Sleuth Kit Java Bindings (JNI)  4.11.0
Java bindings for using The Sleuth Kit
AbstractContent.java
Go to the documentation of this file.
1 /*
2  * Sleuth Kit Data Model
3  *
4  * Copyright 2011-2016 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import java.util.ArrayList;
22 import java.util.Collection;
23 import java.util.Collections;
24 import java.util.HashSet;
25 import java.util.List;
26 import java.util.Set;
27 import java.util.logging.Level;
28 import java.util.logging.Logger;
35 
40 public abstract class AbstractContent implements Content {
41 
42  private final static BlackboardArtifact.Type GEN_INFO_TYPE = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_GEN_INFO);
43  public final static long UNKNOWN_ID = -1;
44  private final SleuthkitCase db;
45  private final long objId;
46  private final String name;
47  private volatile Content parent;
48  private volatile String uniquePath;
49  protected long parentId;
50  private volatile boolean hasChildren;
51  private volatile boolean checkedHasChildren;
52  private volatile int childrenCount;
53  private BlackboardArtifact genInfoArtifact = null;
54 
55  protected AbstractContent(SleuthkitCase db, long obj_id, String name) {
56  this.db = db;
57  this.objId = obj_id;
58  this.name = name;
59  this.parentId = UNKNOWN_ID;
60 
61  checkedHasChildren = false;
62  hasChildren = false;
63  childrenCount = -1;
64  }
65 
66  @Override
67  public String getName() {
68  return this.name;
69  }
70 
71  /*
72  * This base implementation simply walks the hierarchy appending its own
73  * name to the result of calling its parent's getUniquePath() method (with
74  * interleaving forward slashes).
75  */
76  @Override
77  public String getUniquePath() throws TskCoreException {
78  // It is possible that multiple threads could be doing this calculation
79  // simultaneously, but it's worth the potential extra processing to prevent deadlocks.
80  if (uniquePath == null) {
81  String tempUniquePath = "";
82  if (!name.isEmpty()) {
83  tempUniquePath = "/" + getName();
84  }
85 
86  Content myParent = getParent();
87  if (myParent != null) {
88  tempUniquePath = myParent.getUniquePath() + tempUniquePath;
89  }
90 
91  // Don't update uniquePath until it is complete.
92  uniquePath = tempUniquePath;
93  }
94  return uniquePath;
95  }
96 
97  @Override
98  public boolean hasChildren() throws TskCoreException {
99  if (checkedHasChildren == true) {
100  return hasChildren;
101  }
102 
103  hasChildren = this.getSleuthkitCase().getHasChildren(this);
104  checkedHasChildren = true;
105 
106  return hasChildren;
107  }
108 
109  @Override
110  public int getChildrenCount() throws TskCoreException {
111  if (childrenCount != -1) {
112  return childrenCount;
113  }
114 
115  childrenCount = this.getSleuthkitCase().getContentChildrenCount(this);
116 
117  hasChildren = childrenCount > 0;
118  checkedHasChildren = true;
119 
120  return childrenCount;
121  }
122 
123  @Override
125  // It is possible that multiple threads could be doing this calculation
126  // simultaneously, but it's worth the potential extra processing to prevent deadlocks.
127  if (parent == null) {
128  ObjectInfo parentInfo;
129  parentInfo = db.getParentInfo(this);
130  if (parentInfo == null) {
131  parent = null;
132  } else {
133  parent = db.getContentById(parentInfo.getId());
134  }
135  }
136  return parent;
137  }
138 
139  void setParent(Content parent) {
140  this.parent = parent;
141  }
142 
150  void setParentId(long parentId) {
151  this.parentId = parentId;
152  }
153 
154  @Override
155  public long getId() {
156  return this.objId;
157  }
158 
167  @Override
168  public List<Content> getChildren() throws TskCoreException {
169  List<Content> children = new ArrayList<Content>();
170 
171  children.addAll(getSleuthkitCase().getAbstractFileChildren(this));
172  children.addAll(getSleuthkitCase().getBlackboardArtifactChildren(this));
173 
174  return children;
175 
176  }
177 
187  @Override
188  public List<Long> getChildrenIds() throws TskCoreException {
189 
190  List<Long> childrenIDs = new ArrayList<Long>();
191 
192  childrenIDs.addAll(getSleuthkitCase().getAbstractFileChildrenIds(this));
193  childrenIDs.addAll(getSleuthkitCase().getBlackboardArtifactChildrenIds(this));
194 
195  return childrenIDs;
196  }
197 
198  // classes should override this if they can be a data source
199  @Override
201  Content myParent = getParent();
202  if (myParent == null) {
203  return null;
204  }
205 
206  return myParent.getDataSource();
207  }
208 
216  boolean isPoolContent() throws TskCoreException {
217  return getPool() != null;
218  }
219 
228  Volume getPoolVolume() throws TskCoreException {
229  Content myParent = getParent();
230  if (myParent == null) {
231  return null;
232  }
233 
234  if (!(myParent instanceof AbstractContent)) {
235  return null;
236  }
237 
238  if (myParent instanceof Volume) {
239  // This is potentially it, but need to check that this is a volume under a pool
240  if (((Volume) myParent).isPoolContent()) {
241  return (Volume) myParent;
242  } else {
243  // There are no pools in the hierarchy, so we're done
244  return null;
245  }
246  }
247 
248  // Try one level higher
249  return ((AbstractContent) myParent).getPoolVolume();
250  }
251 
259  Pool getPool() throws TskCoreException {
260  Content myParent = getParent();
261  if (myParent == null) {
262  return null;
263  }
264 
265  if (!(myParent instanceof AbstractContent)) {
266  return null;
267  }
268 
269  if (myParent instanceof Pool) {
270  return (Pool) myParent;
271  }
272 
273  // Try one level higher
274  return ((AbstractContent) myParent).getPool();
275  }
276 
283  return db;
284  }
285 
286  @Override
287  public boolean equals(Object obj) {
288  if (obj == null) {
289  return false;
290  }
291  if (getClass() != obj.getClass()) {
292  return false;
293  }
294  final AbstractContent other = (AbstractContent) obj;
295  if (this.objId != other.objId) {
296  return false;
297  }
298 
299  try {
300  // New children may have been added to an existing content
301  // object in which case they are not equal.
302  if (this.getChildrenCount() != other.getChildrenCount()) {
303  return false;
304  }
305  } catch (TskCoreException ex) {
306  Logger.getLogger(AbstractContent.class.getName()).log(Level.SEVERE, null, ex);
307  }
308 
309  return true;
310  }
311 
312  @Override
313  public int hashCode() {
314  int hash = 7 + (int) (this.objId ^ (this.objId >>> 32));
315  try {
316  hash = 41 * hash + this.getChildrenCount();
317  } catch (TskCoreException ex) {
318  Logger.getLogger(AbstractContent.class.getName()).log(Level.SEVERE, null, ex);
319  }
320  return hash;
321  }
322 
323  @Deprecated
324  @Override
325  public BlackboardArtifact newArtifact(int artifactTypeID) throws TskCoreException {
326  // don't let them make more than 1 GEN_INFO
327  if (artifactTypeID == ARTIFACT_TYPE.TSK_GEN_INFO.getTypeID()) {
328  return getGenInfoArtifact(true);
329  }
330  BlackboardArtifact.Type artifactType = db.getArtifactType(artifactTypeID);
331  switch (artifactType.getCategory()) {
332  case DATA_ARTIFACT:
333  return this.newDataArtifact(artifactType, Collections.emptyList());
334  case ANALYSIS_RESULT: {
335  AnalysisResultAdded addedResult = this.newAnalysisResult(artifactType, Score.SCORE_UNKNOWN, null, null, null, Collections.emptyList());
336  return addedResult.getAnalysisResult();
337  }
338  default:
339  throw new TskCoreException(String.format("Unknown category: %s for artifact type id: %d",
340  artifactType.getCategory().getName(), artifactTypeID));
341  }
342  }
343 
344  @Override
345  public AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection<BlackboardAttribute> attributesList) throws TskCoreException {
346 
347  long dataSourceObjectId = this.getDataSource().getId();
348  CaseDbTransaction trans = db.beginTransaction();
349  try {
350  AnalysisResultAdded resultAdded = db.getBlackboard().newAnalysisResult(artifactType, objId, dataSourceObjectId, score, conclusion, configuration, justification, attributesList, trans);
351 
352  trans.commit();
353  return resultAdded;
354  } catch (BlackboardException ex) {
355  trans.rollback();
356  throw new TskCoreException(String.format("Error adding analysis result to content with objId = %d.", objId), ex);
357  }
358  }
359 
360  @Override
361  public AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection<BlackboardAttribute> attributesList, long dataSourceId) throws TskCoreException {
362 
363  long dataSourceObjectId = dataSourceId;
364  CaseDbTransaction trans = db.beginTransaction();
365  try {
366  AnalysisResultAdded resultAdded = db.getBlackboard().newAnalysisResult(artifactType, objId, dataSourceObjectId, score, conclusion, configuration, justification, attributesList, trans);
367 
368  trans.commit();
369  return resultAdded;
370  } catch (BlackboardException ex) {
371  trans.rollback();
372  throw new TskCoreException(String.format("Error adding analysis result to content with objId = %d.", objId), ex);
373  }
374  }
375 
376  @Override
377  public DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection<BlackboardAttribute> attributesList, Long osAccountId) throws TskCoreException {
378  DataArtifact artifact = db.getBlackboard().newDataArtifact(artifactType, objId, this.getDataSource().getId(), attributesList, osAccountId);
379 
380  if (osAccountId != null) {
381  try (CaseDbConnection connection = db.getConnection()) {
383  }
384  }
385  return artifact;
386  }
387 
388  @Override
389  public DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection<BlackboardAttribute> attributesList, Long osAccountId, long dataSourceId) throws TskCoreException {
390  DataArtifact artifact = db.getBlackboard().newDataArtifact(artifactType, objId, dataSourceId, attributesList, osAccountId);
391 
392  if (osAccountId != null) {
393  try (CaseDbConnection connection = db.getConnection()) {
394  db.getOsAccountManager().newOsAccountInstance(osAccountId, dataSourceId, OsAccountInstance.OsAccountInstanceType.ACCESSED, connection);
395  }
396  }
397  return artifact;
398  }
399 
400  @Override
401  public DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection<BlackboardAttribute> attributesList) throws TskCoreException {
402  return newDataArtifact(artifactType, attributesList, null);
403  }
404 
405  @Deprecated
406  @SuppressWarnings("deprecation")
407  @Override
408  public BlackboardArtifact newArtifact(BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException {
409  return newArtifact(type.getTypeID());
410  }
411 
412  @Override
413  public ArrayList<BlackboardArtifact> getArtifacts(String artifactTypeName) throws TskCoreException {
414  return getArtifacts(db.getArtifactType(artifactTypeName).getTypeID());
415  }
416 
417  @Override
418  public ArrayList<BlackboardArtifact> getArtifacts(int artifactTypeID) throws TskCoreException {
419  if (artifactTypeID == ARTIFACT_TYPE.TSK_GEN_INFO.getTypeID()) {
420  if (genInfoArtifact == null) // don't make one if it doesn't already exist
421  {
422  getGenInfoArtifact(false);
423  }
424 
425  ArrayList<BlackboardArtifact> list = new ArrayList<BlackboardArtifact>();
426  // genInfoArtifact coudl still be null if there isn't an artifact
427  if (genInfoArtifact != null) {
428  list.add(genInfoArtifact);
429  }
430  return list;
431  }
432  return db.getBlackboardArtifacts(artifactTypeID, objId);
433  }
434 
435  @Override
436  public ArrayList<BlackboardArtifact> getArtifacts(BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException {
437  return getArtifacts(type.getTypeID());
438  }
439 
440  @Override
441  public BlackboardArtifact getGenInfoArtifact() throws TskCoreException {
442  return getGenInfoArtifact(true);
443  }
444 
445  @Override
446  public BlackboardArtifact getGenInfoArtifact(boolean create) throws TskCoreException {
447  if (genInfoArtifact != null) {
448  return genInfoArtifact;
449  }
450 
451  // go to db directly to avoid infinite loop
452  ArrayList<BlackboardArtifact> arts = db.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO, objId);
453  BlackboardArtifact retArt;
454  if (arts.isEmpty()) {
455  if (create) {
456  retArt = this.newDataArtifact(GEN_INFO_TYPE, Collections.emptyList());
457  } else {
458  return null;
459  }
460  } else {
461  retArt = arts.get(0);
462  }
463  genInfoArtifact = retArt;
464  return retArt;
465  }
466 
467  @Override
468  public ArrayList<BlackboardAttribute> getGenInfoAttributes(ATTRIBUTE_TYPE attr_type) throws TskCoreException {
469  ArrayList<BlackboardAttribute> returnList = new ArrayList<BlackboardAttribute>();
470 
471  if (genInfoArtifact == null) {
472  getGenInfoArtifact(false);
473  if (genInfoArtifact == null) {
474  return returnList;
475  }
476  }
477 
478  for (BlackboardAttribute attribute : genInfoArtifact.getAttributes()) {
479  if (attribute.getAttributeType().getTypeID() == attr_type.getTypeID()) {
480  returnList.add(attribute);
481  }
482  }
483 
484  return returnList;
485  }
486 
487  @Override
488  public ArrayList<BlackboardArtifact> getAllArtifacts() throws TskCoreException {
489  return db.getMatchingArtifacts("WHERE obj_id = " + objId); //NON-NLS
490  }
491 
492  @Override
493  public List<AnalysisResult> getAllAnalysisResults() throws TskCoreException {
494  return db.getBlackboard().getAnalysisResults(objId);
495  }
496 
497  @Override
498  public List<DataArtifact> getAllDataArtifacts() throws TskCoreException {
499  return db.getBlackboard().getDataArtifactsBySource(objId);
500  }
501 
502  @Override
503  public Score getAggregateScore() throws TskCoreException {
504  return db.getScoringManager().getAggregateScore(objId);
505  }
506 
507  @Override
508  public List<AnalysisResult> getAnalysisResults(BlackboardArtifact.Type artifactType) throws TskCoreException {
509  return db.getBlackboard().getAnalysisResults(objId, artifactType.getTypeID()); //NON-NLS
510  }
511 
512  @Override
513  public long getArtifactsCount(String artifactTypeName) throws TskCoreException {
514  return db.getBlackboardArtifactsCount(artifactTypeName, objId);
515  }
516 
517  @Override
518  public long getArtifactsCount(int artifactTypeID) throws TskCoreException {
519  return db.getBlackboardArtifactsCount(artifactTypeID, objId);
520  }
521 
522  @Override
523  public long getArtifactsCount(ARTIFACT_TYPE type) throws TskCoreException {
524  return db.getBlackboardArtifactsCount(type, objId);
525  }
526 
527  @Override
528  public long getAllArtifactsCount() throws TskCoreException {
529  return db.getBlackboardArtifactsCount(objId);
530  }
531 
532  @Override
533  public Set<String> getHashSetNames() throws TskCoreException {
534  Set<String> hashNames = new HashSet<String>();
535  ArrayList<BlackboardArtifact> artifacts = getArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT);
536 
537  for (BlackboardArtifact a : artifacts) {
539  if (attribute != null) {
540  hashNames.add(attribute.getValueString());
541  }
542  }
543  return Collections.unmodifiableSet(hashNames);
544  }
545 
546  @Override
547  public String toString() {
548  return toString(true);
549  }
550 
551  public String toString(boolean preserveState) {
552  if (preserveState) {
553  return "AbstractContent [\t" + "objId " + String.format("%010d", objId) + "\t" //NON-NLS
554  + "name " + name + "\t" + "parentId " + parentId + "\t" //NON-NLS
555  + "\t" + "checkedHasChildren " + checkedHasChildren //NON-NLS
556  + "\t" + "hasChildren " + hasChildren //NON-NLS
557  + "\t" + "childrenCount " + childrenCount //NON-NLS
558  + "uniquePath " + uniquePath + "]\t"; //NON-NLS
559  } else {
560  try {
561  if (getParent() != null) {
562  return "AbstractContent [\t" + "objId " + String.format("%010d", objId) //NON-NLS
563  + "\t" + "name " + name //NON-NLS
564  + "\t" + "checkedHasChildren " + checkedHasChildren //NON-NLS
565  + "\t" + "hasChildren " + hasChildren //NON-NLS
566  + "\t" + "childrenCount " + childrenCount //NON-NLS
567  + "\t" + "getUniquePath " + getUniquePath() //NON-NLS
568  + "\t" + "getParent " + getParent().getId() + "]\t"; //NON-NLS
569  } else {
570  return "AbstractContent [\t" + "objId " //NON-NLS
571  + String.format("%010d", objId) + "\t" + "name " + name //NON-NLS
572  + "\t" + "checkedHasChildren " + checkedHasChildren //NON-NLS
573  + "\t" + "hasChildren " + hasChildren //NON-NLS
574  + "\t" + "childrenCount " + childrenCount //NON-NLS
575  + "\t" + "uniquePath " + getUniquePath() //NON-NLS
576  + "\t" + "parentId " + parentId + "]\t"; //NON-NLS
577  }
578  } catch (TskCoreException ex) {
579  Logger.getLogger(AbstractContent.class.getName()).log(Level.SEVERE, "Could not find Parent", ex); //NON-NLS
580  return "AbstractContent [\t" + "objId " + String.format("%010d", objId) + "\t" //NON-NLS
581  + "name " + name + "\t" + "parentId " + parentId + "\t" //NON-NLS
582  + "\t" + "checkedHasChildren " + checkedHasChildren //NON-NLS
583  + "\t" + "hasChildren " + hasChildren //NON-NLS
584  + "\t" + "childrenCount " + childrenCount //NON-NLS
585  + "uniquePath " + uniquePath + "]\t"; //NON-NLS
586  }
587  }
588  }
589 }
static final Score SCORE_UNKNOWN
Definition: Score.java:213
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID)
ArrayList< BlackboardArtifact > getArtifacts(int artifactTypeID)
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, long sourceObjId, Long dataSourceObjId, Collection< BlackboardAttribute > attributes, Long osAccountId)
AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList)
List< AnalysisResult > getAnalysisResults(BlackboardArtifact.Type artifactType)
ArrayList< BlackboardArtifact > getAllArtifacts()
List< AnalysisResult > getAnalysisResults(long sourceObjId)
String toString(boolean preserveState)
ArrayList< BlackboardArtifact > getMatchingArtifacts(String whereClause)
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId)
List< AnalysisResult > getAllAnalysisResults()
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList)
AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId)
BlackboardArtifact newArtifact(BlackboardArtifact.ARTIFACT_TYPE type)
ArrayList< BlackboardArtifact > getArtifacts(BlackboardArtifact.ARTIFACT_TYPE type)
AbstractContent(SleuthkitCase db, long obj_id, String name)
OsAccountInstance newOsAccountInstance(OsAccount osAccount, DataSource dataSource, OsAccountInstance.OsAccountInstanceType instanceType)
BlackboardArtifact.Type getArtifactType(String artTypeName)
long getArtifactsCount(ARTIFACT_TYPE type)
AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, long objId, Long dataSourceObjId, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList)
BlackboardArtifact newArtifact(int artifactTypeID)
long getArtifactsCount(int artifactTypeID)
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId)
ArrayList< BlackboardArtifact > getArtifacts(String artifactTypeName)
BlackboardArtifact getGenInfoArtifact(boolean create)
ArrayList< BlackboardAttribute > getGenInfoAttributes(ATTRIBUTE_TYPE attr_type)
long getArtifactsCount(String artifactTypeName)

Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.