding_type INTEGER NOT NULL DEFAULT 0;");
1480 return new CaseDbSchemaVersionNumber(5, 0);
1483 closeStatement(statement);
1501 private CaseDbSchemaVersionNumber updateFromSchema5toSchema6(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1502 if (schemaVersion.getMajor() != 5) {
1503 return schemaVersion;
1510 Statement statement = null;
1511 ResultSet resultSet = null;
1517 statement = connection.createStatement();
1518 statement.execute(
"CREATE TABLE IF NOT EXISTS review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
1520 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM review_statuses");
1522 if (resultSet.getLong(
"count") == 0) {
1531 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN review_status_id INTEGER NOT NULL DEFAULT " + BlackboardArtifact.ReviewStatus.UNDECIDED.getID());
1534 return new CaseDbSchemaVersionNumber(6, 0);
1537 closeResultSet(resultSet);
1538 closeStatement(statement);
1556 private CaseDbSchemaVersionNumber updateFromSchema6toSchema7(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1557 if (schemaVersion.getMajor() != 6) {
1558 return schemaVersion;
1564 Statement statement = null;
1565 Statement updstatement = null;
1566 ResultSet resultSet = null;
1569 statement = connection.createStatement();
1570 updstatement = connection.createStatement();
1571 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN extension TEXT");
1573 resultSet = connection.executeQuery(statement,
"SELECT obj_id,name FROM tsk_files");
1574 while (resultSet.next()) {
1575 long objID = resultSet.getLong(
"obj_id");
1576 String name = resultSet.getString(
"name");
1577 updstatement.executeUpdate(
"UPDATE tsk_files SET extension = '" +
escapeSingleQuotes(extractExtension(name)) +
"' "
1578 +
"WHERE obj_id = " + objID);
1581 statement.execute(
"CREATE INDEX file_extension ON tsk_files ( extension )");
1584 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN artifact_obj_id INTEGER NOT NULL DEFAULT -1");
1586 return new CaseDbSchemaVersionNumber(7, 0);
1589 closeResultSet(resultSet);
1590 closeStatement(statement);
1591 closeStatement(updstatement);
1609 private CaseDbSchemaVersionNumber updateFromSchema7toSchema7dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1610 if (schemaVersion.getMajor() != 7) {
1611 return schemaVersion;
1614 if (schemaVersion.getMinor() != 0) {
1615 return schemaVersion;
1621 Statement statement = null;
1622 ResultSet resultSet = null;
1625 statement = connection.createStatement();
1628 if (schemaVersion.getMinor() == 0) {
1630 statement.execute(
"ALTER TABLE tsk_db_info ADD COLUMN schema_minor_ver INTEGER DEFAULT 1");
1632 return new CaseDbSchemaVersionNumber(7, 1);
1635 closeResultSet(resultSet);
1636 closeStatement(statement);
1654 private CaseDbSchemaVersionNumber updateFromSchema7dot1toSchema7dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1655 if (schemaVersion.getMajor() != 7) {
1656 return schemaVersion;
1659 if (schemaVersion.getMinor() != 1) {
1660 return schemaVersion;
1663 Statement statement = null;
1664 Statement updstatement = null;
1665 ResultSet resultSet = null;
1669 statement = connection.createStatement();
1670 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN data_source_obj_id INTEGER NOT NULL DEFAULT -1");
1673 updstatement = connection.createStatement();
1674 resultSet = connection.executeQuery(statement,
"SELECT artifact_id, obj_id FROM blackboard_artifacts");
1675 while (resultSet.next()) {
1676 long artifact_id = resultSet.getLong(
"artifact_id");
1677 long obj_id = resultSet.getLong(
"obj_id");
1678 long data_source_obj_id = getDataSourceObjectId(connection, obj_id);
1679 updstatement.executeUpdate(
"UPDATE blackboard_artifacts SET data_source_obj_id = " + data_source_obj_id +
" "
1680 +
"WHERE artifact_id = " + artifact_id);
1682 closeResultSet(resultSet);
1683 closeStatement(statement);
1684 closeStatement(updstatement);
1689 statement = connection.createStatement();
1690 statement.execute(
"ALTER TABLE tag_names ADD COLUMN knownStatus INTEGER NOT NULL DEFAULT " + TskData.FileKnown.UNKNOWN.getFileKnownValue());
1693 if (this.dbType.equals(DbType.SQLITE)) {
1694 statement.execute(
"CREATE TABLE account_types (account_type_id INTEGER PRIMARY KEY, type_name TEXT UNIQUE NOT NULL, display_name TEXT NOT NULL)");
1695 statement.execute(
"CREATE TABLE accounts (account_id INTEGER PRIMARY KEY, account_type_id INTEGER NOT NULL, account_unique_identifier TEXT NOT NULL, UNIQUE(account_type_id, account_unique_identifier) , FOREIGN KEY(account_type_id) REFERENCES account_types(account_type_id))");
1696 statement.execute(
"CREATE TABLE account_relationships (relationship_id INTEGER PRIMARY KEY, account1_id INTEGER NOT NULL, account2_id INTEGER NOT NULL, relationship_source_obj_id INTEGER NOT NULL, date_time INTEGER, relationship_type INTEGER NOT NULL, data_source_obj_id INTEGER NOT NULL, UNIQUE(account1_id, account2_id, relationship_source_obj_id), FOREIGN KEY(account1_id) REFERENCES accounts(account_id), FOREIGN KEY(account2_id) REFERENCES accounts(account_id), FOREIGN KEY(relationship_source_obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id))");
1698 statement.execute(
"CREATE TABLE account_types (account_type_id BIGSERIAL PRIMARY KEY, type_name TEXT UNIQUE NOT NULL, display_name TEXT NOT NULL)");
1699 statement.execute(
"CREATE TABLE accounts (account_id BIGSERIAL PRIMARY KEY, account_type_id INTEGER NOT NULL, account_unique_identifier TEXT NOT NULL, UNIQUE(account_type_id, account_unique_identifier) , FOREIGN KEY(account_type_id) REFERENCES account_types(account_type_id))");
1700 statement.execute(
"CREATE TABLE account_relationships (relationship_id BIGSERIAL PRIMARY KEY, account1_id INTEGER NOT NULL, account2_id INTEGER NOT NULL, relationship_source_obj_id INTEGER NOT NULL, date_time BIGINT, relationship_type INTEGER NOT NULL, data_source_obj_id INTEGER NOT NULL, UNIQUE(account1_id, account2_id, relationship_source_obj_id), FOREIGN KEY(account1_id) REFERENCES accounts(account_id), FOREIGN KEY(account2_id) REFERENCES accounts(account_id), FOREIGN KEY(relationship_source_obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id))");
1704 statement.execute(
"CREATE INDEX artifact_artifact_objID ON blackboard_artifacts(artifact_obj_id)");
1705 statement.execute(
"CREATE INDEX relationships_account1 ON account_relationships(account1_id)");
1706 statement.execute(
"CREATE INDEX relationships_account2 ON account_relationships(account2_id)");
1707 statement.execute(
"CREATE INDEX relationships_relationship_source_obj_id ON account_relationships(relationship_source_obj_id)");
1708 statement.execute(
"CREATE INDEX relationships_date_time ON account_relationships(date_time)");
1709 statement.execute(
"CREATE INDEX relationships_relationship_type ON account_relationships(relationship_type)");
1710 statement.execute(
"CREATE INDEX relationships_data_source_obj_id ON account_relationships(data_source_obj_id)");
1712 return new CaseDbSchemaVersionNumber(7, 2);
1714 closeResultSet(resultSet);
1715 closeStatement(statement);
1716 closeStatement(updstatement);
1734 private CaseDbSchemaVersionNumber updateFromSchema7dot2toSchema8dot0(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1735 if (schemaVersion.getMajor() != 7) {
1736 return schemaVersion;
1739 if (schemaVersion.getMinor() != 2) {
1740 return schemaVersion;
1743 Statement updateSchemaStatement = connection.createStatement();
1744 Statement getExistingReportsStatement = connection.createStatement();
1745 ResultSet resultSet = null;
1746 ResultSet existingReports = null;
1754 updateSchemaStatement.execute(
"ALTER TABLE reports RENAME TO old_reports");
1757 updateSchemaStatement.execute(
"CREATE TABLE reports (obj_id BIGSERIAL PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id))");
1760 existingReports = getExistingReportsStatement.executeQuery(
"SELECT * FROM old_reports");
1761 while (existingReports.next()) {
1762 String path = existingReports.getString(2);
1763 long crtime = existingReports.getInt(3);
1764 String sourceModule = existingReports.getString(4);
1765 String reportName = existingReports.getString(5);
1767 PreparedStatement insertObjectStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OBJECT, Statement.RETURN_GENERATED_KEYS);
1768 insertObjectStatement.clearParameters();
1769 insertObjectStatement.setNull(1, java.sql.Types.BIGINT);
1770 insertObjectStatement.setLong(2, TskData.ObjectType.REPORT.getObjectType());
1771 connection.executeUpdate(insertObjectStatement);
1772 resultSet = insertObjectStatement.getGeneratedKeys();
1773 if (!resultSet.next()) {
1774 throw new TskCoreException(String.format(
"Failed to INSERT report %s (%s) in tsk_objects table", reportName, path));
1776 long objectId = resultSet.getLong(1);
1779 PreparedStatement insertReportStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_REPORT);
1780 insertReportStatement.clearParameters();
1781 insertReportStatement.setLong(1, objectId);
1782 insertReportStatement.setString(2, path);
1783 insertReportStatement.setLong(3, crtime);
1784 insertReportStatement.setString(4, sourceModule);
1785 insertReportStatement.setString(5, reportName);
1786 connection.executeUpdate(insertReportStatement);
1790 updateSchemaStatement.execute(
"DROP TABLE old_reports");
1792 return new CaseDbSchemaVersionNumber(8, 0);
1794 closeResultSet(resultSet);
1795 closeResultSet(existingReports);
1796 closeStatement(updateSchemaStatement);
1797 closeStatement(getExistingReportsStatement);
1815 private CaseDbSchemaVersionNumber updateFromSchema8dot0toSchema8dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1816 if (schemaVersion.getMajor() != 8) {
1817 return schemaVersion;
1820 if (schemaVersion.getMinor() != 0) {
1821 return schemaVersion;
1826 try (Statement statement = connection.createStatement();) {
1828 if (this.dbType.equals(DbType.SQLITE)) {
1829 statement.execute(
"CREATE TABLE tsk_examiners (examiner_id INTEGER PRIMARY KEY, login_name TEXT NOT NULL, display_name TEXT, UNIQUE(login_name) )");
1830 statement.execute(
"ALTER TABLE content_tags ADD COLUMN examiner_id INTEGER REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1831 statement.execute(
"ALTER TABLE blackboard_artifact_tags ADD COLUMN examiner_id INTEGER REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1833 statement.execute(
"CREATE TABLE tsk_examiners (examiner_id BIGSERIAL PRIMARY KEY, login_name TEXT NOT NULL, display_name TEXT, UNIQUE(login_name))");
1834 statement.execute(
"ALTER TABLE content_tags ADD COLUMN examiner_id BIGINT REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1835 statement.execute(
"ALTER TABLE blackboard_artifact_tags ADD COLUMN examiner_id BIGINT REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1838 return new CaseDbSchemaVersionNumber(8, 1);
1857 private CaseDbSchemaVersionNumber updateFromSchema8dot1toSchema8dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1858 if (schemaVersion.getMajor() != 8) {
1859 return schemaVersion;
1862 if (schemaVersion.getMinor() != 1) {
1863 return schemaVersion;
1868 try (Statement statement = connection.createStatement();) {
1869 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN sha1 TEXT DEFAULT NULL");
1870 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN sha256 TEXT DEFAULT NULL");
1872 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_details TEXT");
1880 statement.execute(
"CREATE TABLE tsk_db_info_extended (name TEXT PRIMARY KEY, value TEXT NOT NULL)");
1881 ResultSet result = statement.executeQuery(
"SELECT tsk_ver FROM tsk_db_info");
1883 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + TSK_VERSION_KEY +
"', '" + result.getLong(
"tsk_ver") +
"')");
1884 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + SCHEMA_MAJOR_VERSION_KEY +
"', '8')");
1885 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + SCHEMA_MINOR_VERSION_KEY +
"', '2')");
1886 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + CREATION_SCHEMA_MAJOR_VERSION_KEY +
"', '0')");
1887 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + CREATION_SCHEMA_MINOR_VERSION_KEY +
"', '0')");
1889 String primaryKeyType;
1892 primaryKeyType =
"BIGSERIAL";
1895 primaryKeyType =
"INTEGER";
1898 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
1902 statement.execute(
"CREATE TABLE tsk_event_types ("
1903 +
" event_type_id " + primaryKeyType +
" PRIMARY KEY, "
1904 +
" display_name TEXT UNIQUE NOT NULL, "
1905 +
" super_type_id INTEGER REFERENCES tsk_event_types(event_type_id) )");
1906 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1907 +
" values( 0, 'Event Types', null)");
1908 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1909 +
" values(1, 'File System', 0)");
1910 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1911 +
" values(2, 'Web Activity', 0)");
1912 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1913 +
" values(3, 'Misc Types', 0)");
1914 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1915 +
" values(4, 'Modified', 1)");
1916 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1917 +
" values(5, 'Accessed', 1)");
1918 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1919 +
" values(6, 'Created', 1)");
1920 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1921 +
" values(7, 'Changed', 1)");
1924 statement.execute(
"CREATE TABLE tsk_event_descriptions ("
1925 +
" event_description_id " + primaryKeyType +
" PRIMARY KEY, "
1926 +
" full_description TEXT NOT NULL, "
1927 +
" med_description TEXT, "
1928 +
" short_description TEXT,"
1929 +
" data_source_obj_id BIGINT NOT NULL, "
1930 +
" file_obj_id BIGINT NOT NULL, "
1931 +
" artifact_id BIGINT, "
1932 +
" hash_hit INTEGER NOT NULL, "
1933 +
" tagged INTEGER NOT NULL, "
1934 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
1935 +
" FOREIGN KEY(file_obj_id) REFERENCES tsk_files(obj_id), "
1936 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
1939 statement.execute(
"CREATE TABLE tsk_events ( "
1940 +
" event_id " + primaryKeyType +
" PRIMARY KEY, "
1941 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
1942 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id) ,"
1943 +
" time INTEGER NOT NULL) "
1947 statement.execute(
"CREATE INDEX events_time ON tsk_events(time)");
1948 statement.execute(
"CREATE INDEX events_type ON tsk_events(event_type_id)");
1949 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
1950 statement.execute(
"CREATE INDEX events_file_obj_id ON tsk_event_descriptions(file_obj_id) ");
1951 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
1952 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
1953 return new CaseDbSchemaVersionNumber(8, 2);
1973 private CaseDbSchemaVersionNumber updateFromSchema8dot2toSchema8dot3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1974 if (schemaVersion.getMajor() != 8) {
1975 return schemaVersion;
1978 if (schemaVersion.getMinor() != 2) {
1979 return schemaVersion;
1984 ResultSet resultSet = null;
1986 try (Statement statement = connection.createStatement();) {
1991 String primaryKeyType;
1994 primaryKeyType =
"BIGSERIAL";
1997 primaryKeyType =
"INTEGER";
2000 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
2004 statement.execute(
"CREATE TABLE IF NOT EXISTS tsk_event_types ("
2005 +
" event_type_id " + primaryKeyType +
" PRIMARY KEY, "
2006 +
" display_name TEXT UNIQUE NOT NULL, "
2007 +
" super_type_id INTEGER REFERENCES tsk_event_types(event_type_id) )");
2009 resultSet = statement.executeQuery(
"SELECT * from tsk_event_types");
2013 if (!resultSet.next()) {
2015 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2016 +
" values( 0, 'Event Types', null)");
2017 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2018 +
" values(1, 'File System', 0)");
2019 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2020 +
" values(2, 'Web Activity', 0)");
2021 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2022 +
" values(3, 'Misc Types', 0)");
2023 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2024 +
" values(4, 'Modified', 1)");
2025 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2026 +
" values(5, 'Accessed', 1)");
2027 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2028 +
" values(6, 'Created', 1)");
2029 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2030 +
" values(7, 'Changed', 1)");
2035 statement.execute(
"DROP TABLE IF EXISTS tsk_events");
2039 statement.execute(
"DROP TABLE IF EXISTS tsk_event_descriptions");
2042 statement.execute(
"CREATE TABLE tsk_event_descriptions ("
2043 +
" event_description_id " + primaryKeyType +
" PRIMARY KEY, "
2044 +
" full_description TEXT NOT NULL, "
2045 +
" med_description TEXT, "
2046 +
" short_description TEXT,"
2047 +
" data_source_obj_id BIGINT NOT NULL, "
2048 +
" file_obj_id BIGINT NOT NULL, "
2049 +
" artifact_id BIGINT, "
2050 +
" hash_hit INTEGER NOT NULL, "
2051 +
" tagged INTEGER NOT NULL, "
2052 +
" UNIQUE(full_description, file_obj_id, artifact_id), "
2053 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
2054 +
" FOREIGN KEY(file_obj_id) REFERENCES tsk_files(obj_id), "
2055 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
2059 statement.execute(
"CREATE TABLE tsk_events ( "
2060 +
" event_id " + primaryKeyType +
" PRIMARY KEY, "
2061 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
2062 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id) ,"
2063 +
" time INTEGER NOT NULL, "
2064 +
" UNIQUE (event_type_id, event_description_id, time))"
2068 statement.execute(
"UPDATE tsk_db_info_extended SET name = 'CREATION_SCHEMA_MAJOR_VERSION' WHERE name = 'CREATED_SCHEMA_MAJOR_VERSION'");
2069 statement.execute(
"UPDATE tsk_db_info_extended SET name = 'CREATION_SCHEMA_MINOR_VERSION' WHERE name = 'CREATED_SCHEMA_MINOR_VERSION'");
2071 return new CaseDbSchemaVersionNumber(8, 3);
2073 closeResultSet(resultSet);
2099 private CaseDbSchemaVersionNumber updateFromSchema8dot3toSchema8dot4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2100 if (schemaVersion.getMajor() != 8) {
2101 return schemaVersion;
2104 if (schemaVersion.getMinor() != 3) {
2105 return schemaVersion;
2108 Statement statement = connection.createStatement();
2109 ResultSet results = null;
2116 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
2122 results = statement.executeQuery(
"SELECT column_name FROM information_schema.columns "
2123 +
"WHERE table_name='tsk_event_descriptions' and column_name='file_obj_id'");
2124 if (results.next()) {
2126 statement.execute(
"ALTER TABLE tsk_event_descriptions "
2127 +
"RENAME COLUMN file_obj_id TO content_obj_id");
2131 statement.execute(
"CREATE TABLE temp_tsk_events ( "
2132 +
" event_id BIGSERIAL PRIMARY KEY, "
2133 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
2134 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id),"
2135 +
" time BIGINT NOT NULL, "
2136 +
" UNIQUE (event_type_id, event_description_id, time))"
2140 statement.execute(
"INSERT INTO temp_tsk_events(event_id, event_type_id, "
2141 +
"event_description_id, time) SELECT * FROM tsk_events");
2144 statement.execute(
"DROP TABLE tsk_events");
2147 statement.execute(
"ALTER TABLE temp_tsk_events RENAME TO tsk_events");
2150 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
2151 statement.execute(
"CREATE INDEX events_content_obj_id ON tsk_event_descriptions(content_obj_id) ");
2152 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
2153 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
2154 statement.execute(
"CREATE INDEX events_time ON tsk_events(time) ");
2158 boolean hasMisnamedColumn =
false;
2159 results = statement.executeQuery(
"pragma table_info('tsk_event_descriptions')");
2160 while (results.next()) {
2161 if (results.getString(
"name") != null && results.getString(
"name").equals(
"file_obj_id")) {
2162 hasMisnamedColumn =
true;
2167 if (hasMisnamedColumn) {
2169 statement.execute(
"CREATE TABLE temp_tsk_event_descriptions ("
2170 +
" event_description_id INTEGER PRIMARY KEY, "
2171 +
" full_description TEXT NOT NULL, "
2172 +
" med_description TEXT, "
2173 +
" short_description TEXT,"
2174 +
" data_source_obj_id BIGINT NOT NULL, "
2175 +
" content_obj_id BIGINT NOT NULL, "
2176 +
" artifact_id BIGINT, "
2177 +
" hash_hit INTEGER NOT NULL, "
2178 +
" tagged INTEGER NOT NULL, "
2179 +
" UNIQUE(full_description, content_obj_id, artifact_id), "
2180 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
2181 +
" FOREIGN KEY(content_obj_id) REFERENCES tsk_files(obj_id), "
2182 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
2185 statement.execute(
"CREATE TABLE temp_tsk_events ( "
2186 +
" event_id INTEGER PRIMARY KEY, "
2187 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
2188 +
" event_description_id BIGINT NOT NULL REFERENCES temp_tsk_event_descriptions(event_description_id),"
2189 +
" time INTEGER NOT NULL, "
2190 +
" UNIQUE (event_type_id, event_description_id, time))"
2194 statement.execute(
"INSERT INTO temp_tsk_event_descriptions(event_description_id, full_description, "
2195 +
"med_description, short_description, data_source_obj_id, content_obj_id, artifact_id, "
2196 +
"hash_hit, tagged) SELECT * FROM tsk_event_descriptions");
2198 statement.execute(
"INSERT INTO temp_tsk_events(event_id, event_type_id, "
2199 +
"event_description_id, time) SELECT * FROM tsk_events");
2202 statement.execute(
"DROP TABLE tsk_events");
2203 statement.execute(
"DROP TABLE tsk_event_descriptions");
2206 statement.execute(
"ALTER TABLE temp_tsk_event_descriptions RENAME TO tsk_event_descriptions");
2207 statement.execute(
"ALTER TABLE temp_tsk_events RENAME TO tsk_events");
2210 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
2211 statement.execute(
"CREATE INDEX events_content_obj_id ON tsk_event_descriptions(content_obj_id) ");
2212 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
2213 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
2214 statement.execute(
"CREATE INDEX events_time ON tsk_events(time) ");
2218 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
2222 if (this.dbType.equals(DbType.SQLITE)) {
2223 statement.execute(
"CREATE TABLE tsk_pool_info (obj_id INTEGER PRIMARY KEY, pool_type INTEGER NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE)");
2225 statement.execute(
"CREATE TABLE tsk_pool_info (obj_id BIGSERIAL PRIMARY KEY, pool_type INTEGER NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE)");
2229 insertAccountTypeIfNotExists(statement,
"IMO",
"IMO");
2230 insertAccountTypeIfNotExists(statement,
"LINE",
"LINE");
2231 insertAccountTypeIfNotExists(statement,
"SKYPE",
"Skype");
2232 insertAccountTypeIfNotExists(statement,
"TANGO",
"Tango");
2233 insertAccountTypeIfNotExists(statement,
"TEXTNOW",
"TextNow");
2234 insertAccountTypeIfNotExists(statement,
"THREEMA",
"ThreeMa");
2235 insertAccountTypeIfNotExists(statement,
"VIBER",
"Viber");
2236 insertAccountTypeIfNotExists(statement,
"XENDER",
"Xender");
2237 insertAccountTypeIfNotExists(statement,
"ZAPYA",
"Zapya");
2238 insertAccountTypeIfNotExists(statement,
"SHAREIT",
"ShareIt");
2240 return new CaseDbSchemaVersionNumber(8, 4);
2242 closeResultSet(results);
2243 closeStatement(statement);
2248 private CaseDbSchemaVersionNumber updateFromSchema8dot4toSchema8dot5(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2249 if (schemaVersion.getMajor() != 8) {
2250 return schemaVersion;
2253 if (schemaVersion.getMinor() != 4) {
2254 return schemaVersion;
2257 Statement statement = connection.createStatement();
2262 statement.execute(
"CREATE TABLE tsk_tag_sets (tag_set_id BIGSERIAL PRIMARY KEY, name TEXT UNIQUE)");
2263 statement.execute(
"ALTER TABLE tag_names ADD COLUMN tag_set_id BIGINT REFERENCES tsk_tag_sets(tag_set_id)");
2266 statement.execute(
"CREATE TABLE tsk_tag_sets (tag_set_id INTEGER PRIMARY KEY, name TEXT UNIQUE)");
2267 statement.execute(
"ALTER TABLE tag_names ADD COLUMN tag_set_id INTEGER REFERENCES tsk_tag_sets(tag_set_id)");
2271 statement.execute(
"ALTER TABLE tag_names ADD COLUMN rank INTEGER");
2279 String insertStmt =
"INSERT INTO tsk_tag_sets (name) VALUES ('Project VIC')";
2281 statement.execute(insertStmt, Statement.RETURN_GENERATED_KEYS);
2283 statement.execute(insertStmt);
2285 try (ResultSet resultSet = statement.getGeneratedKeys()) {
2286 if (resultSet != null && resultSet.next()) {
2287 int tagSetId = resultSet.getInt(1);
2289 String updateQuery =
"UPDATE tag_names SET tag_set_id = %d, color = '%s', rank = %d, display_name = '%s' WHERE display_name = '%s'";
2290 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Red", 1,
"Child Exploitation (Illegal)",
"CAT-1: Child Exploitation (Illegal)"));
2291 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Lime", 2,
"Child Exploitation (Non-Illegal/Age Difficult)",
"CAT-2: Child Exploitation (Non-Illegal/Age Difficult)"));
2292 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Yellow", 3,
"CGI/Animation (Child Exploitive)",
"CAT-3: CGI/Animation (Child Exploitive)"));
2293 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Purple", 4,
"Exemplar/Comparison (Internal Use Only)",
"CAT-4: Exemplar/Comparison (Internal Use Only)"));
2294 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Fuchsia", 5,
"Non-pertinent",
"CAT-5: Non-pertinent"));
2296 String
deleteContentTag =
"DELETE FROM content_tags WHERE tag_name_id IN (SELECT tag_name_id from tag_names WHERE display_name LIKE 'CAT-0: Uncategorized')";
2297 String deleteArtifactTag =
"DELETE FROM blackboard_artifact_tags WHERE tag_name_id IN (SELECT tag_name_id from tag_names WHERE display_name LIKE 'CAT-0: Uncategorized')";
2298 String deleteCat0 =
"DELETE FROM tag_names WHERE display_name = 'CAT-0: Uncategorized'";
2299 statement.executeUpdate(deleteContentTag);
2300 statement.executeUpdate(deleteArtifactTag);
2301 statement.executeUpdate(deleteCat0);
2304 throw new TskCoreException(
"Failed to retrieve the default tag_set_id from DB");
2314 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN data_source_obj_id BIGINT NOT NULL DEFAULT -1;");
2317 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN data_source_obj_id INTEGER NOT NULL DEFAULT -1;");
2320 Statement updateStatement = connection.createStatement();
2321 try (ResultSet resultSet = statement.executeQuery(
"SELECT obj_id FROM tsk_fs_info")) {
2322 while (resultSet.next()) {
2323 long fsId = resultSet.getLong(
"obj_id");
2324 long dataSourceId = getDataSourceObjectId(connection, fsId);
2325 updateStatement.executeUpdate(
"UPDATE tsk_fs_info SET data_source_obj_id = " + dataSourceId +
" WHERE obj_id = " + fsId +
";");
2328 closeStatement(updateStatement);
2331 return new CaseDbSchemaVersionNumber(8, 5);
2334 closeStatement(statement);
2339 private CaseDbSchemaVersionNumber updateFromSchema8dot5toSchema8dot6(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2340 if (schemaVersion.getMajor() != 8) {
2341 return schemaVersion;
2344 if (schemaVersion.getMinor() != 5) {
2345 return schemaVersion;
2348 Statement statement = connection.createStatement();
2351 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN sha256 TEXT");
2353 return new CaseDbSchemaVersionNumber(8, 6);
2356 closeStatement(statement);
2361 @SuppressWarnings(
"deprecation")
2362 private CaseDbSchemaVersionNumber updateFromSchema8dot6toSchema9dot0(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) throws SQLException, TskCoreException {
2363 if (schemaVersion.getMajor() != 8) {
2364 return schemaVersion;
2367 if (schemaVersion.getMinor() != 6) {
2368 return schemaVersion;
2371 Statement statement = connection.createStatement();
2374 String dateDataType =
"BIGINT";
2375 String bigIntDataType =
"BIGINT";
2376 String blobDataType =
"BYTEA";
2377 String primaryKeyType =
"BIGSERIAL";
2379 if (this.dbType.equals(DbType.SQLITE)) {
2380 dateDataType =
"INTEGER";
2381 bigIntDataType =
"INTEGER";
2382 blobDataType =
"BLOB";
2383 primaryKeyType =
"INTEGER";
2385 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN added_date_time " + dateDataType);
2386 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_tool_settings TEXT");
2387 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_tool_name TEXT");
2388 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_tool_version TEXT");
2393 statement.execute(
"ALTER TABLE blackboard_artifact_types ADD COLUMN category_type INTEGER DEFAULT 0");
2394 String analysisTypeObjIdList
2395 = BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
", "
2396 + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() +
", "
2397 + BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() +
", "
2398 + BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID() +
", "
2399 + BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() +
", "
2400 + BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID() +
", "
2401 + BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() +
", "
2402 + BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() +
", "
2403 + BlackboardArtifact.ARTIFACT_TYPE.TSK_FACE_DETECTED.getTypeID() +
", "
2404 + BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID() +
", "
2405 + BlackboardArtifact.ARTIFACT_TYPE.TSK_OBJECT_DETECTED.getTypeID() +
", "
2406 + BlackboardArtifact.ARTIFACT_TYPE.TSK_VERIFICATION_FAILED.getTypeID() +
", "
2407 + BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_USAGE.getTypeID() +
", "
2408 + BlackboardArtifact.ARTIFACT_TYPE.TSK_USER_CONTENT_SUSPECTED.getTypeID() +
", "
2409 + BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_ACCOUNT_TYPE.getTypeID() +
", "
2410 + BlackboardArtifact.ARTIFACT_TYPE.TSK_YARA_HIT.getTypeID() +
", "
2411 + BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CATEGORIZATION.getTypeID();
2412 statement.execute(
"UPDATE blackboard_artifact_types SET category_type = " + BlackboardArtifact.Category.ANALYSIS_RESULT.getID()
2413 +
" WHERE artifact_type_id IN (" + analysisTypeObjIdList +
")");
2416 statement.execute(
"CREATE TABLE tsk_file_attributes (id " + primaryKeyType +
" PRIMARY KEY, "
2417 +
"obj_id " + bigIntDataType +
" NOT NULL, "
2418 +
"attribute_type_id " + bigIntDataType +
" NOT NULL, "
2419 +
"value_type INTEGER NOT NULL, value_byte " + blobDataType +
", "
2420 +
"value_text TEXT, value_int32 INTEGER, value_int64 " + bigIntDataType +
", value_double NUMERIC(20, 10), "
2421 +
"FOREIGN KEY(obj_id) REFERENCES tsk_files(obj_id) ON DELETE CASCADE, "
2422 +
"FOREIGN KEY(attribute_type_id) REFERENCES blackboard_attribute_types(attribute_type_id))");
2425 statement.execute(
"CREATE TABLE tsk_analysis_results (artifact_obj_id " + bigIntDataType +
" PRIMARY KEY, "
2426 +
"conclusion TEXT, "
2427 +
"significance INTEGER NOT NULL, "
2432 +
"configuration TEXT, justification TEXT, "
2433 +
"ignore_score INTEGER DEFAULT 0 "
2436 statement.execute(
"CREATE TABLE tsk_aggregate_score( obj_id " + bigIntDataType +
" PRIMARY KEY, "
2437 +
"data_source_obj_id " + bigIntDataType +
", "
2438 +
"significance INTEGER NOT NULL, "
2441 +
"UNIQUE (obj_id),"
2442 +
"FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE, "
2443 +
"FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE "
2447 statement.execute(
"CREATE TABLE tsk_persons (id " + primaryKeyType +
" PRIMARY KEY, "
2448 +
"name TEXT NOT NULL, "
2449 +
"UNIQUE(name)) ");
2452 statement.execute(
"CREATE TABLE tsk_hosts (id " + primaryKeyType +
" PRIMARY KEY, "
2453 +
"name TEXT NOT NULL, "
2454 +
"db_status INTEGER DEFAULT 0, "
2455 +
"person_id INTEGER, "
2456 +
"merged_into " + bigIntDataType +
", "
2457 +
"FOREIGN KEY(person_id) REFERENCES tsk_persons(id) ON DELETE SET NULL, "
2458 +
"FOREIGN KEY(merged_into) REFERENCES tsk_hosts(id), "
2459 +
"UNIQUE(name)) ");
2462 statement.execute(
"CREATE TABLE tsk_os_account_realms (id " + primaryKeyType +
" PRIMARY KEY, "
2463 +
"realm_name TEXT DEFAULT NULL, "
2464 +
"realm_addr TEXT DEFAULT NULL, "
2465 +
"realm_signature TEXT NOT NULL, "
2466 +
"scope_host_id " + bigIntDataType +
" DEFAULT NULL, "
2467 +
"scope_confidence INTEGER, "
2468 +
"db_status INTEGER DEFAULT 0, "
2469 +
"merged_into " + bigIntDataType +
" DEFAULT NULL, "
2470 +
"UNIQUE(realm_signature), "
2471 +
"FOREIGN KEY(scope_host_id) REFERENCES tsk_hosts(id),"
2472 +
"FOREIGN KEY(merged_into) REFERENCES tsk_os_account_realms(id) )");
2477 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN host_id INTEGER REFERENCES tsk_hosts(id)");
2478 Statement updateStatement = connection.createStatement();
2479 try (ResultSet resultSet = statement.executeQuery(
"SELECT obj_id, device_id FROM data_source_info")) {
2480 Map<String, Long> hostMap =
new HashMap<>();
2482 while (resultSet.next()) {
2483 long objId = resultSet.getLong(
"obj_id");
2484 String deviceId = resultSet.getString(
"device_id");
2486 if (!hostMap.containsKey(deviceId)) {
2487 String hostName =
"Host " + hostIndex;
2488 updateStatement.execute(
"INSERT INTO tsk_hosts (name, db_status) VALUES ('" + hostName +
"', 0)");
2489 hostMap.put(deviceId, hostIndex);
2492 updateStatement.execute(
"UPDATE data_source_info SET host_id = " + hostMap.get(deviceId) +
" WHERE obj_id = " + objId);
2495 closeStatement(updateStatement);
2498 statement.execute(
"CREATE TABLE tsk_os_accounts (os_account_obj_id " + bigIntDataType +
" PRIMARY KEY, "
2499 +
"login_name TEXT DEFAULT NULL, "
2500 +
"full_name TEXT DEFAULT NULL, "
2501 +
"realm_id " + bigIntDataType +
" NOT NULL, "
2502 +
"addr TEXT DEFAULT NULL, "
2503 +
"signature TEXT NOT NULL, "
2504 +
"status INTEGER, "
2506 +
"created_date " + bigIntDataType +
" DEFAULT NULL, "
2507 +
"db_status INTEGER DEFAULT 0, "
2508 +
"merged_into " + bigIntDataType +
" DEFAULT NULL, "
2509 +
"UNIQUE(signature, realm_id), "
2510 +
"FOREIGN KEY(os_account_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE, "
2511 +
"FOREIGN KEY(realm_id) REFERENCES tsk_os_account_realms(id),"
2512 +
"FOREIGN KEY(merged_into) REFERENCES tsk_os_accounts(os_account_obj_id) )");
2514 statement.execute(
"CREATE TABLE tsk_os_account_attributes (id " + primaryKeyType +
" PRIMARY KEY, "
2515 +
"os_account_obj_id " + bigIntDataType +
" NOT NULL, "
2516 +
"host_id " + bigIntDataType +
", "
2517 +
"source_obj_id " + bigIntDataType +
", "
2518 +
"attribute_type_id " + bigIntDataType +
" NOT NULL, "
2519 +
"value_type INTEGER NOT NULL, "
2520 +
"value_byte " + bigIntDataType +
", "
2521 +
"value_text TEXT, "
2522 +
"value_int32 INTEGER, value_int64 " + bigIntDataType +
", "
2523 +
"value_double NUMERIC(20, 10), "
2524 +
"FOREIGN KEY(os_account_obj_id) REFERENCES tsk_os_accounts(os_account_obj_id), "
2525 +
"FOREIGN KEY(host_id) REFERENCES tsk_hosts(id), "
2526 +
"FOREIGN KEY(source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE SET NULL, "
2527 +
"FOREIGN KEY(attribute_type_id) REFERENCES blackboard_attribute_types(attribute_type_id))");
2529 statement.execute(
"CREATE TABLE tsk_os_account_instances (id " + primaryKeyType +
" PRIMARY KEY, "
2530 +
"os_account_obj_id " + bigIntDataType +
" NOT NULL, "
2531 +
"data_source_obj_id " + bigIntDataType +
" NOT NULL, "
2532 +
"instance_type INTEGER NOT NULL, "
2533 +
"UNIQUE(os_account_obj_id, data_source_obj_id), "
2534 +
"FOREIGN KEY(os_account_obj_id) REFERENCES tsk_os_accounts(os_account_obj_id), "
2535 +
"FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE )");
2537 statement.execute(
"CREATE TABLE tsk_data_artifacts ( "
2538 +
"artifact_obj_id " + bigIntDataType +
" PRIMARY KEY, "
2539 +
"os_account_obj_id " + bigIntDataType +
", "
2540 +
"FOREIGN KEY(os_account_obj_id) REFERENCES tsk_os_accounts(os_account_obj_id)) ");
2543 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN owner_uid TEXT DEFAULT NULL");
2544 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN os_account_obj_id " + bigIntDataType +
" DEFAULT NULL REFERENCES tsk_os_accounts(os_account_obj_id) ");
2547 statement.execute(
"CREATE TABLE tsk_host_addresses (id " + primaryKeyType +
" PRIMARY KEY, "
2548 +
"address_type INTEGER NOT NULL, "
2549 +
"address TEXT NOT NULL, "
2550 +
"UNIQUE(address_type, address)) ");
2552 statement.execute(
"CREATE TABLE tsk_host_address_map (id " + primaryKeyType +
" PRIMARY KEY, "
2553 +
"host_id " + bigIntDataType +
" NOT NULL, "
2554 +
"addr_obj_id " + bigIntDataType +
" NOT NULL, "
2555 +
"source_obj_id " + bigIntDataType +
", "
2556 +
"time " + bigIntDataType +
", "
2557 +
"UNIQUE(host_id, addr_obj_id, time), "
2558 +
"FOREIGN KEY(host_id) REFERENCES tsk_hosts(id) ON DELETE CASCADE, "
2559 +
"FOREIGN KEY(addr_obj_id) REFERENCES tsk_host_addresses(id), "
2560 +
"FOREIGN KEY(source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE SET NULL )");
2563 statement.execute(
"CREATE TABLE tsk_host_address_dns_ip_map (id " + primaryKeyType +
" PRIMARY KEY, "
2564 +
"dns_address_id " + bigIntDataType +
" NOT NULL, "
2565 +
"ip_address_id " + bigIntDataType +
" NOT NULL, "
2566 +
"source_obj_id " + bigIntDataType +
", "
2567 +
"time " + bigIntDataType +
", "
2568 +
"UNIQUE(dns_address_id, ip_address_id, time), "
2569 +
"FOREIGN KEY(dns_address_id) REFERENCES tsk_host_addresses(id) ON DELETE CASCADE, "
2570 +
"FOREIGN KEY(ip_address_id) REFERENCES tsk_host_addresses(id) ON DELETE CASCADE,"
2571 +
"FOREIGN KEY(source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE SET NULL )");
2574 statement.execute(
"CREATE TABLE tsk_host_address_usage (id " + primaryKeyType +
" PRIMARY KEY, "
2575 +
"addr_obj_id " + bigIntDataType +
" NOT NULL, "
2576 +
"obj_id " + bigIntDataType +
" NOT NULL, "
2577 +
"data_source_obj_id " + bigIntDataType +
" NOT NULL, "
2578 +
"UNIQUE(addr_obj_id, obj_id), "
2579 +
"FOREIGN KEY(addr_obj_id) REFERENCES tsk_host_addresses(id) ON DELETE CASCADE, "
2580 +
"FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE )");
2582 return new CaseDbSchemaVersionNumber(9, 0);
2585 closeStatement(statement);
2590 private CaseDbSchemaVersionNumber updateFromSchema9dot0toSchema9dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2591 if (schemaVersion.getMajor() != 9) {
2592 return schemaVersion;
2595 if (schemaVersion.getMinor() != 0) {
2596 return schemaVersion;
2599 Statement statement = connection.createStatement();
2604 statement.execute(
"CREATE INDEX tsk_file_attributes_obj_id ON tsk_file_attributes(obj_id)");
2606 statement.execute(
"ALTER TABLE tsk_analysis_results ADD COLUMN priority INTEGER NOT NULL DEFAULT " + Score.Priority.NORMAL.getId());
2607 statement.execute(
"ALTER TABLE tsk_aggregate_score ADD COLUMN priority INTEGER NOT NULL DEFAULT " + Score.Priority.NORMAL.getId());
2609 return new CaseDbSchemaVersionNumber(9, 1);
2611 closeStatement(statement);
2627 private void insertAccountTypeIfNotExists(Statement statement, String type_name, String display_name)
throws TskCoreException, SQLException {
2629 String insertSQL = String.format(
"INTO account_types(type_name, display_name) VALUES ('%s', '%s')", type_name, display_name);
2632 insertSQL =
"INSERT " + insertSQL +
" ON CONFLICT DO NOTHING";
2635 insertSQL =
"INSERT OR IGNORE " + insertSQL;
2638 throw new TskCoreException(
"Unknown DB Type: " +
getDatabaseType().name());
2640 statement.execute(insertSQL);
2650 static String extractExtension(
final String fileName) {
2652 int i = fileName.lastIndexOf(
".");
2654 if ((i > 0) && ((i + 1) < fileName.length())) {
2655 ext = fileName.substring(i + 1);
2666 return ext.toLowerCase();
2690 return CURRENT_DB_SCHEMA_VERSION;
2700 return caseDBSchemaCreationVersion;
2719 return dbBackupPath;
2746 return databaseName;
2766 rwLock.writeLock().lock();
2777 rwLock.writeLock().unlock();
2788 rwLock.readLock().lock();
2799 rwLock.readLock().unlock();
2819 }
catch (Exception ex) {
2820 throw new TskCoreException(
"Failed to open case database at " + dbPath, ex);
2850 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()), databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDir, info.getDbType());
2851 }
catch (PropertyVetoException exp) {
2853 throw new TskCoreException(exp.getMessage(), exp);
2857 }
catch (Exception exp) {
2859 throw new TskCoreException(exp.getMessage(), exp);
2874 CaseDatabaseFactory factory =
new CaseDatabaseFactory(dbPath);
2875 factory.createCaseDatabase();
2879 }
catch (Exception ex) {
2880 throw new TskCoreException(
"Failed to create case database at " + dbPath, ex);
2900 String databaseName = createCaseDataBaseName(caseName);
2914 CaseDatabaseFactory factory =
new CaseDatabaseFactory(databaseName, info);
2915 factory.createCaseDatabase();
2918 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()),
2919 databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDirPath, info.getDbType());
2920 }
catch (PropertyVetoException exp) {
2922 throw new TskCoreException(exp.getMessage(), exp);
2923 }
catch (Exception exp) {
2925 throw new TskCoreException(exp.getMessage(), exp);
2938 private static String createCaseDataBaseName(String candidateDbName) {
2940 if (!candidateDbName.isEmpty()) {
2944 dbName = candidateDbName.replaceAll(
"[^\\p{ASCII}]",
"_");
2949 dbName = dbName.replaceAll(
"[\\p{Cntrl}]",
"_");
2954 dbName = dbName.replaceAll(
"[ /?:'\"\\\\]",
"_");
2959 dbName = dbName.toLowerCase();
2965 if ((dbName.length() > 0 && !(Character.isLetter(dbName.codePointAt(0))) && !(dbName.codePointAt(0) ==
'_'))) {
2966 dbName =
"_" + dbName;
2973 if (dbName.length() > MAX_DB_NAME_LEN_BEFORE_TIMESTAMP) {
2974 dbName = dbName.substring(0, MAX_DB_NAME_LEN_BEFORE_TIMESTAMP);
2986 SimpleDateFormat dateFormat =
new SimpleDateFormat(
"yyyyMMdd_HHmmss");
2987 Date date =
new Date();
2988 dbName = dbName +
"_" + dateFormat.format(date);
3003 if (cachedCurrentExaminer != null) {
3004 return cachedCurrentExaminer;
3006 String loginName = System.getProperty(
"user.name");
3007 if (loginName == null || loginName.isEmpty()) {
3008 throw new TskCoreException(
"Failed to determine logged in user name.");
3011 ResultSet resultSet = null;
3012 CaseDbConnection connection = null;
3015 connection = connections.getConnection();
3016 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_EXAMINER_BY_LOGIN_NAME);
3017 statement.clearParameters();
3018 statement.setString(1, loginName);
3019 resultSet = connection.executeQuery(statement);
3020 if (resultSet.next()) {
3021 cachedCurrentExaminer =
new Examiner(resultSet.getLong(
"examiner_id"), resultSet.getString(
"login_name"), resultSet.getString(
"display_name"));
3022 return cachedCurrentExaminer;
3024 throw new TskCoreException(
"Error getting examaminer for name = " + loginName);
3027 }
catch (SQLException ex) {
3028 throw new TskCoreException(
"Error getting examaminer for name = " + loginName, ex);
3030 closeResultSet(resultSet);
3031 closeConnection(connection);
3046 Examiner getExaminerById(
long id)
throws TskCoreException {
3048 CaseDbConnection connection = null;
3049 ResultSet resultSet = null;
3052 connection = connections.getConnection();
3053 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_EXAMINER_BY_ID);
3054 statement.clearParameters();
3055 statement.setLong(1,
id);
3056 resultSet = connection.executeQuery(statement);
3057 if (resultSet.next()) {
3058 return new Examiner(resultSet.getLong(
"examiner_id"), resultSet.getString(
"login_name"), resultSet.getString(
"full_name"));
3060 throw new TskCoreException(
"Error getting examaminer for id = " +
id);
3062 }
catch (SQLException ex) {
3063 throw new TskCoreException(
"Error getting examaminer for id = " +
id, ex);
3065 closeResultSet(resultSet);
3066 closeConnection(connection);
3089 return this.caseHandle.initAddImageProcess(timeZone, addUnallocSpace, noFatFsOrphans, imageCopyPath,
this);
3101 CaseDbConnection connection = null;
3103 ResultSet rs = null;
3106 connection = connections.getConnection();
3107 s = connection.createStatement();
3108 rs = connection.executeQuery(s,
"SELECT obj_id, type FROM tsk_objects "
3109 +
"WHERE par_obj_id IS NULL");
3110 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
3112 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"),
ObjectType.
valueOf(rs.getShort(
"type"))));
3115 List<Content> rootObjs =
new ArrayList<Content>();
3116 for (ObjectInfo i : infos) {
3117 if (null != i.type) {
3128 throw new TskCoreException(
"Parentless object has wrong type to be a root (ABSTRACTFILE, but not VIRTUAL_DIRECTORY: " + i.type);
3140 throw new TskCoreException(
"Parentless object has wrong type to be a root: " + i.type);
3145 }
catch (SQLException ex) {
3146 throw new TskCoreException(
"Error getting root objects", ex);
3150 closeConnection(connection);
3166 List<Long> getDataSourceObjIds(String deviceId)
throws TskCoreException {
3169 synchronized (deviceIdToDatasourceObjIdMap) {
3170 if (deviceIdToDatasourceObjIdMap.containsKey(deviceId)) {
3171 return new ArrayList<Long>(deviceIdToDatasourceObjIdMap.get(deviceId));
3174 CaseDbConnection connection = null;
3176 ResultSet rs = null;
3179 connection = connections.getConnection();
3180 s = connection.createStatement();
3181 rs = connection.executeQuery(s,
"SELECT obj_id FROM data_source_info WHERE device_id = '" + deviceId +
"'");
3182 List<Long> dataSourceObjIds =
new ArrayList<Long>();
3184 dataSourceObjIds.add(rs.getLong(
"obj_id"));
3187 long ds_obj_id = rs.getLong(
"obj_id");
3188 if (deviceIdToDatasourceObjIdMap.containsKey(deviceId)) {
3189 deviceIdToDatasourceObjIdMap.get(deviceId).add(ds_obj_id);
3191 deviceIdToDatasourceObjIdMap.put(deviceId,
new HashSet<Long>(Arrays.asList(ds_obj_id)));
3194 return dataSourceObjIds;
3195 }
catch (SQLException ex) {
3196 throw new TskCoreException(
"Error getting data sources", ex);
3200 closeConnection(connection);
3223 CaseDbConnection connection = null;
3224 Statement statement = null;
3225 ResultSet resultSet = null;
3226 Statement statement2 = null;
3227 ResultSet resultSet2 = null;
3230 connection = connections.getConnection();
3231 statement = connection.createStatement();
3232 statement2 = connection.createStatement();
3233 resultSet = connection.executeQuery(statement,
3234 "SELECT ds.obj_id, ds.device_id, ds.time_zone, img.type, img.ssize, img.size, img.md5, img.sha1, img.sha256, img.display_name "
3235 +
"FROM data_source_info AS ds "
3236 +
"LEFT JOIN tsk_image_info AS img "
3237 +
"ON ds.obj_id = img.obj_id");
3239 List<DataSource> dataSourceList =
new ArrayList<DataSource>();
3242 while (resultSet.next()) {
3244 Long objectId = resultSet.getLong(
"obj_id");
3245 String deviceId = resultSet.getString(
"device_id");
3246 String timezone = resultSet.getString(
"time_zone");
3247 String type = resultSet.getString(
"type");
3255 resultSet2 = connection.executeQuery(statement2,
"SELECT name FROM tsk_files WHERE tsk_files.obj_id = " + objectId);
3256 String dsName = (resultSet2.next()) ? resultSet2.getString(
"name") :
"";
3264 String parentPath =
"/";
3265 dataSource =
new LocalFilesDataSource(
this, objectId, objectId, deviceId, dsName, dirType, metaType, dirFlag, metaFlags, timezone, null, null,
FileKnown.
UNKNOWN, parentPath);
3270 Long ssize = resultSet.getLong(
"ssize");
3271 Long size = resultSet.getLong(
"size");
3272 String md5 = resultSet.getString(
"md5");
3273 String sha1 = resultSet.getString(
"sha1");
3274 String sha256 = resultSet.getString(
"sha256");
3275 String name = resultSet.getString(
"display_name");
3277 List<String> imagePaths = imagePathsMap.get(objectId);
3279 if (imagePaths.size() > 0) {
3280 String path = imagePaths.get(0);
3281 name = (
new java.io.File(path)).getName();
3287 dataSource =
new Image(
this, objectId, Long.valueOf(type), deviceId, ssize, name,
3288 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, size);
3291 dataSourceList.add(dataSource);
3294 return dataSourceList;
3296 }
catch (SQLException ex) {
3297 throw new TskCoreException(
"Error getting data sources", ex);
3299 closeResultSet(resultSet);
3300 closeStatement(statement);
3301 closeResultSet(resultSet2);
3302 closeStatement(statement2);
3303 closeConnection(connection);
3329 CaseDbConnection connection = null;
3330 Statement statement = null;
3331 ResultSet resultSet = null;
3332 Statement statement2 = null;
3333 ResultSet resultSet2 = null;
3336 connection = connections.getConnection();
3337 statement = connection.createStatement();
3338 statement2 = connection.createStatement();
3339 resultSet = connection.executeQuery(statement,
3340 "SELECT ds.device_id, ds.time_zone, img.type, img.ssize, img.size, img.md5, img.sha1, img.sha256, img.display_name "
3341 +
"FROM data_source_info AS ds "
3342 +
"LEFT JOIN tsk_image_info AS img "
3343 +
"ON ds.obj_id = img.obj_id "
3344 +
"WHERE ds.obj_id = " + objectId);
3345 if (resultSet.next()) {
3346 String deviceId = resultSet.getString(
"device_id");
3347 String timezone = resultSet.getString(
"time_zone");
3348 String type = resultSet.getString(
"type");
3356 resultSet2 = connection.executeQuery(statement2,
"SELECT name FROM tsk_files WHERE tsk_files.obj_id = " + objectId);
3357 String dsName = (resultSet2.next()) ? resultSet2.getString(
"name") :
"";
3364 String parentPath =
"/";
3365 dataSource =
new LocalFilesDataSource(
this, objectId, objectId, deviceId, dsName, dirType, metaType, dirFlag, metaFlags, timezone, null, null,
FileKnown.
UNKNOWN, parentPath);
3370 Long ssize = resultSet.getLong(
"ssize");
3371 Long size = resultSet.getLong(
"size");
3372 String md5 = resultSet.getString(
"md5");
3373 String sha1 = resultSet.getString(
"sha1");
3374 String sha256 = resultSet.getString(
"sha256");
3375 String name = resultSet.getString(
"display_name");
3377 List<String> imagePaths = getImagePathsById(objectId, connection);
3379 if (imagePaths.size() > 0) {
3380 String path = imagePaths.get(0);
3381 name = (
new java.io.File(path)).getName();
3387 dataSource =
new Image(
this, objectId, Long.valueOf(type), deviceId, ssize, name,
3388 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, size);
3391 throw new TskDataException(String.format(
"There is no data source with obj_id = %d", objectId));
3393 }
catch (SQLException ex) {
3394 throw new TskCoreException(String.format(
"Error getting data source with obj_id = %d", objectId), ex);
3396 closeResultSet(resultSet);
3397 closeStatement(statement);
3398 closeResultSet(resultSet2);
3399 closeStatement(statement2);
3400 closeConnection(connection);
3418 return getArtifactsHelper(
"blackboard_artifacts.artifact_type_id = " + artifactTypeID);
3432 CaseDbConnection connection = null;
3433 ResultSet rs = null;
3436 connection = connections.getConnection();
3439 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_FROM_SOURCE);
3440 statement.clearParameters();
3441 statement.setLong(1, objId);
3442 rs = connection.executeQuery(statement);
3445 count = rs.getLong(
"count");
3448 }
catch (SQLException ex) {
3449 throw new TskCoreException(
"Error getting number of blackboard artifacts by content", ex);
3452 closeConnection(connection);
3468 CaseDbConnection connection = null;
3469 ResultSet rs = null;
3472 connection = connections.getConnection();
3475 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_OF_TYPE);
3476 statement.clearParameters();
3477 statement.setInt(1, artifactTypeID);
3478 rs = connection.executeQuery(statement);
3481 count = rs.getLong(
"count");
3484 }
catch (SQLException ex) {
3485 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
3488 closeConnection(connection);
3505 CaseDbConnection connection = null;
3506 ResultSet rs = null;
3509 connection = connections.getConnection();
3512 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_OF_TYPE_BY_DATA_SOURCE);
3513 statement.clearParameters();
3514 statement.setInt(2, artifactTypeID);
3515 statement.setLong(1, dataSourceID);
3516 rs = connection.executeQuery(statement);
3519 count = rs.getLong(
"count");
3522 }
catch (SQLException ex) {
3523 throw new TskCoreException(String.format(
"Error getting number of blackboard artifacts by type (%d) and data source (%d)", artifactTypeID, dataSourceID), ex);
3526 closeConnection(connection);
3546 CaseDbConnection connection = null;
3548 ResultSet rs = null;
3551 connection = connections.getConnection();
3552 s = connection.createStatement();
3553 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3554 +
"arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3555 +
"types.type_name AS type_name, types.display_name AS display_name, "
3556 +
" arts.review_status_id AS review_status_id "
3557 +
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3558 +
"WHERE arts.artifact_id = attrs.artifact_id "
3559 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3560 +
" AND attrs.value_text = '" + value +
"'"
3561 +
" AND types.artifact_type_id=arts.artifact_type_id"
3563 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3565 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
3566 rs.getObject(
"data_source_obj_id") != null ? rs.getLong(
"data_source_obj_id") : null,
3567 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3571 }
catch (SQLException ex) {
3572 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3576 closeConnection(connection);
3599 String valSubStr =
"%" + subString;
3600 if (startsWith ==
false) {
3603 CaseDbConnection connection = null;
3605 ResultSet rs = null;
3608 connection = connections.getConnection();
3609 s = connection.createStatement();
3610 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3611 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3612 +
" types.type_name AS type_name, types.display_name AS display_name, "
3613 +
" arts.review_status_id AS review_status_id "
3614 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3615 +
" WHERE arts.artifact_id = attrs.artifact_id "
3616 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3617 +
" AND LOWER(attrs.value_text) LIKE LOWER('" + valSubStr +
"')"
3618 +
" AND types.artifact_type_id=arts.artifact_type_id "
3620 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3622 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
3623 rs.getObject(
"data_source_obj_id") != null ? rs.getLong(
"data_source_obj_id") : null,
3624 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3628 }
catch (SQLException ex) {
3629 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
3633 closeConnection(connection);
3653 CaseDbConnection connection = null;
3655 ResultSet rs = null;
3658 connection = connections.getConnection();
3659 s = connection.createStatement();
3660 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3661 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3662 +
" types.type_name AS type_name, types.display_name AS display_name, "
3663 +
" arts.review_status_id AS review_status_id "
3664 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3665 +
"WHERE arts.artifact_id = attrs.artifact_id "
3666 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3667 +
" AND attrs.value_int32 = " + value
3668 +
" AND types.artifact_type_id=arts.artifact_type_id "
3670 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3672 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
3673 rs.getObject(
"data_source_obj_id") != null ? rs.getLong(
"data_source_obj_id") : null,
3674 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3678 }
catch (SQLException ex) {
3679 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3683 closeConnection(connection);
3703 CaseDbConnection connection = null;
3705 ResultSet rs = null;
3708 connection = connections.getConnection();
3709 s = connection.createStatement();
3710 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3711 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3712 +
" types.type_name AS type_name, types.display_name AS display_name, "
3713 +
" arts.review_status_id AS review_status_id "
3714 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3715 +
" WHERE arts.artifact_id = attrs.artifact_id "
3716 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3717 +
" AND attrs.value_int64 = " + value
3718 +
" AND types.artifact_type_id=arts.artifact_type_id "
3720 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3722 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
3723 rs.getObject(
"data_source_obj_id") != null ? rs.getLong(
"data_source_obj_id") : null,
3724 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3728 }
catch (SQLException ex) {
3729 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
3733 closeConnection(connection);
3753 CaseDbConnection connection = null;
3755 ResultSet rs = null;
3758 connection = connections.getConnection();
3759 s = connection.createStatement();
3760 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3761 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3762 +
" types.type_name AS type_name, types.display_name AS display_name, "
3763 +
" arts.review_status_id AS review_status_id "
3764 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3765 +
" WHERE arts.artifact_id = attrs.artifact_id "
3766 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3767 +
" AND attrs.value_double = " + value
3768 +
" AND types.artifact_type_id=arts.artifact_type_id "
3770 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3772 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
3773 rs.getObject(
"data_source_obj_id") != null ? rs.getLong(
"data_source_obj_id") : null,
3774 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3778 }
catch (SQLException ex) {
3779 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3783 closeConnection(connection);
3803 CaseDbConnection connection = null;
3805 ResultSet rs = null;
3808 connection = connections.getConnection();
3809 s = connection.createStatement();
3810 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3811 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3812 +
" types.type_name AS type_name, types.display_name AS display_name, "
3813 +
" arts.review_status_id AS review_status_id "
3814 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3815 +
" WHERE arts.artifact_id = attrs.artifact_id "
3816 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3817 +
" AND attrs.value_byte = " + value
3818 +
" AND types.artifact_type_id=arts.artifact_type_id "
3820 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
3822 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
3823 rs.getObject(
"data_source_obj_id") != null ? rs.getLong(
"data_source_obj_id") : null,
3824 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
3828 }
catch (SQLException ex) {
3829 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3833 closeConnection(connection);
3846 CaseDbConnection connection = null;
3848 ResultSet rs = null;
3851 connection = connections.getConnection();
3852 s = connection.createStatement();
3853 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name, category_type FROM blackboard_artifact_types");
3857 rs.getString(
"type_name"), rs.getString(
"display_name"),
3860 return artifactTypes;
3861 }
catch (SQLException ex) {
3862 throw new TskCoreException(
"Error getting artifact types", ex);
3866 closeConnection(connection);
3880 String typeIdList =
"";
3887 String query =
"SELECT DISTINCT artifact_type_id FROM blackboard_artifacts "
3888 +
"WHERE artifact_type_id IN (" + typeIdList +
")";
3889 CaseDbConnection connection = null;
3891 ResultSet rs = null;
3894 connection = connections.getConnection();
3895 s = connection.createStatement();
3896 rs = connection.executeQuery(s, query);
3902 }
catch (SQLException ex) {
3903 throw new TskCoreException(
"Error getting artifact types in use", ex);
3907 closeConnection(connection);
3923 CaseDbConnection connection = null;
3925 ResultSet rs = null;
3928 connection = connections.getConnection();
3929 s = connection.createStatement();
3930 rs = connection.executeQuery(s,
3931 "SELECT DISTINCT arts.artifact_type_id AS artifact_type_id, "
3932 +
"types.type_name AS type_name, "
3933 +
"types.display_name AS display_name, "
3934 +
"types.category_type AS category_type "
3935 +
"FROM blackboard_artifact_types AS types "
3936 +
"INNER JOIN blackboard_artifacts AS arts "
3937 +
"ON arts.artifact_type_id = types.artifact_type_id");
3941 rs.getString(
"type_name"), rs.getString(
"display_name"),
3944 return uniqueArtifactTypes;
3945 }
catch (SQLException ex) {
3946 throw new TskCoreException(
"Error getting attribute types", ex);
3950 closeConnection(connection);
3963 CaseDbConnection connection = null;
3965 ResultSet rs = null;
3968 connection = connections.getConnection();
3969 s = connection.createStatement();
3970 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types");
3976 return attribute_types;
3977 }
catch (SQLException ex) {
3978 throw new TskCoreException(
"Error getting attribute types", ex);
3982 closeConnection(connection);
3999 CaseDbConnection connection = null;
4001 ResultSet rs = null;
4004 connection = connections.getConnection();
4005 s = connection.createStatement();
4006 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM blackboard_attribute_types");
4009 count = rs.getInt(
"count");
4012 }
catch (SQLException ex) {
4013 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
4017 closeConnection(connection);
4034 ArrayList<BlackboardArtifact> getArtifactsHelper(String whereClause)
throws TskCoreException {
4035 CaseDbConnection connection = null;
4036 Statement statement = null;
4037 ResultSet rs = null;
4040 connection = connections.getConnection();
4041 statement = connection.createStatement();
4042 String query =
"SELECT blackboard_artifacts.artifact_id AS artifact_id, "
4043 +
"blackboard_artifacts.obj_id AS obj_id, "
4044 +
"blackboard_artifacts.artifact_obj_id AS artifact_obj_id, "
4045 +
"blackboard_artifacts.data_source_obj_id AS data_source_obj_id, "
4046 +
"blackboard_artifact_types.artifact_type_id AS artifact_type_id, "
4047 +
"blackboard_artifact_types.type_name AS type_name, "
4048 +
"blackboard_artifact_types.display_name AS display_name, "
4049 +
"blackboard_artifacts.review_status_id AS review_status_id "
4050 +
"FROM blackboard_artifacts, blackboard_artifact_types "
4051 +
"WHERE blackboard_artifacts.artifact_type_id = blackboard_artifact_types.artifact_type_id "
4053 +
" AND " + whereClause;
4054 rs = connection.executeQuery(statement, query);
4055 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
4057 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
4058 rs.getObject(
"data_source_obj_id") != null ? rs.getLong(
"data_source_obj_id") : null,
4059 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
4063 }
catch (SQLException ex) {
4064 throw new TskCoreException(
"Error getting or creating a blackboard artifact", ex);
4067 closeStatement(statement);
4068 closeConnection(connection);
4085 private long getArtifactsCountHelper(
int artifactTypeID,
long obj_id)
throws TskCoreException {
4086 CaseDbConnection connection = null;
4087 ResultSet rs = null;
4090 connection = connections.getConnection();
4093 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE);
4094 statement.clearParameters();
4095 statement.setLong(1, obj_id);
4096 statement.setInt(2, artifactTypeID);
4097 rs = connection.executeQuery(statement);
4100 count = rs.getLong(
"count");
4103 }
catch (SQLException ex) {
4104 throw new TskCoreException(
"Error getting blackboard artifact count", ex);
4107 closeConnection(connection);
4125 return getArtifactsHelper(
"blackboard_artifacts.obj_id = " + obj_id +
" AND blackboard_artifact_types.type_name = '" + artifactTypeName +
"';");
4141 return getArtifactsHelper(
"blackboard_artifacts.obj_id = " + obj_id +
" AND blackboard_artifact_types.artifact_type_id = " + artifactTypeID +
";");
4173 int artifactTypeID = this.
getArtifactType(artifactTypeName).getTypeID();
4174 if (artifactTypeID == -1) {
4177 return getArtifactsCountHelper(artifactTypeID, obj_id);
4193 return getArtifactsCountHelper(artifactTypeID, obj_id);
4209 return getArtifactsCountHelper(artifactType.getTypeID(), obj_id);
4224 return getArtifactsHelper(
"blackboard_artifact_types.type_name = '" + artifactTypeName +
"';");
4239 return getArtifactsHelper(
"blackboard_artifact_types.artifact_type_id = " + artifactType.getTypeID() +
";");
4256 CaseDbConnection connection = null;
4258 ResultSet rs = null;
4261 connection = connections.getConnection();
4262 s = connection.createStatement();
4263 rs = connection.executeQuery(s,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
4264 +
"arts.obj_id AS obj_id, arts.artifact_obj_id as artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
4265 +
"types.type_name AS type_name, types.display_name AS display_name,"
4266 +
"arts.review_status_id AS review_status_id "
4267 +
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
4268 +
"WHERE arts.artifact_id = attrs.artifact_id "
4269 +
"AND attrs.attribute_type_id = " + attrType.getTypeID()
4270 +
" AND arts.artifact_type_id = " + artifactType.getTypeID()
4271 +
" AND attrs.value_text = '" + value +
"'"
4272 +
" AND types.artifact_type_id=arts.artifact_type_id"
4274 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
4276 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
4277 rs.getObject(
"data_source_obj_id") != null ? rs.getLong(
"data_source_obj_id") : null,
4278 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
4282 }
catch (SQLException ex) {
4283 throw new TskCoreException(
"Error getting blackboard artifacts by artifact type and attribute. " + ex.getMessage(), ex);
4287 closeConnection(connection);
4304 CaseDbConnection connection = null;
4306 ResultSet rs = null;
4309 connection = connections.getConnection();
4310 s = connection.createStatement();
4311 rs = connection.executeQuery(s,
"SELECT arts.artifact_id AS artifact_id, "
4312 +
"arts.obj_id AS obj_id, arts.artifact_obj_id as artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
4313 +
"types.type_name AS type_name, types.display_name AS display_name,"
4314 +
"arts.review_status_id AS review_status_id "
4315 +
"FROM blackboard_artifacts AS arts, blackboard_artifact_types AS types "
4316 +
"WHERE arts.artifact_id = " + artifactID
4317 +
" AND arts.artifact_type_id = types.artifact_type_id");
4319 return new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"),
4320 rs.getObject(
"data_source_obj_id") != null ? rs.getLong(
"data_source_obj_id") : null,
4321 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
4329 throw new TskCoreException(
"No blackboard artifact with id " + artifactID);
4331 }
catch (SQLException ex) {
4332 throw new TskCoreException(
"Error getting a blackboard artifact. " + ex.getMessage(), ex);
4335 closeConnection(connection);
4350 try (CaseDbConnection connection = connections.getConnection();) {
4351 addBlackBoardAttribute(attr, artifactTypeId, connection);
4352 }
catch (SQLException ex) {
4353 throw new TskCoreException(
"Error adding blackboard attribute " + attr.toString(), ex);
4369 CaseDbConnection connection = null;
4372 connection = connections.getConnection();
4373 connection.beginTransaction();
4375 addBlackBoardAttribute(attr, artifactTypeId, connection);
4377 connection.commitTransaction();
4378 }
catch (SQLException ex) {
4379 rollbackTransaction(connection);
4380 throw new TskCoreException(
"Error adding blackboard attributes", ex);
4382 closeConnection(connection);
4387 void addBlackBoardAttribute(
BlackboardAttribute attr,
int artifactTypeId, CaseDbConnection connection)
throws SQLException, TskCoreException {
4388 PreparedStatement statement;
4389 switch (attr.getAttributeType().getValueType()) {
4392 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_STRING_ATTRIBUTE);
4393 statement.clearParameters();
4394 statement.setString(7, attr.getValueString());
4397 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_BYTE_ATTRIBUTE);
4398 statement.clearParameters();
4399 statement.setBytes(7, attr.getValueBytes());
4402 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INT_ATTRIBUTE);
4403 statement.clearParameters();
4404 statement.setInt(7, attr.getValueInt());
4407 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LONG_ATTRIBUTE);
4408 statement.clearParameters();
4409 statement.setLong(7, attr.getValueLong());
4412 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DOUBLE_ATTRIBUTE);
4413 statement.clearParameters();
4414 statement.setDouble(7, attr.getValueDouble());
4417 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LONG_ATTRIBUTE);
4418 statement.clearParameters();
4419 statement.setLong(7, attr.getValueLong());
4422 throw new TskCoreException(
"Unrecognized artifact attribute value type");
4424 statement.setLong(1, attr.getArtifactID());
4425 statement.setInt(2, artifactTypeId);
4426 statement.setString(3, attr.getSourcesCSV());
4427 statement.setString(4,
"");
4428 statement.setInt(5, attr.getAttributeType().getTypeID());
4429 statement.setLong(6, attr.getAttributeType().getValueType().getType());
4430 connection.executeUpdate(statement);
4433 void addFileAttribute(Attribute attr, CaseDbConnection connection)
throws SQLException, TskCoreException {
4434 PreparedStatement statement;
4435 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE_ATTRIBUTE, Statement.RETURN_GENERATED_KEYS);
4436 statement.clearParameters();
4438 statement.setLong(1, attr.getAttributeParentId());
4439 statement.setInt(2, attr.getAttributeType().getTypeID());
4440 statement.setLong(3, attr.getAttributeType().getValueType().getType());
4442 if (attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE) {
4443 statement.setBytes(4, attr.getValueBytes());
4445 statement.setBytes(4, null);
4448 if (attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING
4449 || attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.JSON) {
4450 statement.setString(5, attr.getValueString());
4452 statement.setString(5, null);
4454 if (attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER) {
4455 statement.setInt(6, attr.getValueInt());
4457 statement.setNull(6, java.sql.Types.INTEGER);
4460 if (attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME
4461 || attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG) {
4462 statement.setLong(7, attr.getValueLong());
4464 statement.setNull(7, java.sql.Types.BIGINT);
4467 if (attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE) {
4468 statement.setDouble(8, attr.getValueDouble());
4470 statement.setNull(8, java.sql.Types.DOUBLE);
4473 connection.executeUpdate(statement);
4474 try (ResultSet resultSet = statement.getGeneratedKeys()) {
4475 if (!resultSet.next()) {
4476 throw new TskCoreException(String.format(
"Failed to insert file attribute "
4477 +
"with id=%d. The expected key was not generated", attr.getId()));
4480 attr.setId(resultSet.getLong(1));
4494 String addSourceToArtifactAttribute(BlackboardAttribute attr, String source)
throws TskCoreException {
4502 if (null == source || source.isEmpty()) {
4503 throw new TskCoreException(
"Attempt to add null or empty source module name to artifact attribute");
4505 CaseDbConnection connection = null;
4507 Statement queryStmt = null;
4508 Statement updateStmt = null;
4509 ResultSet result = null;
4510 String newSources =
"";
4512 connection = connections.getConnection();
4513 connection.beginTransaction();
4514 String valueClause =
"";
4515 BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType = attr.getAttributeType().getValueType();
4516 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
4517 switch (valueType) {
4523 valueClause =
" value_int32 = " + attr.getValueInt();
4527 valueClause =
" value_int64 = " + attr.getValueLong();
4530 valueClause =
" value_double = " + attr.getValueDouble();
4533 throw new TskCoreException(String.format(
"Unrecognized value type for attribute %s", attr.getDisplayString()));
4535 String query =
"SELECT source FROM blackboard_attributes WHERE"
4536 +
" artifact_id = " + attr.getArtifactID()
4537 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
4538 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
4539 +
" AND " + valueClause +
";";
4540 queryStmt = connection.createStatement();
4541 updateStmt = connection.createStatement();
4542 result = connection.executeQuery(queryStmt, query);
4549 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ATTR_BY_VALUE_BYTE);
4550 statement.clearParameters();
4551 statement.setLong(1, attr.getArtifactID());
4552 statement.setLong(2, attr.getAttributeType().getTypeID());
4553 statement.setBytes(3, attr.getValueBytes());
4554 result = connection.executeQuery(statement);
4556 while (result.next()) {
4557 String oldSources = result.getString(
"source");
4558 if (null != oldSources && !oldSources.isEmpty()) {
4559 Set<String> uniqueSources =
new HashSet<String>(Arrays.asList(oldSources.split(
",")));
4560 if (!uniqueSources.contains(source)) {
4561 newSources = oldSources +
"," + source;
4563 newSources = oldSources;
4566 newSources = source;
4568 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
4569 String update =
"UPDATE blackboard_attributes SET source = '" + newSources +
"' WHERE"
4570 +
" artifact_id = " + attr.getArtifactID()
4571 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
4572 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
4573 +
" AND " + valueClause +
";";
4574 connection.executeUpdate(updateStmt, update);
4581 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ATTR_BY_VALUE_BYTE);
4582 statement.clearParameters();
4583 statement.setString(1, newSources);
4584 statement.setLong(2, attr.getArtifactID());
4585 statement.setLong(3, attr.getAttributeType().getTypeID());
4586 statement.setBytes(4, attr.getValueBytes());
4587 connection.executeUpdate(statement);
4590 connection.commitTransaction();
4592 }
catch (SQLException ex) {
4593 rollbackTransaction(connection);
4594 throw new TskCoreException(String.format(
"Error adding source module to attribute %s", attr.getDisplayString()), ex);
4596 closeResultSet(result);
4597 closeStatement(updateStmt);
4598 closeStatement(queryStmt);
4599 closeConnection(connection);
4619 CaseDbConnection connection = null;
4622 ResultSet rs = null;
4624 connection = connections.getConnection();
4625 connection.beginTransaction();
4626 s = connection.createStatement();
4627 rs = connection.executeQuery(s,
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeString +
"'");
4630 rs = connection.executeQuery(s,
"SELECT MAX(attribute_type_id) AS highest_id FROM blackboard_attribute_types");
4633 maxID = rs.getInt(
"highest_id");
4634 if (maxID < MIN_USER_DEFINED_TYPE_ID) {
4635 maxID = MIN_USER_DEFINED_TYPE_ID;
4640 connection.executeUpdate(s,
"INSERT INTO blackboard_attribute_types (attribute_type_id, type_name, display_name, value_type) VALUES ('" + maxID +
"', '" + attrTypeString +
"', '" + displayName +
"', '" + valueType.getType() +
"')");
4642 this.typeIdToAttributeTypeMap.put(type.getTypeID(), type);
4643 this.typeNameToAttributeTypeMap.put(type.getTypeName(), type);
4644 connection.commitTransaction();
4647 throw new TskDataException(
"The attribute type that was added was already within the system.");
4650 }
catch (SQLException ex) {
4651 rollbackTransaction(connection);
4652 throw new TskCoreException(
"Error adding attribute type", ex);
4656 closeConnection(connection);
4672 if (this.typeNameToAttributeTypeMap.containsKey(attrTypeName)) {
4673 return this.typeNameToAttributeTypeMap.get(attrTypeName);
4675 CaseDbConnection connection = null;
4677 ResultSet rs = null;
4680 connection = connections.getConnection();
4681 s = connection.createStatement();
4682 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName +
"'");
4687 this.typeIdToAttributeTypeMap.put(type.getTypeID(), type);
4688 this.typeNameToAttributeTypeMap.put(attrTypeName, type);
4691 }
catch (SQLException ex) {
4692 throw new TskCoreException(
"Error getting attribute type id", ex);
4696 closeConnection(connection);
4712 if (this.typeIdToAttributeTypeMap.containsKey(typeID)) {
4713 return this.typeIdToAttributeTypeMap.get(typeID);
4715 CaseDbConnection connection = null;
4717 ResultSet rs = null;
4720 connection = connections.getConnection();
4721 s = connection.createStatement();
4722 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types WHERE attribute_type_id = " + typeID +
"");
4723 BlackboardAttribute.Type type = null;
4725 type =
new BlackboardAttribute.Type(rs.getInt(
"attribute_type_id"), rs.getString(
"type_name"),
4726 rs.getString(
"display_name"), TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromType(rs.getLong(
"value_type")));
4727 this.typeIdToAttributeTypeMap.put(typeID, type);
4728 this.typeNameToAttributeTypeMap.put(type.getTypeName(), type);
4731 }
catch (SQLException ex) {
4732 throw new TskCoreException(
"Error getting attribute type id", ex);
4736 closeConnection(connection);
4752 if (this.typeNameToArtifactTypeMap.containsKey(artTypeName)) {
4753 return this.typeNameToArtifactTypeMap.get(artTypeName);
4755 CaseDbConnection connection = null;
4757 ResultSet rs = null;
4760 connection = connections.getConnection();
4761 s = connection.createStatement();
4762 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name, category_type FROM blackboard_artifact_types WHERE type_name = '" + artTypeName +
"'");
4766 rs.getString(
"type_name"), rs.getString(
"display_name"),
4768 this.typeIdToArtifactTypeMap.put(type.getTypeID(), type);
4769 this.typeNameToArtifactTypeMap.put(artTypeName, type);
4772 }
catch (SQLException ex) {
4773 throw new TskCoreException(
"Error getting artifact type from the database", ex);
4777 closeConnection(connection);
4794 if (this.typeIdToArtifactTypeMap.containsKey(artTypeId)) {
4795 return typeIdToArtifactTypeMap.get(artTypeId);
4797 CaseDbConnection connection = null;
4799 ResultSet rs = null;
4802 connection = connections.getConnection();
4803 s = connection.createStatement();
4804 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name, category_type FROM blackboard_artifact_types WHERE artifact_type_id = " + artTypeId +
"");
4805 BlackboardArtifact.Type type = null;
4807 type =
new BlackboardArtifact.Type(rs.getInt(
"artifact_type_id"),
4808 rs.getString(
"type_name"), rs.getString(
"display_name"),
4809 BlackboardArtifact.Category.fromID(rs.getInt(
"category_type")));
4810 this.typeIdToArtifactTypeMap.put(artTypeId, type);
4811 this.typeNameToArtifactTypeMap.put(type.getTypeName(), type);
4814 throw new TskCoreException(
"No artifact type found matching id: " + artTypeId);
4816 }
catch (SQLException ex) {
4817 throw new TskCoreException(
"Error getting artifact type from the database", ex);
4821 closeConnection(connection);
4862 CaseDbConnection connection = null;
4865 ResultSet rs = null;
4867 connection = connections.getConnection();
4868 connection.beginTransaction();
4869 s = connection.createStatement();
4870 rs = connection.executeQuery(s,
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName +
"'");
4873 rs = connection.executeQuery(s,
"SELECT MAX(artifact_type_id) AS highest_id FROM blackboard_artifact_types");
4876 maxID = rs.getInt(
"highest_id");
4877 if (maxID < MIN_USER_DEFINED_TYPE_ID) {
4878 maxID = MIN_USER_DEFINED_TYPE_ID;
4883 connection.executeUpdate(s,
"INSERT INTO blackboard_artifact_types (artifact_type_id, type_name, display_name, category_type) VALUES ('" + maxID +
"', '" + artifactTypeName +
"', '" + displayName +
"', " + category.getID() +
" )");
4884 BlackboardArtifact.Type type =
new BlackboardArtifact.Type(maxID, artifactTypeName, displayName, category);
4885 this.typeIdToArtifactTypeMap.put(type.getTypeID(), type);
4886 this.typeNameToArtifactTypeMap.put(type.getTypeName(), type);
4887 connection.commitTransaction();
4890 throw new TskDataException(
"The attribute type that was added was already within the system.");
4892 }
catch (SQLException ex) {
4893 rollbackTransaction(connection);
4894 throw new TskCoreException(
"Error adding artifact type", ex);
4898 closeConnection(connection);
4904 CaseDbConnection connection = null;
4905 Statement statement = null;
4906 ResultSet rs = null;
4909 connection = connections.getConnection();
4910 statement = connection.createStatement();
4911 rs = connection.executeQuery(statement,
"SELECT attrs.artifact_id AS artifact_id, "
4912 +
"attrs.source AS source, attrs.context AS context, attrs.attribute_type_id AS attribute_type_id, "
4913 +
"attrs.value_type AS value_type, attrs.value_byte AS value_byte, "
4914 +
"attrs.value_text AS value_text, attrs.value_int32 AS value_int32, "
4915 +
"attrs.value_int64 AS value_int64, attrs.value_double AS value_double, "
4916 +
"types.type_name AS type_name, types.display_name AS display_name "
4917 +
"FROM blackboard_attributes AS attrs, blackboard_attribute_types AS types WHERE attrs.artifact_id = " + artifact.getArtifactID()
4918 +
" AND attrs.attribute_type_id = types.attribute_type_id");
4919 ArrayList<BlackboardAttribute> attributes =
new ArrayList<BlackboardAttribute>();
4921 int attributeTypeId = rs.getInt(
"attribute_type_id");
4922 String attributeTypeName = rs.getString(
"type_name");
4924 if (this.typeIdToAttributeTypeMap.containsKey(attributeTypeId)) {
4925 attributeType = this.typeIdToAttributeTypeMap.get(attributeTypeId);
4928 rs.getString(
"display_name"),
4930 this.typeIdToAttributeTypeMap.put(attributeTypeId, attributeType);
4931 this.typeNameToAttributeTypeMap.put(attributeTypeName, attributeType);
4935 rs.getLong(
"artifact_id"),
4937 rs.getString(
"source"),
4938 rs.getString(
"context"),
4939 rs.getInt(
"value_int32"),
4940 rs.getLong(
"value_int64"),
4941 rs.getDouble(
"value_double"),
4942 rs.getString(
"value_text"),
4943 rs.getBytes(
"value_byte"), this
4945 attr.setParentDataSourceID(artifact.getDataSourceObjectID());
4946 attributes.add(attr);
4949 }
catch (SQLException ex) {
4950 throw new TskCoreException(
"Error getting attributes for artifact, artifact id = " + artifact.getArtifactID(), ex);
4953 closeStatement(statement);
4954 closeConnection(connection);
4968 ArrayList<Attribute> getFileAttributes(
final AbstractFile file)
throws TskCoreException {
4969 CaseDbConnection connection = null;
4970 Statement statement = null;
4971 ResultSet rs = null;
4974 connection = connections.getConnection();
4975 statement = connection.createStatement();
4976 rs = connection.executeQuery(statement,
"SELECT attrs.id as id, attrs.obj_id AS obj_id, "
4977 +
"attrs.attribute_type_id AS attribute_type_id, "
4978 +
"attrs.value_type AS value_type, attrs.value_byte AS value_byte, "
4979 +
"attrs.value_text AS value_text, attrs.value_int32 AS value_int32, "
4980 +
"attrs.value_int64 AS value_int64, attrs.value_double AS value_double, "
4981 +
"types.type_name AS type_name, types.display_name AS display_name "
4982 +
"FROM tsk_file_attributes AS attrs "
4983 +
" INNER JOIN blackboard_attribute_types AS types "
4984 +
" ON attrs.attribute_type_id = types.attribute_type_id "
4985 +
" WHERE attrs.obj_id = " + file.
getId());
4987 ArrayList<Attribute> attributes =
new ArrayList<Attribute>();
4989 int attributeTypeId = rs.getInt(
"attribute_type_id");
4990 String attributeTypeName = rs.getString(
"type_name");
4992 if (this.typeIdToAttributeTypeMap.containsKey(attributeTypeId)) {
4993 attributeType = this.typeIdToAttributeTypeMap.get(attributeTypeId);
4995 attributeType =
new BlackboardAttribute.
Type(attributeTypeId, attributeTypeName,
4996 rs.getString(
"display_name"),
4997 BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.fromType(rs.getInt(
"value_type")));
4998 this.typeIdToAttributeTypeMap.put(attributeTypeId, attributeType);
4999 this.typeNameToAttributeTypeMap.put(attributeTypeName, attributeType);
5002 final Attribute attr =
new Attribute(
5004 rs.getLong(
"obj_id"),
5006 rs.getInt(
"value_int32"),
5007 rs.getLong(
"value_int64"),
5008 rs.getDouble(
"value_double"),
5009 rs.getString(
"value_text"),
5010 rs.getBytes(
"value_byte"), this
5012 attributes.add(attr);
5015 }
catch (SQLException ex) {
5016 throw new TskCoreException(
"Error getting attributes for file, file id = " + file.
getId(), ex);
5019 closeStatement(statement);
5020 closeConnection(connection);
5038 CaseDbConnection connection = null;
5040 ResultSet rs = null;
5043 connection = connections.getConnection();
5044 s = connection.createStatement();
5045 rs = connection.executeQuery(s,
"SELECT blackboard_attributes.artifact_id AS artifact_id, "
5046 +
"blackboard_attributes.source AS source, blackboard_attributes.context AS context, "
5047 +
"blackboard_attributes.attribute_type_id AS attribute_type_id, "
5048 +
"blackboard_attributes.value_type AS value_type, blackboard_attributes.value_byte AS value_byte, "
5049 +
"blackboard_attributes.value_text AS value_text, blackboard_attributes.value_int32 AS value_int32, "
5050 +
"blackboard_attributes.value_int64 AS value_int64, blackboard_attributes.value_double AS value_double "
5051 +
"FROM blackboard_attributes " + whereClause);
5052 ArrayList<BlackboardAttribute> matches =
new ArrayList<BlackboardAttribute>();
5058 rs.getLong(
"artifact_id"),
5060 rs.getString(
"source"),
5061 rs.getString(
"context"),
5062 rs.getInt(
"value_int32"),
5063 rs.getLong(
"value_int64"),
5064 rs.getDouble(
"value_double"),
5065 rs.getString(
"value_text"),
5066 rs.getBytes(
"value_byte"), this
5071 }
catch (SQLException ex) {
5072 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
5076 closeConnection(connection);
5093 CaseDbConnection connection = null;
5095 ResultSet rs = null;
5098 connection = connections.getConnection();
5099 s = connection.createStatement();
5100 rs = connection.executeQuery(s,
"SELECT blackboard_artifacts.artifact_id AS artifact_id, "
5101 +
"blackboard_artifacts.obj_id AS obj_id, blackboard_artifacts.artifact_obj_id AS artifact_obj_id, blackboard_artifacts.data_source_obj_id AS data_source_obj_id, blackboard_artifacts.artifact_type_id AS artifact_type_id, "
5102 +
"blackboard_artifacts.review_status_id AS review_status_id "
5103 +
"FROM blackboard_artifacts " + whereClause);
5104 ArrayList<BlackboardArtifact> matches =
new ArrayList<BlackboardArtifact>();
5110 rs.getObject(
"data_source_obj_id") != null ? rs.getLong(
"data_source_obj_id") : null,
5111 type.getTypeID(), type.getTypeName(), type.getDisplayName(),
5113 matches.add(artifact);
5116 }
catch (SQLException ex) {
5117 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
5121 closeConnection(connection);
5144 throw new TskCoreException(
"Unknown artifact type for id: " + artifactTypeID);
5147 Category category = type.getCategory();
5148 if (category == null) {
5149 throw new TskCoreException(String.format(
"No category for %s (id: %d)",
5150 type.getDisplayName() == null ?
"<null>" : type.getDisplayName(),
5155 if (content == null) {
5156 throw new TskCoreException(
"No content found for object id: " + obj_id);
5160 case ANALYSIS_RESULT:
5162 .getAnalysisResult();
5166 throw new TskCoreException(
"Unknown category type: " + category.
getName());
5183 @SuppressWarnings(
"deprecation")
5204 @SuppressWarnings(
"deprecation")
5207 try (CaseDbConnection connection = connections.getConnection()) {
5208 return newBlackboardArtifact(artifactTypeID, obj_id, type.getTypeName(), type.getDisplayName(), data_source_obj_id, connection);
5213 private BlackboardArtifact
newBlackboardArtifact(
int artifact_type_id,
long obj_id, String artifactTypeName, String artifactDisplayName)
throws TskCoreException {
5214 try (CaseDbConnection connection = connections.getConnection()) {
5215 long data_source_obj_id = getDataSourceObjectId(connection, obj_id);
5216 return this.
newBlackboardArtifact(artifact_type_id, obj_id, artifactTypeName, artifactDisplayName, data_source_obj_id, connection);
5220 PreparedStatement createInsertArtifactStatement(
int artifact_type_id,
long obj_id,
long artifact_obj_id,
long data_source_obj_id, CaseDbConnection connection)
throws TskCoreException, SQLException {
5222 PreparedStatement statement;
5224 statement = connection.getPreparedStatement(PREPARED_STATEMENT.POSTGRESQL_INSERT_ARTIFACT, Statement.RETURN_GENERATED_KEYS);
5225 statement.clearParameters();
5226 statement.setLong(1, obj_id);
5227 statement.setLong(2, artifact_obj_id);
5228 statement.setLong(3, data_source_obj_id);
5229 statement.setInt(4, artifact_type_id);
5231 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_ARTIFACT, Statement.RETURN_GENERATED_KEYS);
5232 statement.clearParameters();
5233 this.nextArtifactId++;
5234 statement.setLong(1, this.nextArtifactId);
5235 statement.setLong(2, obj_id);
5236 statement.setLong(3, artifact_obj_id);
5237 statement.setLong(4, data_source_obj_id);
5238 statement.setInt(5, artifact_type_id);
5245 BlackboardArtifact
newBlackboardArtifact(
int artifact_type_id,
long obj_id, String artifactTypeName, String artifactDisplayName,
long data_source_obj_id, CaseDbConnection connection)
throws TskCoreException {
5248 long artifact_obj_id = addObject(obj_id, TskData.ObjectType.ARTIFACT.getObjectType(), connection);
5249 PreparedStatement statement = createInsertArtifactStatement(artifact_type_id, obj_id, artifact_obj_id, data_source_obj_id, connection);
5251 connection.executeUpdate(statement);
5252 try (ResultSet resultSet = statement.getGeneratedKeys()) {
5254 return new BlackboardArtifact(
this, resultSet.getLong(1),
5255 obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, artifactTypeName, artifactDisplayName, BlackboardArtifact.ReviewStatus.UNDECIDED,
true);
5257 }
catch (SQLException ex) {
5258 throw new TskCoreException(
"Error creating a blackboard artifact", ex);
5282 AnalysisResult newAnalysisResult(BlackboardArtifact.Type artifactType,
long objId, Long dataSourceObjId, Score score, String conclusion, String configuration, String justification, CaseDbConnection connection)
throws TskCoreException {
5284 if (artifactType.getCategory() != BlackboardArtifact.Category.ANALYSIS_RESULT) {
5285 throw new TskCoreException(String.format(
"Artifact type (name = %s) is not of the AnalysisResult category. ", artifactType.getTypeName()));
5292 long artifactObjId = addObject(objId, TskData.ObjectType.ARTIFACT.getObjectType(), connection);
5295 PreparedStatement insertArtifactstatement;
5296 ResultSet resultSet = null;
5298 insertArtifactstatement = createInsertArtifactStatement(artifactType.getTypeID(), objId, artifactObjId, dataSourceObjId, connection);
5299 connection.executeUpdate(insertArtifactstatement);
5300 resultSet = insertArtifactstatement.getGeneratedKeys();
5302 artifactID = resultSet.getLong(1);
5305 if (score.getSignificance() != Score.Significance.UNKNOWN
5306 || !StringUtils.isBlank(conclusion)
5307 || !StringUtils.isBlank(configuration)
5308 || !StringUtils.isBlank(justification)) {
5310 PreparedStatement analysisResultsStatement;
5312 analysisResultsStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_ANALYSIS_RESULT);
5313 analysisResultsStatement.clearParameters();
5315 analysisResultsStatement.setLong(1, artifactObjId);
5316 analysisResultsStatement.setString(2, (conclusion != null) ? conclusion :
"");
5317 analysisResultsStatement.setInt(3, score.getSignificance().getId());
5318 analysisResultsStatement.setInt(4, score.getPriority().getId());
5319 analysisResultsStatement.setString(5, (configuration != null) ? configuration :
"");
5320 analysisResultsStatement.setString(6, (justification != null) ? justification :
"");
5322 connection.executeUpdate(analysisResultsStatement);
5325 return new AnalysisResult(
this, artifactID, objId, artifactObjId, dataSourceObjId, artifactType.getTypeID(),
5326 artifactType.getTypeName(), artifactType.getDisplayName(),
5327 BlackboardArtifact.ReviewStatus.UNDECIDED,
true,
5328 score, (conclusion != null) ? conclusion :
"",
5329 (configuration != null) ? configuration :
"", (justification != null) ? justification :
"");
5332 closeResultSet(resultSet);
5335 }
catch (SQLException ex) {
5336 throw new TskCoreException(
"Error creating a analysis result", ex);
5354 boolean getContentHasChildren(Content content)
throws TskCoreException {
5355 CaseDbConnection connection = null;
5356 ResultSet rs = null;
5359 connection = connections.getConnection();
5362 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
5363 statement.clearParameters();
5364 statement.setLong(1, content.getId());
5365 rs = connection.executeQuery(statement);
5366 boolean hasChildren =
false;
5368 hasChildren = rs.getInt(
"count") > 0;
5371 }
catch (SQLException e) {
5372 throw new TskCoreException(
"Error checking for children of parent " + content, e);
5375 closeConnection(connection);
5392 int getContentChildrenCount(Content content)
throws TskCoreException {
5394 if (!this.getHasChildren(content)) {
5398 CaseDbConnection connection = null;
5399 ResultSet rs = null;
5402 connection = connections.getConnection();
5405 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
5406 statement.clearParameters();
5407 statement.setLong(1, content.getId());
5408 rs = connection.executeQuery(statement);
5409 int countChildren = -1;
5411 countChildren = rs.getInt(
"count");
5413 return countChildren;
5414 }
catch (SQLException e) {
5415 throw new TskCoreException(
"Error checking for children of parent " + content, e);
5418 closeConnection(connection);
5434 List<Content> getAbstractFileChildren(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
5435 CaseDbConnection connection = null;
5436 ResultSet rs = null;
5439 connection = connections.getConnection();
5441 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT_AND_TYPE);
5442 statement.clearParameters();
5443 long parentId = parent.getId();
5444 statement.setLong(1, parentId);
5445 statement.setShort(2, type.getFileType());
5446 rs = connection.executeQuery(statement);
5447 return fileChildren(rs, connection, parentId);
5448 }
catch (SQLException ex) {
5449 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
5452 closeConnection(connection);
5466 List<Content> getAbstractFileChildren(Content parent)
throws TskCoreException {
5467 CaseDbConnection connection = null;
5468 ResultSet rs = null;
5471 connection = connections.getConnection();
5473 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT);
5474 statement.clearParameters();
5475 long parentId = parent.getId();
5476 statement.setLong(1, parentId);
5477 rs = connection.executeQuery(statement);
5478 return fileChildren(rs, connection, parentId);
5479 }
catch (SQLException ex) {
5480 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
5483 closeConnection(connection);
5499 List<Long> getAbstractFileChildrenIds(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
5500 CaseDbConnection connection = null;
5501 ResultSet rs = null;
5504 connection = connections.getConnection();
5506 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT_AND_TYPE);
5507 statement.clearParameters();
5508 statement.setLong(1, parent.getId());
5509 statement.setShort(2, type.getFileType());
5510 rs = connection.executeQuery(statement);
5511 List<Long> children =
new ArrayList<Long>();
5513 children.add(rs.getLong(
"obj_id"));
5516 }
catch (SQLException ex) {
5517 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
5520 closeConnection(connection);
5534 List<Long> getAbstractFileChildrenIds(Content parent)
throws TskCoreException {
5535 CaseDbConnection connection = null;
5536 ResultSet rs = null;
5539 connection = connections.getConnection();
5541 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT);
5542 statement.clearParameters();
5543 statement.setLong(1, parent.getId());
5544 rs = connection.executeQuery(statement);
5545 List<Long> children =
new ArrayList<Long>();
5547 children.add(rs.getLong(
"obj_id"));
5550 }
catch (SQLException ex) {
5551 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
5554 closeConnection(connection);
5569 List<Long> getBlackboardArtifactChildrenIds(Content parent)
throws TskCoreException {
5570 CaseDbConnection connection = null;
5571 ResultSet rs = null;
5574 connection = connections.getConnection();
5576 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_OBJECTIDS_BY_PARENT);
5577 statement.clearParameters();
5578 statement.setLong(1, parent.getId());
5579 rs = connection.executeQuery(statement);
5580 List<Long> children =
new ArrayList<Long>();
5582 children.add(rs.getLong(
"obj_id"));
5585 }
catch (SQLException ex) {
5586 throw new TskCoreException(
"Error getting children for BlackboardArtifact", ex);
5589 closeConnection(connection);
5603 List<Content> getBlackboardArtifactChildren(Content parent)
throws TskCoreException {
5605 long parentId = parent.getId();
5606 ArrayList<BlackboardArtifact> artsArray = getArtifactsHelper(
"blackboard_artifacts.obj_id = " + parentId +
";");
5608 List<Content> lc =
new ArrayList<Content>();
5609 lc.addAll(artsArray);
5621 Collection<ObjectInfo> getChildrenInfo(Content c)
throws TskCoreException {
5622 CaseDbConnection connection = null;
5624 ResultSet rs = null;
5627 connection = connections.getConnection();
5628 s = connection.createStatement();
5629 rs = connection.executeQuery(s,
"SELECT tsk_objects.obj_id AS obj_id, tsk_objects.type AS type "
5630 +
"FROM tsk_objects LEFT JOIN tsk_files "
5631 +
"ON tsk_objects.obj_id = tsk_files.obj_id "
5632 +
"WHERE tsk_objects.par_obj_id = " + c.getId()
5633 +
" ORDER BY tsk_objects.obj_id");
5634 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
5636 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type"))));
5639 }
catch (SQLException ex) {
5640 throw new TskCoreException(
"Error getting Children Info for Content", ex);
5644 closeConnection(connection);
5659 ObjectInfo getParentInfo(Content c)
throws TskCoreException {
5660 return getParentInfo(c.getId());
5673 ObjectInfo getParentInfo(
long contentId)
throws TskCoreException {
5675 CaseDbConnection connection = null;
5677 ResultSet rs = null;
5679 connection = connections.getConnection();
5680 s = connection.createStatement();
5681 rs = connection.executeQuery(s,
"SELECT parent.obj_id AS obj_id, parent.type AS type "
5682 +
"FROM tsk_objects AS parent INNER JOIN tsk_objects AS child "
5683 +
"ON child.par_obj_id = parent.obj_id "
5684 +
"WHERE child.obj_id = " + contentId);
5686 return new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type")));
5690 }
catch (SQLException ex) {
5691 throw new TskCoreException(
"Error getting Parent Info for Content: " + contentId, ex);
5695 closeConnection(connection);
5710 Directory getParentDirectory(FsContent fsc)
throws TskCoreException {
5715 ObjectInfo parentInfo = getParentInfo(fsc);
5716 if (parentInfo == null) {
5719 Directory parent = null;
5720 if (parentInfo.type == ObjectType.ABSTRACTFILE) {
5721 parent = getDirectoryById(parentInfo.id, fsc.getFileSystem());
5723 throw new TskCoreException(
"Parent of FsContent (id: " + fsc.getId() +
") has wrong type to be directory: " + parentInfo.type);
5742 Content content = frequentlyUsedContentMap.get(
id);
5743 if (null != content) {
5750 CaseDbConnection connection = null;
5752 ResultSet rs = null;
5755 connection = connections.getConnection();
5756 s = connection.createStatement();
5757 rs = connection.executeQuery(s,
"SELECT * FROM tsk_objects WHERE obj_id = " +
id +
" LIMIT 1");
5761 parentId = rs.getLong(
"par_obj_id");
5763 }
catch (SQLException ex) {
5764 throw new TskCoreException(
"Error getting Content by ID.", ex);
5768 closeConnection(connection);
5776 frequentlyUsedContentMap.put(
id, content);
5779 content = getVolumeSystemById(
id, parentId);
5782 content = getVolumeById(
id, parentId);
5783 frequentlyUsedContentMap.put(
id, content);
5786 content = getPoolById(
id, parentId);
5789 content = getFileSystemById(
id, parentId);
5790 frequentlyUsedContentMap.put(
id, content);
5801 frequentlyUsedContentMap.put(
id, content);
5830 String getFilePath(
long id) {
5832 String filePath = null;
5833 CaseDbConnection connection = null;
5834 ResultSet rs = null;
5837 connection = connections.getConnection();
5839 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_FOR_FILE);
5840 statement.clearParameters();
5841 statement.setLong(1,
id);
5842 rs = connection.executeQuery(statement);
5844 filePath = rs.getString(
"path");
5846 }
catch (SQLException | TskCoreException ex) {
5847 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
5850 closeConnection(connection);
5863 TskData.EncodingType getEncodingType(
long id) {
5865 TskData.EncodingType type = TskData.EncodingType.NONE;
5866 CaseDbConnection connection = null;
5867 ResultSet rs = null;
5870 connection = connections.getConnection();
5871 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ENCODING_FOR_FILE);
5872 statement.clearParameters();
5873 statement.setLong(1,
id);
5874 rs = connection.executeQuery(statement);
5876 type = TskData.EncodingType.valueOf(rs.getInt(1));
5878 }
catch (SQLException | TskCoreException ex) {
5879 logger.log(Level.SEVERE,
"Error getting encoding type for file " +
id, ex);
5882 closeConnection(connection);
5896 String getFileParentPath(
long objectId, CaseDbConnection connection) {
5897 String parentPath = null;
5899 ResultSet rs = null;
5901 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_PATH_FOR_FILE);
5902 statement.clearParameters();
5903 statement.setLong(1, objectId);
5904 rs = connection.executeQuery(statement);
5906 parentPath = rs.getString(
"parent_path");
5908 }
catch (SQLException ex) {
5909 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
5925 String getFileName(
long objectId, CaseDbConnection connection) {
5926 String fileName = null;
5928 ResultSet rs = null;
5930 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_NAME);
5931 statement.clearParameters();
5932 statement.setLong(1, objectId);
5933 rs = connection.executeQuery(statement);
5935 fileName = rs.getString(
"name");
5937 }
catch (SQLException ex) {
5938 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
5956 DerivedFile.DerivedMethod getDerivedMethod(
long id)
throws TskCoreException {
5958 DerivedFile.DerivedMethod method = null;
5959 CaseDbConnection connection = null;
5960 ResultSet rs1 = null;
5961 ResultSet rs2 = null;
5964 connection = connections.getConnection();
5966 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_DERIVED_FILE);
5967 statement.clearParameters();
5968 statement.setLong(1,
id);
5969 rs1 = connection.executeQuery(statement);
5971 int method_id = rs1.getInt(
"derived_id");
5972 String rederive = rs1.getString(
"rederive");
5973 method =
new DerivedFile.DerivedMethod(method_id, rederive);
5974 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_DERIVATION_METHOD);
5975 statement.clearParameters();
5976 statement.setInt(1, method_id);
5977 rs2 = connection.executeQuery(statement);
5979 method.setToolName(rs2.getString(
"tool_name"));
5980 method.setToolVersion(rs2.getString(
"tool_version"));
5981 method.setOther(rs2.getString(
"other"));
5984 }
catch (SQLException e) {
5985 logger.log(Level.SEVERE,
"Error getting derived method for file: " +
id, e);
5987 closeResultSet(rs2);
5988 closeResultSet(rs1);
5989 closeConnection(connection);
6006 CaseDbConnection connection = connections.getConnection();
6010 closeConnection(connection);
6028 ResultSet rs = null;
6030 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_BY_ID);
6031 statement.clearParameters();
6032 statement.setLong(1, objectId);
6033 rs = connection.executeQuery(statement);
6034 List<AbstractFile> files = resultSetToAbstractFiles(rs, connection);
6035 if (files.size() > 0) {
6036 return files.get(0);
6040 }
catch (SQLException ex) {
6041 throw new TskCoreException(
"Error getting file by id, id = " + objectId, ex);
6061 CaseDbConnection connection = null;
6062 ResultSet rs = null;
6065 connection = connections.getConnection();
6068 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TYPE_BY_ARTIFACT_OBJ_ID);
6069 statement.clearParameters();
6070 statement.setLong(1,
id);
6072 rs = connection.executeQuery(statement);
6074 throw new TskCoreException(
"Error getting artifacttype for artifact with artifact_obj_id = " +
id);
6079 switch (artifactType.getCategory()) {
6080 case ANALYSIS_RESULT:
6085 throw new TskCoreException(String.format(
"Unknown artifact category for artifact with artifact_obj_id = %d, and artifact type = %s",
id, artifactType.getTypeName()));
6088 }
catch (SQLException ex) {
6089 throw new TskCoreException(
"Error getting artifacts by artifact_obj_id, artifact_obj_id = " +
id, ex);
6092 closeConnection(connection);
6108 CaseDbConnection connection = null;
6109 ResultSet rs = null;
6112 connection = connections.getConnection();
6114 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_BY_ARTIFACT_ID);
6115 statement.clearParameters();
6116 statement.setLong(1,
id);
6117 rs = connection.executeQuery(statement);
6118 List<BlackboardArtifact> artifacts = resultSetToArtifacts(rs);
6119 if (artifacts.size() > 0) {
6120 return artifacts.get(0);
6124 }
catch (SQLException ex) {
6125 throw new TskCoreException(
"Error getting artifacts by artifact id, artifact id = " +
id, ex);
6128 closeConnection(connection);
6145 private long getFileSystemId(
long fileId, CaseDbConnection connection) {
6147 ResultSet rs = null;
6150 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_SYSTEM_BY_OBJECT);
6151 statement.clearParameters();
6152 statement.setLong(1, fileId);
6153 rs = connection.executeQuery(statement);
6155 ret = rs.getLong(
"fs_obj_id");
6160 }
catch (SQLException e) {
6161 logger.log(Level.SEVERE,
"Error checking file system id of a file, id = " + fileId, e);
6181 String query = String.format(
"SELECT COUNT(*) AS count FROM tsk_files WHERE obj_id = %d AND data_source_obj_id = %d", fileId, dataSource.getId());
6182 CaseDbConnection connection = null;
6183 Statement statement = null;
6184 ResultSet resultSet = null;
6187 connection = connections.getConnection();
6188 statement = connection.createStatement();
6189 resultSet = connection.executeQuery(statement, query);
6191 return (resultSet.getLong(
"count") > 0L);
6192 }
catch (SQLException ex) {
6193 throw new TskCoreException(String.format(
"Error executing query %s", query), ex);
6195 closeResultSet(resultSet);
6196 closeStatement(statement);
6197 closeConnection(connection);
6210 private static boolean containsLikeWildcard(String str) {
6214 return str.contains(
"%") || str.contains(
"_");
6229 public List<AbstractFile>
findFiles(
Content dataSource, String fileName)
throws TskCoreException {
6231 if (!containsLikeWildcard(fileName)) {
6235 List<AbstractFile> files =
new ArrayList<>();
6236 CaseDbConnection connection = null;
6237 ResultSet resultSet = null;
6240 connection = connections.getConnection();
6242 PreparedStatement statement;
6243 if (ext.isEmpty()) {
6244 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_NAME);
6245 statement.clearParameters();
6246 statement.setString(1, fileName.toLowerCase());
6247 statement.setLong(2, dataSource.getId());
6249 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_EXTENSION_AND_DATA_SOURCE_AND_NAME);
6250 statement.clearParameters();
6251 statement.setString(1, ext);
6252 statement.setString(2, fileName.toLowerCase());
6253 statement.setLong(3, dataSource.getId());
6256 resultSet = connection.executeQuery(statement);
6257 files.addAll(resultSetToAbstractFiles(resultSet, connection));
6258 }
catch (SQLException e) {
6259 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles.exception.msg3.text"), e);
6261 closeResultSet(resultSet);
6262 closeConnection(connection);
6281 public List<AbstractFile>
findFiles(
Content dataSource, String fileName, String dirSubString)
throws TskCoreException {
6283 if (!containsLikeWildcard(fileName)) {
6287 List<AbstractFile> files =
new ArrayList<>();
6288 CaseDbConnection connection = null;
6289 ResultSet resultSet = null;
6292 connection = connections.getConnection();
6293 PreparedStatement statement;
6294 if (ext.isEmpty()) {
6295 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME);
6296 statement.clearParameters();
6297 statement.setString(1, fileName.toLowerCase());
6298 statement.setString(2,
"%" + dirSubString.toLowerCase() +
"%");
6299 statement.setLong(3, dataSource.getId());
6301 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_EXTENSION_AND_DATA_SOURCE_AND_PARENT_PATH_AND_NAME);
6302 statement.clearParameters();
6303 statement.setString(1, ext);
6304 statement.setString(2, fileName.toLowerCase());
6305 statement.setString(3,
"%" + dirSubString.toLowerCase() +
"%");
6306 statement.setLong(4, dataSource.getId());
6309 resultSet = connection.executeQuery(statement);
6310 files.addAll(resultSetToAbstractFiles(resultSet, connection));
6311 }
catch (SQLException e) {
6312 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles3.exception.msg3.text"), e);
6314 closeResultSet(resultSet);
6315 closeConnection(connection);
6340 if (null != localTrans) {
6343 }
catch (TskCoreException ex2) {
6344 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6362 long addObject(
long parentId,
int objectType, CaseDbConnection connection)
throws SQLException {
6363 ResultSet resultSet = null;
6367 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OBJECT, Statement.RETURN_GENERATED_KEYS);
6368 statement.clearParameters();
6369 if (parentId != 0) {
6370 statement.setLong(1, parentId);
6372 statement.setNull(1, java.sql.Types.BIGINT);
6374 statement.setInt(2, objectType);
6375 connection.executeUpdate(statement);
6376 resultSet = statement.getGeneratedKeys();
6378 if (resultSet.next()) {
6379 if (parentId != 0) {
6380 setHasChildren(parentId);
6382 return resultSet.getLong(1);
6384 throw new SQLException(
"Error inserting object with parent " + parentId +
" into tsk_objects");
6387 closeResultSet(resultSet);
6410 if (transaction == null) {
6411 throw new TskCoreException(
"Passed null CaseDbTransaction");
6414 ResultSet resultSet = null;
6417 CaseDbConnection connection = transaction.getConnection();
6422 if (isRootDirectory((AbstractFile) parent, transaction)) {
6425 parentPath = ((AbstractFile) parent).getParentPath() + parent.
getName() +
"/";
6439 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6440 statement.clearParameters();
6441 statement.setLong(1, newObjId);
6444 if (0 != parentId) {
6445 long parentFs = this.getFileSystemId(parentId, connection);
6446 if (parentFs != -1) {
6447 statement.setLong(2, parentFs);
6449 statement.setNull(2, java.sql.Types.BIGINT);
6452 statement.setNull(2, java.sql.Types.BIGINT);
6456 statement.setString(3, directoryName);
6460 statement.setShort(5, (
short) 1);
6464 statement.setShort(6, dirType.
getValue());
6466 statement.setShort(7, metaType.
getValue());
6470 statement.setShort(8, dirFlag.
getValue());
6473 statement.setShort(9, metaFlags);
6476 statement.setLong(10, 0);
6479 statement.setNull(11, java.sql.Types.BIGINT);
6480 statement.setNull(12, java.sql.Types.BIGINT);
6481 statement.setNull(13, java.sql.Types.BIGINT);
6482 statement.setNull(14, java.sql.Types.BIGINT);
6484 statement.setNull(15, java.sql.Types.VARCHAR);
6485 statement.setNull(16, java.sql.Types.VARCHAR);
6487 statement.setNull(18, java.sql.Types.VARCHAR);
6490 statement.setString(19, parentPath);
6493 long dataSourceObjectId;
6494 if (0 == parentId) {
6495 dataSourceObjectId = newObjId;
6497 dataSourceObjectId = getDataSourceObjectId(connection, parentId);
6499 statement.setLong(20, dataSourceObjectId);
6502 statement.setString(21, null);
6504 statement.setString(22,
OsAccount.NO_OWNER_ID);
6505 statement.setNull(23, java.sql.Types.BIGINT);
6507 connection.executeUpdate(statement);
6509 return new VirtualDirectory(
this, newObjId, dataSourceObjectId, directoryName, dirType,
6512 }
catch (SQLException e) {
6513 throw new TskCoreException(
"Error creating virtual directory '" + directoryName +
"'", e);
6515 closeResultSet(resultSet);
6537 }
catch (TskCoreException ex) {
6540 }
catch (TskCoreException ex2) {
6541 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
6565 if (transaction == null) {
6566 throw new TskCoreException(
"Passed null CaseDbTransaction");
6569 ResultSet resultSet = null;
6572 CaseDbConnection connection = transaction.getConnection();
6575 if ((parent == null) || isRootDirectory(parent, transaction)) {
6588 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6589 statement.clearParameters();
6590 statement.setLong(1, newObjId);
6593 statement.setNull(2, java.sql.Types.BIGINT);
6596 statement.setString(3, directoryName);
6600 statement.setShort(5, (
short) 1);
6604 statement.setShort(6, dirType.
getValue());
6606 statement.setShort(7, metaType.
getValue());
6610 statement.setShort(8, dirFlag.
getValue());
6613 statement.setShort(9, metaFlags);
6616 statement.setLong(10, 0);
6619 statement.setNull(11, java.sql.Types.BIGINT);
6620 statement.setNull(12, java.sql.Types.BIGINT);
6621 statement.setNull(13, java.sql.Types.BIGINT);
6622 statement.setNull(14, java.sql.Types.BIGINT);
6624 statement.setNull(15, java.sql.Types.VARCHAR);
6625 statement.setNull(16, java.sql.Types.VARCHAR);
6627 statement.setNull(18, java.sql.Types.VARCHAR);
6630 statement.setString(19, parentPath);
6633 long dataSourceObjectId = getDataSourceObjectId(connection, parentId);
6634 statement.setLong(20, dataSourceObjectId);
6637 statement.setString(21, null);
6639 statement.setString(22,
OsAccount.NO_OWNER_ID);
6640 statement.setNull(23, java.sql.Types.BIGINT);
6642 connection.executeUpdate(statement);
6644 return new LocalDirectory(
this, newObjId, dataSourceObjectId, directoryName, dirType,
6647 }
catch (SQLException e) {
6648 throw new TskCoreException(
"Error creating local directory '" + directoryName +
"'", e);
6650 closeResultSet(resultSet);
6699 Statement statement = null;
6701 CaseDbConnection connection = transaction.getConnection();
6714 statement = connection.createStatement();
6715 statement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone, host_id) "
6716 +
"VALUES(" + newObjId +
", '" + deviceId +
"', '" + timeZone +
"', " + host.getHostId() +
");");
6725 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6726 preparedStatement.clearParameters();
6727 preparedStatement.setLong(1, newObjId);
6728 preparedStatement.setNull(2, java.sql.Types.BIGINT);
6729 preparedStatement.setString(3, rootDirectoryName);
6731 preparedStatement.setShort(5, (
short) 1);
6735 preparedStatement.setShort(7, metaType.
getValue());
6737 preparedStatement.setShort(8, dirFlag.
getValue());
6740 preparedStatement.setShort(9, metaFlags);
6741 preparedStatement.setLong(10, 0);
6742 preparedStatement.setNull(11, java.sql.Types.BIGINT);
6743 preparedStatement.setNull(12, java.sql.Types.BIGINT);
6744 preparedStatement.setNull(13, java.sql.Types.BIGINT);
6745 preparedStatement.setNull(14, java.sql.Types.BIGINT);
6746 preparedStatement.setNull(15, java.sql.Types.VARCHAR);
6747 preparedStatement.setNull(16, java.sql.Types.VARCHAR);
6749 preparedStatement.setNull(18, java.sql.Types.VARCHAR);
6750 String parentPath =
"/";
6751 preparedStatement.setString(19, parentPath);
6752 preparedStatement.setLong(20, newObjId);
6753 preparedStatement.setString(21, null);
6754 preparedStatement.setString(22,
OsAccount.NO_OWNER_ID);
6755 preparedStatement.setNull(23, java.sql.Types.BIGINT);
6756 connection.executeUpdate(preparedStatement);
6758 return new LocalFilesDataSource(
this, newObjId, newObjId, deviceId, rootDirectoryName, dirType, metaType, dirFlag, metaFlags, timeZone, null, null,
FileKnown.
UNKNOWN, parentPath);
6760 }
catch (SQLException ex) {
6761 throw new TskCoreException(String.format(
"Error creating local files data source with device id %s and directory name %s", deviceId, rootDirectoryName), ex);
6763 closeStatement(statement);
6787 String timezone, String md5, String sha1, String sha256,
6790 return addImage(type, sectorSize, size, displayName, imagePaths, timezone, md5, sha1, sha256, deviceId, null, transaction);
6814 String timezone, String md5, String sha1, String sha256,
6815 String deviceId,
Host host,
6817 Statement statement = null;
6820 CaseDbConnection connection = transaction.getConnection();
6825 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_INFO);
6826 preparedStatement.clearParameters();
6827 preparedStatement.setLong(1, newObjId);
6828 preparedStatement.setShort(2, (
short) type.getValue());
6829 preparedStatement.setLong(3, sectorSize);
6830 preparedStatement.setString(4, timezone);
6832 long savedSize = size < 0 ? 0 : size;
6833 preparedStatement.setLong(5, savedSize);
6834 preparedStatement.setString(6, md5);
6835 preparedStatement.setString(7, sha1);
6836 preparedStatement.setString(8, sha256);
6837 preparedStatement.setString(9, displayName);
6838 connection.executeUpdate(preparedStatement);
6841 for (
int i = 0; i < imagePaths.size(); i++) {
6842 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
6843 preparedStatement.clearParameters();
6844 preparedStatement.setLong(1, newObjId);
6845 preparedStatement.setString(2, imagePaths.get(i));
6846 preparedStatement.setLong(3, i);
6847 connection.executeUpdate(preparedStatement);
6851 String name = displayName;
6852 if (name == null || name.isEmpty()) {
6853 if (imagePaths.size() > 0) {
6854 String path = imagePaths.get(0);
6855 name = (
new java.io.File(path)).getName();
6863 if (name.isEmpty()) {
6871 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DATA_SOURCE_INFO);
6872 statement = connection.createStatement();
6873 preparedStatement.setLong(1, newObjId);
6874 preparedStatement.setString(2, deviceId);
6875 preparedStatement.setString(3, timezone);
6876 preparedStatement.setLong(4,
new Date().getTime());
6877 preparedStatement.setLong(5, host.getHostId());
6878 connection.executeUpdate(preparedStatement);
6881 return new Image(
this, newObjId, type.getValue(), deviceId, sectorSize, name,
6882 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, savedSize);
6883 }
catch (SQLException ex) {
6884 if (!imagePaths.isEmpty()) {
6885 throw new TskCoreException(String.format(
"Error adding image with path %s to database", imagePaths.get(0)), ex);
6887 throw new TskCoreException(String.format(
"Error adding image with display name %s to database", displayName), ex);
6890 closeStatement(statement);
6911 CaseDbConnection connection = transaction.getConnection();
6912 long newObjId = addObject(parentObjId,
TskData.
ObjectType.
VS.getObjectType(), connection);
6916 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_INFO);
6917 preparedStatement.clearParameters();
6918 preparedStatement.setLong(1, newObjId);
6919 preparedStatement.setShort(2, (
short) type.getVsType());
6920 preparedStatement.setLong(3, imgOffset);
6921 preparedStatement.setLong(4, blockSize);
6922 connection.executeUpdate(preparedStatement);
6925 return new VolumeSystem(
this, newObjId,
"", type.getVsType(), imgOffset, blockSize);
6926 }
catch (SQLException ex) {
6927 throw new TskCoreException(String.format(
"Error creating volume system with parent ID %d and image offset %d",
6928 parentObjId, imgOffset), ex);
6947 public Volume addVolume(
long parentObjId,
long addr,
long start,
long length, String desc,
6951 CaseDbConnection connection = transaction.getConnection();
6956 PreparedStatement preparedStatement;
6958 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_PART_POSTGRESQL);
6960 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_PART_SQLITE);
6962 preparedStatement.clearParameters();
6963 preparedStatement.setLong(1, newObjId);
6964 preparedStatement.setLong(2, addr);
6965 preparedStatement.setLong(3, start);
6966 preparedStatement.setLong(4, length);
6967 preparedStatement.setString(5, desc);
6968 preparedStatement.setShort(6, (
short) flags);
6969 connection.executeUpdate(preparedStatement);
6972 return new Volume(
this, newObjId, addr, start, length, flags, desc);
6973 }
catch (SQLException ex) {
6974 throw new TskCoreException(String.format(
"Error creating volume with address %d and parent ID %d", addr, parentObjId), ex);
6992 CaseDbConnection connection = transaction.getConnection();
6997 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_POOL_INFO);
6998 preparedStatement.clearParameters();
6999 preparedStatement.setLong(1, newObjId);
7000 preparedStatement.setShort(2, type.getValue());
7001 connection.executeUpdate(preparedStatement);
7004 return new Pool(
this, newObjId, type.getName(), type.getValue());
7005 }
catch (SQLException ex) {
7006 throw new TskCoreException(String.format(
"Error creating pool with type %d and parent ID %d", type.getValue(), parentObjId), ex);
7029 long rootInum,
long firstInum,
long lastInum, String displayName,
7033 CaseDbConnection connection = transaction.getConnection();
7034 long newObjId = addObject(parentObjId,
TskData.
ObjectType.
FS.getObjectType(), connection);
7037 long dataSourceId = getDataSourceObjectId(connection, newObjId);
7041 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FS_INFO);
7042 preparedStatement.clearParameters();
7043 preparedStatement.setLong(1, newObjId);
7044 preparedStatement.setLong(2, dataSourceId);
7045 preparedStatement.setLong(3, imgOffset);
7046 preparedStatement.setInt(4, type.getValue());
7047 preparedStatement.setLong(5, blockSize);
7048 preparedStatement.setLong(6, blockCount);
7049 preparedStatement.setLong(7, rootInum);
7050 preparedStatement.setLong(8, firstInum);
7051 preparedStatement.setLong(9, lastInum);
7052 preparedStatement.setString(10, displayName);
7053 connection.executeUpdate(preparedStatement);
7056 return new FileSystem(
this, newObjId, displayName, imgOffset, type, blockSize, blockCount, rootInum,
7057 firstInum, lastInum);
7058 }
catch (SQLException ex) {
7059 throw new TskCoreException(String.format(
"Error creating file system with image offset %d and parent ID %d",
7060 imgOffset, parentObjId), ex);
7091 long metaAddr,
int metaSeq,
7094 long ctime,
long crtime,
long atime,
long mtime,
7095 boolean isFile,
Content parent)
throws TskCoreException {
7101 metaAddr, metaSeq, attrType, attrId, dirFlag, metaFlags, size,
7102 ctime, crtime, atime, mtime, null, null, null, isFile, parent,
7104 Collections.emptyList(), transaction);
7108 return fileSystemFile;
7110 if (null != transaction) {
7113 }
catch (TskCoreException ex2) {
7114 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
7159 long metaAddr,
int metaSeq,
7162 long ctime,
long crtime,
long atime,
long mtime,
7163 String md5Hash, String sha256Hash, String mimeType,
7164 boolean isFile,
Content parent, String ownerUid,
7165 OsAccount osAccount, List<Attribute> fileAttributes,
7170 Statement queryStatement = null;
7171 String parentPath =
"/";
7173 CaseDbConnection connection = transaction.getConnection();
7180 AbstractFile parentFile = (AbstractFile) parent;
7181 if (isRootDirectory(parentFile, transaction)) {
7184 parentPath = parentFile.
getParentPath() + parent.getName() +
"/";
7190 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE_SYSTEM_FILE);
7191 statement.clearParameters();
7192 statement.setLong(1, objectId);
7193 statement.setLong(2, fsObjId);
7194 statement.setLong(3, dataSourceObjId);
7195 statement.setShort(4, (
short) attrType.getValue());
7196 statement.setInt(5, attrId);
7197 statement.setString(6, fileName);
7198 statement.setLong(7, metaAddr);
7199 statement.setInt(8, metaSeq);
7201 statement.setShort(10, (
short) 1);
7203 statement.setShort(11, dirType.
getValue());
7205 statement.setShort(12, metaType.
getValue());
7206 statement.setShort(13, dirFlag.getValue());
7207 statement.setShort(14, metaFlags);
7208 statement.setLong(15, size < 0 ? 0 : size);
7209 statement.setLong(16, ctime);
7210 statement.setLong(17, crtime);
7211 statement.setLong(18, atime);
7212 statement.setLong(19, mtime);
7213 statement.setString(20, md5Hash);
7214 statement.setString(21, sha256Hash);
7215 statement.setString(22, mimeType);
7216 statement.setString(23, parentPath);
7217 final String extension = extractExtension(fileName);
7218 statement.setString(24, extension);
7219 statement.setString(25, ownerUid);
7220 if (null != osAccount) {
7221 statement.setLong(26, osAccount.getId());
7223 statement.setNull(26, java.sql.Types.BIGINT);
7226 connection.executeUpdate(statement);
7228 Long osAccountId = (osAccount != null) ? osAccount.getId() : null;
7229 DerivedFile derivedFile =
new DerivedFile(
this, objectId, dataSourceObjId, fileName, dirType, metaType, dirFlag, metaFlags,
7230 size, ctime, crtime, atime, mtime, md5Hash, sha256Hash, null, parentPath, null, parent.getId(), mimeType, null, extension, ownerUid, osAccountId);
7232 timelineManager.addEventsForNewFile(derivedFile, connection);
7234 for (
Attribute fileAttribute : fileAttributes) {
7235 fileAttribute.setAttributeParentId(objectId);
7236 fileAttribute.setCaseDatabase(
this);
7237 addFileAttribute(fileAttribute, connection);
7240 if (osAccount != null) {
7245 attrType, attrId, fileName, metaAddr, metaSeq,
7246 dirType, metaType, dirFlag, metaFlags,
7247 size, ctime, crtime, atime, mtime,
7248 (
short) 0, 0, 0, md5Hash, sha256Hash, null, parentPath, mimeType,
7249 extension, ownerUid, osAccountId, fileAttributes);
7251 }
catch (SQLException ex) {
7252 throw new TskCoreException(String.format(
"Failed to INSERT file system file %s (%s) with parent id %d in tsk_files table", fileName, parentPath, parent.getId()), ex);
7254 closeStatement(queryStatement);
7267 CaseDbConnection connection = null;
7269 ResultSet rs = null;
7272 connection = connections.getConnection();
7273 s = connection.createStatement();
7274 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE"
7276 +
" AND obj_id = data_source_obj_id"
7277 +
" ORDER BY dir_type, LOWER(name)");
7278 List<VirtualDirectory> virtDirRootIds =
new ArrayList<VirtualDirectory>();
7280 virtDirRootIds.add(virtualDirectory(rs, connection));
7282 return virtDirRootIds;
7283 }
catch (SQLException ex) {
7284 throw new TskCoreException(
"Error getting local files virtual folder id", ex);
7288 closeConnection(connection);
7306 assert (null != fileRanges);
7307 if (null == fileRanges) {
7308 throw new TskCoreException(
"TskFileRange object is null");
7311 assert (null != parent);
7312 if (null == parent) {
7313 throw new TskCoreException(
"Conent is null");
7317 Statement statement = null;
7318 ResultSet resultSet = null;
7322 CaseDbConnection connection = transaction.getConnection();
7324 List<LayoutFile> fileRangeLayoutFiles =
new ArrayList<LayoutFile>();
7332 long end_byte_in_parent = fileRange.getByteStart() + fileRange.getByteLen() - 1;
7342 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
7343 prepStmt.clearParameters();
7344 prepStmt.setLong(1, fileRangeId);
7345 prepStmt.setNull(2, java.sql.Types.BIGINT);
7346 prepStmt.setString(3,
"Unalloc_" + parent.getId() +
"_" + fileRange.getByteStart() +
"_" + end_byte_in_parent);
7348 prepStmt.setNull(5, java.sql.Types.BIGINT);
7353 prepStmt.setLong(10, fileRange.getByteLen());
7354 prepStmt.setNull(11, java.sql.Types.BIGINT);
7355 prepStmt.setNull(12, java.sql.Types.BIGINT);
7356 prepStmt.setNull(13, java.sql.Types.BIGINT);
7357 prepStmt.setNull(14, java.sql.Types.BIGINT);
7358 prepStmt.setNull(15, java.sql.Types.VARCHAR);
7359 prepStmt.setNull(16, java.sql.Types.VARCHAR);
7361 prepStmt.setNull(18, java.sql.Types.VARCHAR);
7362 prepStmt.setNull(19, java.sql.Types.VARCHAR);
7363 prepStmt.setLong(20, parent.getId());
7366 prepStmt.setString(21, null);
7368 prepStmt.setString(22,
OsAccount.NO_OWNER_ID);
7369 prepStmt.setNull(23, java.sql.Types.BIGINT);
7371 connection.executeUpdate(prepStmt);
7378 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
7379 prepStmt.clearParameters();
7380 prepStmt.setLong(1, fileRangeId);
7381 prepStmt.setLong(2, fileRange.getByteStart());
7382 prepStmt.setLong(3, fileRange.getByteLen());
7383 prepStmt.setLong(4, fileRange.getSequence());
7384 connection.executeUpdate(prepStmt);
7389 fileRangeLayoutFiles.add(
new LayoutFile(
this,
7392 Long.toString(fileRange.getSequence()),
7398 fileRange.getByteLen(),
7402 parent.getUniquePath(),
7410 return fileRangeLayoutFiles;
7412 }
catch (SQLException ex) {
7413 throw new TskCoreException(
"Failed to add layout files to case database", ex);
7415 closeResultSet(resultSet);
7416 closeStatement(statement);
7418 if (null != transaction) {
7421 }
catch (TskCoreException ex2) {
7422 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
7440 assert (null != carvingResult);
7441 if (null == carvingResult) {
7442 throw new TskCoreException(
"Carving is null");
7444 assert (null != carvingResult.getParent());
7445 if (null == carvingResult.getParent()) {
7446 throw new TskCoreException(
"Carving result has null parent");
7448 assert (null != carvingResult.getCarvedFiles());
7449 if (null == carvingResult.getCarvedFiles()) {
7450 throw new TskCoreException(
"Carving result has null carved files");
7453 Statement statement = null;
7454 ResultSet resultSet = null;
7464 while (null != root) {
7479 synchronized(carvedFileDirsLock) {
7480 carvedFilesDir = rootIdsToCarvedFileDirs.get(root.
getId());
7481 if (null == carvedFilesDir) {
7482 List<Content> rootChildren;
7484 rootChildren = ((FileSystem) root).getRootDirectory().
getChildren();
7488 for (
Content child : rootChildren) {
7494 if (null == carvedFilesDir) {
7495 long parId = root.
getId();
7497 if (root instanceof FileSystem) {
7498 Content rootDir = ((FileSystem) root).getRootDirectory();
7499 parId = rootDir.
getId();
7503 rootIdsToCarvedFileDirs.put(root.
getId(), carvedFilesDir);
7512 CaseDbConnection connection = transaction.getConnection();
7513 String parentPath = getFileParentPath(carvedFilesDir.
getId(), connection) + carvedFilesDir.
getName() +
"/";
7514 List<LayoutFile> carvedFiles =
new ArrayList<>();
7531 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
7532 prepStmt.clearParameters();
7533 prepStmt.setLong(1, carvedFileId);
7535 prepStmt.setLong(2, root.
getId());
7537 prepStmt.setNull(2, java.sql.Types.BIGINT);
7539 prepStmt.setString(3, carvedFile.getName());
7541 prepStmt.setShort(5, (
short) 1);
7546 prepStmt.setLong(10, carvedFile.getSizeInBytes());
7547 prepStmt.setNull(11, java.sql.Types.BIGINT);
7548 prepStmt.setNull(12, java.sql.Types.BIGINT);
7549 prepStmt.setNull(13, java.sql.Types.BIGINT);
7550 prepStmt.setNull(14, java.sql.Types.BIGINT);
7551 prepStmt.setNull(15, java.sql.Types.VARCHAR);
7552 prepStmt.setNull(16, java.sql.Types.VARCHAR);
7554 prepStmt.setNull(18, java.sql.Types.VARCHAR);
7555 prepStmt.setString(19, parentPath);
7557 prepStmt.setString(21, extractExtension(carvedFile.getName()));
7559 prepStmt.setString(22,
OsAccount.NO_OWNER_ID);
7560 prepStmt.setNull(23, java.sql.Types.BIGINT);
7562 connection.executeUpdate(prepStmt);
7569 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
7570 for (
TskFileRange tskFileRange : carvedFile.getLayoutInParent()) {
7571 prepStmt.clearParameters();
7572 prepStmt.setLong(1, carvedFileId);
7573 prepStmt.setLong(2, tskFileRange.getByteStart());
7574 prepStmt.setLong(3, tskFileRange.getByteLen());
7575 prepStmt.setLong(4, tskFileRange.getSequence());
7576 connection.executeUpdate(prepStmt);
7585 carvedFile.getName(),
7591 carvedFile.getSizeInBytes(),
7605 }
catch (SQLException ex) {
7606 throw new TskCoreException(
"Failed to add carved files to case database", ex);
7608 closeResultSet(resultSet);
7609 closeStatement(statement);
7611 if (null != transaction) {
7614 }
catch (TskCoreException ex2) {
7615 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
7652 long size,
long ctime,
long crtime,
long atime,
long mtime,
7653 boolean isFile,
Content parentObj,
7654 String rederiveDetails, String toolName, String toolVersion,
7659 size, ctime, crtime, atime, mtime,
7661 rederiveDetails, toolName, toolVersion,
7662 otherDetails, encodingType, transaction);
7665 }
catch (TskCoreException ex) {
7672 long size,
long ctime,
long crtime,
long atime,
long mtime,
7673 boolean isFile,
Content parentObj,
7674 String rederiveDetails, String toolName, String toolVersion,
7677 localPath = localPath.replaceAll(
"^[/\\\\]+",
"");
7681 CaseDbConnection connection = transaction.getConnection();
7683 final long parentId = parentObj.getId();
7684 String parentPath =
"";
7686 parentPath = parentObj.getUniquePath() +
'/' + parentObj.getName() +
'/';
7688 parentPath = ((AbstractFile) parentObj).getParentPath() + parentObj.getName() +
'/';
7700 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
7701 statement.clearParameters();
7702 statement.setLong(1, newObjId);
7705 long fsObjId = this.getFileSystemId(parentId, connection);
7706 if (fsObjId != -1) {
7707 statement.setLong(2, fsObjId);
7709 statement.setNull(2, java.sql.Types.BIGINT);
7711 statement.setString(3, fileName);
7715 statement.setShort(5, (
short) 1);
7719 statement.setShort(6, dirType.
getValue());
7721 statement.setShort(7, metaType.
getValue());
7725 statement.setShort(8, dirFlag.
getValue());
7728 statement.setShort(9, metaFlags);
7732 long savedSize = size < 0 ? 0 : size;
7733 statement.setLong(10, savedSize);
7737 statement.setLong(11, ctime);
7738 statement.setLong(12, crtime);
7739 statement.setLong(13, atime);
7740 statement.setLong(14, mtime);
7742 statement.setNull(15, java.sql.Types.VARCHAR);
7743 statement.setNull(16, java.sql.Types.VARCHAR);
7745 statement.setNull(18, java.sql.Types.VARCHAR);
7748 statement.setString(19, parentPath);
7751 long dataSourceObjId = getDataSourceObjectId(connection, parentObj);
7752 statement.setLong(20, dataSourceObjId);
7753 final String extension = extractExtension(fileName);
7755 statement.setString(21, extension);
7757 statement.setString(22,
OsAccount.NO_OWNER_ID);
7758 statement.setNull(23, java.sql.Types.BIGINT);
7760 connection.executeUpdate(statement);
7763 addFilePath(connection, newObjId, localPath, encodingType);
7765 DerivedFile derivedFile =
new DerivedFile(
this, newObjId, dataSourceObjId, fileName, dirType, metaType, dirFlag, metaFlags,
7766 savedSize, ctime, crtime, atime, mtime, null, null, null, parentPath, localPath, parentId, null, encodingType, extension,
OsAccount.NO_OWNER_ID,
OsAccount.NO_ACCOUNT);
7768 timelineManager.addEventsForNewFile(derivedFile, connection);
7772 }
catch (SQLException ex) {
7773 throw new TskCoreException(
"Failed to add derived file to case database", ex);
7808 long size,
long ctime,
long crtime,
long atime,
long mtime,
7809 boolean isFile, String mimeType,
7810 String rederiveDetails, String toolName, String toolVersion,
7819 size, ctime, crtime, atime, mtime,
7821 rederiveDetails, toolName, toolVersion,
7822 otherDetails, encodingType, parentObj, trans);
7825 }
catch (TskCoreException ex) {
7826 if (trans != null) {
7834 long size,
long ctime,
long crtime,
long atime,
long mtime,
7835 boolean isFile, String mimeType,
7836 String rederiveDetails, String toolName, String toolVersion,
7841 localPath = localPath.replaceAll(
"^[/\\\\]+",
"");
7843 ResultSet rs = null;
7845 final long parentId = parentObj.
getId();
7846 String parentPath =
"";
7848 parentPath = parentObj.getUniquePath() +
'/' + parentObj.getName() +
'/';
7850 parentPath = ((AbstractFile) parentObj).getParentPath() + parentObj.getName() +
'/';
7854 PreparedStatement statement = trans.getConnection().getPreparedStatement(PREPARED_STATEMENT.UPDATE_DERIVED_FILE);
7855 statement.clearParameters();
7862 statement.setShort(2, dirType.
getValue());
7864 statement.setShort(3, metaType.
getValue());
7868 statement.setShort(4, dirFlag.
getValue());
7871 statement.setShort(5, metaFlags);
7875 long savedSize = size < 0 ? 0 : size;
7876 statement.setLong(6, savedSize);
7880 statement.setLong(7, ctime);
7881 statement.setLong(8, crtime);
7882 statement.setLong(9, atime);
7883 statement.setLong(10, mtime);
7884 statement.setString(11, mimeType);
7885 statement.setString(12, String.valueOf(derivedFile.
getId()));
7886 trans.getConnection().executeUpdate(statement);
7889 updateFilePath(trans.getConnection(), derivedFile.
getId(), localPath, encodingType);
7891 long dataSourceObjId = getDataSourceObjectId(trans.getConnection(), parentObj);
7892 final String extension = extractExtension(derivedFile.
getName());
7893 return new DerivedFile(
this, derivedFile.
getId(), dataSourceObjId, derivedFile.
getName(), dirType, metaType, dirFlag, metaFlags,
7894 savedSize, ctime, crtime, atime, mtime, null, null, null, parentPath, localPath, parentId, null, encodingType, extension, derivedFile.
getOwnerUid().orElse(null), derivedFile.
getOsAccountObjectId().orElse(null));
7895 }
catch (SQLException ex) {
7896 throw new TskCoreException(
"Failed to add derived file to case database", ex);
7922 long size,
long ctime,
long crtime,
long atime,
long mtime,
7928 LocalFile created =
addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, encodingType, parent, localTrans);
7933 if (null != localTrans) {
7936 }
catch (TskCoreException ex2) {
7937 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
7968 long size,
long ctime,
long crtime,
long atime,
long mtime,
7973 size, ctime, crtime, atime, mtime,
7975 isFile, encodingType,
7976 parent, transaction);
8007 long size,
long ctime,
long crtime,
long atime,
long mtime,
8008 String md5, String sha256,
FileKnown known, String mimeType,
8012 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime,
8013 md5, sha256, known, mimeType, isFile, encodingType,
8048 long size,
long ctime,
long crtime,
long atime,
long mtime,
8049 String md5, String sha256,
FileKnown known, String mimeType,
8052 CaseDbConnection connection = transaction.getConnection();
8053 Statement queryStatement = null;
8065 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
8066 statement.clearParameters();
8067 statement.setLong(1, objectId);
8068 statement.setNull(2, java.sql.Types.BIGINT);
8069 statement.setString(3, fileName);
8071 statement.setShort(5, (
short) 1);
8073 statement.setShort(6, dirType.
getValue());
8075 statement.setShort(7, metaType.
getValue());
8077 statement.setShort(8, dirFlag.
getValue());
8079 statement.setShort(9, metaFlags);
8081 long savedSize = size < 0 ? 0 : size;
8082 statement.setLong(10, savedSize);
8083 statement.setLong(11, ctime);
8084 statement.setLong(12, crtime);
8085 statement.setLong(13, atime);
8086 statement.setLong(14, mtime);
8087 statement.setString(15, md5);
8088 statement.setString(16, sha256);
8089 if (known != null) {
8090 statement.setByte(17, known.getFileKnownValue());
8094 statement.setString(18, mimeType);
8096 long dataSourceObjId;
8099 AbstractFile parentFile = (AbstractFile) parent;
8100 if (isRootDirectory(parentFile, transaction)) {
8103 parentPath = parentFile.
getParentPath() + parent.getName() +
"/";
8108 dataSourceObjId = getDataSourceObjectId(connection, parent);
8110 statement.setString(19, parentPath);
8111 statement.setLong(20, dataSourceObjId);
8112 final String extension = extractExtension(fileName);
8113 statement.setString(21, extension);
8115 if (ownerAccount != null) {
8116 statement.setString(22, ownerAccount);
8118 statement.setNull(22, java.sql.Types.VARCHAR);
8121 if (osAccountId != null) {
8122 statement.setLong(23, osAccountId);
8124 statement.setNull(23, java.sql.Types.BIGINT);
8127 connection.executeUpdate(statement);
8128 addFilePath(connection, objectId, localPath, encodingType);
8138 ctime, crtime, atime, mtime,
8139 mimeType, md5, sha256, known,
8140 parent.getId(), parentPath,
8143 encodingType, extension,
8144 ownerAccount, osAccountId);
8148 }
catch (SQLException ex) {
8149 throw new TskCoreException(String.format(
"Failed to INSERT local file %s (%s) with parent id %d in tsk_files table", fileName, localPath, parent.getId()), ex);
8151 closeStatement(queryStatement);
8160 private class RootDirectoryKey {
8162 private long dataSourceId;
8163 private Long fileSystemId;
8165 RootDirectoryKey(
long dataSourceId, Long fileSystemId) {
8166 this.dataSourceId = dataSourceId;
8167 this.fileSystemId = fileSystemId;
8171 public int hashCode() {
8173 hash = 41 * hash + Objects.hashCode(dataSourceId);
8174 hash = 41 * hash + Objects.hashCode(fileSystemId);
8179 public boolean equals(Object obj) {
8186 if (getClass() != obj.getClass()) {
8190 RootDirectoryKey otherKey = (RootDirectoryKey) obj;
8191 if (dataSourceId != otherKey.dataSourceId) {
8195 if (fileSystemId != null) {
8196 return fileSystemId.equals(otherKey.fileSystemId);
8198 return (otherKey.fileSystemId == null);
8214 private boolean isRootDirectory(AbstractFile file, CaseDbTransaction transaction)
throws TskCoreException {
8219 Long fsObjId = null;
8220 if (file instanceof FsContent) {
8221 fsObjId = ((FsContent) file).getFileSystemId();
8224 synchronized (rootDirectoryMapLock) {
8225 if (rootDirectoryMap.containsKey(key)) {
8226 return rootDirectoryMap.get(key).equals(file.
getId());
8233 Boolean isRoot = isRootDirectoryCache.getIfPresent(file.
getId());
8234 if (isRoot != null) {
8238 CaseDbConnection connection = transaction.getConnection();
8239 Statement statement = null;
8240 ResultSet resultSet = null;
8243 String query = String.format(
"SELECT ParentRow.type AS parent_type, ParentRow.obj_id AS parent_object_id "
8244 +
"FROM tsk_objects ParentRow JOIN tsk_objects ChildRow ON ChildRow.par_obj_id = ParentRow.obj_id "
8245 +
"WHERE ChildRow.obj_id = %s;", file.
getId());
8247 statement = connection.createStatement();
8248 resultSet = statement.executeQuery(query);
8249 if (resultSet.next()) {
8250 long parentId = resultSet.getLong(
"parent_object_id");
8251 if (parentId == 0) {
8254 int type = resultSet.getInt(
"parent_type");
8255 boolean result = type == TskData.ObjectType.IMG.getObjectType()
8256 || type == TskData.ObjectType.VS.getObjectType()
8257 || type == TskData.ObjectType.VOL.getObjectType()
8258 || type == TskData.ObjectType.FS.getObjectType();
8259 if (result ==
true) {
8260 synchronized (rootDirectoryMapLock) {
8262 rootDirectoryMap.put(key, file.
getId());
8265 isRootDirectoryCache.put(file.
getId(), result);
8270 synchronized (rootDirectoryMapLock) {
8271 rootDirectoryMap.put(key, file.
getId());
8273 isRootDirectoryCache.put(file.
getId(),
true);
8278 }
catch (SQLException ex) {
8279 throw new TskCoreException(String.format(
"Failed to lookup parent of file (%s) with id %d", file.
getName(), file.
getId()), ex);
8281 closeResultSet(resultSet);
8282 closeStatement(statement);
8308 long ctime,
long crtime,
long atime,
long mtime,
8309 List<TskFileRange> fileRanges,
8310 Content parent)
throws TskCoreException {
8312 if (null == parent) {
8313 throw new TskCoreException(
"Parent can not be null");
8318 parentPath = ((AbstractFile) parent).getParentPath() + parent.getName() +
'/';
8324 Statement statement = null;
8325 ResultSet resultSet = null;
8328 CaseDbConnection connection = transaction.getConnection();
8344 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
8345 prepStmt.clearParameters();
8346 prepStmt.setLong(1, newFileId);
8349 if (0 != parent.getId()) {
8350 long parentFs = this.getFileSystemId(parent.getId(), connection);
8351 if (parentFs != -1) {
8352 prepStmt.setLong(2, parentFs);
8354 prepStmt.setNull(2, java.sql.Types.BIGINT);
8357 prepStmt.setNull(2, java.sql.Types.BIGINT);
8359 prepStmt.setString(3, fileName);
8361 prepStmt.setShort(5, (
short) 0);
8364 prepStmt.setShort(8, dirFlag.getValue());
8365 prepStmt.setShort(9, metaFlag.getValue());
8367 long savedSize = size < 0 ? 0 : size;
8368 prepStmt.setLong(10, savedSize);
8369 prepStmt.setLong(11, ctime);
8370 prepStmt.setLong(12, crtime);
8371 prepStmt.setLong(13, atime);
8372 prepStmt.setLong(14, mtime);
8373 prepStmt.setNull(15, java.sql.Types.VARCHAR);
8374 prepStmt.setNull(16, java.sql.Types.VARCHAR);
8376 prepStmt.setNull(18, java.sql.Types.VARCHAR);
8377 prepStmt.setString(19, parentPath);
8378 prepStmt.setLong(20, parent.getDataSource().getId());
8380 prepStmt.setString(21, extractExtension(fileName));
8382 prepStmt.setString(22,
OsAccount.NO_OWNER_ID);
8383 prepStmt.setNull(23, java.sql.Types.BIGINT);
8385 connection.executeUpdate(prepStmt);
8392 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
8394 prepStmt.clearParameters();
8395 prepStmt.setLong(1, newFileId);
8396 prepStmt.setLong(2, tskFileRange.getByteStart());
8397 prepStmt.setLong(3, tskFileRange.getByteLen());
8398 prepStmt.setLong(4, tskFileRange.getSequence());
8399 connection.executeUpdate(prepStmt);
8407 parent.getDataSource().getId(),
8413 metaFlag.getValue(),
8415 ctime, crtime, atime, mtime,
8427 }
catch (SQLException ex) {
8428 throw new TskCoreException(
"Failed to add layout file " + fileName +
" to case database", ex);
8430 closeResultSet(resultSet);
8431 closeStatement(statement);
8433 if (null != transaction) {
8436 }
catch (TskCoreException ex2) {
8437 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
8452 private long getDataSourceObjectId(CaseDbConnection connection,
Content content)
throws TskCoreException {
8453 if (content == null) {
8454 throw new TskCoreException(
"Null Content parameter given");
8456 if (content instanceof AbstractFile) {
8457 return ((AbstractFile)content).getDataSourceObjectId();
8459 return getDataSourceObjectId(connection, content.getId());
8475 private long getDataSourceObjectId(CaseDbConnection connection,
long objectId)
throws TskCoreException {
8477 Statement statement = null;
8478 ResultSet resultSet = null;
8480 statement = connection.createStatement();
8481 long dataSourceObjId;
8482 long ancestorId = objectId;
8484 dataSourceObjId = ancestorId;
8485 String query = String.format(
"SELECT par_obj_id FROM tsk_objects WHERE obj_id = %s;", ancestorId);
8486 resultSet = statement.executeQuery(query);
8487 if (resultSet.next()) {
8488 ancestorId = resultSet.getLong(
"par_obj_id");
8490 throw new TskCoreException(String.format(
"tsk_objects table is corrupt, SQL query returned no result: %s", query));
8494 }
while (0 != ancestorId);
8495 return dataSourceObjId;
8496 }
catch (SQLException ex) {
8497 throw new TskCoreException(String.format(
"Error finding root data source for object (obj_id = %d)", objectId), ex);
8499 closeResultSet(resultSet);
8500 closeStatement(statement);
8516 private void addFilePath(CaseDbConnection connection,
long objId, String path, TskData.EncodingType type) throws SQLException {
8517 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LOCAL_PATH);
8518 statement.clearParameters();
8519 statement.setLong(1, objId);
8520 statement.setString(2, path);
8521 statement.setInt(3, type.getType());
8522 connection.executeUpdate(statement);
8536 private void updateFilePath(CaseDbConnection connection,
long objId, String path, TskData.EncodingType type) throws SQLException {
8537 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_LOCAL_PATH);
8538 statement.clearParameters();
8539 statement.setString(1, path);
8540 statement.setInt(2, type.getType());
8541 statement.setLong(3, objId);
8542 connection.executeUpdate(statement);
8558 public List<AbstractFile>
findFilesInFolder(String fileName, AbstractFile parentFile)
throws TskCoreException {
8560 if (!containsLikeWildcard(fileName)) {
8564 CaseDbConnection connection = null;
8565 ResultSet rs = null;
8566 long parentId = parentFile.getId();
8570 connection = connections.getConnection();
8572 PreparedStatement statement;
8573 if (ext.isEmpty()) {
8574 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT_AND_NAME);
8575 statement.clearParameters();
8576 statement.setLong(1, parentId);
8577 statement.setString(2, fileName);
8579 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_EXTENSION_AND_PARENT_AND_NAME);
8580 statement.clearParameters();
8581 statement.setString(1, ext);
8582 statement.setLong(2, parentId);
8583 statement.setString(3, fileName);
8586 rs = connection.executeQuery(statement);
8587 return resultSetToAbstractFiles(rs, connection);
8588 }
catch (SQLException ex) {
8589 throw new TskCoreException(
"Error getting AbstractFile children with name=" + fileName +
" for Content parent with ID=" + parentFile.getId(), ex);
8592 closeConnection(connection);
8609 CaseDbConnection connection = null;
8611 ResultSet rs = null;
8614 connection = connections.getConnection();
8615 s = connection.createStatement();
8616 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE " + sqlWhereClause);
8618 return rs.getLong(
"count");
8619 }
catch (SQLException e) {
8620 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.countFilesWhere().", e);
8624 closeConnection(connection);
8647 CaseDbConnection connection = null;
8649 ResultSet rs = null;
8652 connection = connections.getConnection();
8653 s = connection.createStatement();
8654 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
8655 return resultSetToAbstractFiles(rs, connection);
8656 }
catch (SQLException e) {
8657 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFilesWhere(): " + sqlWhereClause, e);
8661 closeConnection(connection);
8685 String queryTemplate =
"SELECT tsk_files.* FROM tsk_files JOIN tsk_objects ON tsk_objects.obj_id = tsk_files.obj_id WHERE par_obj_id = %d AND %s";
8687 try (CaseDbConnection connection = connections.getConnection()) {
8688 String query = String.format(queryTemplate, parentId, sqlWhereClause);
8689 try (Statement s = connection.createStatement(); ResultSet rs = connection.executeQuery(s, query)) {
8690 return resultSetToAbstractFiles(rs, connection);
8691 }
catch (SQLException ex) {
8692 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFilesInFolderWhere(): " + query, ex);
8712 CaseDbConnection connection = null;
8714 ResultSet rs = null;
8717 connection = connections.getConnection();
8718 s = connection.createStatement();
8719 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_files WHERE " + sqlWhereClause);
8720 List<Long> ret =
new ArrayList<>();
8722 ret.add(rs.getLong(
"obj_id"));
8725 }
catch (SQLException e) {
8726 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFileIdsWhere(): " + sqlWhereClause, e);
8730 closeConnection(connection);
8746 public List<AbstractFile>
openFiles(
Content dataSource, String filePath)
throws TskCoreException {
8750 String path = AbstractFile.createNonUniquePath(filePath).toLowerCase();
8753 int lastSlash = path.lastIndexOf(
'/');
8756 if (lastSlash == path.length()) {
8757 path = path.substring(0, lastSlash - 1);
8758 lastSlash = path.lastIndexOf(
'/');
8761 String parentPath = path.substring(0, lastSlash);
8762 String fileName = path.substring(lastSlash);
8764 return findFiles(dataSource, fileName, parentPath);
8778 CaseDbConnection connection = null;
8780 ResultSet rs = null;
8783 connection = connections.getConnection();
8784 s = connection.createStatement();
8785 rs = connection.executeQuery(s,
"SELECT * FROM tsk_file_layout WHERE obj_id = " +
id +
" ORDER BY sequence");
8786 List<TskFileRange> ranges =
new ArrayList<TskFileRange>();
8789 rs.getLong(
"byte_len"), rs.getLong(
"sequence"));
8793 }
catch (SQLException ex) {
8794 throw new TskCoreException(
"Error getting TskFileLayoutRanges by id, id = " +
id, ex);
8798 closeConnection(connection);
8814 CaseDbConnection connection = null;
8816 ResultSet rs = null;
8819 connection = connections.getConnection();
8820 s = connection.createStatement();
8821 rs = connection.executeQuery(s,
"SELECT tsk_image_info.type, tsk_image_info.ssize, tsk_image_info.tzone, tsk_image_info.size, tsk_image_info.md5, tsk_image_info.sha1, tsk_image_info.sha256, tsk_image_info.display_name, data_source_info.device_id, tsk_image_names.name "
8822 +
"FROM tsk_image_info "
8823 +
"INNER JOIN data_source_info ON tsk_image_info.obj_id = data_source_info.obj_id "
8824 +
"LEFT JOIN tsk_image_names ON tsk_image_names.obj_id = data_source_info.obj_id "
8825 +
"WHERE tsk_image_info.obj_id = " +
id);
8827 List<String> imagePaths =
new ArrayList<>();
8828 long type, ssize, size;
8829 String tzone, md5, sha1, sha256, name, device_id, imagePath;
8832 imagePath = rs.getString(
"name");
8833 if (imagePath != null) {
8834 imagePaths.add(imagePath);
8836 type = rs.getLong(
"type");
8837 ssize = rs.getLong(
"ssize");
8838 tzone = rs.getString(
"tzone");
8839 size = rs.getLong(
"size");
8840 md5 = rs.getString(
"md5");
8841 sha1 = rs.getString(
"sha1");
8842 sha256 = rs.getString(
"sha256");
8843 name = rs.getString(
"display_name");
8845 if (imagePaths.size() > 0) {
8846 String path = imagePaths.get(0);
8847 name = (
new java.io.File(path)).getName();
8852 device_id = rs.getString(
"device_id");
8854 throw new TskCoreException(
"No image found for id: " +
id);
8859 imagePath = rs.getString(
"name");
8860 if (imagePath != null) {
8861 imagePaths.add(imagePath);
8865 return new Image(
this,
id, type, device_id, ssize, name,
8866 imagePaths.toArray(
new String[imagePaths.size()]), tzone, md5, sha1, sha256, size);
8867 }
catch (SQLException ex) {
8868 throw new TskCoreException(
"Error getting Image by id, id = " +
id, ex);
8872 closeConnection(connection);
8889 CaseDbConnection connection = null;
8891 ResultSet rs = null;
8894 connection = connections.getConnection();
8895 s = connection.createStatement();
8896 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_info "
8897 +
"where obj_id = " +
id);
8899 long type = rs.getLong(
"vs_type");
8900 long imgOffset = rs.getLong(
"img_offset");
8901 long blockSize = rs.getLong(
"block_size");
8903 vs.setParent(parent);
8906 throw new TskCoreException(
"No volume system found for id:" +
id);
8908 }
catch (SQLException ex) {
8909 throw new TskCoreException(
"Error getting Volume System by ID.", ex);
8913 closeConnection(connection);
8926 VolumeSystem getVolumeSystemById(
long id,
long parentId)
throws TskCoreException {
8927 VolumeSystem vs = getVolumeSystemById(
id, null);
8928 vs.setParentId(parentId);
8943 FileSystem getFileSystemById(
long id, Image parent)
throws TskCoreException {
8944 return getFileSystemByIdHelper(
id, parent);
8955 FileSystem getFileSystemById(
long id,
long parentId)
throws TskCoreException {
8957 FileSystem fs = getFileSystemById(
id, vol);
8958 fs.setParentId(parentId);
8973 FileSystem getFileSystemById(
long id, Volume parent)
throws TskCoreException {
8974 return getFileSystemByIdHelper(
id, parent);
8988 Pool getPoolById(
long id, Content parent)
throws TskCoreException {
8989 return getPoolByIdHelper(
id, parent);
9000 Pool getPoolById(
long id,
long parentId)
throws TskCoreException {
9001 Pool pool = getPoolById(
id, null);
9002 pool.setParentId(parentId);
9017 private Pool getPoolByIdHelper(
long id, Content parent)
throws TskCoreException {
9020 try (CaseDbConnection connection = connections.getConnection();
9021 Statement s = connection.createStatement();
9022 ResultSet rs = connection.executeQuery(s,
"SELECT * FROM tsk_pool_info "
9023 +
"where obj_id = " +
id);) {
9025 Pool pool =
new Pool(
this, rs.getLong(
"obj_id"), TskData.TSK_POOL_TYPE_ENUM.valueOf(rs.getLong(
"pool_type")).getName(), rs.getLong(
"pool_type"));
9026 pool.setParent(parent);
9030 throw new TskCoreException(
"No pool found for ID:" +
id);
9032 }
catch (SQLException ex) {
9033 throw new TskCoreException(
"Error getting Pool by ID", ex);
9050 private FileSystem getFileSystemByIdHelper(
long id, Content parent)
throws TskCoreException {
9054 synchronized (fileSystemIdMap) {
9055 if (fileSystemIdMap.containsKey(
id)) {
9056 return fileSystemIdMap.get(
id);
9059 CaseDbConnection connection = null;
9061 ResultSet rs = null;
9064 connection = connections.getConnection();
9065 s = connection.createStatement();
9066 rs = connection.executeQuery(s,
"SELECT * FROM tsk_fs_info "
9067 +
"where obj_id = " +
id);
9069 TskData.TSK_FS_TYPE_ENUM fsType = TskData.TSK_FS_TYPE_ENUM.valueOf(rs.getInt(
"fs_type"));
9070 FileSystem fs =
new FileSystem(
this, rs.getLong(
"obj_id"),
"", rs.getLong(
"img_offset"),
9071 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
9072 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
9073 fs.setParent(parent);
9075 synchronized (fileSystemIdMap) {
9076 fileSystemIdMap.put(
id, fs);
9080 throw new TskCoreException(
"No file system found for id:" +
id);
9082 }
catch (SQLException ex) {
9083 throw new TskCoreException(
"Error getting File System by ID", ex);
9087 closeConnection(connection);
9103 Volume getVolumeById(
long id, VolumeSystem parent)
throws TskCoreException {
9104 CaseDbConnection connection = null;
9106 ResultSet rs = null;
9109 connection = connections.getConnection();
9110 s = connection.createStatement();
9111 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_parts "
9112 +
"where obj_id = " +
id);
9123 description = rs.getString(
"desc");
9124 }
catch (Exception ex) {
9125 description = rs.getString(
"descr");
9127 Volume vol =
new Volume(
this, rs.getLong(
"obj_id"), rs.getLong(
"addr"),
9128 rs.getLong(
"start"), rs.getLong(
"length"), rs.getLong(
"flags"),
9130 vol.setParent(parent);
9133 throw new TskCoreException(
"No volume found for id:" +
id);
9135 }
catch (SQLException ex) {
9136 throw new TskCoreException(
"Error getting Volume by ID", ex);
9140 closeConnection(connection);
9153 Volume getVolumeById(
long id,
long parentId)
throws TskCoreException {
9154 Volume vol = getVolumeById(
id, null);
9155 vol.setParentId(parentId);
9170 Directory getDirectoryById(
long id, FileSystem parentFs)
throws TskCoreException {
9171 CaseDbConnection connection = null;
9173 ResultSet rs = null;
9176 connection = connections.getConnection();
9177 s = connection.createStatement();
9178 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files "
9179 +
"WHERE obj_id = " +
id);
9180 Directory temp = null;
9182 final short type = rs.getShort(
"type");
9183 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()) {
9184 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()
9185 || rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) {
9186 temp = directory(rs, parentFs);
9188 }
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()) {
9189 throw new TskCoreException(
"Expecting an FS-type directory, got virtual, id: " +
id);
9192 throw new TskCoreException(
"No Directory found for id:" +
id);
9195 }
catch (SQLException ex) {
9196 throw new TskCoreException(
"Error getting Directory by ID", ex);
9200 closeConnection(connection);
9215 List<FileSystem> fileSystems =
new ArrayList<>();
9216 String queryStr =
"SELECT * FROM tsk_fs_info WHERE data_source_obj_id = " + image.getId();
9218 CaseDbConnection connection = null;
9220 ResultSet rs = null;
9223 connection = connections.getConnection();
9224 s = connection.createStatement();
9225 rs = connection.executeQuery(s, queryStr);
9229 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
9230 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
9232 fileSystems.add(fs);
9234 }
catch (SQLException ex) {
9235 throw new TskCoreException(
"Error looking up files systems. Query: " + queryStr, ex);
9239 closeConnection(connection);
9255 List<Content> getImageChildren(
Image img)
throws TskCoreException {
9256 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
9257 List<Content> children =
new ArrayList<Content>();
9258 for (ObjectInfo info : childInfos) {
9259 if (null != info.type) {
9260 switch (info.type) {
9262 children.add(getVolumeSystemById(info.id, img));
9265 children.add(getPoolById(info.id, img));
9268 children.add(getFileSystemById(info.id, img));
9286 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
9303 List<Long> getImageChildrenIds(Image img)
throws TskCoreException {
9304 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
9305 List<Long> children =
new ArrayList<Long>();
9306 for (ObjectInfo info : childInfos) {
9307 if (info.type == ObjectType.VS
9308 || info.type == ObjectType.POOL
9309 || info.type == ObjectType.FS
9310 || info.type == ObjectType.ABSTRACTFILE
9311 || info.type == ObjectType.ARTIFACT) {
9312 children.add(info.id);
9313 }
else if (info.type == ObjectType.REPORT) {
9316 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
9332 List<Content> getPoolChildren(Pool pool)
throws TskCoreException {
9333 Collection<ObjectInfo> childInfos = getChildrenInfo(pool);
9334 List<Content> children =
new ArrayList<Content>();
9335 for (ObjectInfo info : childInfos) {
9336 if (null != info.type) {
9337 switch (info.type) {
9339 children.add(getVolumeSystemById(info.id, pool));
9354 throw new TskCoreException(
"Pool has child of invalid type: " + info.type);
9371 List<Long> getPoolChildrenIds(Pool pool)
throws TskCoreException {
9372 Collection<ObjectInfo> childInfos = getChildrenInfo(pool);
9373 List<Long> children =
new ArrayList<Long>();
9374 for (ObjectInfo info : childInfos) {
9375 if (info.type == ObjectType.VS || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
9376 children.add(info.id);
9378 throw new TskCoreException(
"Pool has child of invalid type: " + info.type);
9394 List<Content> getVolumeSystemChildren(VolumeSystem vs)
throws TskCoreException {
9395 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
9396 List<Content> children =
new ArrayList<Content>();
9397 for (ObjectInfo info : childInfos) {
9398 if (null != info.type) {
9399 switch (info.type) {
9401 children.add(getVolumeById(info.id, vs));
9416 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
9433 List<Long> getVolumeSystemChildrenIds(VolumeSystem vs)
throws TskCoreException {
9434 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
9435 List<Long> children =
new ArrayList<Long>();
9436 for (ObjectInfo info : childInfos) {
9437 if (info.type == ObjectType.VOL || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
9438 children.add(info.id);
9440 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
9456 List<Content> getVolumeChildren(Volume vol)
throws TskCoreException {
9457 Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
9458 List<Content> children =
new ArrayList<Content>();
9459 for (ObjectInfo info : childInfos) {
9460 if (null != info.type) {
9461 switch (info.type) {
9463 children.add(getPoolById(info.id, vol));
9466 children.add(getFileSystemById(info.id, vol));
9481 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
9498 List<Long> getVolumeChildrenIds(Volume vol)
throws TskCoreException {
9499 final Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
9500 final List<Long> children =
new ArrayList<Long>();
9501 for (ObjectInfo info : childInfos) {
9502 if (info.type == ObjectType.FS || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
9503 children.add(info.id);
9505 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
9524 public Image addImageInfo(
long deviceObjId, List<String> imageFilePaths, String timeZone)
throws TskCoreException {
9525 return addImageInfo(deviceObjId, imageFilePaths, timeZone, null);
9542 public Image addImageInfo(
long deviceObjId, List<String> imageFilePaths, String timeZone,
Host host)
throws TskCoreException {
9543 long imageId = this.caseHandle.addImageInfo(deviceObjId, imageFilePaths, timeZone, host,
this);
9557 CaseDbConnection connection = null;
9558 Statement s1 = null;
9559 ResultSet rs1 = null;
9562 connection = connections.getConnection();
9563 s1 = connection.createStatement();
9564 rs1 = connection.executeQuery(s1,
"SELECT tsk_image_info.obj_id, tsk_image_names.name FROM tsk_image_info "
9565 +
"LEFT JOIN tsk_image_names ON tsk_image_info.obj_id = tsk_image_names.obj_id");
9566 Map<Long, List<String>> imgPaths =
new LinkedHashMap<Long, List<String>>();
9567 while (rs1.next()) {
9568 long obj_id = rs1.getLong(
"obj_id");
9569 String name = rs1.getString(
"name");
9570 List<String> imagePaths = imgPaths.get(obj_id);
9571 if (imagePaths == null) {
9572 List<String> paths =
new ArrayList<String>();
9576 imgPaths.put(obj_id, paths);
9579 imagePaths.add(name);
9584 }
catch (SQLException ex) {
9585 throw new TskCoreException(
"Error getting image paths.", ex);
9587 closeResultSet(rs1);
9589 closeConnection(connection);
9605 private List<String> getImagePathsById(
long objectId, CaseDbConnection connection)
throws TskCoreException {
9606 List<String> imagePaths =
new ArrayList<>();
9608 Statement statement = null;
9609 ResultSet resultSet = null;
9611 statement = connection.createStatement();
9612 resultSet = connection.executeQuery(statement,
"SELECT name FROM tsk_image_names WHERE tsk_image_names.obj_id = " + objectId);
9613 while (resultSet.next()) {
9614 imagePaths.add(resultSet.getString(
"name"));
9616 }
catch (SQLException ex) {
9617 throw new TskCoreException(String.format(
"Error getting image names with obj_id = %d", objectId), ex);
9619 closeResultSet(resultSet);
9620 closeStatement(statement);
9634 CaseDbConnection connection = null;
9636 ResultSet rs = null;
9639 connection = connections.getConnection();
9640 s = connection.createStatement();
9641 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_image_info");
9642 Collection<Long> imageIDs =
new ArrayList<Long>();
9644 imageIDs.add(rs.getLong(
"obj_id"));
9646 List<Image> images =
new ArrayList<Image>();
9647 for (
long id : imageIDs) {
9651 }
catch (SQLException ex) {
9652 throw new TskCoreException(
"Error retrieving images.", ex);
9656 closeConnection(connection);
9671 public void setImagePaths(
long obj_id, List<String> paths)
throws TskCoreException {
9672 CaseDbConnection connection = null;
9674 PreparedStatement statement;
9676 connection = connections.getConnection();
9677 connection.beginTransaction();
9678 statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_IMAGE_NAME);
9679 statement.clearParameters();
9680 statement.setLong(1, obj_id);
9681 connection.executeUpdate(statement);
9682 for (
int i = 0; i < paths.size(); i++) {
9683 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
9684 statement.clearParameters();
9685 statement.setLong(1, obj_id);
9686 statement.setString(2, paths.get(i));
9687 statement.setLong(3, i);
9688 connection.executeUpdate(statement);
9690 connection.commitTransaction();
9691 }
catch (SQLException ex) {
9692 rollbackTransaction(connection);
9693 throw new TskCoreException(
"Error updating image paths.", ex);
9695 closeConnection(connection);
9711 void deleteDataSource(
long dataSourceObjectId)
throws TskCoreException {
9712 CaseDbConnection connection = null;
9713 Statement statement;
9716 connection = connections.getConnection();
9717 statement = connection.createStatement();
9718 connection.beginTransaction();
9721 statement.execute(
"DELETE FROM tsk_objects WHERE obj_id = " + dataSourceObjectId);
9724 String accountSql =
"DELETE FROM accounts WHERE account_id in (SELECT account_id FROM accounts "
9725 +
"WHERE account_id NOT IN (SELECT account1_id FROM account_relationships) "
9726 +
"AND account_id NOT IN (SELECT account2_id FROM account_relationships))";
9727 statement.execute(accountSql);
9728 connection.commitTransaction();
9729 }
catch (SQLException ex) {
9730 rollbackTransaction(connection);
9731 throw new TskCoreException(
"Error deleting data source.", ex);
9733 closeConnection(connection);
9763 List<AbstractFile> resultSetToAbstractFiles(ResultSet rs, CaseDbConnection connection)
throws SQLException {
9764 ArrayList<AbstractFile> results =
new ArrayList<AbstractFile>();
9767 final short type = rs.getShort(
"type");
9768 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()
9769 && (rs.getShort(
"meta_type") != TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue())) {
9771 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
9772 result = directory(rs, null);
9774 result = file(rs, null);
9776 results.add(result);
9777 }
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()
9778 || (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue())) {
9779 final VirtualDirectory virtDir = virtualDirectory(rs, connection);
9780 results.add(virtDir);
9781 }
else if (type == TSK_DB_FILES_TYPE_ENUM.LOCAL_DIR.getFileType()) {
9782 final LocalDirectory localDir = localDirectory(rs);
9783 results.add(localDir);
9784 }
else if (type == TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS.getFileType()
9785 || type == TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS.getFileType()
9786 || type == TSK_DB_FILES_TYPE_ENUM.CARVED.getFileType()
9787 || type == TSK_DB_FILES_TYPE_ENUM.LAYOUT_FILE.getFileType()) {
9788 TSK_DB_FILES_TYPE_ENUM atype = TSK_DB_FILES_TYPE_ENUM.valueOf(type);
9789 String parentPath = rs.getString(
"parent_path");
9790 if (parentPath == null) {
9794 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
9796 osAccountObjId = null;
9799 LayoutFile lf =
new LayoutFile(
this,
9800 rs.getLong(
"obj_id"),
9801 rs.getLong(
"data_source_obj_id"),
9802 rs.getString(
"name"),
9804 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")), TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
9805 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
9807 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
9808 rs.getString(
"md5"), rs.getString(
"sha256"), FileKnown.valueOf(rs.getByte(
"known")), parentPath,
9809 rs.getString(
"mime_type"),
9810 rs.getString(
"owner_uid"), osAccountObjId);
9812 }
else if (type == TSK_DB_FILES_TYPE_ENUM.DERIVED.getFileType()) {
9813 final DerivedFile df;
9814 df = derivedFile(rs, connection, AbstractContent.UNKNOWN_ID);
9816 }
else if (type == TSK_DB_FILES_TYPE_ENUM.LOCAL.getFileType()) {
9818 lf = localFile(rs, connection, AbstractContent.UNKNOWN_ID);
9820 }
else if (type == TSK_DB_FILES_TYPE_ENUM.SLACK.getFileType()) {
9821 final SlackFile sf = slackFile(rs, null);
9825 }
catch (SQLException e) {
9826 logger.log(Level.SEVERE,
"Error getting abstract files from result set", e);
9845 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
9847 osAccountObjId = null;
9851 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
9852 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
9853 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
9854 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
9855 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
9856 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
9857 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
9858 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
9859 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
9860 rs.getString(
"md5"), rs.getString(
"sha256"), FileKnown.valueOf(rs.getByte(
"known")),
9861 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension"), rs.getString(
"owner_uid"), osAccountObjId, Collections.emptyList());
9862 f.setFileSystem(fs);
9877 Directory directory(ResultSet rs, FileSystem fs)
throws SQLException {
9878 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
9880 osAccountObjId = null;
9883 Directory dir =
new Directory(
this, rs.getLong(
"obj_id"), rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
9884 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
9885 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
9886 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
9887 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
9888 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
9889 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
9890 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
9891 rs.getShort(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
9892 rs.getString(
"md5"), rs.getString(
"sha256"), FileKnown.valueOf(rs.getByte(
"known")),
9893 rs.getString(
"parent_path"), rs.getString(
"owner_uid"), osAccountObjId);
9894 dir.setFileSystem(fs);
9908 VirtualDirectory virtualDirectory(ResultSet rs, CaseDbConnection connection)
throws SQLException {
9909 String parentPath = rs.getString(
"parent_path");
9910 if (parentPath == null) {
9914 long objId = rs.getLong(
"obj_id");
9915 long dsObjId = rs.getLong(
"data_source_obj_id");
9916 if (objId == dsObjId) {
9918 String deviceId =
"";
9919 String timeZone =
"";
9921 ResultSet rsDataSourceInfo = null;
9925 s = connection.createStatement();
9926 rsDataSourceInfo = connection.executeQuery(s,
"SELECT device_id, time_zone FROM data_source_info WHERE obj_id = " + objId);
9927 if (rsDataSourceInfo.next()) {
9928 deviceId = rsDataSourceInfo.getString(
"device_id");
9929 timeZone = rsDataSourceInfo.getString(
"time_zone");
9931 }
catch (SQLException ex) {
9932 logger.log(Level.SEVERE,
"Error data source info for datasource id " + objId, ex);
9934 closeResultSet(rsDataSourceInfo);
9939 return new LocalFilesDataSource(
this,
9942 rs.getString(
"name"),
9943 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
9944 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
9945 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
9946 rs.getShort(
"meta_flags"),
9948 rs.getString(
"md5"),
9949 rs.getString(
"sha256"),
9950 FileKnown.valueOf(rs.getByte(
"known")),
9953 final VirtualDirectory vd =
new VirtualDirectory(
this,
9955 rs.getString(
"name"),
9956 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
9957 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
9958 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
9959 rs.getShort(
"meta_flags"), rs.getString(
"md5"), rs.getString(
"sha256"),
9960 FileKnown.valueOf(rs.getByte(
"known")), parentPath);
9974 LocalDirectory localDirectory(ResultSet rs)
throws SQLException {
9975 String parentPath = rs.getString(
"parent_path");
9976 if (parentPath == null) {
9979 final LocalDirectory ld =
new LocalDirectory(
this, rs.getLong(
"obj_id"),
9980 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"),
9981 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
9982 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
9983 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
9984 rs.getShort(
"meta_flags"), rs.getString(
"md5"), rs.getString(
"sha256"),
9985 FileKnown.valueOf(rs.getByte(
"known")), parentPath);
10002 private DerivedFile derivedFile(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
10003 boolean hasLocalPath = rs.getBoolean(
"has_path");
10004 long objId = rs.getLong(
"obj_id");
10005 String localPath = null;
10006 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
10007 if (hasLocalPath) {
10008 ResultSet rsFilePath = null;
10011 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
10012 statement.clearParameters();
10013 statement.setLong(1, objId);
10014 rsFilePath = connection.executeQuery(statement);
10015 if (rsFilePath.next()) {
10016 localPath = rsFilePath.getString(
"path");
10017 encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
10019 }
catch (SQLException ex) {
10020 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
10022 closeResultSet(rsFilePath);
10026 String parentPath = rs.getString(
"parent_path");
10027 if (parentPath == null) {
10031 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10032 if (rs.wasNull()) {
10033 osAccountObjId = null;
10036 final DerivedFile df =
new DerivedFile(
this, objId, rs.getLong(
"data_source_obj_id"),
10037 rs.getString(
"name"),
10038 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10039 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10040 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
10041 rs.getLong(
"size"),
10042 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10043 rs.getString(
"md5"), rs.getString(
"sha256"), FileKnown.valueOf(rs.getByte(
"known")),
10044 parentPath, localPath, parentId, rs.getString(
"mime_type"),
10045 encodingType, rs.getString(
"extension"),
10046 rs.getString(
"owner_uid"), osAccountObjId);
10063 private LocalFile localFile(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
10064 long objId = rs.getLong(
"obj_id");
10065 String localPath = null;
10066 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
10067 if (rs.getBoolean(
"has_path")) {
10068 ResultSet rsFilePath = null;
10071 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
10072 statement.clearParameters();
10073 statement.setLong(1, objId);
10074 rsFilePath = connection.executeQuery(statement);
10075 if (rsFilePath.next()) {
10076 localPath = rsFilePath.getString(
"path");
10077 encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
10079 }
catch (SQLException ex) {
10080 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
10082 closeResultSet(rsFilePath);
10086 String parentPath = rs.getString(
"parent_path");
10087 if (null == parentPath) {
10090 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10091 if (rs.wasNull()) {
10092 osAccountObjId = null;
10095 LocalFile file =
new LocalFile(
this, objId, rs.getString(
"name"),
10096 TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type")),
10097 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10098 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10099 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
10100 rs.getLong(
"size"),
10101 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10102 rs.getString(
"mime_type"), rs.getString(
"md5"), rs.getString(
"sha256"), FileKnown.valueOf(rs.getByte(
"known")),
10103 parentId, parentPath, rs.getLong(
"data_source_obj_id"),
10104 localPath, encodingType, rs.getString(
"extension"),
10105 rs.getString(
"owner_uid"), osAccountObjId);
10121 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10122 if (rs.wasNull()) {
10123 osAccountObjId = null;
10126 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
10127 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
10128 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
10129 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10130 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10131 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
10132 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
10133 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10134 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
10135 rs.getString(
"md5"), rs.getString(
"sha256"), FileKnown.valueOf(rs.getByte(
"known")),
10136 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension"),
10137 rs.getString(
"owner_uid"), osAccountObjId);
10138 f.setFileSystem(fs);
10153 List<Content> fileChildren(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
10154 List<Content> children =
new ArrayList<Content>();
10156 while (rs.next()) {
10157 TskData.TSK_DB_FILES_TYPE_ENUM type = TskData.TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type"));
10159 if (null != type) {
10162 if (rs.getShort(
"meta_type") != TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) {
10164 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
10165 result = directory(rs, null);
10167 result = file(rs, null);
10169 children.add(result);
10171 VirtualDirectory virtDir = virtualDirectory(rs, connection);
10172 children.add(virtDir);
10176 VirtualDirectory virtDir = virtualDirectory(rs, connection);
10177 children.add(virtDir);
10180 LocalDirectory localDir = localDirectory(rs);
10181 children.add(localDir);
10183 case UNALLOC_BLOCKS:
10184 case UNUSED_BLOCKS:
10186 case LAYOUT_FILE: {
10187 String parentPath = rs.getString(
"parent_path");
10188 if (parentPath == null) {
10191 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10192 if (rs.wasNull()) {
10193 osAccountObjId = null;
10195 final LayoutFile lf =
new LayoutFile(
this, rs.getLong(
"obj_id"),
10196 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"), type,
10197 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10198 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10199 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
10200 rs.getLong(
"size"),
10201 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10202 rs.getString(
"md5"), rs.getString(
"sha256"),
10203 FileKnown.valueOf(rs.getByte(
"known")), parentPath, rs.getString(
"mime_type"),
10204 rs.getString(
"owner_uid"), osAccountObjId);
10209 final DerivedFile df = derivedFile(rs, connection, parentId);
10213 final LocalFile lf = localFile(rs, connection, parentId);
10218 final SlackFile sf = slackFile(rs, null);
10245 private List<BlackboardArtifact> resultSetToArtifacts(ResultSet rs)
throws SQLException, TskCoreException {
10246 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<BlackboardArtifact>();
10248 while (rs.next()) {
10249 BlackboardArtifact.Type artifactType =
getArtifactType(rs.getInt(
"artifact_type_id"));
10250 if (artifactType != null) {
10251 artifacts.add(
new BlackboardArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"), rs.getLong(
"artifact_obj_id"), rs.getLong(
"data_source_obj_id"),
10252 rs.getInt(
"artifact_type_id"), artifactType.getTypeName(), artifactType.getDisplayName(),
10253 BlackboardArtifact.ReviewStatus.withID(rs.getInt(
"review_status_id"))));
10255 throw new TskCoreException(
"Error looking up artifact type ID " + rs.getInt(
"artifact_type_id") +
" from artifact " + rs.getLong(
"artifact_id"));
10258 }
catch (SQLException e) {
10259 logger.log(Level.SEVERE,
"Error getting artifacts from result set", e);
10322 CaseDbConnection getConnection() throws TskCoreException {
10323 return connections.getConnection();
10333 String getCaseHandleIdentifier() {
10334 return caseHandleIdentifier;
10353 connections.close();
10354 }
catch (TskCoreException ex) {
10355 logger.log(Level.SEVERE,
"Error closing database connection pool.", ex);
10358 fileSystemIdMap.clear();
10361 if (this.caseHandle != null) {
10362 this.caseHandle.free();
10363 this.caseHandle = null;
10365 }
catch (TskCoreException ex) {
10366 logger.log(Level.SEVERE,
"Error freeing case handle.", ex);
10385 long id = file.getId();
10386 FileKnown currentKnown = file.getKnown();
10387 if (currentKnown.compareTo(fileKnown) > 0) {
10391 try (CaseDbConnection connection = connections.getConnection();
10392 Statement statement = connection.createStatement();) {
10393 connection.executeUpdate(statement,
"UPDATE tsk_files "
10394 +
"SET known='" + fileKnown.getFileKnownValue() +
"' "
10395 +
"WHERE obj_id=" + id);
10397 file.setKnown(fileKnown);
10398 }
catch (SQLException ex) {
10399 throw new TskCoreException(
"Error setting Known status.", ex);
10414 void setFileName(String name,
long objId)
throws TskCoreException {
10416 try (CaseDbConnection connection = connections.getConnection();) {
10418 preparedStatement.clearParameters();
10419 preparedStatement.setString(1, name);
10420 preparedStatement.setLong(2, objId);
10421 connection.executeUpdate(preparedStatement);
10422 }
catch (SQLException ex) {
10423 throw new TskCoreException(String.format(
"Error updating while the name for object ID %d to %s", objId, name), ex);
10437 void setImageName(String name,
long objId)
throws TskCoreException {
10439 try (CaseDbConnection connection = connections.getConnection();) {
10440 PreparedStatement preparedStatement = connection.getPreparedStatement(SleuthkitCase.PREPARED_STATEMENT.UPDATE_IMAGE_NAME);
10441 preparedStatement.clearParameters();
10442 preparedStatement.setString(1, name);
10443 preparedStatement.setLong(2, objId);
10444 connection.executeUpdate(preparedStatement);
10445 }
catch (SQLException ex) {
10446 throw new TskCoreException(String.format(
"Error updating while the name for object ID %d to %s", objId, name), ex);
10466 void setImageSizes(Image image,
long totalSize,
long sectorSize)
throws TskCoreException {
10469 try (CaseDbConnection connection = connections.getConnection();) {
10470 PreparedStatement preparedStatement = connection.getPreparedStatement(SleuthkitCase.PREPARED_STATEMENT.UPDATE_IMAGE_SIZES);
10471 preparedStatement.clearParameters();
10472 preparedStatement.setLong(1, totalSize);
10473 preparedStatement.setLong(2, sectorSize);
10474 preparedStatement.setLong(3, image.getId());
10475 connection.executeUpdate(preparedStatement);
10476 }
catch (SQLException ex) {
10477 throw new TskCoreException(String.format(
"Error updating image sizes to %d and sector size to %d for object ID %d ", totalSize, sectorSize, image.getId()), ex);
10494 try (CaseDbConnection connection = connections.getConnection();
10495 Statement statement = connection.createStatement()) {
10496 connection.executeUpdate(statement, String.format(
"UPDATE tsk_files SET mime_type = '%s' WHERE obj_id = %d", mimeType, file.getId()));
10497 file.setMIMEType(mimeType);
10498 }
catch (SQLException ex) {
10499 throw new TskCoreException(String.format(
"Error setting MIME type for file (obj_id = %s)", file.getId()), ex);
10518 short metaFlag = file.getMetaFlagsAsInt();
10527 try (CaseDbConnection connection = connections.getConnection();
10528 Statement statement = connection.createStatement();) {
10529 connection.executeUpdate(statement, String.format(
"UPDATE tsk_files SET meta_flags = '%d', dir_flags = '%d' WHERE obj_id = %d", newMetaFlgs, newDirFlags, file.getId()));
10536 }
catch (SQLException ex) {
10537 throw new TskCoreException(String.format(
"Error setting unalloc meta flag for file (obj_id = %s)", file.getId()), ex);
10552 void setMd5Hash(AbstractFile file, String md5Hash)
throws TskCoreException {
10553 if (md5Hash == null) {
10556 long id = file.getId();
10558 try (CaseDbConnection connection = connections.getConnection();) {
10559 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_FILE_MD5);
10560 statement.clearParameters();
10561 statement.setString(1, md5Hash.toLowerCase());
10562 statement.setLong(2,
id);
10563 connection.executeUpdate(statement);
10564 file.setMd5Hash(md5Hash.toLowerCase());
10565 }
catch (SQLException ex) {
10566 throw new TskCoreException(
"Error setting MD5 hash", ex);
10581 void setMd5ImageHash(Image img, String md5Hash)
throws TskCoreException {
10582 if (md5Hash == null) {
10585 long id = img.getId();
10587 try (CaseDbConnection connection = connections.getConnection();) {
10588 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_MD5);
10589 statement.clearParameters();
10590 statement.setString(1, md5Hash.toLowerCase());
10591 statement.setLong(2,
id);
10592 connection.executeUpdate(statement);
10593 }
catch (SQLException ex) {
10594 throw new TskCoreException(
"Error setting MD5 hash", ex);
10610 String getMd5ImageHash(Image img)
throws TskCoreException {
10611 long id = img.getId();
10612 CaseDbConnection connection = null;
10613 ResultSet rs = null;
10617 connection = connections.getConnection();
10619 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_MD5);
10620 statement.clearParameters();
10621 statement.setLong(1,
id);
10622 rs = connection.executeQuery(statement);
10624 hash = rs.getString(
"md5");
10627 }
catch (SQLException ex) {
10628 throw new TskCoreException(
"Error getting MD5 hash", ex);
10630 closeResultSet(rs);
10631 closeConnection(connection);
10645 void setSha1ImageHash(Image img, String sha1Hash)
throws TskCoreException {
10646 if (sha1Hash == null) {
10649 long id = img.getId();
10651 try (CaseDbConnection connection = connections.getConnection();) {
10652 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_SHA1);
10653 statement.clearParameters();
10654 statement.setString(1, sha1Hash.toLowerCase());
10655 statement.setLong(2,
id);
10656 connection.executeUpdate(statement);
10657 }
catch (SQLException ex) {
10658 throw new TskCoreException(
"Error setting SHA1 hash", ex);
10674 String getSha1ImageHash(Image img)
throws TskCoreException {
10675 long id = img.getId();
10676 CaseDbConnection connection = null;
10677 ResultSet rs = null;
10681 connection = connections.getConnection();
10683 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_SHA1);
10684 statement.clearParameters();
10685 statement.setLong(1,
id);
10686 rs = connection.executeQuery(statement);
10688 hash = rs.getString(
"sha1");
10691 }
catch (SQLException ex) {
10692 throw new TskCoreException(
"Error getting SHA1 hash", ex);
10694 closeResultSet(rs);
10695 closeConnection(connection);
10709 void setSha256ImageHash(Image img, String sha256Hash)
throws TskCoreException {
10710 if (sha256Hash == null) {
10713 long id = img.getId();
10715 try (CaseDbConnection connection = connections.getConnection();) {
10716 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_SHA256);
10717 statement.clearParameters();
10718 statement.setString(1, sha256Hash.toLowerCase());
10719 statement.setLong(2,
id);
10720 connection.executeUpdate(statement);
10721 }
catch (SQLException ex) {
10722 throw new TskCoreException(
"Error setting SHA256 hash", ex);
10738 String getSha256ImageHash(Image img)
throws TskCoreException {
10739 long id = img.getId();
10740 CaseDbConnection connection = null;
10741 ResultSet rs = null;
10745 connection = connections.getConnection();
10747 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_SHA256);
10748 statement.clearParameters();
10749 statement.setLong(1,
id);
10750 rs = connection.executeQuery(statement);
10752 hash = rs.getString(
"sha256");
10755 }
catch (SQLException ex) {
10756 throw new TskCoreException(
"Error setting SHA256 hash", ex);
10758 closeResultSet(rs);
10759 closeConnection(connection);
10772 void setAcquisitionDetails(DataSource datasource, String details)
throws TskCoreException {
10774 long id = datasource.getId();
10776 try (CaseDbConnection connection = connections.getConnection();) {
10777 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ACQUISITION_DETAILS);
10778 statement.clearParameters();
10779 statement.setString(1, details);
10780 statement.setLong(2,
id);
10781 connection.executeUpdate(statement);
10782 }
catch (SQLException ex) {
10783 throw new TskCoreException(
"Error setting acquisition details", ex);
10800 void setAcquisitionToolDetails(DataSource datasource, String name, String version, String settings)
throws TskCoreException {
10802 long id = datasource.getId();
10804 try (CaseDbConnection connection = connections.getConnection();) {
10805 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ACQUISITION_TOOL_SETTINGS);
10806 statement.clearParameters();
10807 statement.setString(1, settings);
10808 statement.setString(2, name);
10809 statement.setString(3, version);
10810 statement.setLong(4,
id);
10811 connection.executeUpdate(statement);
10812 }
catch (SQLException ex) {
10813 throw new TskCoreException(
"Error setting acquisition details", ex);
10828 void setAcquisitionDetails(
long dataSourceId, String details, CaseDbTransaction trans)
throws TskCoreException {
10830 CaseDbConnection connection = trans.getConnection();
10831 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ACQUISITION_DETAILS);
10832 statement.clearParameters();
10833 statement.setString(1, details);
10834 statement.setLong(2, dataSourceId);
10835 connection.executeUpdate(statement);
10836 }
catch (SQLException ex) {
10837 throw new TskCoreException(
"Error setting acquisition details", ex);
10850 String getAcquisitionDetails(DataSource datasource)
throws TskCoreException {
10851 long id = datasource.getId();
10852 CaseDbConnection connection = null;
10853 ResultSet rs = null;
10857 connection = connections.getConnection();
10859 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ACQUISITION_DETAILS);
10860 statement.clearParameters();
10861 statement.setLong(1,
id);
10862 rs = connection.executeQuery(statement);
10864 hash = rs.getString(
"acquisition_details");
10867 }
catch (SQLException ex) {
10868 throw new TskCoreException(
"Error setting acquisition details", ex);
10870 closeResultSet(rs);
10871 closeConnection(connection);
10886 String getDataSourceInfoString(DataSource datasource, String columnName)
throws TskCoreException {
10887 long id = datasource.getId();
10888 CaseDbConnection connection = null;
10889 ResultSet rs = null;
10890 String returnValue =
"";
10893 connection = connections.getConnection();
10895 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ACQUISITION_TOOL_SETTINGS);
10896 statement.clearParameters();
10897 statement.setLong(1,
id);
10898 rs = connection.executeQuery(statement);
10900 returnValue = rs.getString(columnName);
10902 return returnValue;
10903 }
catch (SQLException ex) {
10904 throw new TskCoreException(
"Error setting acquisition details", ex);
10906 closeResultSet(rs);
10907 closeConnection(connection);
10922 Long getDataSourceInfoLong(DataSource datasource, String columnName)
throws TskCoreException {
10923 long id = datasource.getId();
10924 CaseDbConnection connection = null;
10925 ResultSet rs = null;
10926 Long returnValue = null;
10929 connection = connections.getConnection();
10931 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ACQUISITION_TOOL_SETTINGS);
10932 statement.clearParameters();
10933 statement.setLong(1,
id);
10934 rs = connection.executeQuery(statement);
10936 returnValue = rs.getLong(columnName);
10938 return returnValue;
10939 }
catch (SQLException ex) {
10940 throw new TskCoreException(
"Error setting acquisition details", ex);
10942 closeResultSet(rs);
10943 closeConnection(connection);
10959 if (newStatus == null) {
10963 try (CaseDbConnection connection = connections.getConnection();
10964 Statement statement = connection.createStatement();) {
10965 connection.executeUpdate(statement,
"UPDATE blackboard_artifacts "
10966 +
" SET review_status_id=" + newStatus.getID()
10967 +
" WHERE blackboard_artifacts.artifact_id = " + artifact.
getArtifactID());
10968 }
catch (SQLException ex) {
10969 throw new TskCoreException(
"Error setting review status", ex);
10986 CaseDbConnection connection = null;
10987 Statement s = null;
10988 ResultSet rs = null;
10991 connection = connections.getConnection();
10992 s = connection.createStatement();
10993 Short contentShort = contentType.getValue();
10994 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE meta_type = '" + contentShort.toString() +
"'");
10997 count = rs.getInt(
"count");
11000 }
catch (SQLException ex) {
11001 throw new TskCoreException(
"Error getting number of objects.", ex);
11003 closeResultSet(rs);
11005 closeConnection(connection);
11019 String escapedText = null;
11020 if (text != null) {
11021 escapedText = text.replaceAll(
"'",
"''");
11023 return escapedText;
11034 if (md5Hash == null) {
11035 return Collections.<AbstractFile>emptyList();
11038 CaseDbConnection connection = null;
11039 Statement s = null;
11040 ResultSet rs = null;
11043 connection = connections.getConnection();
11044 s = connection.createStatement();
11045 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE "
11046 +
" md5 = '" + md5Hash.toLowerCase() +
"' "
11048 return resultSetToAbstractFiles(rs, connection);
11049 }
catch (SQLException | TskCoreException ex) {
11050 logger.log(Level.WARNING,
"Error querying database.", ex);
11052 closeResultSet(rs);
11054 closeConnection(connection);
11057 return Collections.<AbstractFile>emptyList();
11067 boolean allFilesAreHashed =
false;
11069 CaseDbConnection connection = null;
11070 Statement s = null;
11071 ResultSet rs = null;
11074 connection = connections.getConnection();
11075 s = connection.createStatement();
11076 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
11078 +
"AND md5 IS NULL "
11079 +
"AND size > '0'");
11080 if (rs.next() && rs.getInt(
"count") == 0) {
11081 allFilesAreHashed =
true;
11083 }
catch (SQLException | TskCoreException ex) {
11084 logger.log(Level.WARNING,
"Failed to query whether all files have MD5 hashes", ex);
11086 closeResultSet(rs);
11088 closeConnection(connection);
11091 return allFilesAreHashed;
11103 CaseDbConnection connection = null;
11104 Statement s = null;
11105 ResultSet rs = null;
11107 connection = connections.getConnection();
11108 s = connection.createStatement();
11109 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
11110 +
"WHERE md5 IS NOT NULL "
11111 +
"AND size > '0'");
11113 count = rs.getInt(
"count");
11115 }
catch (SQLException | TskCoreException ex) {
11116 logger.log(Level.WARNING,
"Failed to query for all the files.", ex);
11118 closeResultSet(rs);
11120 closeConnection(connection);
11136 CaseDbConnection connection = null;
11137 ResultSet resultSet = null;
11140 connection = connections.getConnection();
11143 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES);
11144 resultSet = connection.executeQuery(statement);
11145 ArrayList<TagName> tagNames =
new ArrayList<>();
11146 while (resultSet.next()) {
11147 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11149 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank")));
11152 }
catch (SQLException ex) {
11153 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
11155 closeResultSet(resultSet);
11156 closeConnection(connection);
11172 CaseDbConnection connection = null;
11173 ResultSet resultSet = null;
11176 connection = connections.getConnection();
11179 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE);
11180 resultSet = connection.executeQuery(statement);
11181 ArrayList<TagName> tagNames =
new ArrayList<>();
11182 while (resultSet.next()) {
11183 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11185 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank")));
11188 }
catch (SQLException ex) {
11189 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
11191 closeResultSet(resultSet);
11192 closeConnection(connection);
11211 ArrayList<TagName> tagNames =
new ArrayList<>();
11217 CaseDbConnection connection = null;
11218 ResultSet resultSet = null;
11221 connection = connections.getConnection();
11223 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE_BY_DATASOURCE);
11224 statement.setLong(1, dsObjId);
11225 statement.setLong(2, dsObjId);
11226 resultSet = connection.executeQuery(statement);
11227 while (resultSet.next()) {
11228 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11230 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank")));
11233 }
catch (SQLException ex) {
11234 throw new TskCoreException(
"Failed to get tag names in use for data source objID : " + dsObjId, ex);
11236 closeResultSet(resultSet);
11237 closeConnection(connection);
11276 try (CaseDbConnection connection = connections.getConnection();) {
11277 PreparedStatement statement;
11279 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OR_UPDATE_TAG_NAME, Statement.RETURN_GENERATED_KEYS);
11280 statement.clearParameters();
11281 statement.setString(5, description);
11282 statement.setString(6, color.getName());
11283 statement.setByte(7, knownStatus.getFileKnownValue());
11284 statement.setString(1, displayName);
11285 statement.setString(2, description);
11286 statement.setString(3, color.getName());
11287 statement.setByte(4, knownStatus.getFileKnownValue());
11288 connection.executeUpdate(statement);
11290 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAME_BY_NAME);
11291 statement.clearParameters();
11292 statement.setString(1, displayName);
11293 try (ResultSet resultSet = connection.executeQuery(statement)) {
11295 return new TagName(resultSet.getLong(
"tag_name_id"), displayName, description, color, knownStatus, resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
11297 }
catch (SQLException ex) {
11298 throw new TskCoreException(
"Error adding row for " + displayName +
" tag name to tag_names table", ex);
11332 PreparedStatement statement = trans.getConnection().getPreparedStatement(PREPARED_STATEMENT.DELETE_CONTENT_TAG);
11333 statement.clearParameters();
11334 statement.setLong(1, tag.getId());
11335 trans.getConnection().executeUpdate(statement);
11338 Long contentId = tag.getContent() != null ? tag.getContent().getId() : null;
11339 Long dataSourceId = tag.getContent() != null && tag.getContent().getDataSource() != null
11340 ? tag.getContent().getDataSource().getId()
11343 this.
getScoringManager().updateAggregateScoreAfterDeletion(contentId, dataSourceId, trans);
11347 }
catch (SQLException ex) {
11348 throw new TskCoreException(
"Error deleting row from content_tags table (id = " + tag.getId() +
")", ex);
11350 if (trans != null) {
11365 CaseDbConnection connection = null;
11366 ResultSet resultSet = null;
11369 connection = connections.getConnection();
11375 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS);
11376 resultSet = connection.executeQuery(statement);
11377 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
11378 while (resultSet.next()) {
11379 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11381 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
11383 tags.add(
new ContentTag(resultSet.getLong(
"tag_id"), content, tagName, resultSet.getString(
"comment"),
11384 resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name")));
11387 }
catch (SQLException ex) {
11388 throw new TskCoreException(
"Error selecting rows from content_tags table", ex);
11390 closeResultSet(resultSet);
11391 closeConnection(connection);
11407 if (tagName.getId() ==
Tag.ID_NOT_SET) {
11408 throw new TskCoreException(
"TagName object is invalid, id not set");
11410 CaseDbConnection connection = null;
11411 ResultSet resultSet = null;
11414 connection = connections.getConnection();
11417 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME);
11418 statement.clearParameters();
11419 statement.setLong(1, tagName.getId());
11420 resultSet = connection.executeQuery(statement);
11421 if (resultSet.next()) {
11422 return resultSet.getLong(
"count");
11424 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
11426 }
catch (SQLException ex) {
11427 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
11429 closeResultSet(resultSet);
11430 closeConnection(connection);
11452 if (tagName.getId() ==
Tag.ID_NOT_SET) {
11453 throw new TskCoreException(
"TagName object is invalid, id not set");
11456 CaseDbConnection connection = null;
11457 ResultSet resultSet = null;
11460 connection = connections.getConnection();
11465 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
11466 statement.clearParameters();
11467 statement.setLong(1, tagName.getId());
11468 statement.setLong(2, dsObjId);
11470 resultSet = connection.executeQuery(statement);
11471 if (resultSet.next()) {
11472 return resultSet.getLong(
"count");
11474 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")" +
" for dsObjId = " + dsObjId);
11476 }
catch (SQLException ex) {
11477 throw new TskCoreException(
"Failed to get content_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
11479 closeResultSet(resultSet);
11480 closeConnection(connection);
11497 CaseDbConnection connection = null;
11498 ResultSet resultSet = null;
11502 connection = connections.getConnection();
11509 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAG_BY_ID);
11510 statement.clearParameters();
11511 statement.setLong(1, contentTagID);
11512 resultSet = connection.executeQuery(statement);
11514 while (resultSet.next()) {
11515 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11517 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
11519 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
11523 }
catch (SQLException ex) {
11524 throw new TskCoreException(
"Error getting content tag with id = " + contentTagID, ex);
11526 closeResultSet(resultSet);
11527 closeConnection(connection);
11545 if (tagName.getId() ==
Tag.ID_NOT_SET) {
11546 throw new TskCoreException(
"TagName object is invalid, id not set");
11548 CaseDbConnection connection = null;
11549 ResultSet resultSet = null;
11552 connection = connections.getConnection();
11558 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME);
11559 statement.clearParameters();
11560 statement.setLong(1, tagName.getId());
11561 resultSet = connection.executeQuery(statement);
11562 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
11563 while (resultSet.next()) {
11565 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
11570 }
catch (SQLException ex) {
11571 throw new TskCoreException(
"Error getting content_tags rows (tag_name_id = " + tagName.getId() +
")", ex);
11573 closeResultSet(resultSet);
11574 closeConnection(connection);
11593 CaseDbConnection connection = null;
11594 ResultSet resultSet = null;
11597 connection = connections.getConnection();
11605 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
11606 statement.clearParameters();
11607 statement.setLong(1, tagName.getId());
11608 statement.setLong(2, dsObjId);
11609 resultSet = connection.executeQuery(statement);
11610 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
11611 while (resultSet.next()) {
11613 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
11618 }
catch (SQLException ex) {
11619 throw new TskCoreException(
"Failed to get content_tags row count for tag_name_id = " + tagName.getId() +
" data source objID : " + dsObjId, ex);
11621 closeResultSet(resultSet);
11622 closeConnection(connection);
11639 CaseDbConnection connection = null;
11640 ResultSet resultSet = null;
11643 connection = connections.getConnection();
11650 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_CONTENT);
11651 statement.clearParameters();
11652 statement.setLong(1, content.getId());
11653 resultSet = connection.executeQuery(statement);
11654 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
11655 while (resultSet.next()) {
11656 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11658 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
11660 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
11664 }
catch (SQLException ex) {
11665 throw new TskCoreException(
"Error getting content tags data for content (obj_id = " + content.getId() +
")", ex);
11667 closeResultSet(resultSet);
11668 closeConnection(connection);
11701 PreparedStatement statement = trans.getConnection().getPreparedStatement(PREPARED_STATEMENT.DELETE_ARTIFACT_TAG);
11702 statement.clearParameters();
11703 statement.setLong(1, tag.getId());
11704 trans.getConnection().executeUpdate(statement);
11707 Long artifactObjId = tag.getArtifact().getId();
11708 Long dataSourceId = tag.getContent() != null && tag.getContent().getDataSource() != null
11709 ? tag.getContent().getDataSource().getId()
11712 this.
getScoringManager().updateAggregateScoreAfterDeletion(artifactObjId, dataSourceId, trans);
11716 }
catch (SQLException ex) {
11717 throw new TskCoreException(
"Error deleting row from blackboard_artifact_tags table (id = " + tag.getId() +
")", ex);
11719 if (trans != null) {
11735 CaseDbConnection connection = null;
11736 ResultSet resultSet = null;
11739 connection = connections.getConnection();
11745 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS);
11746 resultSet = connection.executeQuery(statement);
11747 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<>();
11748 while (resultSet.next()) {
11749 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11751 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
11755 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
11759 }
catch (SQLException ex) {
11760 throw new TskCoreException(
"Error selecting rows from blackboard_artifact_tags table", ex);
11762 closeResultSet(resultSet);
11763 closeConnection(connection);
11779 if (tagName.getId() ==
Tag.ID_NOT_SET) {
11780 throw new TskCoreException(
"TagName object is invalid, id not set");
11782 CaseDbConnection connection = null;
11783 ResultSet resultSet = null;
11786 connection = connections.getConnection();
11789 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME);
11790 statement.clearParameters();
11791 statement.setLong(1, tagName.getId());
11792 resultSet = connection.executeQuery(statement);
11793 if (resultSet.next()) {
11794 return resultSet.getLong(
"count");
11796 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
11798 }
catch (SQLException ex) {
11799 throw new TskCoreException(
"Error getting blackboard artifact_content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
11801 closeResultSet(resultSet);
11802 closeConnection(connection);
11823 if (tagName.getId() ==
Tag.ID_NOT_SET) {
11824 throw new TskCoreException(
"TagName object is invalid, id not set");
11827 CaseDbConnection connection = null;
11828 ResultSet resultSet = null;
11831 connection = connections.getConnection();
11836 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME_BY_DATASOURCE);
11837 statement.clearParameters();
11838 statement.setLong(1, tagName.getId());
11839 statement.setLong(2, dsObjId);
11840 resultSet = connection.executeQuery(statement);
11841 if (resultSet.next()) {
11842 return resultSet.getLong(
"count");
11844 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() +
")" +
" for dsObjId = " + dsObjId);
11846 }
catch (SQLException ex) {
11847 throw new TskCoreException(
"Failed to get blackboard_artifact_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
11849 closeResultSet(resultSet);
11850 closeConnection(connection);
11867 if (tagName.getId() ==
Tag.ID_NOT_SET) {
11868 throw new TskCoreException(
"TagName object is invalid, id not set");
11870 CaseDbConnection connection = null;
11871 ResultSet resultSet = null;
11874 connection = connections.getConnection();
11880 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME);
11881 statement.clearParameters();
11882 statement.setLong(1, tagName.getId());
11883 resultSet = connection.executeQuery(statement);
11884 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
11885 while (resultSet.next()) {
11889 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
11893 }
catch (SQLException ex) {
11894 throw new TskCoreException(
"Error getting blackboard artifact tags data (tag_name_id = " + tagName.getId() +
")", ex);
11896 closeResultSet(resultSet);
11897 closeConnection(connection);
11918 if (tagName.getId() ==
Tag.ID_NOT_SET) {
11919 throw new TskCoreException(
"TagName object is invalid, id not set");
11922 CaseDbConnection connection = null;
11923 ResultSet resultSet = null;
11926 connection = connections.getConnection();
11934 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
11935 statement.clearParameters();
11936 statement.setLong(1, tagName.getId());
11937 statement.setLong(2, dsObjId);
11938 resultSet = connection.executeQuery(statement);
11939 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
11940 while (resultSet.next()) {
11944 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
11948 }
catch (SQLException ex) {
11949 throw new TskCoreException(
"Failed to get blackboard_artifact_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
11951 closeResultSet(resultSet);
11952 closeConnection(connection);
11971 CaseDbConnection connection = null;
11972 ResultSet resultSet = null;
11976 connection = connections.getConnection();
11983 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAG_BY_ID);
11984 statement.clearParameters();
11985 statement.setLong(1, artifactTagID);
11986 resultSet = connection.executeQuery(statement);
11988 while (resultSet.next()) {
11989 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11991 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
11995 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
11999 }
catch (SQLException ex) {
12000 throw new TskCoreException(
"Error getting blackboard artifact tag with id = " + artifactTagID, ex);
12002 closeResultSet(resultSet);
12003 closeConnection(connection);
12022 CaseDbConnection connection = null;
12023 ResultSet resultSet = null;
12026 connection = connections.getConnection();
12033 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_ARTIFACT);
12034 statement.clearParameters();
12035 statement.setLong(1, artifact.getArtifactID());
12036 resultSet = connection.executeQuery(statement);
12037 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<>();
12038 while (resultSet.next()) {
12039 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
12041 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
12044 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
12048 }
catch (SQLException ex) {
12049 throw new TskCoreException(
"Error getting blackboard artifact tags data (artifact_id = " + artifact.getArtifactID() +
")", ex);
12051 closeResultSet(resultSet);
12052 closeConnection(connection);
12067 try (CaseDbConnection connection = connections.getConnection();) {
12069 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_PATH);
12070 statement.clearParameters();
12071 statement.setString(1, newPath);
12072 statement.setLong(2, objectId);
12073 connection.executeUpdate(statement);
12074 }
catch (SQLException ex) {
12075 throw new TskCoreException(
"Error updating image path in database for object " + objectId, ex);
12094 public Report addReport(String localPath, String sourceModuleName, String reportName)
throws TskCoreException {
12095 return addReport(localPath, sourceModuleName, reportName, null);
12116 String relativePath =
"";
12117 long createTime = 0;
12118 String localPathLower = localPath.toLowerCase();
12120 if (localPathLower.startsWith(
"http")) {
12121 relativePath = localPathLower;
12122 createTime = System.currentTimeMillis() / 1000;
12133 int length =
new File(casePathLower).toURI().relativize(
new File(localPathLower).toURI()).getPath().length();
12134 relativePath =
new File(localPath.substring(localPathLower.length() - length)).getPath();
12135 }
catch (IllegalArgumentException ex) {
12136 String errorMessage = String.format(
"Local path %s not in the database directory or one of its subdirectories", localPath);
12137 throw new TskCoreException(errorMessage, ex);
12141 java.io.File tempFile =
new java.io.File(localPath);
12143 createTime = tempFile.lastModified() / 1000;
12144 }
catch (Exception ex) {
12145 throw new TskCoreException(
"Could not get create time for report at " + localPath, ex);
12151 try (CaseDbConnection connection = connections.getConnection();) {
12154 long parentObjId = 0;
12155 if (parent != null) {
12156 parentObjId = parent.getId();
12161 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_REPORT);
12162 statement.clearParameters();
12163 statement.setLong(1, objectId);
12164 statement.setString(2, relativePath);
12165 statement.setLong(3, createTime);
12166 statement.setString(4, sourceModuleName);
12167 statement.setString(5, reportName);
12168 connection.executeUpdate(statement);
12169 return new Report(
this, objectId, localPath, createTime, sourceModuleName, reportName, parent);
12170 }
catch (SQLException ex) {
12171 throw new TskCoreException(
"Error adding report " + localPath +
" to reports table", ex);
12186 CaseDbConnection connection = null;
12187 ResultSet resultSet = null;
12188 ResultSet parentResultSet = null;
12189 PreparedStatement statement = null;
12190 Statement parentStatement = null;
12193 connection = connections.getConnection();
12196 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_REPORTS);
12197 parentStatement = connection.createStatement();
12198 resultSet = connection.executeQuery(statement);
12199 ArrayList<Report> reports =
new ArrayList<Report>();
12200 while (resultSet.next()) {
12201 String localpath = resultSet.getString(
"path");
12202 if (localpath.toLowerCase().startsWith(
"http") ==
false) {
12204 localpath = Paths.get(
getDbDirPath(), localpath).normalize().toString();
12209 long reportId = resultSet.getLong(
"obj_id");
12210 String parentQuery = String.format(
"SELECT * FROM tsk_objects WHERE obj_id = %s;", reportId);
12211 parentResultSet = parentStatement.executeQuery(parentQuery);
12212 if (parentResultSet.next()) {
12213 long parentId = parentResultSet.getLong(
"par_obj_id");
12216 parentResultSet.close();
12218 reports.add(
new Report(
this,
12221 resultSet.getLong(
"crtime"),
12222 resultSet.getString(
"src_module_name"),
12223 resultSet.getString(
"report_name"),
12227 }
catch (SQLException ex) {
12228 throw new TskCoreException(
"Error querying reports table", ex);
12230 closeResultSet(resultSet);
12231 closeResultSet(parentResultSet);
12232 closeStatement(statement);
12233 closeStatement(parentStatement);
12235 closeConnection(connection);
12250 CaseDbConnection connection = null;
12251 PreparedStatement statement = null;
12252 Statement parentStatement = null;
12253 ResultSet resultSet = null;
12254 ResultSet parentResultSet = null;
12258 connection = connections.getConnection();
12261 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_REPORT_BY_ID);
12262 parentStatement = connection.createStatement();
12263 statement.clearParameters();
12264 statement.setLong(1,
id);
12265 resultSet = connection.executeQuery(statement);
12267 if (resultSet.next()) {
12270 String parentQuery = String.format(
"SELECT * FROM tsk_objects WHERE obj_id = %s;",
id);
12271 parentResultSet = parentStatement.executeQuery(parentQuery);
12272 if (parentResultSet.next()) {
12273 long parentId = parentResultSet.getLong(
"par_obj_id");
12277 report =
new Report(
this, resultSet.getLong(
"obj_id"),
12278 Paths.get(
getDbDirPath(), resultSet.getString(
"path")).normalize().toString(),
12279 resultSet.getLong(
"crtime"),
12280 resultSet.getString(
"src_module_name"),
12281 resultSet.getString(
"report_name"),
12284 throw new TskCoreException(
"No report found for id: " +
id);
12286 }
catch (SQLException ex) {
12287 throw new TskCoreException(
"Error querying reports table for id: " +
id, ex);
12289 closeResultSet(resultSet);
12290 closeResultSet(parentResultSet);
12291 closeStatement(statement);
12292 closeStatement(parentStatement);
12293 closeConnection(connection);
12309 try (CaseDbConnection connection = connections.getConnection();) {
12311 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_REPORT);
12312 statement.setLong(1, report.getId());
12313 connection.executeUpdate(statement);
12315 statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_REPORT_TSK_OBJECT);
12316 statement.setLong(1, report.getId());
12318 connection.executeUpdate(statement);
12319 }
catch (SQLException ex) {
12320 throw new TskCoreException(
"Error querying reports table", ex);
12326 static void closeResultSet(ResultSet resultSet) {
12327 if (resultSet != null) {
12330 }
catch (SQLException ex) {
12331 logger.log(Level.SEVERE,
"Error closing ResultSet", ex);
12336 static void closeStatement(Statement statement) {
12337 if (statement != null) {
12340 }
catch (SQLException ex) {
12341 logger.log(Level.SEVERE,
"Error closing Statement", ex);
12347 static void closeConnection(CaseDbConnection connection) {
12348 if (connection != null) {
12349 connection.close();
12353 private static void rollbackTransaction(CaseDbConnection connection) {
12354 if (connection != null) {
12355 connection.rollbackTransaction();
12367 void setIngestJobEndDateTime(
long ingestJobId,
long endDateTime)
throws TskCoreException {
12369 try (CaseDbConnection connection = connections.getConnection();) {
12370 Statement statement = connection.createStatement();
12371 statement.executeUpdate(
"UPDATE ingest_jobs SET end_date_time=" + endDateTime +
" WHERE ingest_job_id=" + ingestJobId +
";");
12372 }
catch (SQLException ex) {
12373 throw new TskCoreException(
"Error updating the end date (ingest_job_id = " + ingestJobId +
".", ex);
12379 void setIngestJobStatus(
long ingestJobId, IngestJobStatusType status)
throws TskCoreException {
12381 try (CaseDbConnection connection = connections.getConnection();
12382 Statement statement = connection.createStatement();) {
12383 statement.executeUpdate(
"UPDATE ingest_jobs SET status_id=" + status.ordinal() +
" WHERE ingest_job_id=" + ingestJobId +
";");
12384 }
catch (SQLException ex) {
12385 throw new TskCoreException(
"Error ingest job status (ingest_job_id = " + ingestJobId +
".", ex);
12408 CaseDbConnection connection = null;
12410 ResultSet resultSet = null;
12411 Statement statement;
12413 connection = connections.getConnection();
12414 connection.beginTransaction();
12415 statement = connection.createStatement();
12416 PreparedStatement insertStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INGEST_JOB, Statement.RETURN_GENERATED_KEYS);
12417 insertStatement.setLong(1, dataSource.getId());
12418 insertStatement.setString(2, hostName);
12419 insertStatement.setLong(3, jobStart.getTime());
12420 insertStatement.setLong(4, jobEnd.getTime());
12421 insertStatement.setInt(5, status.ordinal());
12422 insertStatement.setString(6, settingsDir);
12423 connection.executeUpdate(insertStatement);
12424 resultSet = insertStatement.getGeneratedKeys();
12426 long id = resultSet.getLong(1);
12427 for (
int i = 0; i < ingestModules.size(); i++) {
12429 statement.executeUpdate(
"INSERT INTO ingest_job_modules (ingest_job_id, ingest_module_id, pipeline_position) "
12430 +
"VALUES (" +
id +
", " + ingestModule.
getIngestModuleId() +
", " + i +
");");
12434 connection.commitTransaction();
12435 return new IngestJobInfo(
id, dataSource.getId(), hostName, jobStart,
"", ingestModules,
this);
12436 }
catch (SQLException ex) {
12437 rollbackTransaction(connection);
12438 throw new TskCoreException(
"Error adding the ingest job.", ex);
12440 closeResultSet(resultSet);
12441 closeConnection(connection);
12460 CaseDbConnection connection = null;
12461 ResultSet resultSet = null;
12462 Statement statement = null;
12463 String uniqueName = factoryClassName +
"-" + displayName +
"-" + type.toString() +
"-" + version;
12466 connection = connections.getConnection();
12467 statement = connection.createStatement();
12468 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
12469 if (!resultSet.next()) {
12472 PreparedStatement insertStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INGEST_MODULE, Statement.RETURN_GENERATED_KEYS);
12473 insertStatement.setString(1, displayName);
12474 insertStatement.setString(2, uniqueName);
12475 insertStatement.setInt(3, type.ordinal());
12476 insertStatement.setString(4, version);
12477 connection.executeUpdate(insertStatement);
12478 resultSet = statement.getGeneratedKeys();
12480 long id = resultSet.getLong(1);
12485 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
12486 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version"));
12488 }
catch (SQLException ex) {
12490 closeStatement(statement);
12491 if (connection != null) {
12492 statement = connection.createStatement();
12493 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
12494 if (resultSet.next()) {
12495 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
12499 throw new TskCoreException(
"Couldn't add new module to database.", ex);
12500 }
catch (SQLException ex1) {
12501 throw new TskCoreException(
"Couldn't add new module to database.", ex1);
12504 closeResultSet(resultSet);
12505 closeStatement(statement);
12506 closeConnection(connection);
12519 CaseDbConnection connection = null;
12520 ResultSet resultSet = null;
12521 Statement statement = null;
12522 List<IngestJobInfo> ingestJobs =
new ArrayList<>();
12525 connection = connections.getConnection();
12526 statement = connection.createStatement();
12527 resultSet = statement.executeQuery(
"SELECT * FROM ingest_jobs");
12528 while (resultSet.next()) {
12529 ingestJobs.add(
new IngestJobInfo(resultSet.getInt(
"ingest_job_id"), resultSet.getLong(
"obj_id"),
12530 resultSet.getString(
"host_name"),
new Date(resultSet.getLong(
"start_date_time")),
12532 resultSet.getString(
"settings_dir"), this.getIngestModules(resultSet.getInt(
"ingest_job_id"), connection),
this));
12535 }
catch (SQLException ex) {
12536 throw new TskCoreException(
"Couldn't get the ingest jobs.", ex);
12538 closeResultSet(resultSet);
12539 closeStatement(statement);
12540 closeConnection(connection);
12555 private List<IngestModuleInfo> getIngestModules(
int ingestJobId, CaseDbConnection connection)
throws SQLException {
12556 ResultSet resultSet = null;
12557 Statement statement = null;
12558 List<IngestModuleInfo> ingestModules =
new ArrayList<>();
12561 statement = connection.createStatement();
12562 resultSet = statement.executeQuery(
"SELECT ingest_job_modules.ingest_module_id AS ingest_module_id, "
12563 +
"ingest_job_modules.pipeline_position AS pipeline_position, "
12564 +
"ingest_modules.display_name AS display_name, ingest_modules.unique_name AS unique_name, "
12565 +
"ingest_modules.type_id AS type_id, ingest_modules.version AS version "
12566 +
"FROM ingest_job_modules, ingest_modules "
12567 +
"WHERE ingest_job_modules.ingest_job_id = " + ingestJobId +
" "
12568 +
"AND ingest_modules.ingest_module_id = ingest_job_modules.ingest_module_id "
12569 +
"ORDER BY (ingest_job_modules.pipeline_position);");
12570 while (resultSet.next()) {
12571 ingestModules.add(
new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
12572 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version")));
12574 return ingestModules;
12576 closeResultSet(resultSet);
12577 closeStatement(statement);
12592 String getInsertOrIgnoreSQL(String sql) {
12595 return " INSERT " + sql +
" ON CONFLICT DO NOTHING ";
12597 return " INSERT OR IGNORE " + sql;
12599 throw new UnsupportedOperationException(
"Unsupported DB type: " +
getDatabaseType().name());
12606 static class ObjectInfo {
12609 private TskData.ObjectType type;
12611 ObjectInfo(
long id, ObjectType type) {
12620 TskData.ObjectType getType() {
12625 private interface DbCommand {
12627 void execute() throws SQLException;
12630 private enum PREPARED_STATEMENT {
12632 SELECT_ARTIFACTS_BY_TYPE(
"SELECT artifact_id, obj_id FROM blackboard_artifacts "
12633 +
"WHERE artifact_type_id = ?"),
12634 COUNT_ARTIFACTS_OF_TYPE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
12635 COUNT_ARTIFACTS_OF_TYPE_BY_DATA_SOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE data_source_obj_id = ? AND artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
12636 COUNT_ARTIFACTS_FROM_SOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE obj_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
12637 COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE obj_id = ? AND artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
12638 SELECT_FILES_BY_PARENT(
"SELECT tsk_files.* "
12639 +
"FROM tsk_objects INNER JOIN tsk_files "
12640 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
12641 +
"WHERE (tsk_objects.par_obj_id = ? ) "
12642 +
"ORDER BY tsk_files.meta_type DESC, LOWER(tsk_files.name)"),
12643 SELECT_FILES_BY_PARENT_AND_TYPE(
"SELECT tsk_files.* "
12644 +
"FROM tsk_objects INNER JOIN tsk_files "
12645 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
12646 +
"WHERE (tsk_objects.par_obj_id = ? AND tsk_files.type = ? ) "
12647 +
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"),
12648 SELECT_FILES_BY_PARENT_AND_NAME(
"SELECT tsk_files.* "
12649 +
"FROM tsk_objects INNER JOIN tsk_files "
12650 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
12651 +
"WHERE (tsk_objects.par_obj_id = ? AND "
12652 +
"LOWER(tsk_files.name) LIKE LOWER(?) AND LOWER(tsk_files.name) NOT LIKE LOWER('%journal%')) "
12653 +
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"),
12654 SELECT_FILES_BY_EXTENSION_AND_PARENT_AND_NAME(
"SELECT tsk_files.* "
12655 +
"FROM tsk_objects INNER JOIN tsk_files "
12656 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
12657 +
"WHERE tsk_files.extension = ? AND "
12658 +
"(tsk_objects.par_obj_id = ? AND "
12659 +
"LOWER(tsk_files.name) LIKE LOWER(?) AND LOWER(tsk_files.name) NOT LIKE LOWER('%journal%')) "
12660 +
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"),
12661 SELECT_FILE_IDS_BY_PARENT(
"SELECT tsk_files.obj_id AS obj_id "
12662 +
"FROM tsk_objects INNER JOIN tsk_files "
12663 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
12664 +
"WHERE (tsk_objects.par_obj_id = ?)"),
12665 SELECT_FILE_IDS_BY_PARENT_AND_TYPE(
"SELECT tsk_files.obj_id AS obj_id "
12666 +
"FROM tsk_objects INNER JOIN tsk_files "
12667 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
12668 +
"WHERE (tsk_objects.par_obj_id = ? "
12669 +
"AND tsk_files.type = ? )"),
12670 SELECT_FILE_BY_ID(
"SELECT * FROM tsk_files WHERE obj_id = ? LIMIT 1"),
12671 SELECT_ARTIFACT_BY_ARTIFACT_OBJ_ID(
"SELECT * FROM blackboard_artifacts WHERE artifact_obj_id = ? LIMIT 1"),
12672 SELECT_ARTIFACT_TYPE_BY_ARTIFACT_OBJ_ID(
"SELECT artifact_type_id FROM blackboard_artifacts WHERE artifact_obj_id = ? LIMIT 1"),
12673 SELECT_ARTIFACT_BY_ARTIFACT_ID(
"SELECT * FROM blackboard_artifacts WHERE artifact_id = ? LIMIT 1"),
12674 INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, review_status_id) "
12675 +
"VALUES (?, ?, ?, ?, ?," + BlackboardArtifact.ReviewStatus.UNDECIDED.getID() +
")"),
12676 POSTGRESQL_INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, review_status_id) "
12677 +
"VALUES (DEFAULT, ?, ?, ?, ?," + BlackboardArtifact.ReviewStatus.UNDECIDED.getID() +
")"),
12678 INSERT_ANALYSIS_RESULT(
"INSERT INTO tsk_analysis_results (artifact_obj_id, conclusion, significance, priority, configuration, justification) "
12679 +
"VALUES (?, ?, ?, ?, ?, ?)"),
12680 INSERT_STRING_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_text) "
12681 +
"VALUES (?,?,?,?,?,?,?)"),
12682 INSERT_BYTE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_byte) "
12683 +
"VALUES (?,?,?,?,?,?,?)"),
12684 INSERT_INT_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int32) "
12685 +
"VALUES (?,?,?,?,?,?,?)"),
12686 INSERT_LONG_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int64) "
12687 +
"VALUES (?,?,?,?,?,?,?)"),
12688 INSERT_DOUBLE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_double) "
12689 +
"VALUES (?,?,?,?,?,?,?)"),
12690 INSERT_FILE_ATTRIBUTE(
"INSERT INTO tsk_file_attributes (obj_id, attribute_type_id, value_type, value_byte, value_text, value_int32, value_int64, value_double) "
12691 +
"VALUES (?,?,?,?,?,?,?,?)"),
12692 SELECT_FILES_BY_DATA_SOURCE_AND_NAME(
"SELECT * FROM tsk_files WHERE LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND data_source_obj_id = ?"),
12693 SELECT_FILES_BY_EXTENSION_AND_DATA_SOURCE_AND_NAME(
"SELECT * FROM tsk_files WHERE extension = ? AND LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND data_source_obj_id = ?"),
12694 SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME(
"SELECT * FROM tsk_files WHERE LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND LOWER(parent_path) LIKE LOWER(?) AND data_source_obj_id = ?"),
12695 SELECT_FILES_BY_EXTENSION_AND_DATA_SOURCE_AND_PARENT_PATH_AND_NAME(
"SELECT * FROM tsk_files WHERE extension = ? AND LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND LOWER(parent_path) LIKE LOWER(?) AND data_source_obj_id = ?"),
12696 UPDATE_FILE_MD5(
"UPDATE tsk_files SET md5 = ? WHERE obj_id = ?"),
12697 UPDATE_IMAGE_MD5(
"UPDATE tsk_image_info SET md5 = ? WHERE obj_id = ?"),
12698 UPDATE_IMAGE_SHA1(
"UPDATE tsk_image_info SET sha1 = ? WHERE obj_id = ?"),
12699 UPDATE_IMAGE_SHA256(
"UPDATE tsk_image_info SET sha256 = ? WHERE obj_id = ?"),
12700 SELECT_IMAGE_MD5(
"SELECT md5 FROM tsk_image_info WHERE obj_id = ?"),
12701 SELECT_IMAGE_SHA1(
"SELECT sha1 FROM tsk_image_info WHERE obj_id = ?"),
12702 SELECT_IMAGE_SHA256(
"SELECT sha256 FROM tsk_image_info WHERE obj_id = ?"),
12703 UPDATE_ACQUISITION_DETAILS(
"UPDATE data_source_info SET acquisition_details = ? WHERE obj_id = ?"),
12704 UPDATE_ACQUISITION_TOOL_SETTINGS(
"UPDATE data_source_info SET acquisition_tool_settings = ?, acquisition_tool_name = ?, acquisition_tool_version = ? WHERE obj_id = ?"),
12705 SELECT_ACQUISITION_DETAILS(
"SELECT acquisition_details FROM data_source_info WHERE obj_id = ?"),
12706 SELECT_ACQUISITION_TOOL_SETTINGS(
"SELECT acquisition_tool_settings, acquisition_tool_name, acquisition_tool_version, added_date_time FROM data_source_info WHERE obj_id = ?"),
12707 SELECT_LOCAL_PATH_FOR_FILE(
"SELECT path FROM tsk_files_path WHERE obj_id = ?"),
12708 SELECT_ENCODING_FOR_FILE(
"SELECT encoding_type FROM tsk_files_path WHERE obj_id = ?"),
12709 SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE(
"SELECT path, encoding_type FROM tsk_files_path WHERE obj_id = ?"),
12710 SELECT_PATH_FOR_FILE(
"SELECT parent_path FROM tsk_files WHERE obj_id = ?"),
12711 SELECT_FILE_NAME(
"SELECT name FROM tsk_files WHERE obj_id = ?"),
12712 SELECT_DERIVED_FILE(
"SELECT derived_id, rederive FROM tsk_files_derived WHERE obj_id = ?"),
12713 SELECT_FILE_DERIVATION_METHOD(
"SELECT tool_name, tool_version, other FROM tsk_files_derived_method WHERE derived_id = ?"),
12714 SELECT_MAX_OBJECT_ID(
"SELECT MAX(obj_id) AS max_obj_id FROM tsk_objects"),
12715 INSERT_OBJECT(
"INSERT INTO tsk_objects (par_obj_id, type) VALUES (?, ?)"),
12716 INSERT_FILE(
"INSERT INTO tsk_files (obj_id, fs_obj_id, name, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, md5, sha256, known, mime_type, parent_path, data_source_obj_id, extension, owner_uid, os_account_obj_id ) "
12717 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
12718 INSERT_FILE_SYSTEM_FILE(
"INSERT INTO tsk_files(obj_id, fs_obj_id, data_source_obj_id, attr_type, attr_id, name, meta_addr, meta_seq, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, md5, sha256, mime_type, parent_path, extension, owner_uid, os_account_obj_id )"
12719 +
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
12720 UPDATE_DERIVED_FILE(
"UPDATE tsk_files SET type = ?, dir_type = ?, meta_type = ?, dir_flags = ?, meta_flags = ?, size= ?, ctime= ?, crtime= ?, atime= ?, mtime= ?, mime_type = ? "
12721 +
"WHERE obj_id = ?"),
12722 INSERT_LAYOUT_FILE(
"INSERT INTO tsk_file_layout (obj_id, byte_start, byte_len, sequence) "
12723 +
"VALUES (?, ?, ?, ?)"),
12724 INSERT_LOCAL_PATH(
"INSERT INTO tsk_files_path (obj_id, path, encoding_type) VALUES (?, ?, ?)"),
12725 UPDATE_LOCAL_PATH(
"UPDATE tsk_files_path SET path = ?, encoding_type = ? WHERE obj_id = ?"),
12726 COUNT_CHILD_OBJECTS_BY_PARENT(
"SELECT COUNT(obj_id) AS count FROM tsk_objects WHERE par_obj_id = ?"),
12727 SELECT_FILE_SYSTEM_BY_OBJECT(
"SELECT fs_obj_id from tsk_files WHERE obj_id=?"),
12728 SELECT_TAG_NAMES(
"SELECT * FROM tag_names"),
12729 SELECT_TAG_NAMES_IN_USE(
"SELECT * FROM tag_names "
12730 +
"WHERE tag_name_id IN "
12731 +
"(SELECT tag_name_id from content_tags UNION SELECT tag_name_id FROM blackboard_artifact_tags)"),
12732 SELECT_TAG_NAMES_IN_USE_BY_DATASOURCE(
"SELECT * FROM tag_names "
12733 +
"WHERE tag_name_id IN "
12734 +
"( SELECT content_tags.tag_name_id as tag_name_id "
12735 +
"FROM content_tags as content_tags, tsk_files as tsk_files"
12736 +
" WHERE content_tags.obj_id = tsk_files.obj_id"
12737 +
" AND tsk_files.data_source_obj_id = ?"
12739 +
"SELECT artifact_tags.tag_name_id as tag_name_id "
12740 +
" FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts "
12741 +
" WHERE artifact_tags.artifact_id = arts.artifact_id"
12742 +
" AND arts.data_source_obj_id = ?"
12744 INSERT_TAG_NAME(
"INSERT INTO tag_names (display_name, description, color, knownStatus) VALUES (?, ?, ?, ?)"),
12745 INSERT_CONTENT_TAG(
"INSERT INTO content_tags (obj_id, tag_name_id, comment, begin_byte_offset, end_byte_offset, examiner_id) VALUES (?, ?, ?, ?, ?, ?)"),
12746 DELETE_CONTENT_TAG(
"DELETE FROM content_tags WHERE tag_id = ?"),
12747 COUNT_CONTENT_TAGS_BY_TAG_NAME(
"SELECT COUNT(*) AS count FROM content_tags WHERE tag_name_id = ?"),
12748 COUNT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
12749 "SELECT COUNT(*) AS count FROM content_tags as content_tags, tsk_files as tsk_files WHERE content_tags.obj_id = tsk_files.obj_id"
12750 +
" AND content_tags.tag_name_id = ? "
12751 +
" AND tsk_files.data_source_obj_id = ? "
12753 SELECT_CONTENT_TAGS(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
12754 +
"FROM content_tags "
12755 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
12756 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id"),
12757 SELECT_CONTENT_TAGS_BY_TAG_NAME(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tsk_examiners.login_name "
12758 +
"FROM content_tags "
12759 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
12760 +
"WHERE tag_name_id = ?"),
12761 SELECT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id "
12762 +
"FROM content_tags as content_tags, tsk_files as tsk_files, tag_names as tag_names, tsk_examiners as tsk_examiners "
12763 +
"WHERE content_tags.examiner_id = tsk_examiners.examiner_id"
12764 +
" AND content_tags.obj_id = tsk_files.obj_id"
12765 +
" AND content_tags.tag_name_id = tag_names.tag_name_id"
12766 +
" AND content_tags.tag_name_id = ?"
12767 +
" AND tsk_files.data_source_obj_id = ? "),
12768 SELECT_CONTENT_TAG_BY_ID(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
12769 +
"FROM content_tags "
12770 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
12771 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
12772 +
"WHERE tag_id = ?"),
12773 SELECT_CONTENT_TAGS_BY_CONTENT(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
12774 +
"FROM content_tags "
12775 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
12776 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
12777 +
"WHERE content_tags.obj_id = ?"),
12778 INSERT_ARTIFACT_TAG(
"INSERT INTO blackboard_artifact_tags (artifact_id, tag_name_id, comment, examiner_id) "
12779 +
"VALUES (?, ?, ?, ?)"),
12780 DELETE_ARTIFACT_TAG(
"DELETE FROM blackboard_artifact_tags WHERE tag_id = ?"),
12781 SELECT_ARTIFACT_TAGS(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tag_names.tag_set_id, tsk_examiners.login_name, tag_names.rank "
12782 +
"FROM blackboard_artifact_tags "
12783 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
12784 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id"),
12785 COUNT_ARTIFACTS_BY_TAG_NAME(
"SELECT COUNT(*) AS count FROM blackboard_artifact_tags WHERE tag_name_id = ?"),
12786 COUNT_ARTIFACTS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts WHERE artifact_tags.artifact_id = arts.artifact_id"
12787 +
" AND artifact_tags.tag_name_id = ?"
12788 +
" AND arts.data_source_obj_id = ? "),
12789 SELECT_ARTIFACT_TAGS_BY_TAG_NAME(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tsk_examiners.login_name "
12790 +
"FROM blackboard_artifact_tags "
12791 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
12792 +
"WHERE tag_name_id = ?"),
12793 SELECT_ARTIFACT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT artifact_tags.tag_id, artifact_tags.artifact_id, artifact_tags.tag_name_id, artifact_tags.comment, arts.obj_id, arts.artifact_obj_id, arts.data_source_obj_id, arts.artifact_type_id, arts.review_status_id, tsk_examiners.login_name "
12794 +
"FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts, tsk_examiners AS tsk_examiners "
12795 +
"WHERE artifact_tags.examiner_id = tsk_examiners.examiner_id"
12796 +
" AND artifact_tags.artifact_id = arts.artifact_id"
12797 +
" AND artifact_tags.tag_name_id = ? "
12798 +
" AND arts.data_source_obj_id = ? "),
12799 SELECT_ARTIFACT_TAG_BY_ID(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
12800 +
"FROM blackboard_artifact_tags "
12801 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
12802 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
12803 +
"WHERE blackboard_artifact_tags.tag_id = ?"),
12804 SELECT_ARTIFACT_TAGS_BY_ARTIFACT(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
12805 +
"FROM blackboard_artifact_tags "
12806 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
12807 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
12808 +
"WHERE blackboard_artifact_tags.artifact_id = ?"),
12809 SELECT_REPORTS(
"SELECT * FROM reports"),
12810 SELECT_REPORT_BY_ID(
"SELECT * FROM reports WHERE obj_id = ?"),
12811 INSERT_REPORT(
"INSERT INTO reports (obj_id, path, crtime, src_module_name, report_name) VALUES (?, ?, ?, ?, ?)"),
12812 DELETE_REPORT(
"DELETE FROM reports WHERE reports.obj_id = ?"),
12813 DELETE_REPORT_TSK_OBJECT(
"DELETE FROM tsk_objects where tsk_objects.obj_id = ? and tsk_objects.type = ?"),
12814 INSERT_INGEST_JOB(
"INSERT INTO ingest_jobs (obj_id, host_name, start_date_time, end_date_time, status_id, settings_dir) VALUES (?, ?, ?, ?, ?, ?)"),
12815 INSERT_INGEST_MODULE(
"INSERT INTO ingest_modules (display_name, unique_name, type_id, version) VALUES(?, ?, ?, ?)"),
12816 SELECT_ATTR_BY_VALUE_BYTE(
"SELECT source FROM blackboard_attributes WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
12817 UPDATE_ATTR_BY_VALUE_BYTE(
"UPDATE blackboard_attributes SET source = ? WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
12818 UPDATE_IMAGE_PATH(
"UPDATE tsk_image_names SET name = ? WHERE obj_id = ?"),
12819 SELECT_ARTIFACT_OBJECTIDS_BY_PARENT(
"SELECT blackboard_artifacts.artifact_obj_id AS artifact_obj_id "
12820 +
"FROM tsk_objects INNER JOIN blackboard_artifacts "
12821 +
"ON tsk_objects.obj_id=blackboard_artifacts.obj_id "
12822 +
"WHERE (tsk_objects.par_obj_id = ?)"),
12823 INSERT_OR_UPDATE_TAG_NAME(
"INSERT INTO tag_names (display_name, description, color, knownStatus) VALUES (?, ?, ?, ?) ON CONFLICT (display_name) DO UPDATE SET description = ?, color = ?, knownStatus = ?"),
12824 SELECT_EXAMINER_BY_ID(
"SELECT * FROM tsk_examiners WHERE examiner_id = ?"),
12825 SELECT_EXAMINER_BY_LOGIN_NAME(
"SELECT * FROM tsk_examiners WHERE login_name = ?"),
12826 INSERT_EXAMINER_POSTGRESQL(
"INSERT INTO tsk_examiners (login_name) VALUES (?) ON CONFLICT DO NOTHING"),
12827 INSERT_EXAMINER_SQLITE(
"INSERT OR IGNORE INTO tsk_examiners (login_name) VALUES (?)"),
12828 UPDATE_FILE_NAME(
"UPDATE tsk_files SET name = ? WHERE obj_id = ?"),
12829 UPDATE_IMAGE_NAME(
"UPDATE tsk_image_info SET display_name = ? WHERE obj_id = ?"),
12830 UPDATE_IMAGE_SIZES(
"UPDATE tsk_image_info SET size = ?, ssize = ? WHERE obj_id = ?"),
12831 DELETE_IMAGE_NAME(
"DELETE FROM tsk_image_names WHERE obj_id = ?"),
12832 INSERT_IMAGE_NAME(
"INSERT INTO tsk_image_names (obj_id, name, sequence) VALUES (?, ?, ?)"),
12833 INSERT_IMAGE_INFO(
"INSERT INTO tsk_image_info (obj_id, type, ssize, tzone, size, md5, sha1, sha256, display_name)"
12834 +
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"),
12835 INSERT_DATA_SOURCE_INFO(
"INSERT INTO data_source_info (obj_id, device_id, time_zone, added_date_time, host_id) VALUES (?, ?, ?, ?, ?)"),
12836 INSERT_VS_INFO(
"INSERT INTO tsk_vs_info (obj_id, vs_type, img_offset, block_size) VALUES (?, ?, ?, ?)"),
12837 INSERT_VS_PART_SQLITE(
"INSERT INTO tsk_vs_parts (obj_id, addr, start, length, desc, flags) VALUES (?, ?, ?, ?, ?, ?)"),
12838 INSERT_VS_PART_POSTGRESQL(
"INSERT INTO tsk_vs_parts (obj_id, addr, start, length, descr, flags) VALUES (?, ?, ?, ?, ?, ?)"),
12839 INSERT_POOL_INFO(
"INSERT INTO tsk_pool_info (obj_id, pool_type) VALUES (?, ?)"),
12840 INSERT_FS_INFO(
"INSERT INTO tsk_fs_info (obj_id, data_source_obj_id, img_offset, fs_type, block_size, block_count, root_inum, first_inum, last_inum, display_name)"
12841 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
12842 SELECT_TAG_NAME_BY_ID(
"SELECT * FROM tag_names where tag_name_id = ?"),
12843 SELECT_TAG_NAME_BY_NAME(
"SELECT * FROM tag_names where display_name = ?");
12845 private final String sql;
12847 private PREPARED_STATEMENT(String sql) {
12861 abstract private class ConnectionPool {
12863 private PooledDataSource pooledDataSource;
12865 public ConnectionPool() {
12866 pooledDataSource = null;
12869 CaseDbConnection getConnection() throws TskCoreException {
12870 if (pooledDataSource == null) {
12871 throw new TskCoreException(
"Error getting case database connection - case is closed");
12874 return getPooledConnection();
12875 }
catch (SQLException exp) {
12876 throw new TskCoreException(exp.getMessage());
12880 void close() throws TskCoreException {
12881 if (pooledDataSource != null) {
12883 pooledDataSource.close();
12884 }
catch (SQLException exp) {
12885 throw new TskCoreException(exp.getMessage());
12887 pooledDataSource = null;
12892 abstract CaseDbConnection getPooledConnection() throws SQLException;
12894 public PooledDataSource getPooledDataSource() {
12895 return pooledDataSource;
12898 public void setPooledDataSource(PooledDataSource pooledDataSource) {
12899 this.pooledDataSource = pooledDataSource;
12907 private final class SQLiteConnections
extends ConnectionPool {
12909 private final Map<String, String> configurationOverrides =
new HashMap<String, String>();
12911 SQLiteConnections(String dbPath)
throws SQLException {
12912 configurationOverrides.put(
"acquireIncrement",
"2");
12913 configurationOverrides.put(
"initialPoolSize",
"5");
12914 configurationOverrides.put(
"minPoolSize",
"5");
12919 configurationOverrides.put(
"maxPoolSize",
"20");
12920 configurationOverrides.put(
"maxStatements",
"200");
12921 configurationOverrides.put(
"maxStatementsPerConnection",
"20");
12923 SQLiteConfig config =
new SQLiteConfig();
12924 config.setSynchronous(SQLiteConfig.SynchronousMode.OFF);
12925 config.setReadUncommited(
true);
12926 config.enforceForeignKeys(
true);
12927 SQLiteDataSource unpooled =
new SQLiteDataSource(config);
12928 unpooled.setUrl(
"jdbc:sqlite:" + dbPath);
12929 setPooledDataSource((PooledDataSource) DataSources.pooledDataSource(unpooled, configurationOverrides));
12933 public CaseDbConnection getPooledConnection() throws SQLException {
12935 if (CaseDbTransaction.hasOpenTransaction(Thread.currentThread().getId())) {
12937 if (!Thread.currentThread().getName().contains(
"ImageGallery")) {
12938 logger.log(Level.WARNING, String.format(
"Thread %s (ID = %d) already has an open transaction. New connection may encounter SQLITE_BUSY error. ", Thread.currentThread().getName(), Thread.currentThread().getId()),
new Throwable());
12941 return new SQLiteConnection(getPooledDataSource().getConnection());
12949 private final class PostgreSQLConnections
extends ConnectionPool {
12951 PostgreSQLConnections(String host,
int port, String dbName, String userName, String password)
throws PropertyVetoException, UnsupportedEncodingException {
12952 ComboPooledDataSource comboPooledDataSource =
new ComboPooledDataSource();
12953 comboPooledDataSource.setDriverClass(
"org.postgresql.Driver");
12954 comboPooledDataSource.setJdbcUrl(
"jdbc:postgresql://" + host +
":" + port +
"/"
12955 + URLEncoder.encode(dbName, StandardCharsets.UTF_8.toString()));
12956 comboPooledDataSource.setUser(userName);
12957 comboPooledDataSource.setPassword(password);
12958 comboPooledDataSource.setAcquireIncrement(2);
12959 comboPooledDataSource.setInitialPoolSize(5);
12960 comboPooledDataSource.setMinPoolSize(5);
12965 comboPooledDataSource.setMaxPoolSize(20);
12966 comboPooledDataSource.setMaxStatements(200);
12967 comboPooledDataSource.setMaxStatementsPerConnection(20);
12968 setPooledDataSource(comboPooledDataSource);
12972 public CaseDbConnection getPooledConnection() throws SQLException {
12973 return new PostgreSQLConnection(getPooledDataSource().getConnection());
12980 abstract class CaseDbConnection
implements AutoCloseable {
12982 static final int SLEEP_LENGTH_IN_MILLISECONDS = 5000;
12983 static final int MAX_RETRIES = 20;
12985 private class CreateStatement
implements DbCommand {
12987 private final Connection connection;
12988 private Statement statement = null;
12990 CreateStatement(Connection connection) {
12991 this.connection = connection;
12994 Statement getStatement() {
12999 public void execute() throws SQLException {
13000 statement = connection.createStatement();
13004 private class SetAutoCommit
implements DbCommand {
13006 private final Connection connection;
13007 private final boolean mode;
13009 SetAutoCommit(Connection connection,
boolean mode) {
13010 this.connection = connection;
13015 public void execute() throws SQLException {
13016 connection.setAutoCommit(mode);
13020 private class Commit
implements DbCommand {
13022 private final Connection connection;
13024 Commit(Connection connection) {
13025 this.connection = connection;
13029 public void execute() throws SQLException {
13030 connection.commit();
13042 private class AggregateScoreTablePostgreSQLWriteLock
implements DbCommand {
13044 private final Connection connection;
13046 AggregateScoreTablePostgreSQLWriteLock(Connection connection) {
13047 this.connection = connection;
13051 public void execute() throws SQLException {
13052 PreparedStatement preparedStatement = connection.prepareStatement(
"LOCK TABLE ONLY tsk_aggregate_score in SHARE ROW EXCLUSIVE MODE");
13053 preparedStatement.execute();
13058 private class ExecuteQuery
implements DbCommand {
13060 private final Statement statement;
13061 private final String query;
13062 private ResultSet resultSet;
13064 ExecuteQuery(Statement statement, String query) {
13065 this.statement = statement;
13066 this.query = query;
13069 ResultSet getResultSet() {
13074 public void execute() throws SQLException {
13075 resultSet = statement.executeQuery(query);
13079 private class ExecutePreparedStatementQuery
implements DbCommand {
13081 private final PreparedStatement preparedStatement;
13082 private ResultSet resultSet;
13084 ExecutePreparedStatementQuery(PreparedStatement preparedStatement) {
13085 this.preparedStatement = preparedStatement;
13088 ResultSet getResultSet() {
13093 public void execute() throws SQLException {
13094 resultSet = preparedStatement.executeQuery();
13098 private class ExecutePreparedStatementUpdate
implements DbCommand {
13100 private final PreparedStatement preparedStatement;
13102 ExecutePreparedStatementUpdate(PreparedStatement preparedStatement) {
13103 this.preparedStatement = preparedStatement;
13107 public void execute() throws SQLException {
13108 preparedStatement.executeUpdate();
13112 private class ExecuteStatementUpdate
implements DbCommand {
13114 private final Statement statement;
13115 private final String updateCommand;
13117 ExecuteStatementUpdate(Statement statement, String updateCommand) {
13118 this.statement = statement;
13119 this.updateCommand = updateCommand;
13123 public void execute() throws SQLException {
13124 statement.executeUpdate(updateCommand);
13128 private class ExecuteStatementUpdateGenerateKeys
implements DbCommand {
13130 private final Statement statement;
13131 private final int generateKeys;
13132 private final String updateCommand;
13134 ExecuteStatementUpdateGenerateKeys(Statement statement, String updateCommand,
int generateKeys) {
13135 this.statement = statement;
13136 this.generateKeys = generateKeys;
13137 this.updateCommand = updateCommand;
13141 public void execute() throws SQLException {
13142 statement.executeUpdate(updateCommand, generateKeys);
13146 private class PrepareStatement
implements DbCommand {
13148 private final Connection connection;
13149 private final String input;
13150 private PreparedStatement preparedStatement = null;
13152 PrepareStatement(Connection connection, String input) {
13153 this.connection = connection;
13154 this.input = input;
13157 PreparedStatement getPreparedStatement() {
13158 return preparedStatement;
13162 public void execute() throws SQLException {
13163 preparedStatement = connection.prepareStatement(input);
13167 private class PrepareStatementGenerateKeys
implements DbCommand {
13169 private final Connection connection;
13170 private final String input;
13171 private final int generateKeys;
13172 private PreparedStatement preparedStatement = null;
13174 PrepareStatementGenerateKeys(Connection connection, String input,
int generateKeysInput) {
13175 this.connection = connection;
13176 this.input = input;
13177 this.generateKeys = generateKeysInput;
13180 PreparedStatement getPreparedStatement() {
13181 return preparedStatement;
13185 public void execute() throws SQLException {
13186 preparedStatement = connection.prepareStatement(input, generateKeys);
13190 abstract void executeCommand(DbCommand command)
throws SQLException;
13192 private final Connection connection;
13193 private final Map<PREPARED_STATEMENT, PreparedStatement> preparedStatements;
13194 private final Map<String, PreparedStatement> adHocPreparedStatements;
13196 CaseDbConnection(Connection connection) {
13197 this.connection = connection;
13198 preparedStatements =
new EnumMap<PREPARED_STATEMENT, PreparedStatement>(PREPARED_STATEMENT.class);
13199 adHocPreparedStatements =
new HashMap<>();
13203 return this.connection != null;
13206 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey)
throws SQLException {
13207 return getPreparedStatement(statementKey, Statement.NO_GENERATED_KEYS);
13210 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey,
int generateKeys)
throws SQLException {
13212 PreparedStatement statement;
13213 if (this.preparedStatements.containsKey(statementKey)) {
13214 statement = this.preparedStatements.get(statementKey);
13216 statement = prepareStatement(statementKey.getSQL(), generateKeys);
13217 this.preparedStatements.put(statementKey, statement);
13233 PreparedStatement getPreparedStatement(String sqlStatement,
int generateKeys)
throws SQLException {
13234 PreparedStatement statement;
13235 String statementKey =
"SQL:" + sqlStatement +
" Key:" + generateKeys;
13236 if (adHocPreparedStatements.containsKey(statementKey)) {
13237 statement = this.adHocPreparedStatements.get(statementKey);
13239 statement = prepareStatement(sqlStatement, generateKeys);
13240 this.adHocPreparedStatements.put(statementKey, statement);
13245 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
13246 PrepareStatement prepareStatement =
new PrepareStatement(this.getConnection(), sqlStatement);
13247 executeCommand(prepareStatement);
13248 return prepareStatement.getPreparedStatement();
13251 Statement createStatement() throws SQLException {
13252 CreateStatement createStatement =
new CreateStatement(this.connection);
13253 executeCommand(createStatement);
13254 return createStatement.getStatement();
13258 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
false);
13259 executeCommand(setAutoCommit);
13262 void commitTransaction() throws SQLException {
13263 Commit commit =
new Commit(connection);
13264 executeCommand(commit);
13266 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
true);
13267 executeCommand(setAutoCommit);
13275 void rollbackTransaction() {
13277 connection.rollback();
13278 }
catch (SQLException e) {
13279 logger.log(Level.SEVERE,
"Error rolling back transaction", e);
13282 connection.setAutoCommit(
true);
13283 }
catch (SQLException e) {
13284 logger.log(Level.SEVERE,
"Error restoring auto-commit", e);
13295 void rollbackTransactionWithThrow() throws SQLException {
13297 connection.rollback();
13299 connection.setAutoCommit(
true);
13311 void getAggregateScoreTableWriteLock() throws SQLException, TskCoreException {
13314 AggregateScoreTablePostgreSQLWriteLock tableWriteLock =
new AggregateScoreTablePostgreSQLWriteLock(connection);
13315 executeCommand(tableWriteLock);
13322 throw new TskCoreException(
"Unknown DB Type: " +
getDatabaseType().name());
13326 ResultSet
executeQuery(Statement statement, String query)
throws SQLException {
13327 ExecuteQuery queryCommand =
new ExecuteQuery(statement, query);
13328 executeCommand(queryCommand);
13329 return queryCommand.getResultSet();
13341 ResultSet
executeQuery(PreparedStatement statement)
throws SQLException {
13342 ExecutePreparedStatementQuery executePreparedStatementQuery =
new ExecutePreparedStatementQuery(statement);
13343 executeCommand(executePreparedStatementQuery);
13344 return executePreparedStatementQuery.getResultSet();
13347 void executeUpdate(Statement statement, String update)
throws SQLException {
13348 executeUpdate(statement, update, Statement.NO_GENERATED_KEYS);
13351 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
13352 ExecuteStatementUpdate executeStatementUpdate =
new ExecuteStatementUpdate(statement, update);
13353 executeCommand(executeStatementUpdate);
13356 void executeUpdate(PreparedStatement statement)
throws SQLException {
13357 ExecutePreparedStatementUpdate executePreparedStatementUpdate =
new ExecutePreparedStatementUpdate(statement);
13358 executeCommand(executePreparedStatementUpdate);
13365 public void close() {
13367 for (PreparedStatement stmt : preparedStatements.values()) {
13368 closeStatement(stmt);
13370 for (PreparedStatement stmt : adHocPreparedStatements.values()) {
13371 closeStatement(stmt);
13373 connection.close();
13374 }
catch (SQLException ex) {
13375 logger.log(Level.SEVERE,
"Unable to close connection to case database", ex);
13379 Connection getConnection() {
13380 return this.connection;
13387 private final class SQLiteConnection
extends CaseDbConnection {
13389 private static final int DATABASE_LOCKED_ERROR = 0;
13390 private static final int SQLITE_BUSY_ERROR = 5;
13392 SQLiteConnection(Connection conn) {
13397 void executeCommand(DbCommand command)
throws SQLException {
13398 int retryCounter = 0;
13403 }
catch (SQLException ex) {
13404 if ((ex.getErrorCode() == SQLITE_BUSY_ERROR || ex.getErrorCode() == DATABASE_LOCKED_ERROR) && retryCounter < MAX_RETRIES) {
13411 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
13412 }
catch (InterruptedException exp) {
13413 Logger.getLogger(SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
13426 private final class PostgreSQLConnection
extends CaseDbConnection {
13428 private final String COMMUNICATION_ERROR = PSQLState.COMMUNICATION_ERROR.getState();
13429 private final String SYSTEM_ERROR = PSQLState.SYSTEM_ERROR.getState();
13430 private final String UNKNOWN_STATE = PSQLState.UNKNOWN_STATE.getState();
13431 private static final int MAX_RETRIES = 3;
13433 PostgreSQLConnection(Connection conn) {
13438 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
13439 CaseDbConnection.ExecuteStatementUpdateGenerateKeys executeStatementUpdateGenerateKeys =
new CaseDbConnection.ExecuteStatementUpdateGenerateKeys(statement, update, generateKeys);
13440 executeCommand(executeStatementUpdateGenerateKeys);
13444 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
13445 CaseDbConnection.PrepareStatementGenerateKeys prepareStatementGenerateKeys =
new CaseDbConnection.PrepareStatementGenerateKeys(this.getConnection(), sqlStatement, generateKeys);
13446 executeCommand(prepareStatementGenerateKeys);
13447 return prepareStatementGenerateKeys.getPreparedStatement();
13451 void executeCommand(DbCommand command)
throws SQLException {
13452 SQLException lastException = null;
13453 for (
int retries = 0; retries < MAX_RETRIES; retries++) {
13456 lastException = null;
13458 }
catch (SQLException ex) {
13459 lastException = ex;
13460 String sqlState = ex.getSQLState();
13461 if (sqlState == null || sqlState.equals(COMMUNICATION_ERROR) || sqlState.equals(SYSTEM_ERROR) || sqlState.equals(UNKNOWN_STATE)) {
13463 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
13464 }
catch (InterruptedException exp) {
13465 Logger.getLogger(SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
13474 if (lastException != null) {
13475 throw lastException;
13496 private final CaseDbConnection connection;
13502 private Map<Long, ScoreChange> scoreChangeMap =
new HashMap<>();
13503 private List<Host> hostsAdded =
new ArrayList<>();
13504 private List<OsAccount> accountsChanged =
new ArrayList<>();
13505 private List<OsAccount> accountsAdded =
new ArrayList<>();
13506 private List<Long> deletedOsAccountObjectIds =
new ArrayList<>();
13507 private List<Long> deletedResultObjectIds =
new ArrayList<>();
13509 private static Set<Long> threadsWithOpenTransaction =
new HashSet<>();
13510 private static final Object threadsWithOpenTransactionLock =
new Object();
13513 this.sleuthkitCase = sleuthkitCase;
13516 this.connection = sleuthkitCase.getConnection();
13518 synchronized (threadsWithOpenTransactionLock) {
13519 this.connection.beginTransaction();
13520 threadsWithOpenTransaction.add(Thread.currentThread().getId());
13522 }
catch (SQLException ex) {
13524 throw new TskCoreException(
"Failed to create transaction on case database", ex);
13536 CaseDbConnection getConnection() {
13537 return this.connection;
13545 void registerScoreChange(
ScoreChange scoreChange) {
13546 scoreChangeMap.put(scoreChange.
getObjectId(), scoreChange);
13554 void registerAddedHost(
Host host) {
13555 if (host != null) {
13556 this.hostsAdded.add(host);
13565 void registerChangedOsAccount(
OsAccount account) {
13566 if (account != null) {
13567 accountsChanged.add(account);
13576 void registerDeletedOsAccount(
long osAccountObjId) {
13577 deletedOsAccountObjectIds.add(osAccountObjId);
13585 void registerAddedOsAccount(
OsAccount account) {
13586 if (account != null) {
13587 accountsAdded.add(account);
13597 void registerDeletedAnalysisResult(
long analysisResultObjId) {
13598 this.deletedResultObjectIds.add(analysisResultObjId);
13609 private static boolean hasOpenTransaction(
long threadId) {
13610 synchronized (threadsWithOpenTransactionLock) {
13611 return threadsWithOpenTransaction.contains(threadId);
13623 this.connection.commitTransaction();
13624 }
catch (SQLException ex) {
13625 throw new TskCoreException(
"Failed to commit transaction on case database", ex);
13629 if (!scoreChangeMap.isEmpty()) {
13630 Map<Long, List<ScoreChange>> changesByDataSource = scoreChangeMap.values().stream()
13632 for (Map.Entry<Long, List<ScoreChange>> entry : changesByDataSource.entrySet()) {
13636 if (!hostsAdded.isEmpty()) {
13639 if (!accountsAdded.isEmpty()) {
13642 if (!accountsChanged.isEmpty()) {
13645 if (!deletedOsAccountObjectIds.isEmpty()) {
13648 if (!deletedResultObjectIds.isEmpty()) {
13662 this.connection.rollbackTransactionWithThrow();
13663 }
catch (SQLException ex) {
13664 throw new TskCoreException(
"Case database transaction rollback failed", ex);
13675 this.connection.close();
13677 synchronized (threadsWithOpenTransactionLock) {
13678 threadsWithOpenTransaction.remove(Thread.currentThread().getId());
13694 private ResultSet resultSet;
13695 private CaseDbConnection connection;
13697 private CaseDbQuery(String query)
throws TskCoreException {
13698 this(query,
false);
13701 private CaseDbQuery(String query,
boolean allowWriteQuery)
throws TskCoreException {
13702 if (!allowWriteQuery) {
13703 if (!query.regionMatches(
true, 0,
"SELECT", 0,
"SELECT".length())) {
13704 throw new TskCoreException(
"Unsupported query: Only SELECT queries are supported.");
13710 connection = connections.getConnection();
13711 resultSet = connection.executeQuery(connection.createStatement(), query);
13712 }
catch (SQLException ex) {
13714 throw new TskCoreException(
"Error executing query: ", ex);
13715 }
catch (TskCoreException ex) {
13731 public void close() throws TskCoreException {
13733 if (resultSet != null) {
13734 final Statement statement = resultSet.getStatement();
13735 if (statement != null) {
13740 closeConnection(connection);
13741 }
catch (SQLException ex) {
13742 throw new TskCoreException(
"Error closing query: ", ex);
13758 sleuthkitCaseErrorObservers.add(observer);
13770 int i = sleuthkitCaseErrorObservers.indexOf(observer);
13772 sleuthkitCaseErrorObservers.remove(i);
13786 for (
ErrorObserver observer : sleuthkitCaseErrorObservers) {
13787 if (observer != null) {
13789 observer.receiveError(context, errorMessage);
13790 }
catch (Exception ex) {
13791 logger.log(Level.SEVERE,
"Observer client unable to receive message: {0}, {1}",
new Object[]{context, errorMessage, ex});
13823 private final String contextString;
13825 private Context(String context) {
13826 this.contextString = context;
13830 return contextString;
13834 void receiveError(String context, String errorMessage);
13848 long getDataSourceObjectId(
long objectId) {
13850 CaseDbConnection connection = connections.getConnection();
13852 return getDataSourceObjectId(connection, objectId);
13854 closeConnection(connection);
13856 }
catch (TskCoreException ex) {
13857 logger.log(Level.SEVERE,
"Error getting data source object id for a file", ex);
13873 CaseDbConnection connection = null;
13874 ResultSet rs = null;
13877 connection = connections.getConnection();
13880 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_MAX_OBJECT_ID);
13881 rs = connection.executeQuery(statement);
13884 id = rs.getLong(
"max_obj_id");
13887 }
catch (SQLException e) {
13888 throw new TskCoreException(
"Error getting last object id", e);
13890 closeResultSet(rs);
13891 closeConnection(connection);
13911 CaseDbConnection connection = null;
13912 Statement s = null;
13913 ResultSet rs = null;
13916 connection = connections.getConnection();
13917 s = connection.createStatement();
13918 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
13919 List<FsContent> results =
new ArrayList<FsContent>();
13920 List<AbstractFile> temp = resultSetToAbstractFiles(rs, connection);
13921 for (AbstractFile f : temp) {
13924 results.add((FsContent) f);
13928 }
catch (SQLException e) {
13929 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findFilesWhere().", e);
13931 closeResultSet(rs);
13933 closeConnection(connection);
13951 CaseDbConnection connection = null;
13952 Statement s = null;
13953 ResultSet rs = null;
13956 connection = connections.getConnection();
13957 s = connection.createStatement();
13958 rs = connection.executeQuery(s,
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName +
"'");
13961 typeId = rs.getInt(
"artifact_type_id");
13964 }
catch (SQLException ex) {
13965 throw new TskCoreException(
"Error getting artifact type id", ex);
13967 closeResultSet(rs);
13969 closeConnection(connection);
14002 public int addArtifactType(String artifactTypeName, String displayName)
throws TskCoreException {
14005 }
catch (TskDataException ex) {
14006 throw new TskCoreException(
"Failed to add artifact type.", ex);
14024 public int addAttrType(String attrTypeString, String displayName)
throws TskCoreException {
14027 }
catch (TskDataException ex) {
14028 throw new TskCoreException(
"Couldn't add new attribute type");
14044 CaseDbConnection connection = null;
14045 Statement s = null;
14046 ResultSet rs = null;
14049 connection = connections.getConnection();
14050 s = connection.createStatement();
14051 rs = connection.executeQuery(s,
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName +
"'");
14054 typeId = rs.getInt(
"attribute_type_id");
14057 }
catch (SQLException ex) {
14058 throw new TskCoreException(
"Error getting attribute type id", ex);
14060 closeResultSet(rs);
14062 closeConnection(connection);
14081 CaseDbConnection connection = null;
14082 Statement s = null;
14083 ResultSet rs = null;
14086 connection = connections.getConnection();
14087 s = connection.createStatement();
14088 rs = connection.executeQuery(s,
"SELECT type_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
14090 return rs.getString(
"type_name");
14092 throw new TskCoreException(
"No type with that id");
14094 }
catch (SQLException ex) {
14095 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
14097 closeResultSet(rs);
14099 closeConnection(connection);
14118 CaseDbConnection connection = null;
14119 Statement s = null;
14120 ResultSet rs = null;
14123 connection = connections.getConnection();
14124 s = connection.createStatement();
14125 rs = connection.executeQuery(s,
"SELECT display_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
14127 return rs.getString(
"display_name");
14129 throw new TskCoreException(
"No type with that id");
14131 }
catch (SQLException ex) {
14132 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
14134 closeResultSet(rs);
14136 closeConnection(connection);
14171 public ResultSet
runQuery(String query)
throws SQLException {
14172 CaseDbConnection connection = null;
14175 connection = connections.getConnection();
14176 return connection.executeQuery(connection.createStatement(), query);
14177 }
catch (TskCoreException ex) {
14178 throw new SQLException(
"Error getting connection for ad hoc query", ex);
14182 closeConnection(connection);
14198 final Statement statement = resultSet.getStatement();
14200 if (statement != null) {
14222 public LayoutFile addCarvedFile(String carvedFileName,
long carvedFileSize,
long containerId, List<TskFileRange> data)
throws TskCoreException {
14225 files.add(carvedFile);
14229 || parent instanceof
Volume
14230 || parent instanceof
Image) {
14233 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", containerId));
14252 public List<LayoutFile>
addCarvedFiles(List<CarvedFileContainer> filesToAdd)
throws TskCoreException {
14256 carvedFiles.add(carvedFile);
14261 || parent instanceof
Volume
14262 || parent instanceof
Image) {
14265 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", parent.
getId()));
14301 long size,
long ctime,
long crtime,
long atime,
long mtime,
14302 boolean isFile, AbstractFile parentFile,
14303 String rederiveDetails, String toolName, String toolVersion, String otherDetails)
throws TskCoreException {
14304 return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime,
14305 isFile, parentFile, rederiveDetails, toolName, toolVersion,
14340 long size,
long ctime,
long crtime,
long atime,
long mtime,
14341 String md5,
FileKnown known, String mimeType,
14345 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime,
14346 md5, null, known, mimeType, isFile, encodingType,
14347 parent, transaction);
14376 long size,
long ctime,
long crtime,
long atime,
long mtime,
14379 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile,
14404 long size,
long ctime,
long crtime,
long atime,
long mtime,
14406 AbstractFile parent)
throws TskCoreException {
14407 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime,
14429 return this.caseHandle.initAddImageProcess(timezone, addUnallocSpace, noFatFsOrphans,
"",
this);
14446 }
catch (TskCoreException ex) {
14447 logger.log(Level.SEVERE,
"Error loading all file systems for image with ID {0}", image.
getId());
14448 return new ArrayList<>();
14470 public List<AbstractFile>
findFiles(
Content dataSource, String fileName, AbstractFile parentFile)
throws TskCoreException {
Image addImageInfo(long deviceObjId, List< String > imageFilePaths, String timeZone, Host host)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, long value)
final IngestJobInfo addIngestJob(Content dataSource, String hostName, List< IngestModuleInfo > ingestModules, Date jobStart, Date jobEnd, IngestJobStatusType status, String settingsDir)
static ARTIFACT_TYPE fromID(int id)
FS
File that can be found in file system tree.
static FileKnown valueOf(byte known)
BlackboardArtifact getArtifactByArtifactId(long id)
AddImageProcess makeAddImageProcess(String timezone, boolean addUnallocSpace, boolean noFatFsOrphans)
BlackboardArtifact getArtifactById(long id)
List< Report > getAllReports()
ArrayList< BlackboardAttribute > getBlackboardAttributes(final BlackboardArtifact artifact)
long getBlackboardArtifactsCount(long objId)
int getArtifactTypeID(String artifactTypeName)
Type(int typeID, String typeName, String displayName, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType)
long getBlackboardArtifactTagsCountByTagName(TagName tagName)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType)
LocalDirectory addLocalDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, int value)
void addBlackboardAttributes(Collection< BlackboardAttribute > attributes, int artifactTypeId)
Optional< HostAddress > getHostAddress(HostAddress.HostAddressType type, String address)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID, long obj_id)
static final Score SCORE_UNKNOWN
CommunicationsManager getCommunicationsManager()
AnalysisResult getAnalysisResultById(long artifactObjId)
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
CaseDbTransaction beginTransaction()
OsAccount getOsAccountByObjectId(long osAccountObjId)
boolean isCompatible(CaseDbSchemaVersionNumber dbSchemaVersion)
List< Content > getChildren()
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent)
ALLOC
Metadata structure is currently in an allocated state.
int countFilesMd5Hashed()
static TSK_FS_TYPE_ENUM valueOf(int fsTypeValue)
CaseDbSchemaVersionNumber getDBSchemaCreationVersion()
void newOsAccountInstance(OsAccount osAccount, DataSource dataSource, OsAccountInstance.OsAccountInstanceType instanceType)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID)
void addErrorObserver(ErrorObserver observer)
DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, String mimeType, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType, Content parentObj, CaseDbTransaction trans)
DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, String mimeType, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
Blackboard getBlackboard()
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
TSK_FS_META_TYPE_DIR
Directory file NON-NLS.
List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parentFile)
synchronized void close()
static Category fromID(int id)
TagName addOrUpdateTagName(String displayName, String description, TagName.HTML_COLOR color, TskData.FileKnown knownStatus)
void setFileMIMEType(AbstractFile file, String mimeType)
UNALLOC
Metadata structure is currently in an unallocated state.
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, String sha256, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Long osAccountId, String ownerAccount, Content parent, CaseDbTransaction transaction)
void addBlackboardAttribute(BlackboardAttribute attr, int artifactTypeId)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent, CaseDbTransaction transaction)
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList)
final List< LayoutFile > addLayoutFiles(Content parent, List< TskFileRange > fileRanges)
int addArtifactType(String artifactTypeName, String displayName)
List< DataSource > getDataSources()
BlackboardArtifactTagChange addArtifactTag(BlackboardArtifact artifact, TagName tagName, String comment)
synchronized CaseDbAccessManager getCaseDbAccessManager()
DataArtifact getDataArtifactById(long artifactObjId)
BlackboardArtifactTag getBlackboardArtifactTagByID(long artifactTagID)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, double value)
List< AbstractFile > openFiles(Content dataSource, String filePath)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByArtifact(BlackboardArtifact artifact)
final IngestModuleInfo addIngestModule(String displayName, String factoryClassName, IngestModuleType type, String version)
long getBlackboardArtifactsCount(String artifactTypeName, long obj_id)
Content getContentById(long id)
BlackboardArtifactTag getAddedTag()
VersionNumber getDBSchemaVersion()
static IngestJobStatusType fromID(int typeId)
List< TagName > getTagNamesInUse()
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, byte value)
LAYOUT_FILE
Set of blocks from an image that have been designated as a file.
List< AbstractFile > findAllFilesInFolderWhere(long parentId, String sqlWhereClause)
static final String NAME_CARVED
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, String sha256, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
static SleuthkitCase openCase(String databaseName, CaseDbConnectionInfo info, String caseDir)
static IngestModuleType fromID(int typeId)
List< ContentTag > getAllContentTags()
long getDataSourceObjectId()
List< VirtualDirectory > getVirtualDirectoryRoots()
LayoutFile addLayoutFile(String fileName, long size, TSK_FS_NAME_FLAG_ENUM dirFlag, TSK_FS_META_FLAG_ENUM metaFlag, long ctime, long crtime, long atime, long mtime, List< TskFileRange > fileRanges, Content parent)
long getBlackboardArtifactTagsCountByTagName(TagName tagName, long dsObjId)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypes()
ContentTag getContentTagByID(long contentTagID)
LOCAL
Local file that was added (not from a disk image)
HostAddressManager getHostAddressManager()
Map< Long, List< String > > getImagePaths()
List< Long > findAllFileIdsWhere(String sqlWhereClause)
synchronized TaggingManager getTaggingManager()
BlackboardArtifact getBlackboardArtifact(long artifactID)
List< BlackboardArtifact.Type > getArtifactTypesInUse()
OsAccountRealmManager getOsAccountRealmManager()
BlackboardAttribute.Type addArtifactAttributeType(String attrTypeString, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName)
AbstractFile getAbstractFileById(long id)
CARVED
Set of blocks for a file found from carving. Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS ra...
BlackboardArtifactTag addBlackboardArtifactTag(BlackboardArtifact artifact, TagName tagName, String comment)
long countFilesWhere(String sqlWhereClause)
long getBlackboardArtifactsCount(ARTIFACT_TYPE artifactType, long obj_id)
FS
File System - see tsk_fs_info for more details.
Pool addPool(long parentObjId, TskData.TSK_POOL_TYPE_ENUM type, CaseDbTransaction transaction)
boolean isFileFromSource(Content dataSource, long fileId)
ArrayList< BlackboardArtifact > getMatchingArtifacts(String whereClause)
VirtualDirectory addVirtualDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypesInUse()
void deleteReport(Report report)
List< Image > getImages()
int getAttrTypeID(String attrTypeName)
Image getImageById(long id)
Report addReport(String localPath, String sourceModuleName, String reportName, Content parent)
List< Content > getChildren()
USED
Metadata structure has been allocated at least once.
void unregisterForEvents(Object listener)
LOCAL_DIR
Local directory that was added (not from a disk image)
TimelineManager getTimelineManager()
final List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
void releaseSingleUserCaseReadLock()
PersonManager getPersonManager()
VOL
Volume - see tsk_vs_parts for more details.
void closeRunQuery(ResultSet resultSet)
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
int addAttrType(String attrTypeString, String displayName)
void deleteBlackboardArtifactTag(BlackboardArtifactTag tag)
long getContentTagsCountByTagName(TagName tagName, long dsObjId)
List< ContentTag > getContentTagsByTagName(TagName tagName)
BlackboardArtifact newBlackboardArtifact(int artifactTypeID, long obj_id)
static String escapeSingleQuotes(String text)
String getAttrTypeDisplayName(int attrTypeID)
List< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
void setFileUnalloc(AbstractFile file)
List< AbstractFile > findFiles(Content dataSource, String fileName)
List< AbstractFile > findFilesInFolder(String fileName, AbstractFile parentFile)
List< TagName > getAllTagNames()
HostManager getHostManager()
Report getReportById(long id)
BlackboardAttribute.Type getAttributeType(String attrTypeName)
Image addImageInfo(long deviceObjId, List< String > imageFilePaths, String timeZone)
static HTML_COLOR getColorByName(String colorName)
void acquireSingleUserCaseWriteLock()
REPORT
Artifact - see blackboard_artifacts for more details.
List< AbstractFile > findFilesByMd5(String md5Hash)
long getBlackboardArtifactsTypeCount(int artifactTypeID, long dataSourceID)
BlackboardArtifact.Type getArtifactType(String artTypeName)
void releaseSingleUserCaseWriteLock()
DERIVED
File derived from a parent file (i.e. from ZIP)
Host newHost(String name)
List< LayoutFile > addCarvedFiles(List< CarvedFileContainer > filesToAdd)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName)
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromType(long typeId)
static SleuthkitCase newCase(String caseName, CaseDbConnectionInfo info, String caseDirPath)
Report addReport(String localPath, String sourceModuleName, String reportName)
void releaseExclusiveLock()
List< BlackboardArtifactTag > getAllBlackboardArtifactTags()
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName, long obj_id)
Image addImage(TskData.TSK_IMG_TYPE_ENUM type, long sectorSize, long size, String displayName, List< String > imagePaths, String timezone, String md5, String sha1, String sha256, String deviceId, CaseDbTransaction transaction)
void removeErrorObserver(ErrorObserver observer)
String getContextString()
List< Content > getRootObjects()
List< AbstractFile > findFiles(Content dataSource, String fileName, String dirSubString)
static short toInt(Set< TSK_FS_META_FLAG_ENUM > metaFlags)
ContentTagChange addContentTag(Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset)
FileSystem addFileSystem(long parentObjId, long imgOffset, TskData.TSK_FS_TYPE_ENUM type, long blockSize, long blockCount, long rootInum, long firstInum, long lastInum, String displayName, CaseDbTransaction transaction)
void acquireExclusiveLock()
boolean allFilesMd5Hashed()
String getAttrTypeString(int attrTypeID)
int getBlackboardAttributeTypesCount()
LayoutFile addCarvedFile(String carvedFileName, long carvedFileSize, long containerId, List< TskFileRange > data)
ArrayList< BlackboardAttribute.ATTRIBUTE_TYPE > getBlackboardAttributeTypes()
UNALLOC_BLOCKS
Set of blocks not allocated by file system. Parent should be image, volume, or file system...
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, AbstractFile parent)
ArrayList< BlackboardAttribute > getMatchingAttributes(String whereClause)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
long getBlackboardArtifactsTypeCount(int artifactTypeID)
List< ContentTag > getContentTagsByTagName(TagName tagName, long dsObjId)
void deleteContentTag(ContentTag tag)
AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList)
static ObjectType valueOf(short objectType)
Optional< String > getOwnerUid()
long getContentTagsCountByTagName(TagName tagName)
FsContent addFileSystemFile(long dataSourceObjId, long fsObjId, String fileName, long metaAddr, int metaSeq, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parent)
Collection< FileSystem > getImageFileSystems(Image image)
void updateImagePath(String newPath, long objectId)
VolumeSystem addVolumeSystem(long parentObjId, TskData.TSK_VS_TYPE_ENUM type, long imgOffset, long blockSize, CaseDbTransaction transaction)
Examiner getCurrentExaminer()
LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootDirectoryName, String timeZone, Host host, CaseDbTransaction transaction)
UNKNOWN
File marked as unknown by hash db.
List< TagName > getTagNamesInUse(long dsObjId)
List< AbstractFile > findAllFilesWhere(String sqlWhereClause)
boolean setKnown(AbstractFile file, FileKnown fileKnown)
OsAccountManager getOsAccountManager()
static void tryConnect(CaseDbConnectionInfo info)
static SleuthkitCase openCase(String dbPath)
CaseDbQuery executeInsertOrUpdate(String query)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName, long dsObjId)
Volume addVolume(long parentObjId, long addr, long start, long length, String desc, long flags, CaseDbTransaction transaction)
long getBlackboardArtifactsCount(int artifactTypeID, long obj_id)
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType, CaseDbTransaction transaction)
void submitError(String context, String errorMessage)
final List< IngestJobInfo > getIngestJobs()
ALLOC
Name is in an allocated state.
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
static SleuthkitCase newCase(String dbPath)
String getBackupDatabasePath()
void acquireSingleUserCaseReadLock()
VirtualDirectory addVirtualDirectory(long parentId, String directoryName)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
List< ContentTag > getContentTagsByContent(Content content)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, long obj_id)
TagName addTagName(String displayName, String description, TagName.HTML_COLOR color)
int countFsContentType(TskData.TSK_FS_META_TYPE_ENUM contentType)
ABSTRACTFILE
File - see tsk_files for more details.
ContentTag addContentTag(Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset)
DataSource getDataSource(long objectId)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String subString, boolean startsWith)
TSK_FS_META_TYPE_REG
Regular file NON-NLS.
Iterable< BlackboardArtifact.Type > getArtifactTypes()
List< BlackboardAttribute.Type > getAttributeTypes()
LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootDirectoryName, String timeZone, CaseDbTransaction transaction)
FsContent addFileSystemFile(long dataSourceObjId, long fsObjId, String fileName, long metaAddr, int metaSeq, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, String md5Hash, String sha256Hash, String mimeType, boolean isFile, Content parent, String ownerUid, OsAccount osAccount, List< Attribute > fileAttributes, CaseDbTransaction transaction)
AddImageProcess makeAddImageProcess(String timeZone, boolean addUnallocSpace, boolean noFatFsOrphans, String imageCopyPath)
List< FsContent > findFilesWhere(String sqlWhereClause)
Long getDataSourceObjectId()
static ReviewStatus withID(int id)
void copyCaseDB(String newDBPath)
FileManager getFileManager()
Image addImage(TskData.TSK_IMG_TYPE_ENUM type, long sectorSize, long size, String displayName, List< String > imagePaths, String timezone, String md5, String sha1, String sha256, String deviceId, Host host, CaseDbTransaction transaction)
ResultSet runQuery(String query)
List< TskFileRange > getFileRanges(long id)
BlackboardArtifact.Type addBlackboardArtifactType(String artifactTypeName, String displayName)
void registerForEvents(Object listener)
CaseDbQuery executeQuery(String query)
ScoringManager getScoringManager()
void setReviewStatus(BlackboardArtifact artifact, BlackboardArtifact.ReviewStatus newStatus)
void setImagePaths(long obj_id, List< String > paths)
VS
Volume System - see tsk_vs_info for more details.
IMG
Disk Image - see tsk_image_info for more details.
UNALLOC
Name is in an unallocated state.
Collection< FileSystem > getFileSystems(Image image)
LocalDirectory addLocalDirectory(long parentId, String directoryName)
Optional< Long > getOsAccountObjectId()