19 package org.sleuthkit.datamodel;
21 import com.google.common.annotations.Beta;
22 import com.google.common.cache.Cache;
23 import com.google.common.cache.CacheBuilder;
24 import com.google.common.collect.ImmutableSet;
25 import com.google.common.eventbus.EventBus;
26 import com.mchange.v2.c3p0.ComboPooledDataSource;
27 import com.mchange.v2.c3p0.DataSources;
28 import com.mchange.v2.c3p0.PooledDataSource;
29 import com.zaxxer.sparsebits.SparseBitSet;
30 import java.beans.PropertyVetoException;
31 import java.io.BufferedInputStream;
32 import java.io.BufferedOutputStream;
34 import java.io.FileInputStream;
35 import java.io.FileOutputStream;
36 import java.io.IOException;
37 import java.io.InputStream;
38 import java.io.OutputStream;
39 import java.io.UnsupportedEncodingException;
40 import java.net.InetAddress;
41 import java.net.URLEncoder;
42 import java.nio.charset.StandardCharsets;
43 import java.nio.file.Paths;
44 import java.sql.Connection;
45 import java.sql.DriverManager;
46 import java.sql.PreparedStatement;
47 import java.sql.ResultSet;
48 import java.sql.SQLException;
49 import java.sql.Statement;
50 import java.text.SimpleDateFormat;
51 import java.util.ArrayList;
52 import java.util.Arrays;
53 import java.util.Collection;
54 import java.util.Collections;
55 import java.util.concurrent.atomic.AtomicBoolean;
56 import java.util.concurrent.atomic.AtomicInteger;
57 import java.util.Date;
58 import java.util.EnumMap;
59 import java.util.HashMap;
60 import java.util.HashSet;
61 import java.util.LinkedHashMap;
62 import java.util.List;
64 import java.util.MissingResourceException;
65 import java.util.Objects;
66 import java.util.Properties;
67 import java.util.ResourceBundle;
69 import java.util.UUID;
70 import java.util.concurrent.TimeUnit;
71 import java.util.concurrent.locks.ReentrantReadWriteLock;
72 import java.util.logging.Level;
73 import java.util.logging.Logger;
74 import java.util.stream.Collectors;
75 import org.apache.commons.lang3.StringUtils;
76 import org.postgresql.util.PSQLState;
94 import org.sqlite.SQLiteConfig;
95 import org.sqlite.SQLiteDataSource;
96 import org.sqlite.SQLiteJDBCLoader;
104 private static final int MAX_DB_NAME_LEN_BEFORE_TIMESTAMP = 47;
109 private static final long BASE_ARTIFACT_ID = Long.MIN_VALUE;
110 private static final Logger logger = Logger.getLogger(
SleuthkitCase.class.getName());
111 private static final ResourceBundle bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
112 private static final int IS_REACHABLE_TIMEOUT_MS = 1000;
113 private static final String SQL_ERROR_CONNECTION_GROUP =
"08";
114 private static final String SQL_ERROR_AUTHENTICATION_GROUP =
"28";
115 private static final String SQL_ERROR_PRIVILEGE_GROUP =
"42";
116 private static final String SQL_ERROR_RESOURCE_GROUP =
"53";
117 private static final String SQL_ERROR_LIMIT_GROUP =
"54";
118 private static final String SQL_ERROR_INTERNAL_GROUP =
"xx";
120 private static final Set<String> CORE_TABLE_NAMES = ImmutableSet.of(
122 "tsk_event_descriptions",
135 "tsk_files_derived_method",
138 "blackboard_artifact_tags",
139 "blackboard_artifacts",
140 "blackboard_attributes",
141 "blackboard_artifact_types",
142 "blackboard_attribute_types",
144 "file_encoding_types",
145 "ingest_module_types",
146 "ingest_job_status_types",
149 "ingest_job_modules",
152 "account_relationships",
156 private static final Set<String> CORE_INDEX_NAMES = ImmutableSet.of(
160 "artifact_artifact_objID",
165 "relationships_account1",
166 "relationships_account2",
167 "relationships_relationship_source_obj_id",
168 "relationships_date_time",
169 "relationships_relationship_type",
170 "relationships_data_source_obj_id",
173 "events_data_source_obj_id",
174 "events_file_obj_id",
175 "events_artifact_id");
177 private static final String TSK_VERSION_KEY =
"TSK_VER";
178 private static final String SCHEMA_MAJOR_VERSION_KEY =
"SCHEMA_MAJOR_VERSION";
179 private static final String SCHEMA_MINOR_VERSION_KEY =
"SCHEMA_MINOR_VERSION";
180 private static final String CREATION_SCHEMA_MAJOR_VERSION_KEY =
"CREATION_SCHEMA_MAJOR_VERSION";
181 private static final String CREATION_SCHEMA_MINOR_VERSION_KEY =
"CREATION_SCHEMA_MINOR_VERSION";
183 private final ConnectionPool connections;
184 private final Object carvedFileDirsLock =
new Object();
185 private final static int MAX_CARVED_FILES_PER_FOLDER = 2000;
186 private final Map<Long, CarvedFileDirInfo> rootIdsToCarvedFileDirs =
new HashMap<>();
187 private final Map<Long, FileSystem> fileSystemIdMap =
new HashMap<>();
188 private final List<ErrorObserver> sleuthkitCaseErrorObservers =
new ArrayList<>();
189 private final String databaseName;
190 private final String dbPath;
191 private final DbType dbType;
192 private final String caseDirPath;
194 private final String caseHandleIdentifier;
195 private String dbBackupPath;
196 private AtomicBoolean timelineEventsDisabled =
new AtomicBoolean(
false);
201 private final Object rootDirectoryMapLock =
new Object();
202 private final Map<RootDirectoryKey, Long> rootDirectoryMap =
new HashMap<>();
203 private final Cache<Long, Boolean> isRootDirectoryCache
204 = CacheBuilder.newBuilder().maximumSize(200000).expireAfterAccess(5, TimeUnit.MINUTES).build();
210 private final Map<Long, SparseBitSet> hasChildrenBitSetMap =
new HashMap<>();
212 private long nextArtifactId;
217 private final ReentrantReadWriteLock rwLock =
new ReentrantReadWriteLock(
true);
232 private final Map<String, Set<Long>> deviceIdToDatasourceObjIdMap =
new HashMap<>();
234 private final EventBus eventBus =
new EventBus(
"SleuthkitCase-EventBus");
237 eventBus.register(listener);
241 eventBus.unregister(listener);
244 void fireTSKEvent(Object event) {
245 eventBus.post(event);
249 private final Map<Long, Content> frequentlyUsedContentMap =
new HashMap<>();
251 private Examiner cachedCurrentExaminer = null;
254 Properties p =
new Properties(System.getProperties());
255 p.put(
"com.mchange.v2.log.MLog",
"com.mchange.v2.log.FallbackMLog");
256 p.put(
"com.mchange.v2.log.FallbackMLog.DEFAULT_CUTOFF_LEVEL",
"SEVERE");
257 System.setProperties(p);
276 if (info.getHost() == null || info.getHost().isEmpty()) {
277 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingHostname"));
278 }
else if (info.getPort() == null || info.getPort().isEmpty()) {
279 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPort"));
280 }
else if (info.getUserName() == null || info.getUserName().isEmpty()) {
281 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingUsername"));
282 }
else if (info.getPassword() == null || info.getPassword().isEmpty()) {
283 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPassword"));
287 Class.forName(
"org.postgresql.Driver");
288 Connection conn = DriverManager.getConnection(
"jdbc:postgresql://" + info.getHost() +
":" + info.getPort() +
"/postgres", info.getUserName(), info.getPassword());
292 }
catch (SQLException ex) {
294 String sqlState = ex.getSQLState().toLowerCase();
295 if (sqlState.startsWith(SQL_ERROR_CONNECTION_GROUP)) {
297 if (InetAddress.getByName(info.getHost()).isReachable(IS_REACHABLE_TIMEOUT_MS)) {
299 result = bundle.getString(
"DatabaseConnectionCheck.Port");
301 result = bundle.getString(
"DatabaseConnectionCheck.HostnameOrPort");
303 }
catch (IOException | MissingResourceException any) {
305 result = bundle.getString(
"DatabaseConnectionCheck.Everything");
307 }
else if (sqlState.startsWith(SQL_ERROR_AUTHENTICATION_GROUP)) {
308 result = bundle.getString(
"DatabaseConnectionCheck.Authentication");
309 }
else if (sqlState.startsWith(SQL_ERROR_PRIVILEGE_GROUP)) {
310 result = bundle.getString(
"DatabaseConnectionCheck.Access");
311 }
else if (sqlState.startsWith(SQL_ERROR_RESOURCE_GROUP)) {
312 result = bundle.getString(
"DatabaseConnectionCheck.ServerDiskSpace");
313 }
else if (sqlState.startsWith(SQL_ERROR_LIMIT_GROUP)) {
314 result = bundle.getString(
"DatabaseConnectionCheck.ServerRestart");
315 }
else if (sqlState.startsWith(SQL_ERROR_INTERNAL_GROUP)) {
316 result = bundle.getString(
"DatabaseConnectionCheck.InternalServerIssue");
318 result = bundle.getString(
"DatabaseConnectionCheck.Connection");
321 }
catch (ClassNotFoundException ex) {
322 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.Installation"));
338 Class.forName(
"org.sqlite.JDBC");
339 this.dbPath = dbPath;
340 this.dbType = dbType;
342 this.caseDirPath = dbFile.getParentFile().getAbsolutePath();
343 this.databaseName = dbFile.
getName();
344 this.connections =
new SQLiteConnections(dbPath);
345 this.caseHandle = caseHandle;
346 this.caseHandleIdentifier = caseHandle.getCaseDbIdentifier();
348 logSQLiteJDBCDriverInfo();
368 private SleuthkitCase(String host,
int port, String dbName, String userName, String password, SleuthkitJNI.CaseDbHandle caseHandle, String caseDirPath, DbType dbType)
throws Exception {
370 this.databaseName = dbName;
371 this.dbType = dbType;
372 this.caseDirPath = caseDirPath;
373 this.connections =
new PostgreSQLConnections(host, port, dbName, userName, password);
374 this.caseHandle = caseHandle;
375 this.caseHandleIdentifier = caseHandle.getCaseDbIdentifier();
379 private void init() throws Exception {
380 blackboard =
new Blackboard(
this);
381 updateDatabaseSchema(null);
382 try (CaseDbConnection connection = connections.getConnection()) {
383 blackboard.initBlackboardArtifactTypes(connection);
384 blackboard.initBlackboardAttributeTypes(connection);
385 initNextArtifactId(connection);
386 initIngestModuleTypes(connection);
387 initIngestStatusTypes(connection);
388 initReviewStatuses(connection);
389 initEncodingTypes(connection);
390 populateHasChildrenMap(connection);
391 updateExaminers(connection);
392 initDBSchemaCreationVersion(connection);
395 fileManager =
new FileManager(
this);
396 communicationsMgr =
new CommunicationsManager(
this);
397 timelineMgr =
new TimelineManager(
this);
398 dbAccessManager =
new CaseDbAccessManager(
this);
399 taggingMgr =
new TaggingManager(
this);
400 scoringManager =
new ScoringManager(
this);
401 osAccountRealmManager =
new OsAccountRealmManager(
this);
402 osAccountManager =
new OsAccountManager(
this);
403 hostManager =
new HostManager(
this);
404 personManager =
new PersonManager(
this);
405 hostAddressManager =
new HostAddressManager(
this);
413 static Set<String> getCoreTableNames() {
414 return Collections.unmodifiableSet(CORE_TABLE_NAMES);
422 static Set<String> getCoreIndexNames() {
423 return Collections.unmodifiableSet(CORE_INDEX_NAMES);
434 boolean getHasChildren(Content content) {
435 long objId = content.getId();
436 long mapIndex = objId / Integer.MAX_VALUE;
437 int mapValue = (int) (objId % Integer.MAX_VALUE);
439 synchronized (hasChildrenBitSetMap) {
440 if (hasChildrenBitSetMap.containsKey(mapIndex)) {
441 return hasChildrenBitSetMap.get(mapIndex).get(mapValue);
452 private void setHasChildren(Long objId) {
453 long mapIndex = objId / Integer.MAX_VALUE;
454 int mapValue = (int) (objId % Integer.MAX_VALUE);
456 synchronized (hasChildrenBitSetMap) {
457 if (hasChildrenBitSetMap.containsKey(mapIndex)) {
458 hasChildrenBitSetMap.get(mapIndex).set(mapValue);
460 SparseBitSet bitSet =
new SparseBitSet();
461 bitSet.set(mapValue);
462 hasChildrenBitSetMap.put(mapIndex, bitSet);
475 return communicationsMgr;
515 return dbAccessManager;
535 return scoringManager;
546 return osAccountRealmManager;
557 return osAccountManager;
579 return personManager;
590 return hostAddressManager;
602 private void initNextArtifactId(CaseDbConnection connection)
throws SQLException {
604 try (Statement statement = connection.createStatement()) {
605 ResultSet resultSet = connection.executeQuery(statement,
"SELECT MAX(artifact_id) AS max_artifact_id FROM blackboard_artifacts");
607 nextArtifactId = resultSet.getLong(
"max_artifact_id") + 1;
608 if (nextArtifactId == 1) {
609 nextArtifactId = BASE_ARTIFACT_ID;
623 private void initIngestModuleTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
624 Statement statement = null;
625 ResultSet resultSet = null;
628 statement = connection.createStatement();
629 for (IngestModuleType type : IngestModuleType.values()) {
631 String query =
"INSERT INTO ingest_module_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"')";
633 query +=
" ON CONFLICT ON CONSTRAINT ingest_module_types_pkey DO NOTHING";
635 statement.execute(query);
636 }
catch (SQLException ex) {
637 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_module_types WHERE type_id = " + type.ordinal() +
";");
639 if (resultSet.getLong(
"count") == 0) {
647 closeResultSet(resultSet);
648 closeStatement(statement);
660 private void initIngestStatusTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
661 Statement statement = null;
662 ResultSet resultSet = null;
665 statement = connection.createStatement();
666 for (IngestJobStatusType type : IngestJobStatusType.values()) {
668 String query =
"INSERT INTO ingest_job_status_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"')";
670 query +=
" ON CONFLICT ON CONSTRAINT ingest_job_status_types_pkey DO NOTHING";
672 statement.execute(query);
673 }
catch (SQLException ex) {
674 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_job_status_types WHERE type_id = " + type.ordinal() +
";");
676 if (resultSet.getLong(
"count") == 0) {
684 closeResultSet(resultSet);
685 closeStatement(statement);
696 private void initReviewStatuses(CaseDbConnection connection)
throws SQLException, TskCoreException {
697 Statement statement = null;
698 ResultSet resultSet = null;
701 statement = connection.createStatement();
702 for (BlackboardArtifact.ReviewStatus status : BlackboardArtifact.ReviewStatus.values()) {
704 String query =
"INSERT INTO review_statuses (review_status_id, review_status_name, display_name) "
705 +
"VALUES (" + status.getID() +
",'" + status.getName() +
"','" + status.getDisplayName() +
"')";
707 query +=
" ON CONFLICT ON CONSTRAINT review_statuses_pkey DO NOTHING";
709 statement.execute(query);
710 }
catch (SQLException ex) {
711 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM review_statuses WHERE review_status_id = " + status.getID());
713 if (resultSet.getLong(
"count") == 0) {
721 closeResultSet(resultSet);
722 closeStatement(statement);
734 private void initEncodingTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
735 Statement statement = null;
736 ResultSet resultSet = null;
739 statement = connection.createStatement();
740 for (TskData.EncodingType type : TskData.EncodingType.values()) {
742 String query =
"INSERT INTO file_encoding_types (encoding_type, name) VALUES (" + type.getType() +
" , '" + type.name() +
"')";
744 query +=
" ON CONFLICT ON CONSTRAINT file_encoding_types_pkey DO NOTHING";
746 statement.execute(query);
747 }
catch (SQLException ex) {
748 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM file_encoding_types WHERE encoding_type = " + type.getType());
750 if (resultSet.getLong(
"count") == 0) {
758 closeResultSet(resultSet);
759 closeStatement(statement);
772 private void updateExaminers(CaseDbConnection connection)
throws SQLException, TskCoreException {
774 String loginName = System.getProperty(
"user.name");
775 if (loginName.isEmpty()) {
776 logger.log(Level.SEVERE,
"Cannot determine logged in user name");
782 PreparedStatement statement;
785 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_EXAMINER_POSTGRESQL);
788 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_EXAMINER_SQLITE);
791 throw new TskCoreException(
"Unknown DB Type: " +
getDatabaseType().name());
793 statement.clearParameters();
794 statement.setString(1, loginName);
795 connection.executeUpdate(statement);
796 }
catch (SQLException ex) {
797 throw new TskCoreException(
"Error inserting row in tsk_examiners. login name: " + loginName, ex);
810 private void populateHasChildrenMap(CaseDbConnection connection)
throws TskCoreException {
811 long timestamp = System.currentTimeMillis();
813 Statement statement = null;
814 ResultSet resultSet = null;
817 statement = connection.createStatement();
818 resultSet = statement.executeQuery(
"select distinct par_obj_id from tsk_objects");
820 synchronized (hasChildrenBitSetMap) {
821 while (resultSet.next()) {
822 setHasChildren(resultSet.getLong(
"par_obj_id"));
825 long delay = System.currentTimeMillis() - timestamp;
826 logger.log(Level.INFO,
"Time to initialize parent node cache: {0} ms", delay);
827 }
catch (SQLException ex) {
828 throw new TskCoreException(
"Error populating parent node cache", ex);
830 closeResultSet(resultSet);
831 closeStatement(statement);
842 void addDataSourceToHasChildrenMap() throws TskCoreException {
844 CaseDbConnection connection = connections.getConnection();
846 populateHasChildrenMap(connection);
848 closeConnection(connection);
861 private void updateDatabaseSchema(String dbPath)
throws Exception {
862 CaseDbConnection connection = null;
863 ResultSet resultSet = null;
864 Statement statement = null;
867 connection = connections.getConnection();
868 connection.beginTransaction();
870 boolean hasMinorVersion =
false;
871 ResultSet columns = connection.getConnection().getMetaData().getColumns(null, null,
"tsk_db_info",
"schema%");
872 while (columns.next()) {
873 if (columns.getString(
"COLUMN_NAME").equals(
"schema_minor_ver")) {
874 hasMinorVersion =
true;
879 int dbSchemaMajorVersion;
880 int dbSchemaMinorVersion = 0;
882 statement = connection.createStatement();
883 resultSet = connection.executeQuery(statement,
"SELECT schema_ver"
884 + (hasMinorVersion ?
", schema_minor_ver" :
"")
885 +
" FROM tsk_db_info");
886 if (resultSet.next()) {
887 dbSchemaMajorVersion = resultSet.getInt(
"schema_ver");
888 if (hasMinorVersion) {
890 dbSchemaMinorVersion = resultSet.getInt(
"schema_minor_ver");
893 throw new TskCoreException();
895 CaseDbSchemaVersionNumber dbSchemaVersion =
new CaseDbSchemaVersionNumber(dbSchemaMajorVersion, dbSchemaMinorVersion);
902 if (
false == CURRENT_DB_SCHEMA_VERSION.
isCompatible(dbSchemaVersion)) {
904 throw new TskUnsupportedSchemaVersionException(
905 "Unsupported DB schema version " + dbSchemaVersion +
", the highest supported schema version is " + CURRENT_DB_SCHEMA_VERSION.
getMajor() +
".X");
906 }
else if (dbSchemaVersion.compareTo(CURRENT_DB_SCHEMA_VERSION) < 0) {
909 if (null != dbPath) {
912 String backupFilePath = dbPath +
".schemaVer" + dbSchemaVersion.toString() +
".backup";
914 dbBackupPath = backupFilePath;
921 dbSchemaVersion = updateFromSchema2toSchema3(dbSchemaVersion, connection);
922 dbSchemaVersion = updateFromSchema3toSchema4(dbSchemaVersion, connection);
923 dbSchemaVersion = updateFromSchema4toSchema5(dbSchemaVersion, connection);
924 dbSchemaVersion = updateFromSchema5toSchema6(dbSchemaVersion, connection);
925 dbSchemaVersion = updateFromSchema6toSchema7(dbSchemaVersion, connection);
926 dbSchemaVersion = updateFromSchema7toSchema7dot1(dbSchemaVersion, connection);
927 dbSchemaVersion = updateFromSchema7dot1toSchema7dot2(dbSchemaVersion, connection);
928 dbSchemaVersion = updateFromSchema7dot2toSchema8dot0(dbSchemaVersion, connection);
929 dbSchemaVersion = updateFromSchema8dot0toSchema8dot1(dbSchemaVersion, connection);
930 dbSchemaVersion = updateFromSchema8dot1toSchema8dot2(dbSchemaVersion, connection);
931 dbSchemaVersion = updateFromSchema8dot2toSchema8dot3(dbSchemaVersion, connection);
932 dbSchemaVersion = updateFromSchema8dot3toSchema8dot4(dbSchemaVersion, connection);
933 dbSchemaVersion = updateFromSchema8dot4toSchema8dot5(dbSchemaVersion, connection);
934 dbSchemaVersion = updateFromSchema8dot5toSchema8dot6(dbSchemaVersion, connection);
935 dbSchemaVersion = updateFromSchema8dot6toSchema9dot0(dbSchemaVersion, connection);
936 dbSchemaVersion = updateFromSchema9dot0toSchema9dot1(dbSchemaVersion, connection);
937 dbSchemaVersion = updateFromSchema9dot1toSchema9dot2(dbSchemaVersion, connection);
938 dbSchemaVersion = updateFromSchema9dot2toSchema9dot3(dbSchemaVersion, connection);
942 statement = connection.createStatement();
943 connection.executeUpdate(statement,
"UPDATE tsk_db_info SET schema_ver = " + dbSchemaVersion.getMajor() +
", schema_minor_ver = " + dbSchemaVersion.getMinor());
944 connection.executeUpdate(statement,
"UPDATE tsk_db_info_extended SET value = " + dbSchemaVersion.getMajor() +
" WHERE name = '" + SCHEMA_MAJOR_VERSION_KEY +
"'");
945 connection.executeUpdate(statement,
"UPDATE tsk_db_info_extended SET value = " + dbSchemaVersion.getMinor() +
" WHERE name = '" + SCHEMA_MINOR_VERSION_KEY +
"'");
950 connection.commitTransaction();
951 }
catch (Exception ex) {
952 rollbackTransaction(connection);
955 closeResultSet(resultSet);
956 closeStatement(statement);
957 closeConnection(connection);
969 private void initDBSchemaCreationVersion(CaseDbConnection connection)
throws SQLException {
971 Statement statement = null;
972 ResultSet resultSet = null;
973 String createdSchemaMajorVersion =
"0";
974 String createdSchemaMinorVersion =
"0";
977 statement = connection.createStatement();
978 resultSet = connection.executeQuery(statement,
"SELECT name, value FROM tsk_db_info_extended");
979 while (resultSet.next()) {
980 String name = resultSet.getString(
"name");
981 if (name.equals(CREATION_SCHEMA_MAJOR_VERSION_KEY) || name.equals(
"CREATED_SCHEMA_MAJOR_VERSION")) {
982 createdSchemaMajorVersion = resultSet.getString(
"value");
983 }
else if (name.equals(CREATION_SCHEMA_MINOR_VERSION_KEY) || name.equals(
"CREATED_SCHEMA_MINOR_VERSION")) {
984 createdSchemaMinorVersion = resultSet.getString(
"value");
989 closeResultSet(resultSet);
990 closeStatement(statement);
994 caseDBSchemaCreationVersion =
new CaseDbSchemaVersionNumber(Integer.parseInt(createdSchemaMajorVersion), Integer.parseInt(createdSchemaMinorVersion));
1007 if (dbPath.isEmpty()) {
1008 throw new IOException(
"Copying case database files is not supported for this type of case database");
1010 InputStream in = null;
1011 OutputStream out = null;
1014 InputStream inFile =
new FileInputStream(dbPath);
1015 in =
new BufferedInputStream(inFile);
1016 OutputStream outFile =
new FileOutputStream(newDBPath);
1017 out =
new BufferedOutputStream(outFile);
1018 int bytesRead = in.read();
1019 while (bytesRead != -1) {
1020 out.write(bytesRead);
1021 bytesRead = in.read();
1032 }
catch (IOException e) {
1033 logger.log(Level.WARNING,
"Could not close streams after db copy", e);
1042 private void logSQLiteJDBCDriverInfo() {
1044 SleuthkitCase.logger.info(String.format(
"sqlite-jdbc version %s loaded in %s mode",
1045 SQLiteJDBCLoader.getVersion(), SQLiteJDBCLoader.isNativeMode()
1046 ?
"native" :
"pure-java"));
1047 }
catch (Exception ex) {
1048 SleuthkitCase.logger.log(Level.SEVERE,
"Error querying case database mode", ex);
1065 @SuppressWarnings(
"deprecation")
1066 private CaseDbSchemaVersionNumber updateFromSchema2toSchema3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) throws SQLException, TskCoreException {
1067 if (schemaVersion.getMajor() != 2) {
1068 return schemaVersion;
1070 Statement statement = null;
1071 Statement statement2 = null;
1072 Statement updateStatement = null;
1073 ResultSet resultSet = null;
1076 statement = connection.createStatement();
1077 statement2 = connection.createStatement();
1080 statement.execute(
"CREATE TABLE tag_names (tag_name_id INTEGER PRIMARY KEY, display_name TEXT UNIQUE, description TEXT NOT NULL, color TEXT NOT NULL)");
1081 statement.execute(
"CREATE TABLE content_tags (tag_id INTEGER PRIMARY KEY, obj_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL, begin_byte_offset INTEGER NOT NULL, end_byte_offset INTEGER NOT NULL)");
1082 statement.execute(
"CREATE TABLE blackboard_artifact_tags (tag_id INTEGER PRIMARY KEY, artifact_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL)");
1085 statement.execute(
"CREATE TABLE reports (report_id INTEGER PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL)");
1088 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN size INTEGER;");
1089 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN md5 TEXT;");
1090 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN display_name TEXT;");
1093 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN display_name TEXT;");
1096 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN meta_seq INTEGER;");
1101 statement.execute(
"ALTER TABLE blackboard_attributes ADD COLUMN artifact_type_id INTEGER NULL NOT NULL DEFAULT -1;");
1102 statement.execute(
"CREATE INDEX attribute_artifactTypeId ON blackboard_attributes(artifact_type_id);");
1103 statement.execute(
"CREATE INDEX attribute_valueText ON blackboard_attributes(value_text);");
1104 statement.execute(
"CREATE INDEX attribute_valueInt32 ON blackboard_attributes(value_int32);");
1105 statement.execute(
"CREATE INDEX attribute_valueInt64 ON blackboard_attributes(value_int64);");
1106 statement.execute(
"CREATE INDEX attribute_valueDouble ON blackboard_attributes(value_double);");
1107 resultSet = statement.executeQuery(
"SELECT attrs.artifact_id AS artifact_id, "
1108 +
"arts.artifact_type_id AS artifact_type_id "
1109 +
"FROM blackboard_attributes AS attrs "
1110 +
"INNER JOIN blackboard_artifacts AS arts "
1111 +
"WHERE attrs.artifact_id = arts.artifact_id;");
1112 updateStatement = connection.createStatement();
1113 while (resultSet.next()) {
1114 long artifactId = resultSet.getLong(
"artifact_id");
1115 int artifactTypeId = resultSet.getInt(
"artifact_type_id");
1116 updateStatement.executeUpdate(
1117 "UPDATE blackboard_attributes "
1118 +
"SET artifact_type_id = " + artifactTypeId
1119 +
" WHERE blackboard_attributes.artifact_id = " + artifactId +
";");
1124 Map<String, Long> tagNames =
new HashMap<>();
1125 long tagNameCounter = 1;
1129 resultSet = statement.executeQuery(
"SELECT * FROM \n"
1130 +
"(SELECT blackboard_artifacts.obj_id AS objId, blackboard_attributes.artifact_id AS artifactId, blackboard_attributes.value_text AS name\n"
1131 +
"FROM blackboard_artifacts INNER JOIN blackboard_attributes \n"
1132 +
"ON blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id \n"
1133 +
"WHERE blackboard_artifacts.artifact_type_id = "
1134 + BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
1135 +
" AND blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TAG_NAME.getTypeID()
1136 +
") AS tagNames \n"
1138 +
"(SELECT tsk_files.obj_id as objId2, tsk_files.size AS fileSize \n"
1139 +
"FROM blackboard_artifacts INNER JOIN tsk_files \n"
1140 +
"ON blackboard_artifacts.obj_id = tsk_files.obj_id) AS fileData \n"
1141 +
"ON tagNames.objId = fileData.objId2 \n"
1143 +
"(SELECT value_text AS comment, artifact_id AS tagArtifactId FROM blackboard_attributes WHERE attribute_type_id = "
1144 + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID() +
") AS tagComments \n"
1145 +
"ON tagNames.artifactId = tagComments.tagArtifactId");
1147 while (resultSet.next()) {
1148 long objId = resultSet.getLong(
"objId");
1149 long fileSize = resultSet.getLong(
"fileSize");
1150 String tagName = resultSet.getString(
"name");
1151 String tagComment = resultSet.getString(
"comment");
1152 if (tagComment == null) {
1156 if (tagName != null && !tagName.isEmpty()) {
1159 if (tagNames.containsKey(tagName)) {
1160 tagNameIndex = tagNames.get(tagName);
1162 statement2.execute(
"INSERT INTO tag_names (display_name, description, color) "
1163 +
"VALUES(\"" + tagName +
"\", \"\", \"None\")");
1164 tagNames.put(tagName, tagNameCounter);
1165 tagNameIndex = tagNameCounter;
1169 statement2.execute(
"INSERT INTO content_tags (obj_id, tag_name_id, comment, begin_byte_offset, end_byte_offset) "
1170 +
"VALUES(" + objId +
", " + tagNameIndex +
", \"" + tagComment +
"\", 0, " + fileSize +
")");
1177 resultSet = statement.executeQuery(
"SELECT * FROM \n"
1178 +
"(SELECT blackboard_artifacts.obj_id AS objId, blackboard_attributes.artifact_id AS artifactId, "
1179 +
"blackboard_attributes.value_text AS name\n"
1180 +
"FROM blackboard_artifacts INNER JOIN blackboard_attributes \n"
1181 +
"ON blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id \n"
1182 +
"WHERE blackboard_artifacts.artifact_type_id = "
1183 + BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID()
1184 +
" AND blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TAG_NAME.getTypeID()
1185 +
") AS tagNames \n"
1187 +
"(SELECT value_int64 AS taggedArtifactId, artifact_id AS associatedArtifactId FROM blackboard_attributes WHERE attribute_type_id = "
1188 + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TAGGED_ARTIFACT.getTypeID() +
") AS tagArtifacts \n"
1189 +
"ON tagNames.artifactId = tagArtifacts.associatedArtifactId \n"
1191 +
"(SELECT value_text AS comment, artifact_id AS commentArtifactId FROM blackboard_attributes WHERE attribute_type_id = "
1192 + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID() +
") AS tagComments \n"
1193 +
"ON tagNames.artifactId = tagComments.commentArtifactId");
1195 while (resultSet.next()) {
1196 long artifactId = resultSet.getLong(
"taggedArtifactId");
1197 String tagName = resultSet.getString(
"name");
1198 String tagComment = resultSet.getString(
"comment");
1199 if (tagComment == null) {
1202 if (tagName != null && !tagName.isEmpty()) {
1205 if (tagNames.containsKey(tagName)) {
1206 tagNameIndex = tagNames.get(tagName);
1208 statement2.execute(
"INSERT INTO tag_names (display_name, description, color) "
1209 +
"VALUES(\"" + tagName +
"\", \"\", \"None\")");
1210 tagNames.put(tagName, tagNameCounter);
1211 tagNameIndex = tagNameCounter;
1215 statement2.execute(
"INSERT INTO blackboard_artifact_tags (artifact_id, tag_name_id, comment) "
1216 +
"VALUES(" + artifactId +
", " + tagNameIndex +
", \"" + tagComment +
"\")");
1222 "DELETE FROM blackboard_attributes WHERE artifact_id IN "
1223 +
"(SELECT artifact_id FROM blackboard_artifacts WHERE artifact_type_id = "
1224 + ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
1225 +
" OR artifact_type_id = " + ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() +
");");
1227 "DELETE FROM blackboard_artifacts WHERE artifact_type_id = "
1228 + ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
1229 +
" OR artifact_type_id = " + ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() +
";");
1231 return new CaseDbSchemaVersionNumber(3, 0);
1233 closeStatement(updateStatement);
1234 closeResultSet(resultSet);
1235 closeStatement(statement);
1236 closeStatement(statement2);
1254 private CaseDbSchemaVersionNumber updateFromSchema3toSchema4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1255 if (schemaVersion.getMajor() != 3) {
1256 return schemaVersion;
1259 Statement statement = null;
1260 ResultSet resultSet = null;
1261 Statement queryStatement = null;
1262 ResultSet queryResultSet = null;
1263 Statement updateStatement = null;
1268 statement = connection.createStatement();
1269 updateStatement = connection.createStatement();
1270 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN mime_type TEXT;");
1271 resultSet = statement.executeQuery(
"SELECT files.obj_id AS obj_id, attrs.value_text AS value_text "
1272 +
"FROM tsk_files AS files, blackboard_attributes AS attrs, blackboard_artifacts AS arts "
1273 +
"WHERE files.obj_id = arts.obj_id AND "
1274 +
"arts.artifact_id = attrs.artifact_id AND "
1275 +
"arts.artifact_type_id = 1 AND "
1276 +
"attrs.attribute_type_id = 62");
1277 while (resultSet.next()) {
1278 updateStatement.executeUpdate(
1280 +
"SET mime_type = '" + resultSet.getString(
"value_text") +
"' "
1281 +
"WHERE tsk_files.obj_id = " + resultSet.getInt(
"obj_id") +
";");
1286 statement.execute(
"ALTER TABLE blackboard_attribute_types ADD COLUMN value_type INTEGER NOT NULL DEFAULT -1;");
1287 resultSet = statement.executeQuery(
"SELECT * FROM blackboard_attribute_types AS types");
1288 while (resultSet.next()) {
1289 int attributeTypeId = resultSet.getInt(
"attribute_type_id");
1290 String attributeLabel = resultSet.getString(
"type_name");
1291 if (attributeTypeId < Blackboard.MIN_USER_DEFINED_TYPE_ID) {
1292 updateStatement.executeUpdate(
1293 "UPDATE blackboard_attribute_types "
1294 +
"SET value_type = " + ATTRIBUTE_TYPE.fromLabel(attributeLabel).getValueType().getType() +
" "
1295 +
"WHERE blackboard_attribute_types.attribute_type_id = " + attributeTypeId +
";");
1301 queryStatement = connection.createStatement();
1302 statement.execute(
"CREATE TABLE data_source_info (obj_id INTEGER PRIMARY KEY, device_id TEXT NOT NULL, time_zone TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id));");
1303 resultSet = statement.executeQuery(
"SELECT * FROM tsk_objects WHERE par_obj_id IS NULL");
1304 while (resultSet.next()) {
1305 long objectId = resultSet.getLong(
"obj_id");
1306 String timeZone =
"";
1307 queryResultSet = queryStatement.executeQuery(
"SELECT tzone FROM tsk_image_info WHERE obj_id = " + objectId);
1308 if (queryResultSet.next()) {
1309 timeZone = queryResultSet.getString(
"tzone");
1311 queryResultSet.close();
1312 updateStatement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) "
1313 +
"VALUES(" + objectId +
", '" + UUID.randomUUID().toString() +
"' , '" + timeZone +
"');");
1327 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN data_source_obj_id BIGINT NOT NULL DEFAULT -1;");
1328 resultSet = statement.executeQuery(
"SELECT tsk_files.obj_id AS obj_id, par_obj_id FROM tsk_files, tsk_objects WHERE tsk_files.obj_id = tsk_objects.obj_id");
1329 while (resultSet.next()) {
1330 long fileId = resultSet.getLong(
"obj_id");
1331 long dataSourceId = getDataSourceObjectId(connection, fileId);
1332 updateStatement.executeUpdate(
"UPDATE tsk_files SET data_source_obj_id = " + dataSourceId +
" WHERE obj_id = " + fileId +
";");
1335 statement.execute(
"CREATE TABLE ingest_module_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
1336 statement.execute(
"CREATE TABLE ingest_job_status_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
1337 if (this.dbType.equals(DbType.SQLITE)) {
1338 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id INTEGER PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
1339 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id INTEGER PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
1341 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id BIGSERIAL PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
1342 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id BIGSERIAL PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
1345 statement.execute(
"CREATE TABLE ingest_job_modules (ingest_job_id INTEGER, ingest_module_id INTEGER, pipeline_position INTEGER, PRIMARY KEY(ingest_job_id, ingest_module_id), FOREIGN KEY(ingest_job_id) REFERENCES ingest_jobs(ingest_job_id), FOREIGN KEY(ingest_module_id) REFERENCES ingest_modules(ingest_module_id));");
1346 initIngestModuleTypes(connection);
1347 initIngestStatusTypes(connection);
1349 return new CaseDbSchemaVersionNumber(4, 0);
1352 closeResultSet(queryResultSet);
1353 closeStatement(queryStatement);
1354 closeStatement(updateStatement);
1355 closeResultSet(resultSet);
1356 closeStatement(statement);
1374 private CaseDbSchemaVersionNumber updateFromSchema4toSchema5(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1375 if (schemaVersion.getMajor() != 4) {
1376 return schemaVersion;
1379 Statement statement = null;
1383 statement = connection.createStatement();
1384 statement.execute(
"CREATE TABLE review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
1394 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN review_status_id INTEGER NOT NULL DEFAULT " + BlackboardArtifact.ReviewStatus.UNDECIDED.getID());
1397 statement.execute(
"CREATE TABLE file_encoding_types (encoding_type INTEGER PRIMARY KEY, name TEXT NOT NULL);");
1398 initEncodingTypes(connection);
1405 initReviewStatuses(connection);
1410 statement.execute(
"ALTER TABLE tsk_files_path ADD COLUMN encoding_type INTEGER NOT NULL DEFAULT 0;");
1412 return new CaseDbSchemaVersionNumber(5, 0);
1415 closeStatement(statement);
1433 private CaseDbSchemaVersionNumber updateFromSchema5toSchema6(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1434 if (schemaVersion.getMajor() != 5) {
1435 return schemaVersion;
1442 Statement statement = null;
1443 ResultSet resultSet = null;
1449 statement = connection.createStatement();
1450 statement.execute(
"CREATE TABLE IF NOT EXISTS review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
1452 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM review_statuses");
1454 if (resultSet.getLong(
"count") == 0) {
1463 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN review_status_id INTEGER NOT NULL DEFAULT " + BlackboardArtifact.ReviewStatus.UNDECIDED.getID());
1466 return new CaseDbSchemaVersionNumber(6, 0);
1469 closeResultSet(resultSet);
1470 closeStatement(statement);
1488 private CaseDbSchemaVersionNumber updateFromSchema6toSchema7(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1489 if (schemaVersion.getMajor() != 6) {
1490 return schemaVersion;
1496 Statement statement = null;
1497 Statement updstatement = null;
1498 ResultSet resultSet = null;
1501 statement = connection.createStatement();
1502 updstatement = connection.createStatement();
1503 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN extension TEXT");
1505 resultSet = connection.executeQuery(statement,
"SELECT obj_id,name FROM tsk_files");
1506 while (resultSet.next()) {
1507 long objID = resultSet.getLong(
"obj_id");
1508 String name = resultSet.getString(
"name");
1509 updstatement.executeUpdate(
"UPDATE tsk_files SET extension = '" +
escapeSingleQuotes(extractExtension(name)) +
"' "
1510 +
"WHERE obj_id = " + objID);
1513 statement.execute(
"CREATE INDEX file_extension ON tsk_files ( extension )");
1516 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN artifact_obj_id INTEGER NOT NULL DEFAULT -1");
1518 return new CaseDbSchemaVersionNumber(7, 0);
1521 closeResultSet(resultSet);
1522 closeStatement(statement);
1523 closeStatement(updstatement);
1541 private CaseDbSchemaVersionNumber updateFromSchema7toSchema7dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1542 if (schemaVersion.getMajor() != 7) {
1543 return schemaVersion;
1546 if (schemaVersion.getMinor() != 0) {
1547 return schemaVersion;
1553 Statement statement = null;
1554 ResultSet resultSet = null;
1557 statement = connection.createStatement();
1560 if (schemaVersion.getMinor() == 0) {
1562 statement.execute(
"ALTER TABLE tsk_db_info ADD COLUMN schema_minor_ver INTEGER DEFAULT 1");
1564 return new CaseDbSchemaVersionNumber(7, 1);
1567 closeResultSet(resultSet);
1568 closeStatement(statement);
1586 private CaseDbSchemaVersionNumber updateFromSchema7dot1toSchema7dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1587 if (schemaVersion.getMajor() != 7) {
1588 return schemaVersion;
1591 if (schemaVersion.getMinor() != 1) {
1592 return schemaVersion;
1595 Statement statement = null;
1596 Statement updstatement = null;
1597 ResultSet resultSet = null;
1601 statement = connection.createStatement();
1602 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN data_source_obj_id INTEGER NOT NULL DEFAULT -1");
1605 updstatement = connection.createStatement();
1606 resultSet = connection.executeQuery(statement,
"SELECT artifact_id, obj_id FROM blackboard_artifacts");
1607 while (resultSet.next()) {
1608 long artifact_id = resultSet.getLong(
"artifact_id");
1609 long obj_id = resultSet.getLong(
"obj_id");
1610 long data_source_obj_id = getDataSourceObjectId(connection, obj_id);
1611 updstatement.executeUpdate(
"UPDATE blackboard_artifacts SET data_source_obj_id = " + data_source_obj_id +
" "
1612 +
"WHERE artifact_id = " + artifact_id);
1614 closeResultSet(resultSet);
1615 closeStatement(statement);
1616 closeStatement(updstatement);
1621 statement = connection.createStatement();
1622 statement.execute(
"ALTER TABLE tag_names ADD COLUMN knownStatus INTEGER NOT NULL DEFAULT " + TskData.FileKnown.UNKNOWN.getFileKnownValue());
1625 if (this.dbType.equals(DbType.SQLITE)) {
1626 statement.execute(
"CREATE TABLE account_types (account_type_id INTEGER PRIMARY KEY, type_name TEXT UNIQUE NOT NULL, display_name TEXT NOT NULL)");
1627 statement.execute(
"CREATE TABLE accounts (account_id INTEGER PRIMARY KEY, account_type_id INTEGER NOT NULL, account_unique_identifier TEXT NOT NULL, UNIQUE(account_type_id, account_unique_identifier) , FOREIGN KEY(account_type_id) REFERENCES account_types(account_type_id))");
1628 statement.execute(
"CREATE TABLE account_relationships (relationship_id INTEGER PRIMARY KEY, account1_id INTEGER NOT NULL, account2_id INTEGER NOT NULL, relationship_source_obj_id INTEGER NOT NULL, date_time INTEGER, relationship_type INTEGER NOT NULL, data_source_obj_id INTEGER NOT NULL, UNIQUE(account1_id, account2_id, relationship_source_obj_id), FOREIGN KEY(account1_id) REFERENCES accounts(account_id), FOREIGN KEY(account2_id) REFERENCES accounts(account_id), FOREIGN KEY(relationship_source_obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id))");
1630 statement.execute(
"CREATE TABLE account_types (account_type_id BIGSERIAL PRIMARY KEY, type_name TEXT UNIQUE NOT NULL, display_name TEXT NOT NULL)");
1631 statement.execute(
"CREATE TABLE accounts (account_id BIGSERIAL PRIMARY KEY, account_type_id INTEGER NOT NULL, account_unique_identifier TEXT NOT NULL, UNIQUE(account_type_id, account_unique_identifier) , FOREIGN KEY(account_type_id) REFERENCES account_types(account_type_id))");
1632 statement.execute(
"CREATE TABLE account_relationships (relationship_id BIGSERIAL PRIMARY KEY, account1_id INTEGER NOT NULL, account2_id INTEGER NOT NULL, relationship_source_obj_id INTEGER NOT NULL, date_time BIGINT, relationship_type INTEGER NOT NULL, data_source_obj_id INTEGER NOT NULL, UNIQUE(account1_id, account2_id, relationship_source_obj_id), FOREIGN KEY(account1_id) REFERENCES accounts(account_id), FOREIGN KEY(account2_id) REFERENCES accounts(account_id), FOREIGN KEY(relationship_source_obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id))");
1636 statement.execute(
"CREATE INDEX artifact_artifact_objID ON blackboard_artifacts(artifact_obj_id)");
1637 statement.execute(
"CREATE INDEX relationships_account1 ON account_relationships(account1_id)");
1638 statement.execute(
"CREATE INDEX relationships_account2 ON account_relationships(account2_id)");
1639 statement.execute(
"CREATE INDEX relationships_relationship_source_obj_id ON account_relationships(relationship_source_obj_id)");
1640 statement.execute(
"CREATE INDEX relationships_date_time ON account_relationships(date_time)");
1641 statement.execute(
"CREATE INDEX relationships_relationship_type ON account_relationships(relationship_type)");
1642 statement.execute(
"CREATE INDEX relationships_data_source_obj_id ON account_relationships(data_source_obj_id)");
1644 return new CaseDbSchemaVersionNumber(7, 2);
1646 closeResultSet(resultSet);
1647 closeStatement(statement);
1648 closeStatement(updstatement);
1666 private CaseDbSchemaVersionNumber updateFromSchema7dot2toSchema8dot0(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1667 if (schemaVersion.getMajor() != 7) {
1668 return schemaVersion;
1671 if (schemaVersion.getMinor() != 2) {
1672 return schemaVersion;
1675 Statement updateSchemaStatement = connection.createStatement();
1676 Statement getExistingReportsStatement = connection.createStatement();
1677 ResultSet resultSet = null;
1678 ResultSet existingReports = null;
1686 updateSchemaStatement.execute(
"ALTER TABLE reports RENAME TO old_reports");
1689 updateSchemaStatement.execute(
"CREATE TABLE reports (obj_id BIGSERIAL PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id))");
1692 existingReports = getExistingReportsStatement.executeQuery(
"SELECT * FROM old_reports");
1693 while (existingReports.next()) {
1694 String path = existingReports.getString(2);
1695 long crtime = existingReports.getInt(3);
1696 String sourceModule = existingReports.getString(4);
1697 String reportName = existingReports.getString(5);
1699 PreparedStatement insertObjectStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OBJECT, Statement.RETURN_GENERATED_KEYS);
1700 insertObjectStatement.clearParameters();
1701 insertObjectStatement.setNull(1, java.sql.Types.BIGINT);
1702 insertObjectStatement.setLong(2, TskData.ObjectType.REPORT.getObjectType());
1703 connection.executeUpdate(insertObjectStatement);
1704 resultSet = insertObjectStatement.getGeneratedKeys();
1705 if (!resultSet.next()) {
1706 throw new TskCoreException(String.format(
"Failed to INSERT report %s (%s) in tsk_objects table", reportName, path));
1708 long objectId = resultSet.getLong(1);
1711 PreparedStatement insertReportStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_REPORT);
1712 insertReportStatement.clearParameters();
1713 insertReportStatement.setLong(1, objectId);
1714 insertReportStatement.setString(2, path);
1715 insertReportStatement.setLong(3, crtime);
1716 insertReportStatement.setString(4, sourceModule);
1717 insertReportStatement.setString(5, reportName);
1718 connection.executeUpdate(insertReportStatement);
1722 updateSchemaStatement.execute(
"DROP TABLE old_reports");
1724 return new CaseDbSchemaVersionNumber(8, 0);
1726 closeResultSet(resultSet);
1727 closeResultSet(existingReports);
1728 closeStatement(updateSchemaStatement);
1729 closeStatement(getExistingReportsStatement);
1747 private CaseDbSchemaVersionNumber updateFromSchema8dot0toSchema8dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1748 if (schemaVersion.getMajor() != 8) {
1749 return schemaVersion;
1752 if (schemaVersion.getMinor() != 0) {
1753 return schemaVersion;
1758 try (Statement statement = connection.createStatement();) {
1760 if (this.dbType.equals(DbType.SQLITE)) {
1761 statement.execute(
"CREATE TABLE tsk_examiners (examiner_id INTEGER PRIMARY KEY, login_name TEXT NOT NULL, display_name TEXT, UNIQUE(login_name) )");
1762 statement.execute(
"ALTER TABLE content_tags ADD COLUMN examiner_id INTEGER REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1763 statement.execute(
"ALTER TABLE blackboard_artifact_tags ADD COLUMN examiner_id INTEGER REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1765 statement.execute(
"CREATE TABLE tsk_examiners (examiner_id BIGSERIAL PRIMARY KEY, login_name TEXT NOT NULL, display_name TEXT, UNIQUE(login_name))");
1766 statement.execute(
"ALTER TABLE content_tags ADD COLUMN examiner_id BIGINT REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1767 statement.execute(
"ALTER TABLE blackboard_artifact_tags ADD COLUMN examiner_id BIGINT REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1770 return new CaseDbSchemaVersionNumber(8, 1);
1789 private CaseDbSchemaVersionNumber updateFromSchema8dot1toSchema8dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1790 if (schemaVersion.getMajor() != 8) {
1791 return schemaVersion;
1794 if (schemaVersion.getMinor() != 1) {
1795 return schemaVersion;
1800 try (Statement statement = connection.createStatement();) {
1801 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN sha1 TEXT DEFAULT NULL");
1802 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN sha256 TEXT DEFAULT NULL");
1804 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_details TEXT");
1812 statement.execute(
"CREATE TABLE tsk_db_info_extended (name TEXT PRIMARY KEY, value TEXT NOT NULL)");
1813 ResultSet result = statement.executeQuery(
"SELECT tsk_ver FROM tsk_db_info");
1815 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + TSK_VERSION_KEY +
"', '" + result.getLong(
"tsk_ver") +
"')");
1816 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + SCHEMA_MAJOR_VERSION_KEY +
"', '8')");
1817 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + SCHEMA_MINOR_VERSION_KEY +
"', '2')");
1818 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + CREATION_SCHEMA_MAJOR_VERSION_KEY +
"', '0')");
1819 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + CREATION_SCHEMA_MINOR_VERSION_KEY +
"', '0')");
1821 String primaryKeyType;
1824 primaryKeyType =
"BIGSERIAL";
1827 primaryKeyType =
"INTEGER";
1830 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
1834 statement.execute(
"CREATE TABLE tsk_event_types ("
1835 +
" event_type_id " + primaryKeyType +
" PRIMARY KEY, "
1836 +
" display_name TEXT UNIQUE NOT NULL, "
1837 +
" super_type_id INTEGER REFERENCES tsk_event_types(event_type_id) )");
1838 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1839 +
" values( 0, 'Event Types', null)");
1840 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1841 +
" values(1, 'File System', 0)");
1842 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1843 +
" values(2, 'Web Activity', 0)");
1844 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1845 +
" values(3, 'Misc Types', 0)");
1846 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1847 +
" values(4, 'Modified', 1)");
1848 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1849 +
" values(5, 'Accessed', 1)");
1850 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1851 +
" values(6, 'Created', 1)");
1852 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1853 +
" values(7, 'Changed', 1)");
1856 statement.execute(
"CREATE TABLE tsk_event_descriptions ("
1857 +
" event_description_id " + primaryKeyType +
" PRIMARY KEY, "
1858 +
" full_description TEXT NOT NULL, "
1859 +
" med_description TEXT, "
1860 +
" short_description TEXT,"
1861 +
" data_source_obj_id BIGINT NOT NULL, "
1862 +
" file_obj_id BIGINT NOT NULL, "
1863 +
" artifact_id BIGINT, "
1864 +
" hash_hit INTEGER NOT NULL, "
1865 +
" tagged INTEGER NOT NULL, "
1866 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
1867 +
" FOREIGN KEY(file_obj_id) REFERENCES tsk_files(obj_id), "
1868 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
1871 statement.execute(
"CREATE TABLE tsk_events ( "
1872 +
" event_id " + primaryKeyType +
" PRIMARY KEY, "
1873 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
1874 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id) ,"
1875 +
" time INTEGER NOT NULL) "
1879 statement.execute(
"CREATE INDEX events_time ON tsk_events(time)");
1880 statement.execute(
"CREATE INDEX events_type ON tsk_events(event_type_id)");
1881 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
1882 statement.execute(
"CREATE INDEX events_file_obj_id ON tsk_event_descriptions(file_obj_id) ");
1883 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
1884 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
1885 return new CaseDbSchemaVersionNumber(8, 2);
1905 private CaseDbSchemaVersionNumber updateFromSchema8dot2toSchema8dot3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1906 if (schemaVersion.getMajor() != 8) {
1907 return schemaVersion;
1910 if (schemaVersion.getMinor() != 2) {
1911 return schemaVersion;
1916 ResultSet resultSet = null;
1918 try (Statement statement = connection.createStatement();) {
1923 String primaryKeyType;
1926 primaryKeyType =
"BIGSERIAL";
1929 primaryKeyType =
"INTEGER";
1932 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
1936 statement.execute(
"CREATE TABLE IF NOT EXISTS tsk_event_types ("
1937 +
" event_type_id " + primaryKeyType +
" PRIMARY KEY, "
1938 +
" display_name TEXT UNIQUE NOT NULL, "
1939 +
" super_type_id INTEGER REFERENCES tsk_event_types(event_type_id) )");
1941 resultSet = statement.executeQuery(
"SELECT * from tsk_event_types");
1945 if (!resultSet.next()) {
1947 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1948 +
" values( 0, 'Event Types', null)");
1949 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1950 +
" values(1, 'File System', 0)");
1951 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1952 +
" values(2, 'Web Activity', 0)");
1953 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1954 +
" values(3, 'Misc Types', 0)");
1955 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1956 +
" values(4, 'Modified', 1)");
1957 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1958 +
" values(5, 'Accessed', 1)");
1959 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1960 +
" values(6, 'Created', 1)");
1961 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1962 +
" values(7, 'Changed', 1)");
1967 statement.execute(
"DROP TABLE IF EXISTS tsk_events");
1971 statement.execute(
"DROP TABLE IF EXISTS tsk_event_descriptions");
1974 statement.execute(
"CREATE TABLE tsk_event_descriptions ("
1975 +
" event_description_id " + primaryKeyType +
" PRIMARY KEY, "
1976 +
" full_description TEXT NOT NULL, "
1977 +
" med_description TEXT, "
1978 +
" short_description TEXT,"
1979 +
" data_source_obj_id BIGINT NOT NULL, "
1980 +
" file_obj_id BIGINT NOT NULL, "
1981 +
" artifact_id BIGINT, "
1982 +
" hash_hit INTEGER NOT NULL, "
1983 +
" tagged INTEGER NOT NULL, "
1984 +
" UNIQUE(full_description, file_obj_id, artifact_id), "
1985 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
1986 +
" FOREIGN KEY(file_obj_id) REFERENCES tsk_files(obj_id), "
1987 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
1991 statement.execute(
"CREATE TABLE tsk_events ( "
1992 +
" event_id " + primaryKeyType +
" PRIMARY KEY, "
1993 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
1994 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id) ,"
1995 +
" time INTEGER NOT NULL, "
1996 +
" UNIQUE (event_type_id, event_description_id, time))"
2000 statement.execute(
"UPDATE tsk_db_info_extended SET name = 'CREATION_SCHEMA_MAJOR_VERSION' WHERE name = 'CREATED_SCHEMA_MAJOR_VERSION'");
2001 statement.execute(
"UPDATE tsk_db_info_extended SET name = 'CREATION_SCHEMA_MINOR_VERSION' WHERE name = 'CREATED_SCHEMA_MINOR_VERSION'");
2003 return new CaseDbSchemaVersionNumber(8, 3);
2005 closeResultSet(resultSet);
2031 private CaseDbSchemaVersionNumber updateFromSchema8dot3toSchema8dot4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2032 if (schemaVersion.getMajor() != 8) {
2033 return schemaVersion;
2036 if (schemaVersion.getMinor() != 3) {
2037 return schemaVersion;
2040 Statement statement = connection.createStatement();
2041 ResultSet results = null;
2048 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
2054 results = statement.executeQuery(
"SELECT column_name FROM information_schema.columns "
2055 +
"WHERE table_name='tsk_event_descriptions' and column_name='file_obj_id'");
2056 if (results.next()) {
2058 statement.execute(
"ALTER TABLE tsk_event_descriptions "
2059 +
"RENAME COLUMN file_obj_id TO content_obj_id");
2063 statement.execute(
"CREATE TABLE temp_tsk_events ( "
2064 +
" event_id BIGSERIAL PRIMARY KEY, "
2065 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
2066 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id),"
2067 +
" time BIGINT NOT NULL, "
2068 +
" UNIQUE (event_type_id, event_description_id, time))"
2072 statement.execute(
"INSERT INTO temp_tsk_events(event_id, event_type_id, "
2073 +
"event_description_id, time) SELECT * FROM tsk_events");
2076 statement.execute(
"DROP TABLE tsk_events");
2079 statement.execute(
"ALTER TABLE temp_tsk_events RENAME TO tsk_events");
2082 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
2083 statement.execute(
"CREATE INDEX events_content_obj_id ON tsk_event_descriptions(content_obj_id) ");
2084 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
2085 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
2086 statement.execute(
"CREATE INDEX events_time ON tsk_events(time) ");
2090 boolean hasMisnamedColumn =
false;
2091 results = statement.executeQuery(
"pragma table_info('tsk_event_descriptions')");
2092 while (results.next()) {
2093 if (results.getString(
"name") != null && results.getString(
"name").equals(
"file_obj_id")) {
2094 hasMisnamedColumn =
true;
2099 if (hasMisnamedColumn) {
2101 statement.execute(
"CREATE TABLE temp_tsk_event_descriptions ("
2102 +
" event_description_id INTEGER PRIMARY KEY, "
2103 +
" full_description TEXT NOT NULL, "
2104 +
" med_description TEXT, "
2105 +
" short_description TEXT,"
2106 +
" data_source_obj_id BIGINT NOT NULL, "
2107 +
" content_obj_id BIGINT NOT NULL, "
2108 +
" artifact_id BIGINT, "
2109 +
" hash_hit INTEGER NOT NULL, "
2110 +
" tagged INTEGER NOT NULL, "
2111 +
" UNIQUE(full_description, content_obj_id, artifact_id), "
2112 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
2113 +
" FOREIGN KEY(content_obj_id) REFERENCES tsk_files(obj_id), "
2114 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
2117 statement.execute(
"CREATE TABLE temp_tsk_events ( "
2118 +
" event_id INTEGER PRIMARY KEY, "
2119 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
2120 +
" event_description_id BIGINT NOT NULL REFERENCES temp_tsk_event_descriptions(event_description_id),"
2121 +
" time INTEGER NOT NULL, "
2122 +
" UNIQUE (event_type_id, event_description_id, time))"
2126 statement.execute(
"INSERT INTO temp_tsk_event_descriptions(event_description_id, full_description, "
2127 +
"med_description, short_description, data_source_obj_id, content_obj_id, artifact_id, "
2128 +
"hash_hit, tagged) SELECT * FROM tsk_event_descriptions");
2130 statement.execute(
"INSERT INTO temp_tsk_events(event_id, event_type_id, "
2131 +
"event_description_id, time) SELECT * FROM tsk_events");
2134 statement.execute(
"DROP TABLE tsk_events");
2135 statement.execute(
"DROP TABLE tsk_event_descriptions");
2138 statement.execute(
"ALTER TABLE temp_tsk_event_descriptions RENAME TO tsk_event_descriptions");
2139 statement.execute(
"ALTER TABLE temp_tsk_events RENAME TO tsk_events");
2142 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
2143 statement.execute(
"CREATE INDEX events_content_obj_id ON tsk_event_descriptions(content_obj_id) ");
2144 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
2145 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
2146 statement.execute(
"CREATE INDEX events_time ON tsk_events(time) ");
2150 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
2154 if (this.dbType.equals(DbType.SQLITE)) {
2155 statement.execute(
"CREATE TABLE tsk_pool_info (obj_id INTEGER PRIMARY KEY, pool_type INTEGER NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE)");
2157 statement.execute(
"CREATE TABLE tsk_pool_info (obj_id BIGSERIAL PRIMARY KEY, pool_type INTEGER NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE)");
2161 insertAccountTypeIfNotExists(statement,
"IMO",
"IMO");
2162 insertAccountTypeIfNotExists(statement,
"LINE",
"LINE");
2163 insertAccountTypeIfNotExists(statement,
"SKYPE",
"Skype");
2164 insertAccountTypeIfNotExists(statement,
"TANGO",
"Tango");
2165 insertAccountTypeIfNotExists(statement,
"TEXTNOW",
"TextNow");
2166 insertAccountTypeIfNotExists(statement,
"THREEMA",
"ThreeMa");
2167 insertAccountTypeIfNotExists(statement,
"VIBER",
"Viber");
2168 insertAccountTypeIfNotExists(statement,
"XENDER",
"Xender");
2169 insertAccountTypeIfNotExists(statement,
"ZAPYA",
"Zapya");
2170 insertAccountTypeIfNotExists(statement,
"SHAREIT",
"ShareIt");
2172 return new CaseDbSchemaVersionNumber(8, 4);
2174 closeResultSet(results);
2175 closeStatement(statement);
2180 private CaseDbSchemaVersionNumber updateFromSchema8dot4toSchema8dot5(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2181 if (schemaVersion.getMajor() != 8) {
2182 return schemaVersion;
2185 if (schemaVersion.getMinor() != 4) {
2186 return schemaVersion;
2189 Statement statement = connection.createStatement();
2194 statement.execute(
"CREATE TABLE tsk_tag_sets (tag_set_id BIGSERIAL PRIMARY KEY, name TEXT UNIQUE)");
2195 statement.execute(
"ALTER TABLE tag_names ADD COLUMN tag_set_id BIGINT REFERENCES tsk_tag_sets(tag_set_id)");
2198 statement.execute(
"CREATE TABLE tsk_tag_sets (tag_set_id INTEGER PRIMARY KEY, name TEXT UNIQUE)");
2199 statement.execute(
"ALTER TABLE tag_names ADD COLUMN tag_set_id INTEGER REFERENCES tsk_tag_sets(tag_set_id)");
2203 statement.execute(
"ALTER TABLE tag_names ADD COLUMN rank INTEGER");
2211 String insertStmt =
"INSERT INTO tsk_tag_sets (name) VALUES ('Project VIC')";
2213 statement.execute(insertStmt, Statement.RETURN_GENERATED_KEYS);
2215 statement.execute(insertStmt);
2217 try (ResultSet resultSet = statement.getGeneratedKeys()) {
2218 if (resultSet != null && resultSet.next()) {
2219 int tagSetId = resultSet.getInt(1);
2221 String updateQuery =
"UPDATE tag_names SET tag_set_id = %d, color = '%s', rank = %d, display_name = '%s' WHERE display_name = '%s'";
2222 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Red", 1,
"Child Exploitation (Illegal)",
"CAT-1: Child Exploitation (Illegal)"));
2223 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Lime", 2,
"Child Exploitation (Non-Illegal/Age Difficult)",
"CAT-2: Child Exploitation (Non-Illegal/Age Difficult)"));
2224 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Yellow", 3,
"CGI/Animation (Child Exploitive)",
"CAT-3: CGI/Animation (Child Exploitive)"));
2225 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Purple", 4,
"Exemplar/Comparison (Internal Use Only)",
"CAT-4: Exemplar/Comparison (Internal Use Only)"));
2226 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Fuchsia", 5,
"Non-pertinent",
"CAT-5: Non-pertinent"));
2228 String
deleteContentTag =
"DELETE FROM content_tags WHERE tag_name_id IN (SELECT tag_name_id from tag_names WHERE display_name LIKE 'CAT-0: Uncategorized')";
2229 String deleteArtifactTag =
"DELETE FROM blackboard_artifact_tags WHERE tag_name_id IN (SELECT tag_name_id from tag_names WHERE display_name LIKE 'CAT-0: Uncategorized')";
2230 String deleteCat0 =
"DELETE FROM tag_names WHERE display_name = 'CAT-0: Uncategorized'";
2231 statement.executeUpdate(deleteContentTag);
2232 statement.executeUpdate(deleteArtifactTag);
2233 statement.executeUpdate(deleteCat0);
2236 throw new TskCoreException(
"Failed to retrieve the default tag_set_id from DB");
2246 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN data_source_obj_id BIGINT NOT NULL DEFAULT -1;");
2249 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN data_source_obj_id INTEGER NOT NULL DEFAULT -1;");
2252 Statement updateStatement = connection.createStatement();
2253 try (ResultSet resultSet = statement.executeQuery(
"SELECT obj_id FROM tsk_fs_info")) {
2254 while (resultSet.next()) {
2255 long fsId = resultSet.getLong(
"obj_id");
2256 long dataSourceId = getDataSourceObjectId(connection, fsId);
2257 updateStatement.executeUpdate(
"UPDATE tsk_fs_info SET data_source_obj_id = " + dataSourceId +
" WHERE obj_id = " + fsId +
";");
2260 closeStatement(updateStatement);
2263 return new CaseDbSchemaVersionNumber(8, 5);
2266 closeStatement(statement);
2271 private CaseDbSchemaVersionNumber updateFromSchema8dot5toSchema8dot6(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2272 if (schemaVersion.getMajor() != 8) {
2273 return schemaVersion;
2276 if (schemaVersion.getMinor() != 5) {
2277 return schemaVersion;
2280 Statement statement = connection.createStatement();
2283 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN sha256 TEXT");
2285 return new CaseDbSchemaVersionNumber(8, 6);
2288 closeStatement(statement);
2293 @SuppressWarnings(
"deprecation")
2294 private CaseDbSchemaVersionNumber updateFromSchema8dot6toSchema9dot0(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) throws SQLException, TskCoreException {
2295 if (schemaVersion.getMajor() != 8) {
2296 return schemaVersion;
2299 if (schemaVersion.getMinor() != 6) {
2300 return schemaVersion;
2303 Statement statement = connection.createStatement();
2306 String dateDataType =
"BIGINT";
2307 String bigIntDataType =
"BIGINT";
2308 String blobDataType =
"BYTEA";
2309 String primaryKeyType =
"BIGSERIAL";
2311 if (this.dbType.equals(DbType.SQLITE)) {
2312 dateDataType =
"INTEGER";
2313 bigIntDataType =
"INTEGER";
2314 blobDataType =
"BLOB";
2315 primaryKeyType =
"INTEGER";
2317 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN added_date_time " + dateDataType);
2318 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_tool_settings TEXT");
2319 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_tool_name TEXT");
2320 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_tool_version TEXT");
2325 statement.execute(
"ALTER TABLE blackboard_artifact_types ADD COLUMN category_type INTEGER DEFAULT 0");
2326 String analysisTypeObjIdList
2327 = BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
", "
2328 + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() +
", "
2329 + BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() +
", "
2330 + BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID() +
", "
2331 + BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() +
", "
2332 + BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID() +
", "
2333 + BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() +
", "
2334 + BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() +
", "
2335 + BlackboardArtifact.ARTIFACT_TYPE.TSK_FACE_DETECTED.getTypeID() +
", "
2336 + BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID() +
", "
2337 + BlackboardArtifact.ARTIFACT_TYPE.TSK_OBJECT_DETECTED.getTypeID() +
", "
2338 + BlackboardArtifact.ARTIFACT_TYPE.TSK_VERIFICATION_FAILED.getTypeID() +
", "
2339 + BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_USAGE.getTypeID() +
", "
2340 + BlackboardArtifact.ARTIFACT_TYPE.TSK_USER_CONTENT_SUSPECTED.getTypeID() +
", "
2341 + BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_ACCOUNT_TYPE.getTypeID() +
", "
2342 + BlackboardArtifact.ARTIFACT_TYPE.TSK_YARA_HIT.getTypeID() +
", "
2343 + BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CATEGORIZATION.getTypeID();
2344 statement.execute(
"UPDATE blackboard_artifact_types SET category_type = " + BlackboardArtifact.Category.ANALYSIS_RESULT.getID()
2345 +
" WHERE artifact_type_id IN (" + analysisTypeObjIdList +
")");
2348 statement.execute(
"CREATE TABLE tsk_file_attributes (id " + primaryKeyType +
" PRIMARY KEY, "
2349 +
"obj_id " + bigIntDataType +
" NOT NULL, "
2350 +
"attribute_type_id " + bigIntDataType +
" NOT NULL, "
2351 +
"value_type INTEGER NOT NULL, value_byte " + blobDataType +
", "
2352 +
"value_text TEXT, value_int32 INTEGER, value_int64 " + bigIntDataType +
", value_double NUMERIC(20, 10), "
2353 +
"FOREIGN KEY(obj_id) REFERENCES tsk_files(obj_id) ON DELETE CASCADE, "
2354 +
"FOREIGN KEY(attribute_type_id) REFERENCES blackboard_attribute_types(attribute_type_id))");
2357 statement.execute(
"CREATE TABLE tsk_analysis_results (artifact_obj_id " + bigIntDataType +
" PRIMARY KEY, "
2358 +
"conclusion TEXT, "
2359 +
"significance INTEGER NOT NULL, "
2367 +
"configuration TEXT, justification TEXT, "
2368 +
"ignore_score INTEGER DEFAULT 0 "
2371 statement.execute(
"CREATE TABLE tsk_aggregate_score( obj_id " + bigIntDataType +
" PRIMARY KEY, "
2372 +
"data_source_obj_id " + bigIntDataType +
", "
2373 +
"significance INTEGER NOT NULL, "
2376 +
"UNIQUE (obj_id),"
2377 +
"FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE, "
2378 +
"FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE "
2382 statement.execute(
"CREATE TABLE tsk_persons (id " + primaryKeyType +
" PRIMARY KEY, "
2383 +
"name TEXT NOT NULL, "
2384 +
"UNIQUE(name)) ");
2387 statement.execute(
"CREATE TABLE tsk_hosts (id " + primaryKeyType +
" PRIMARY KEY, "
2388 +
"name TEXT NOT NULL, "
2389 +
"db_status INTEGER DEFAULT 0, "
2390 +
"person_id INTEGER, "
2391 +
"merged_into " + bigIntDataType +
", "
2392 +
"FOREIGN KEY(person_id) REFERENCES tsk_persons(id) ON DELETE SET NULL, "
2393 +
"FOREIGN KEY(merged_into) REFERENCES tsk_hosts(id), "
2394 +
"UNIQUE(name)) ");
2397 statement.execute(
"CREATE TABLE tsk_os_account_realms (id " + primaryKeyType +
" PRIMARY KEY, "
2398 +
"realm_name TEXT DEFAULT NULL, "
2399 +
"realm_addr TEXT DEFAULT NULL, "
2400 +
"realm_signature TEXT NOT NULL, "
2401 +
"scope_host_id " + bigIntDataType +
" DEFAULT NULL, "
2402 +
"scope_confidence INTEGER, "
2403 +
"db_status INTEGER DEFAULT 0, "
2404 +
"merged_into " + bigIntDataType +
" DEFAULT NULL, "
2405 +
"UNIQUE(realm_signature), "
2406 +
"FOREIGN KEY(scope_host_id) REFERENCES tsk_hosts(id),"
2407 +
"FOREIGN KEY(merged_into) REFERENCES tsk_os_account_realms(id) )");
2412 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN host_id INTEGER REFERENCES tsk_hosts(id)");
2413 Statement updateStatement = connection.createStatement();
2414 try (ResultSet resultSet = statement.executeQuery(
"SELECT obj_id, device_id FROM data_source_info")) {
2415 Map<String, Long> hostMap =
new HashMap<>();
2417 while (resultSet.next()) {
2418 long objId = resultSet.getLong(
"obj_id");
2419 String deviceId = resultSet.getString(
"device_id");
2421 if (!hostMap.containsKey(deviceId)) {
2422 String hostName =
"Host " + hostIndex;
2423 updateStatement.execute(
"INSERT INTO tsk_hosts (name, db_status) VALUES ('" + hostName +
"', 0)");
2424 hostMap.put(deviceId, hostIndex);
2427 updateStatement.execute(
"UPDATE data_source_info SET host_id = " + hostMap.get(deviceId) +
" WHERE obj_id = " + objId);
2430 closeStatement(updateStatement);
2433 statement.execute(
"CREATE TABLE tsk_os_accounts (os_account_obj_id " + bigIntDataType +
" PRIMARY KEY, "
2434 +
"login_name TEXT DEFAULT NULL, "
2435 +
"full_name TEXT DEFAULT NULL, "
2436 +
"realm_id " + bigIntDataType +
" NOT NULL, "
2437 +
"addr TEXT DEFAULT NULL, "
2438 +
"signature TEXT NOT NULL, "
2439 +
"status INTEGER, "
2441 +
"created_date " + bigIntDataType +
" DEFAULT NULL, "
2442 +
"db_status INTEGER DEFAULT 0, "
2443 +
"merged_into " + bigIntDataType +
" DEFAULT NULL, "
2444 +
"UNIQUE(signature, realm_id), "
2445 +
"FOREIGN KEY(os_account_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE, "
2446 +
"FOREIGN KEY(realm_id) REFERENCES tsk_os_account_realms(id),"
2447 +
"FOREIGN KEY(merged_into) REFERENCES tsk_os_accounts(os_account_obj_id) )");
2449 statement.execute(
"CREATE TABLE tsk_os_account_attributes (id " + primaryKeyType +
" PRIMARY KEY, "
2450 +
"os_account_obj_id " + bigIntDataType +
" NOT NULL, "
2451 +
"host_id " + bigIntDataType +
", "
2452 +
"source_obj_id " + bigIntDataType +
", "
2453 +
"attribute_type_id " + bigIntDataType +
" NOT NULL, "
2454 +
"value_type INTEGER NOT NULL, "
2455 +
"value_byte " + bigIntDataType +
", "
2456 +
"value_text TEXT, "
2457 +
"value_int32 INTEGER, value_int64 " + bigIntDataType +
", "
2458 +
"value_double NUMERIC(20, 10), "
2459 +
"FOREIGN KEY(os_account_obj_id) REFERENCES tsk_os_accounts(os_account_obj_id), "
2460 +
"FOREIGN KEY(host_id) REFERENCES tsk_hosts(id), "
2461 +
"FOREIGN KEY(source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE SET NULL, "
2462 +
"FOREIGN KEY(attribute_type_id) REFERENCES blackboard_attribute_types(attribute_type_id))");
2464 statement.execute(
"CREATE TABLE tsk_os_account_instances (id " + primaryKeyType +
" PRIMARY KEY, "
2465 +
"os_account_obj_id " + bigIntDataType +
" NOT NULL, "
2466 +
"data_source_obj_id " + bigIntDataType +
" NOT NULL, "
2467 +
"instance_type INTEGER NOT NULL, "
2468 +
"UNIQUE(os_account_obj_id, data_source_obj_id), "
2469 +
"FOREIGN KEY(os_account_obj_id) REFERENCES tsk_os_accounts(os_account_obj_id), "
2470 +
"FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE )");
2472 statement.execute(
"CREATE TABLE tsk_data_artifacts ( "
2473 +
"artifact_obj_id " + bigIntDataType +
" PRIMARY KEY, "
2474 +
"os_account_obj_id " + bigIntDataType +
", "
2475 +
"FOREIGN KEY(os_account_obj_id) REFERENCES tsk_os_accounts(os_account_obj_id)) ");
2478 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN owner_uid TEXT DEFAULT NULL");
2479 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN os_account_obj_id " + bigIntDataType +
" DEFAULT NULL REFERENCES tsk_os_accounts(os_account_obj_id) ");
2482 statement.execute(
"CREATE TABLE tsk_host_addresses (id " + primaryKeyType +
" PRIMARY KEY, "
2483 +
"address_type INTEGER NOT NULL, "
2484 +
"address TEXT NOT NULL, "
2485 +
"UNIQUE(address_type, address)) ");
2487 statement.execute(
"CREATE TABLE tsk_host_address_map (id " + primaryKeyType +
" PRIMARY KEY, "
2488 +
"host_id " + bigIntDataType +
" NOT NULL, "
2489 +
"addr_obj_id " + bigIntDataType +
" NOT NULL, "
2490 +
"source_obj_id " + bigIntDataType +
", "
2491 +
"time " + bigIntDataType +
", "
2492 +
"UNIQUE(host_id, addr_obj_id, time), "
2493 +
"FOREIGN KEY(host_id) REFERENCES tsk_hosts(id) ON DELETE CASCADE, "
2494 +
"FOREIGN KEY(addr_obj_id) REFERENCES tsk_host_addresses(id), "
2495 +
"FOREIGN KEY(source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE SET NULL )");
2498 statement.execute(
"CREATE TABLE tsk_host_address_dns_ip_map (id " + primaryKeyType +
" PRIMARY KEY, "
2499 +
"dns_address_id " + bigIntDataType +
" NOT NULL, "
2500 +
"ip_address_id " + bigIntDataType +
" NOT NULL, "
2501 +
"source_obj_id " + bigIntDataType +
", "
2502 +
"time " + bigIntDataType +
", "
2503 +
"UNIQUE(dns_address_id, ip_address_id, time), "
2504 +
"FOREIGN KEY(dns_address_id) REFERENCES tsk_host_addresses(id) ON DELETE CASCADE, "
2505 +
"FOREIGN KEY(ip_address_id) REFERENCES tsk_host_addresses(id) ON DELETE CASCADE,"
2506 +
"FOREIGN KEY(source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE SET NULL )");
2509 statement.execute(
"CREATE TABLE tsk_host_address_usage (id " + primaryKeyType +
" PRIMARY KEY, "
2510 +
"addr_obj_id " + bigIntDataType +
" NOT NULL, "
2511 +
"obj_id " + bigIntDataType +
" NOT NULL, "
2512 +
"data_source_obj_id " + bigIntDataType +
" NOT NULL, "
2513 +
"UNIQUE(addr_obj_id, obj_id), "
2514 +
"FOREIGN KEY(addr_obj_id) REFERENCES tsk_host_addresses(id) ON DELETE CASCADE, "
2515 +
"FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE )");
2517 return new CaseDbSchemaVersionNumber(9, 0);
2520 closeStatement(statement);
2525 private CaseDbSchemaVersionNumber updateFromSchema9dot0toSchema9dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2526 if (schemaVersion.getMajor() != 9) {
2527 return schemaVersion;
2530 if (schemaVersion.getMinor() != 0) {
2531 return schemaVersion;
2534 Statement statement = connection.createStatement();
2535 ResultSet results = null;
2543 results = statement.executeQuery(
"SELECT column_name FROM information_schema.columns "
2544 +
"WHERE table_name='tsk_analysis_results' and column_name='method_category'");
2545 if (results.next()) {
2547 statement.execute(
"ALTER TABLE tsk_analysis_results "
2548 +
"DROP COLUMN method_category");
2549 statement.execute(
"ALTER TABLE tsk_aggregate_score "
2550 +
"DROP COLUMN method_category");
2556 boolean hasMisnamedColumn =
false;
2557 results = statement.executeQuery(
"pragma table_info('tsk_analysis_results')");
2558 while (results.next()) {
2559 if (results.getString(
"name") != null && results.getString(
"name").equals(
"method_category")) {
2560 hasMisnamedColumn =
true;
2565 if (hasMisnamedColumn) {
2568 statement.execute(
"CREATE TABLE temp_tsk_analysis_results (artifact_obj_id INTEGER PRIMARY KEY, "
2569 +
"conclusion TEXT, "
2570 +
"significance INTEGER NOT NULL, "
2571 +
"configuration TEXT, justification TEXT, "
2572 +
"ignore_score INTEGER DEFAULT 0 "
2574 statement.execute(
"CREATE TABLE temp_tsk_aggregate_score( obj_id INTEGER PRIMARY KEY, "
2575 +
"data_source_obj_id INTEGER, "
2576 +
"significance INTEGER NOT NULL, "
2577 +
"UNIQUE (obj_id),"
2578 +
"FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE, "
2579 +
"FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE "
2583 statement.execute(
"INSERT INTO temp_tsk_analysis_results(artifact_obj_id, "
2584 +
"conclusion, justification, significance, configuration, ignore_score) "
2585 +
"SELECT artifact_obj_id, conclusion, justification, significance, configuration, ignore_score FROM tsk_analysis_results");
2586 statement.execute(
"INSERT INTO temp_tsk_aggregate_score(obj_id, "
2587 +
"data_source_obj_id, significance) "
2588 +
"SELECT obj_id, data_source_obj_id, significance FROM tsk_aggregate_score");
2591 statement.execute(
"DROP TABLE tsk_analysis_results");
2592 statement.execute(
"DROP TABLE tsk_aggregate_score");
2595 statement.execute(
"ALTER TABLE temp_tsk_analysis_results RENAME TO tsk_analysis_results");
2596 statement.execute(
"ALTER TABLE temp_tsk_aggregate_score RENAME TO tsk_aggregate_score");
2601 throw new TskCoreException(
"Unsupported database type: " +
getDatabaseType().toString());
2605 statement.execute(
"CREATE INDEX tsk_file_attributes_obj_id ON tsk_file_attributes(obj_id)");
2607 statement.execute(
"ALTER TABLE tsk_analysis_results ADD COLUMN priority INTEGER NOT NULL DEFAULT " + Score.Priority.NORMAL.getId());
2608 statement.execute(
"ALTER TABLE tsk_aggregate_score ADD COLUMN priority INTEGER NOT NULL DEFAULT " + Score.Priority.NORMAL.getId());
2610 statement.execute(
"UPDATE blackboard_artifact_types SET category_type = 1 WHERE artifact_type_id = 16");
2612 return new CaseDbSchemaVersionNumber(9, 1);
2614 closeResultSet(results);
2615 closeStatement(statement);
2633 private CaseDbSchemaVersionNumber updateFromSchema9dot1toSchema9dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2634 if (schemaVersion.getMajor() != 9) {
2635 return schemaVersion;
2638 if (schemaVersion.getMinor() != 1) {
2639 return schemaVersion;
2642 Statement updateSchemaStatement = connection.createStatement();
2643 ResultSet results = null;
2647 String bigIntDataType =
"BIGINT";
2648 String primaryKeyType =
"BIGSERIAL";
2650 if (this.dbType.equals(DbType.SQLITE)) {
2651 bigIntDataType =
"INTEGER";
2652 primaryKeyType =
"INTEGER";
2658 updateSchemaStatement.execute(
"ALTER TABLE tsk_os_account_instances RENAME TO old_tsk_os_account_instances");
2661 updateSchemaStatement.execute(
"CREATE TABLE tsk_os_account_instances (id " + primaryKeyType +
" PRIMARY KEY, "
2662 +
"os_account_obj_id " + bigIntDataType +
" NOT NULL, "
2663 +
"data_source_obj_id " + bigIntDataType +
" NOT NULL, "
2664 +
"instance_type INTEGER NOT NULL, "
2665 +
"UNIQUE(os_account_obj_id, data_source_obj_id, instance_type), "
2666 +
"FOREIGN KEY(os_account_obj_id) REFERENCES tsk_os_accounts(os_account_obj_id) ON DELETE CASCADE, "
2667 +
"FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE ) ");
2670 updateSchemaStatement.execute(
"INSERT INTO tsk_os_account_instances(os_account_obj_id, "
2671 +
"data_source_obj_id, instance_type) SELECT os_account_obj_id, data_source_obj_id, instance_type FROM old_tsk_os_account_instances ORDER BY id ASC");
2674 updateSchemaStatement.execute(
"DROP TABLE old_tsk_os_account_instances");
2676 return new CaseDbSchemaVersionNumber(9, 2);
2678 closeResultSet(results);
2679 closeStatement(updateSchemaStatement);
2684 private CaseDbSchemaVersionNumber updateFromSchema9dot2toSchema9dot3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2685 if (schemaVersion.getMajor() != 9) {
2686 return schemaVersion;
2689 if (schemaVersion.getMinor() != 2) {
2690 return schemaVersion;
2693 Statement statement = connection.createStatement();
2697 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN sha1 TEXT");
2700 return new CaseDbSchemaVersionNumber(9, 3);
2703 closeStatement(statement);
2719 private void insertAccountTypeIfNotExists(Statement statement, String type_name, String display_name)
throws TskCoreException, SQLException {
2721 String insertSQL = String.format(
"INTO account_types(type_name, display_name) VALUES ('%s', '%s')", type_name, display_name);
2724 insertSQL =
"INSERT " + insertSQL +
" ON CONFLICT DO NOTHING";
2727 insertSQL =
"INSERT OR IGNORE " + insertSQL;
2730 throw new TskCoreException(
"Unknown DB Type: " +
getDatabaseType().name());
2732 statement.execute(insertSQL);
2742 static String extractExtension(
final String fileName) {
2744 int i = fileName.lastIndexOf(
".");
2746 if ((i > 0) && ((i + 1) < fileName.length())) {
2747 ext = fileName.substring(i + 1);
2758 return ext.toLowerCase();
2782 return CURRENT_DB_SCHEMA_VERSION;
2792 return caseDBSchemaCreationVersion;
2811 return dbBackupPath;
2838 return databaseName;
2858 rwLock.writeLock().lock();
2869 rwLock.writeLock().unlock();
2880 rwLock.readLock().lock();
2891 rwLock.readLock().unlock();
2911 }
catch (Exception ex) {
2912 throw new TskCoreException(
"Failed to open case database at " + dbPath, ex);
2942 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()), databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDir, info.getDbType());
2943 }
catch (PropertyVetoException exp) {
2945 throw new TskCoreException(exp.getMessage(), exp);
2949 }
catch (Exception exp) {
2951 throw new TskCoreException(exp.getMessage(), exp);
2966 CaseDatabaseFactory factory =
new CaseDatabaseFactory(dbPath);
2967 factory.createCaseDatabase();
2971 }
catch (Exception ex) {
2972 throw new TskCoreException(
"Failed to create case database at " + dbPath, ex);
2992 String databaseName = createCaseDataBaseName(caseName);
3006 CaseDatabaseFactory factory =
new CaseDatabaseFactory(databaseName, info);
3007 factory.createCaseDatabase();
3010 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()),
3011 databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDirPath, info.getDbType());
3012 }
catch (PropertyVetoException exp) {
3014 throw new TskCoreException(exp.getMessage(), exp);
3015 }
catch (Exception exp) {
3017 throw new TskCoreException(exp.getMessage(), exp);
3030 private static String createCaseDataBaseName(String candidateDbName) {
3032 if (!candidateDbName.isEmpty()) {
3036 dbName = candidateDbName.replaceAll(
"[^\\p{ASCII}]",
"_");
3041 dbName = dbName.replaceAll(
"[\\p{Cntrl}]",
"_");
3046 dbName = dbName.replaceAll(
"[ /?:'\"\\\\]",
"_");
3051 dbName = dbName.toLowerCase();
3057 if ((dbName.length() > 0 && !(Character.isLetter(dbName.codePointAt(0))) && !(dbName.codePointAt(0) ==
'_'))) {
3058 dbName =
"_" + dbName;
3065 if (dbName.length() > MAX_DB_NAME_LEN_BEFORE_TIMESTAMP) {
3066 dbName = dbName.substring(0, MAX_DB_NAME_LEN_BEFORE_TIMESTAMP);
3078 SimpleDateFormat dateFormat =
new SimpleDateFormat(
"yyyyMMdd_HHmmss");
3079 Date date =
new Date();
3080 dbName = dbName +
"_" + dateFormat.format(date);
3092 timelineEventsDisabled.set(
true);
3105 if (cachedCurrentExaminer != null) {
3106 return cachedCurrentExaminer;
3108 String loginName = System.getProperty(
"user.name");
3109 if (loginName == null || loginName.isEmpty()) {
3110 throw new TskCoreException(
"Failed to determine logged in user name.");
3113 ResultSet resultSet = null;
3114 CaseDbConnection connection = null;
3117 connection = connections.getConnection();
3118 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_EXAMINER_BY_LOGIN_NAME);
3119 statement.clearParameters();
3120 statement.setString(1, loginName);
3121 resultSet = connection.executeQuery(statement);
3122 if (resultSet.next()) {
3123 cachedCurrentExaminer =
new Examiner(resultSet.getLong(
"examiner_id"), resultSet.getString(
"login_name"), resultSet.getString(
"display_name"));
3124 return cachedCurrentExaminer;
3126 throw new TskCoreException(
"Error getting examaminer for name = " + loginName);
3129 }
catch (SQLException ex) {
3130 throw new TskCoreException(
"Error getting examaminer for name = " + loginName, ex);
3132 closeResultSet(resultSet);
3133 closeConnection(connection);
3148 Examiner getExaminerById(
long id)
throws TskCoreException {
3150 CaseDbConnection connection = null;
3151 ResultSet resultSet = null;
3154 connection = connections.getConnection();
3155 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_EXAMINER_BY_ID);
3156 statement.clearParameters();
3157 statement.setLong(1,
id);
3158 resultSet = connection.executeQuery(statement);
3159 if (resultSet.next()) {
3160 return new Examiner(resultSet.getLong(
"examiner_id"), resultSet.getString(
"login_name"), resultSet.getString(
"full_name"));
3162 throw new TskCoreException(
"Error getting examaminer for id = " +
id);
3164 }
catch (SQLException ex) {
3165 throw new TskCoreException(
"Error getting examaminer for id = " +
id, ex);
3167 closeResultSet(resultSet);
3168 closeConnection(connection);
3191 return this.caseHandle.initAddImageProcess(timeZone, addUnallocSpace, noFatFsOrphans, imageCopyPath,
this);
3203 CaseDbConnection connection = null;
3205 ResultSet rs = null;
3208 connection = connections.getConnection();
3209 s = connection.createStatement();
3210 rs = connection.executeQuery(s,
"SELECT obj_id, type FROM tsk_objects "
3211 +
"WHERE par_obj_id IS NULL");
3212 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
3214 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"),
ObjectType.
valueOf(rs.getShort(
"type"))));
3217 List<Content> rootObjs =
new ArrayList<Content>();
3218 for (ObjectInfo i : infos) {
3219 if (null != i.type) {
3230 throw new TskCoreException(
"Parentless object has wrong type to be a root (ABSTRACTFILE, but not VIRTUAL_DIRECTORY: " + i.type);
3242 throw new TskCoreException(
"Parentless object has wrong type to be a root: " + i.type);
3247 }
catch (SQLException ex) {
3248 throw new TskCoreException(
"Error getting root objects", ex);
3252 closeConnection(connection);
3268 List<Long> getDataSourceObjIds(String deviceId)
throws TskCoreException {
3271 synchronized (deviceIdToDatasourceObjIdMap) {
3272 if (deviceIdToDatasourceObjIdMap.containsKey(deviceId)) {
3273 return new ArrayList<Long>(deviceIdToDatasourceObjIdMap.get(deviceId));
3276 CaseDbConnection connection = null;
3278 ResultSet rs = null;
3281 connection = connections.getConnection();
3282 s = connection.createStatement();
3283 rs = connection.executeQuery(s,
"SELECT obj_id FROM data_source_info WHERE device_id = '" + deviceId +
"'");
3284 List<Long> dataSourceObjIds =
new ArrayList<Long>();
3286 dataSourceObjIds.add(rs.getLong(
"obj_id"));
3289 long ds_obj_id = rs.getLong(
"obj_id");
3290 if (deviceIdToDatasourceObjIdMap.containsKey(deviceId)) {
3291 deviceIdToDatasourceObjIdMap.get(deviceId).add(ds_obj_id);
3293 deviceIdToDatasourceObjIdMap.put(deviceId,
new HashSet<Long>(Arrays.asList(ds_obj_id)));
3296 return dataSourceObjIds;
3297 }
catch (SQLException ex) {
3298 throw new TskCoreException(
"Error getting data sources", ex);
3302 closeConnection(connection);
3325 CaseDbConnection connection = null;
3326 Statement statement = null;
3327 ResultSet resultSet = null;
3328 Statement statement2 = null;
3329 ResultSet resultSet2 = null;
3332 connection = connections.getConnection();
3333 statement = connection.createStatement();
3334 statement2 = connection.createStatement();
3335 resultSet = connection.executeQuery(statement,
3336 "SELECT ds.obj_id, ds.device_id, ds.time_zone, img.type, img.ssize, img.size, img.md5, img.sha1, img.sha256, img.display_name "
3337 +
"FROM data_source_info AS ds "
3338 +
"LEFT JOIN tsk_image_info AS img "
3339 +
"ON ds.obj_id = img.obj_id");
3341 List<DataSource> dataSourceList =
new ArrayList<DataSource>();
3344 while (resultSet.next()) {
3346 Long objectId = resultSet.getLong(
"obj_id");
3347 String deviceId = resultSet.getString(
"device_id");
3348 String timezone = resultSet.getString(
"time_zone");
3349 String type = resultSet.getString(
"type");
3357 resultSet2 = connection.executeQuery(statement2,
"SELECT name FROM tsk_files WHERE tsk_files.obj_id = " + objectId);
3358 String dsName = (resultSet2.next()) ? resultSet2.getString(
"name") :
"";
3366 String parentPath =
"/";
3367 dataSource =
new LocalFilesDataSource(
this, objectId, objectId, deviceId, dsName, dirType, metaType, dirFlag, metaFlags, timezone, null, null, null,
FileKnown.
UNKNOWN, parentPath);
3372 Long ssize = resultSet.getLong(
"ssize");
3373 Long size = resultSet.getLong(
"size");
3374 String md5 = resultSet.getString(
"md5");
3375 String sha1 = resultSet.getString(
"sha1");
3376 String sha256 = resultSet.getString(
"sha256");
3377 String name = resultSet.getString(
"display_name");
3379 List<String> imagePaths = imagePathsMap.get(objectId);
3381 if (imagePaths.size() > 0) {
3382 String path = imagePaths.get(0);
3383 name = (
new java.io.File(path)).getName();
3389 dataSource =
new Image(
this, objectId, Long.valueOf(type), deviceId, ssize, name,
3390 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, size);
3393 dataSourceList.add(dataSource);
3396 return dataSourceList;
3398 }
catch (SQLException ex) {
3399 throw new TskCoreException(
"Error getting data sources", ex);
3401 closeResultSet(resultSet);
3402 closeStatement(statement);
3403 closeResultSet(resultSet2);
3404 closeStatement(statement2);
3405 closeConnection(connection);
3431 CaseDbConnection connection = null;
3432 Statement statement = null;
3433 ResultSet resultSet = null;
3434 Statement statement2 = null;
3435 ResultSet resultSet2 = null;
3438 connection = connections.getConnection();
3439 statement = connection.createStatement();
3440 statement2 = connection.createStatement();
3441 resultSet = connection.executeQuery(statement,
3442 "SELECT ds.device_id, ds.time_zone, img.type, img.ssize, img.size, img.md5, img.sha1, img.sha256, img.display_name "
3443 +
"FROM data_source_info AS ds "
3444 +
"LEFT JOIN tsk_image_info AS img "
3445 +
"ON ds.obj_id = img.obj_id "
3446 +
"WHERE ds.obj_id = " + objectId);
3447 if (resultSet.next()) {
3448 String deviceId = resultSet.getString(
"device_id");
3449 String timezone = resultSet.getString(
"time_zone");
3450 String type = resultSet.getString(
"type");
3458 resultSet2 = connection.executeQuery(statement2,
"SELECT name FROM tsk_files WHERE tsk_files.obj_id = " + objectId);
3459 String dsName = (resultSet2.next()) ? resultSet2.getString(
"name") :
"";
3466 String parentPath =
"/";
3467 dataSource =
new LocalFilesDataSource(
this, objectId, objectId, deviceId, dsName, dirType, metaType, dirFlag, metaFlags, timezone, null, null, null,
FileKnown.
UNKNOWN, parentPath);
3472 Long ssize = resultSet.getLong(
"ssize");
3473 Long size = resultSet.getLong(
"size");
3474 String md5 = resultSet.getString(
"md5");
3475 String sha1 = resultSet.getString(
"sha1");
3476 String sha256 = resultSet.getString(
"sha256");
3477 String name = resultSet.getString(
"display_name");
3479 List<String> imagePaths = getImagePathsById(objectId, connection);
3481 if (imagePaths.size() > 0) {
3482 String path = imagePaths.get(0);
3483 name = (
new java.io.File(path)).getName();
3489 dataSource =
new Image(
this, objectId, Long.valueOf(type), deviceId, ssize, name,
3490 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, size);
3493 throw new TskDataException(String.format(
"There is no data source with obj_id = %d", objectId));
3495 }
catch (SQLException ex) {
3496 throw new TskCoreException(String.format(
"Error getting data source with obj_id = %d", objectId), ex);
3498 closeResultSet(resultSet);
3499 closeStatement(statement);
3500 closeResultSet(resultSet2);
3501 closeStatement(statement2);
3502 closeConnection(connection);
3523 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
3524 artifacts.addAll(blackboard.getArtifactsByType(blackboard.
getArtifactType(artifactTypeID)));
3539 CaseDbConnection connection = null;
3540 ResultSet rs = null;
3543 connection = connections.getConnection();
3546 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_FROM_SOURCE);
3547 statement.clearParameters();
3548 statement.setLong(1, objId);
3549 rs = connection.executeQuery(statement);
3552 count = rs.getLong(
"count");
3555 }
catch (SQLException ex) {
3556 throw new TskCoreException(
"Error getting number of blackboard artifacts by content", ex);
3559 closeConnection(connection);
3575 CaseDbConnection connection = null;
3576 ResultSet rs = null;
3579 connection = connections.getConnection();
3582 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_OF_TYPE);
3583 statement.clearParameters();
3584 statement.setInt(1, artifactTypeID);
3585 rs = connection.executeQuery(statement);
3588 count = rs.getLong(
"count");
3591 }
catch (SQLException ex) {
3592 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
3595 closeConnection(connection);
3612 CaseDbConnection connection = null;
3613 ResultSet rs = null;
3616 connection = connections.getConnection();
3619 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_OF_TYPE_BY_DATA_SOURCE);
3620 statement.clearParameters();
3621 statement.setInt(2, artifactTypeID);
3622 statement.setLong(1, dataSourceID);
3623 rs = connection.executeQuery(statement);
3626 count = rs.getLong(
"count");
3629 }
catch (SQLException ex) {
3630 throw new TskCoreException(String.format(
"Error getting number of blackboard artifacts by type (%d) and data source (%d)", artifactTypeID, dataSourceID), ex);
3633 closeConnection(connection);
3657 try (CaseDbConnection connection = connections.getConnection(); Statement statement = connection.createStatement();
3658 ResultSet resultSet = connection.executeQuery(statement,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3659 +
"arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3660 +
"types.type_name AS type_name, types.display_name AS display_name, "
3661 +
" arts.review_status_id AS review_status_id "
3662 +
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3663 +
"WHERE arts.artifact_id = attrs.artifact_id "
3664 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3665 +
" AND attrs.value_text = '" + value +
"'"
3666 +
" AND types.artifact_type_id=arts.artifact_type_id"
3669 List<Long> analysisArtifactObjIds =
new ArrayList<>();
3670 List<Long> dataArtifactObjIds =
new ArrayList<>();
3671 while (resultSet.next()) {
3674 analysisArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3676 dataArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3680 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
3681 if (!analysisArtifactObjIds.isEmpty()) {
3685 if (!dataArtifactObjIds.isEmpty()) {
3689 }
catch (SQLException ex) {
3690 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3716 String valSubStr =
"%" + subString;
3717 if (startsWith ==
false) {
3722 try (CaseDbConnection connection = connections.getConnection(); Statement statement = connection.createStatement();
3723 ResultSet resultSet = connection.executeQuery(statement,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3724 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3725 +
" types.type_name AS type_name, types.display_name AS display_name, "
3726 +
" arts.review_status_id AS review_status_id "
3727 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3728 +
" WHERE arts.artifact_id = attrs.artifact_id "
3729 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3730 +
" AND LOWER(attrs.value_text) LIKE LOWER('" + valSubStr +
"')"
3731 +
" AND types.artifact_type_id=arts.artifact_type_id "
3733 List<Long> analysisArtifactObjIds =
new ArrayList<>();
3734 List<Long> dataArtifactObjIds =
new ArrayList<>();
3735 while (resultSet.next()) {
3738 analysisArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3740 dataArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3744 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
3745 if (!analysisArtifactObjIds.isEmpty()) {
3749 if (!dataArtifactObjIds.isEmpty()) {
3753 }
catch (SQLException ex) {
3754 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
3778 try (CaseDbConnection connection = connections.getConnection(); Statement statement = connection.createStatement();
3779 ResultSet resultSet = connection.executeQuery(statement,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3780 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3781 +
" types.type_name AS type_name, types.display_name AS display_name, "
3782 +
" arts.review_status_id AS review_status_id "
3783 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3784 +
"WHERE arts.artifact_id = attrs.artifact_id "
3785 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3786 +
" AND attrs.value_int32 = " + value
3787 +
" AND types.artifact_type_id=arts.artifact_type_id "
3789 List<Long> analysisArtifactObjIds =
new ArrayList<>();
3790 List<Long> dataArtifactObjIds =
new ArrayList<>();
3791 while (resultSet.next()) {
3794 analysisArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3796 dataArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3800 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
3801 if (!analysisArtifactObjIds.isEmpty()) {
3805 if (!dataArtifactObjIds.isEmpty()) {
3809 }
catch (SQLException ex) {
3810 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3835 try (CaseDbConnection connection = connections.getConnection(); Statement statement = connection.createStatement();
3836 ResultSet resultSet = connection.executeQuery(statement,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3837 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3838 +
" types.type_name AS type_name, types.display_name AS display_name, "
3839 +
" arts.review_status_id AS review_status_id "
3840 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3841 +
" WHERE arts.artifact_id = attrs.artifact_id "
3842 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3843 +
" AND attrs.value_int64 = " + value
3844 +
" AND types.artifact_type_id=arts.artifact_type_id "
3846 List<Long> analysisArtifactObjIds =
new ArrayList<>();
3847 List<Long> dataArtifactObjIds =
new ArrayList<>();
3848 while (resultSet.next()) {
3851 analysisArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3853 dataArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3857 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
3858 if (!analysisArtifactObjIds.isEmpty()) {
3862 if (!dataArtifactObjIds.isEmpty()) {
3866 }
catch (SQLException ex) {
3867 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
3892 try (CaseDbConnection connection = connections.getConnection(); Statement statement = connection.createStatement();
3893 ResultSet resultSet = connection.executeQuery(statement,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3894 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3895 +
" types.type_name AS type_name, types.display_name AS display_name, "
3896 +
" arts.review_status_id AS review_status_id "
3897 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3898 +
" WHERE arts.artifact_id = attrs.artifact_id "
3899 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3900 +
" AND attrs.value_double = " + value
3901 +
" AND types.artifact_type_id=arts.artifact_type_id "
3903 List<Long> analysisArtifactObjIds =
new ArrayList<>();
3904 List<Long> dataArtifactObjIds =
new ArrayList<>();
3905 while (resultSet.next()) {
3908 analysisArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3910 dataArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3914 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
3915 if (!analysisArtifactObjIds.isEmpty()) {
3919 if (!dataArtifactObjIds.isEmpty()) {
3923 }
catch (SQLException ex) {
3924 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3950 try (CaseDbConnection connection = connections.getConnection(); Statement statement = connection.createStatement();
3951 ResultSet resultSet = connection.executeQuery(statement,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3952 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3953 +
" types.type_name AS type_name, types.display_name AS display_name, "
3954 +
" arts.review_status_id AS review_status_id "
3955 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3956 +
" WHERE arts.artifact_id = attrs.artifact_id "
3957 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3958 +
" AND attrs.value_byte = " + value
3959 +
" AND types.artifact_type_id=arts.artifact_type_id "
3961 List<Long> analysisArtifactObjIds =
new ArrayList<>();
3962 List<Long> dataArtifactObjIds =
new ArrayList<>();
3963 while (resultSet.next()) {
3966 analysisArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3968 dataArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3972 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
3973 if (!analysisArtifactObjIds.isEmpty()) {
3977 if (!dataArtifactObjIds.isEmpty()) {
3981 }
catch (SQLException ex) {
3982 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3996 CaseDbConnection connection = null;
3998 ResultSet rs = null;
4001 connection = connections.getConnection();
4002 s = connection.createStatement();
4003 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name, category_type FROM blackboard_artifact_types");
4007 rs.getString(
"type_name"), rs.getString(
"display_name"),
4010 return artifactTypes;
4011 }
catch (SQLException ex) {
4012 throw new TskCoreException(
"Error getting artifact types", ex);
4016 closeConnection(connection);
4030 String typeIdList =
"";
4037 String query =
"SELECT DISTINCT artifact_type_id FROM blackboard_artifacts "
4038 +
"WHERE artifact_type_id IN (" + typeIdList +
")";
4039 CaseDbConnection connection = null;
4041 ResultSet rs = null;
4044 connection = connections.getConnection();
4045 s = connection.createStatement();
4046 rs = connection.executeQuery(s, query);
4052 }
catch (SQLException ex) {
4053 throw new TskCoreException(
"Error getting artifact types in use", ex);
4057 closeConnection(connection);
4073 CaseDbConnection connection = null;
4075 ResultSet rs = null;
4078 connection = connections.getConnection();
4079 s = connection.createStatement();
4080 rs = connection.executeQuery(s,
4081 "SELECT DISTINCT arts.artifact_type_id AS artifact_type_id, "
4082 +
"types.type_name AS type_name, "
4083 +
"types.display_name AS display_name, "
4084 +
"types.category_type AS category_type "
4085 +
"FROM blackboard_artifact_types AS types "
4086 +
"INNER JOIN blackboard_artifacts AS arts "
4087 +
"ON arts.artifact_type_id = types.artifact_type_id");
4091 rs.getString(
"type_name"), rs.getString(
"display_name"),
4094 return uniqueArtifactTypes;
4095 }
catch (SQLException ex) {
4096 throw new TskCoreException(
"Error getting attribute types", ex);
4100 closeConnection(connection);
4113 CaseDbConnection connection = null;
4115 ResultSet rs = null;
4118 connection = connections.getConnection();
4119 s = connection.createStatement();
4120 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types");
4126 return attribute_types;
4127 }
catch (SQLException ex) {
4128 throw new TskCoreException(
"Error getting attribute types", ex);
4132 closeConnection(connection);
4149 CaseDbConnection connection = null;
4151 ResultSet rs = null;
4154 connection = connections.getConnection();
4155 s = connection.createStatement();
4156 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM blackboard_attribute_types");
4159 count = rs.getInt(
"count");
4162 }
catch (SQLException ex) {
4163 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
4167 closeConnection(connection);
4184 private long getArtifactsCountHelper(
int artifactTypeID,
long obj_id)
throws TskCoreException {
4185 CaseDbConnection connection = null;
4186 ResultSet rs = null;
4189 connection = connections.getConnection();
4192 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE);
4193 statement.clearParameters();
4194 statement.setLong(1, obj_id);
4195 statement.setInt(2, artifactTypeID);
4196 rs = connection.executeQuery(statement);
4199 count = rs.getLong(
"count");
4202 }
catch (SQLException ex) {
4203 throw new TskCoreException(
"Error getting blackboard artifact count", ex);
4206 closeConnection(connection);
4224 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
4225 artifacts.addAll(blackboard.getArtifactsBySourceId(
getArtifactType(artifactTypeName), obj_id));
4242 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
4243 artifacts.addAll(blackboard.getArtifactsBySourceId(blackboard.
getArtifactType(artifactTypeID), obj_id));
4276 int artifactTypeID = this.
getArtifactType(artifactTypeName).getTypeID();
4277 if (artifactTypeID == -1) {
4280 return getArtifactsCountHelper(artifactTypeID, obj_id);
4296 return getArtifactsCountHelper(artifactTypeID, obj_id);
4312 return getArtifactsCountHelper(artifactType.getTypeID(), obj_id);
4327 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
4328 artifacts.addAll(blackboard.getArtifactsByType(
getArtifactType(artifactTypeName)));
4344 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
4345 artifacts.addAll(blackboard.getArtifactsByType(blackboard.
getArtifactType(artifactType.getTypeID())));
4367 String dataArtifactJoin =
"tsk_data_artifacts AS datarts ON datarts.artifact_obj_id = arts.artifact_obj_id";
4368 String analysisResultJoin =
"tsk_analysis_results AS anresult ON anresult.artifact_obj_id = arts.artifact_obj_id";
4369 String dataArtifactColumns =
", datarts.os_account_obj_id AS os_account_obj_id";
4370 String analysResultColumns =
", anresult.conclusion AS conclusion, anresult.significance AS significance, anresult.priority AS priority, anresult.configuration AS configuration, anresult.justification AS justification ";
4372 String formatQuery =
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
4373 +
"arts.obj_id AS obj_id, arts.artifact_obj_id as artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
4374 +
"types.type_name AS type_name, types.display_name AS display_name,"
4375 +
"arts.review_status_id AS review_status_id %s "
4376 +
"FROM blackboard_artifacts AS arts "
4377 +
"JOIN blackboard_attributes AS attrs ON arts.artifact_id = attrs.artifact_id "
4378 +
"JOIN blackboard_artifact_types AS types ON types.artifact_type_id = arts.artifact_type_id "
4380 +
"WHERE arts.artifact_id = attrs.artifact_id "
4381 +
"AND attrs.attribute_type_id = %d "
4382 +
" AND arts.artifact_type_id = %d "
4383 +
" AND attrs.value_text = '%s' "
4384 +
" AND types.artifact_type_id=arts.artifact_type_id "
4385 +
" AND arts.review_status_id != %d";
4387 String query = String.format(formatQuery,
4390 attrType.getTypeID(),
4391 artifactType.getTypeID(),
4396 try (CaseDbConnection connection = connections.getConnection(); Statement s = connection.createStatement(); ResultSet rs = connection.executeQuery(s, query)) {
4397 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
4400 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
4402 osAccountObjId = null;
4405 artifacts.add(
new DataArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"),
4406 rs.getLong(
"artifact_obj_id"),
4407 rs.getObject(
"data_source_obj_id") != null ? rs.getLong(
"data_source_obj_id") : null,
4408 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
4411 artifacts.add(
new AnalysisResult(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"),
4412 rs.getLong(
"artifact_obj_id"),
4413 rs.getObject(
"data_source_obj_id") != null ? rs.getLong(
"data_source_obj_id") : null,
4414 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
4417 rs.getString(
"conclusion"), rs.getString(
"configuration"), rs.getString(
"justification")));
4421 }
catch (SQLException ex) {
4422 throw new TskCoreException(
"Error getting blackboard artifacts by artifact type and attribute. " + ex.getMessage(), ex);
4440 List<DataArtifact> dataArtifacts = blackboard.
getDataArtifactsWhere(
"artifacts.artifact_id = " + artifactID);
4441 if (!dataArtifacts.isEmpty()) {
4442 return dataArtifacts.get(0);
4445 List<AnalysisResult> analysisResults = blackboard.
getAnalysisResultsWhere(
"artifacts.artifact_id = " + artifactID);
4446 if (!analysisResults.isEmpty()) {
4447 return analysisResults.get(0);
4450 throw new TskCoreException(
"No blackboard artifact with id " + artifactID);
4463 try (CaseDbConnection connection = connections.getConnection();) {
4464 addBlackBoardAttribute(attr, artifactTypeId, connection);
4465 }
catch (SQLException ex) {
4466 throw new TskCoreException(
"Error adding blackboard attribute " + attr.toString(), ex);
4482 CaseDbConnection connection = null;
4485 connection = connections.getConnection();
4486 connection.beginTransaction();
4488 addBlackBoardAttribute(attr, artifactTypeId, connection);
4490 connection.commitTransaction();
4491 }
catch (SQLException ex) {
4492 rollbackTransaction(connection);
4493 throw new TskCoreException(
"Error adding blackboard attributes", ex);
4495 closeConnection(connection);
4500 void addBlackBoardAttribute(
BlackboardAttribute attr,
int artifactTypeId, CaseDbConnection connection)
throws SQLException, TskCoreException {
4501 PreparedStatement statement;
4502 switch (attr.getAttributeType().getValueType()) {
4505 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_STRING_ATTRIBUTE);
4506 statement.clearParameters();
4507 statement.setString(7, attr.getValueString());
4510 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_BYTE_ATTRIBUTE);
4511 statement.clearParameters();
4512 statement.setBytes(7, attr.getValueBytes());
4515 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INT_ATTRIBUTE);
4516 statement.clearParameters();
4517 statement.setInt(7, attr.getValueInt());
4520 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LONG_ATTRIBUTE);
4521 statement.clearParameters();
4522 statement.setLong(7, attr.getValueLong());
4525 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DOUBLE_ATTRIBUTE);
4526 statement.clearParameters();
4527 statement.setDouble(7, attr.getValueDouble());
4530 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LONG_ATTRIBUTE);
4531 statement.clearParameters();
4532 statement.setLong(7, attr.getValueLong());
4535 throw new TskCoreException(
"Unrecognized artifact attribute value type");
4537 statement.setLong(1, attr.getArtifactID());
4538 statement.setInt(2, artifactTypeId);
4539 statement.setString(3, attr.getSourcesCSV());
4540 statement.setString(4,
"");
4541 statement.setInt(5, attr.getAttributeType().getTypeID());
4542 statement.setLong(6, attr.getAttributeType().getValueType().getType());
4543 connection.executeUpdate(statement);
4546 void addFileAttribute(Attribute attr, CaseDbConnection connection)
throws SQLException, TskCoreException {
4547 PreparedStatement statement;
4548 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE_ATTRIBUTE, Statement.RETURN_GENERATED_KEYS);
4549 statement.clearParameters();
4551 statement.setLong(1, attr.getAttributeParentId());
4552 statement.setInt(2, attr.getAttributeType().getTypeID());
4553 statement.setLong(3, attr.getAttributeType().getValueType().getType());
4555 if (attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE) {
4556 statement.setBytes(4, attr.getValueBytes());
4558 statement.setBytes(4, null);
4561 if (attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING
4562 || attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.JSON) {
4563 statement.setString(5, attr.getValueString());
4565 statement.setString(5, null);
4567 if (attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER) {
4568 statement.setInt(6, attr.getValueInt());
4570 statement.setNull(6, java.sql.Types.INTEGER);
4573 if (attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME
4574 || attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG) {
4575 statement.setLong(7, attr.getValueLong());
4577 statement.setNull(7, java.sql.Types.BIGINT);
4580 if (attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE) {
4581 statement.setDouble(8, attr.getValueDouble());
4583 statement.setNull(8, java.sql.Types.DOUBLE);
4586 connection.executeUpdate(statement);
4587 try (ResultSet resultSet = statement.getGeneratedKeys()) {
4588 if (!resultSet.next()) {
4589 throw new TskCoreException(String.format(
"Failed to insert file attribute "
4590 +
"with id=%d. The expected key was not generated", attr.getId()));
4593 attr.setId(resultSet.getLong(1));
4607 String addSourceToArtifactAttribute(BlackboardAttribute attr, String source)
throws TskCoreException {
4615 if (null == source || source.isEmpty()) {
4616 throw new TskCoreException(
"Attempt to add null or empty source module name to artifact attribute");
4618 CaseDbConnection connection = null;
4620 Statement queryStmt = null;
4621 Statement updateStmt = null;
4622 ResultSet result = null;
4623 String newSources =
"";
4625 connection = connections.getConnection();
4626 connection.beginTransaction();
4627 String valueClause =
"";
4628 BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType = attr.getAttributeType().getValueType();
4629 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
4630 switch (valueType) {
4636 valueClause =
" value_int32 = " + attr.getValueInt();
4640 valueClause =
" value_int64 = " + attr.getValueLong();
4643 valueClause =
" value_double = " + attr.getValueDouble();
4646 throw new TskCoreException(String.format(
"Unrecognized value type for attribute %s", attr.getDisplayString()));
4648 String query =
"SELECT source FROM blackboard_attributes WHERE"
4649 +
" artifact_id = " + attr.getArtifactID()
4650 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
4651 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
4652 +
" AND " + valueClause +
";";
4653 queryStmt = connection.createStatement();
4654 updateStmt = connection.createStatement();
4655 result = connection.executeQuery(queryStmt, query);
4662 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ATTR_BY_VALUE_BYTE);
4663 statement.clearParameters();
4664 statement.setLong(1, attr.getArtifactID());
4665 statement.setLong(2, attr.getAttributeType().getTypeID());
4666 statement.setBytes(3, attr.getValueBytes());
4667 result = connection.executeQuery(statement);
4669 while (result.next()) {
4670 String oldSources = result.getString(
"source");
4671 if (null != oldSources && !oldSources.isEmpty()) {
4672 Set<String> uniqueSources =
new HashSet<String>(Arrays.asList(oldSources.split(
",")));
4673 if (!uniqueSources.contains(source)) {
4674 newSources = oldSources +
"," + source;
4676 newSources = oldSources;
4679 newSources = source;
4681 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
4682 String update =
"UPDATE blackboard_attributes SET source = '" + newSources +
"' WHERE"
4683 +
" artifact_id = " + attr.getArtifactID()
4684 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
4685 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
4686 +
" AND " + valueClause +
";";
4687 connection.executeUpdate(updateStmt, update);
4694 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ATTR_BY_VALUE_BYTE);
4695 statement.clearParameters();
4696 statement.setString(1, newSources);
4697 statement.setLong(2, attr.getArtifactID());
4698 statement.setLong(3, attr.getAttributeType().getTypeID());
4699 statement.setBytes(4, attr.getValueBytes());
4700 connection.executeUpdate(statement);
4703 connection.commitTransaction();
4705 }
catch (SQLException ex) {
4706 rollbackTransaction(connection);
4707 throw new TskCoreException(String.format(
"Error adding source module to attribute %s", attr.getDisplayString()), ex);
4709 closeResultSet(result);
4710 closeStatement(updateStmt);
4711 closeStatement(queryStmt);
4712 closeConnection(connection);
4736 throw new TskCoreException(
"Error adding artifact type: " + attrTypeString, ex);
4812 }
catch (BlackboardException ex) {
4813 throw new TskCoreException(
"Error getting or adding artifact type with name: " + artifactTypeName, ex);
4847 CaseDbConnection connection = null;
4849 ResultSet rs = null;
4852 connection = connections.getConnection();
4853 s = connection.createStatement();
4854 rs = connection.executeQuery(s,
"SELECT blackboard_attributes.artifact_id AS artifact_id, "
4855 +
"blackboard_attributes.source AS source, blackboard_attributes.context AS context, "
4856 +
"blackboard_attributes.attribute_type_id AS attribute_type_id, "
4857 +
"blackboard_attributes.value_type AS value_type, blackboard_attributes.value_byte AS value_byte, "
4858 +
"blackboard_attributes.value_text AS value_text, blackboard_attributes.value_int32 AS value_int32, "
4859 +
"blackboard_attributes.value_int64 AS value_int64, blackboard_attributes.value_double AS value_double "
4860 +
"FROM blackboard_attributes " + whereClause);
4861 ArrayList<BlackboardAttribute> matches =
new ArrayList<>();
4867 rs.getLong(
"artifact_id"),
4869 rs.getString(
"source"),
4870 rs.getString(
"context"),
4871 rs.getInt(
"value_int32"),
4872 rs.getLong(
"value_int64"),
4873 rs.getDouble(
"value_double"),
4874 rs.getString(
"value_text"),
4875 rs.getBytes(
"value_byte"), this
4880 }
catch (SQLException ex) {
4881 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
4885 closeConnection(connection);
4902 String query =
"SELECT blackboard_artifacts.artifact_id AS artifact_id, "
4903 +
"blackboard_artifacts.obj_id AS obj_id, blackboard_artifacts.artifact_obj_id AS artifact_obj_id, blackboard_artifacts.data_source_obj_id AS data_source_obj_id, blackboard_artifacts.artifact_type_id AS artifact_type_id, "
4904 +
"blackboard_artifacts.review_status_id AS review_status_id "
4905 +
"FROM blackboard_artifacts " + whereClause;
4907 try (CaseDbConnection connection = connections.getConnection(); Statement statement = connection.createStatement(); ResultSet resultSet = statement.executeQuery(query)) {
4909 List<Long> analysisArtifactObjIds =
new ArrayList<>();
4910 List<Long> dataArtifactObjIds =
new ArrayList<>();
4911 while (resultSet.next()) {
4914 analysisArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
4916 dataArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
4920 ArrayList<BlackboardArtifact> matches =
new ArrayList<>();
4921 if (!analysisArtifactObjIds.isEmpty()) {
4925 if (!dataArtifactObjIds.isEmpty()) {
4930 }
catch (SQLException ex) {
4931 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
4955 throw new TskCoreException(
"Unknown artifact type for id: " + artifactTypeID);
4958 Category category = type.getCategory();
4959 if (category == null) {
4960 throw new TskCoreException(String.format(
"No category for %s (id: %d)",
4961 type.getDisplayName() == null ?
"<null>" : type.getDisplayName(),
4966 if (content == null) {
4967 throw new TskCoreException(
"No content found for object id: " + obj_id);
4971 case ANALYSIS_RESULT:
4973 .getAnalysisResult();
4977 throw new TskCoreException(
"Unknown category type: " + category.
getName());
4994 @SuppressWarnings(
"deprecation")
5015 @SuppressWarnings(
"deprecation")
5018 try (CaseDbConnection connection = connections.getConnection()) {
5019 return newBlackboardArtifact(artifactTypeID, obj_id, type.getTypeName(), type.getDisplayName(), data_source_obj_id, connection);
5024 private BlackboardArtifact
newBlackboardArtifact(
int artifact_type_id,
long obj_id, String artifactTypeName, String artifactDisplayName)
throws TskCoreException {
5025 try (CaseDbConnection connection = connections.getConnection()) {
5026 long data_source_obj_id = getDataSourceObjectId(connection, obj_id);
5027 return this.
newBlackboardArtifact(artifact_type_id, obj_id, artifactTypeName, artifactDisplayName, data_source_obj_id, connection);
5031 PreparedStatement createInsertArtifactStatement(
int artifact_type_id,
long obj_id,
long artifact_obj_id,
long data_source_obj_id, CaseDbConnection connection)
throws TskCoreException, SQLException {
5033 PreparedStatement statement;
5035 statement = connection.getPreparedStatement(PREPARED_STATEMENT.POSTGRESQL_INSERT_ARTIFACT, Statement.RETURN_GENERATED_KEYS);
5036 statement.clearParameters();
5037 statement.setLong(1, obj_id);
5038 statement.setLong(2, artifact_obj_id);
5039 statement.setLong(3, data_source_obj_id);
5040 statement.setInt(4, artifact_type_id);
5042 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_ARTIFACT, Statement.RETURN_GENERATED_KEYS);
5043 statement.clearParameters();
5044 this.nextArtifactId++;
5045 statement.setLong(1, this.nextArtifactId);
5046 statement.setLong(2, obj_id);
5047 statement.setLong(3, artifact_obj_id);
5048 statement.setLong(4, data_source_obj_id);
5049 statement.setInt(5, artifact_type_id);
5072 private BlackboardArtifact
newBlackboardArtifact(
int artifact_type_id,
long obj_id, String artifactTypeName, String artifactDisplayName,
long data_source_obj_id, CaseDbConnection connection)
throws TskCoreException {
5075 if (type.getCategory() == BlackboardArtifact.Category.ANALYSIS_RESULT) {
5076 return blackboard.
newAnalysisResult(type, obj_id, data_source_obj_id, Score.SCORE_UNKNOWN, null, null, null, Collections.emptyList()).getAnalysisResult();
5078 return blackboard.
newDataArtifact(type, obj_id, data_source_obj_id, Collections.emptyList(), null);
5080 }
catch (BlackboardException ex) {
5081 throw new TskCoreException(
"Error creating a blackboard artifact", ex);
5103 AnalysisResult newAnalysisResult(BlackboardArtifact.Type artifactType,
long objId, Long dataSourceObjId, Score score, String conclusion, String configuration, String justification, CaseDbConnection connection)
throws TskCoreException {
5105 if (artifactType.getCategory() != BlackboardArtifact.Category.ANALYSIS_RESULT) {
5106 throw new TskCoreException(String.format(
"Artifact type (name = %s) is not of the AnalysisResult category. ", artifactType.getTypeName()));
5113 long artifactObjId = addObject(objId, TskData.ObjectType.ARTIFACT.getObjectType(), connection);
5116 PreparedStatement insertArtifactstatement;
5117 ResultSet resultSet = null;
5119 insertArtifactstatement = createInsertArtifactStatement(artifactType.getTypeID(), objId, artifactObjId, dataSourceObjId, connection);
5120 connection.executeUpdate(insertArtifactstatement);
5121 resultSet = insertArtifactstatement.getGeneratedKeys();
5123 artifactID = resultSet.getLong(1);
5126 if (score.getSignificance() != Score.Significance.UNKNOWN
5127 || !StringUtils.isBlank(conclusion)
5128 || !StringUtils.isBlank(configuration)
5129 || !StringUtils.isBlank(justification)) {
5131 PreparedStatement analysisResultsStatement;
5133 analysisResultsStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_ANALYSIS_RESULT);
5134 analysisResultsStatement.clearParameters();
5136 analysisResultsStatement.setLong(1, artifactObjId);
5137 analysisResultsStatement.setString(2, (conclusion != null) ? conclusion :
"");
5138 analysisResultsStatement.setInt(3, score.getSignificance().getId());
5139 analysisResultsStatement.setInt(4, score.getPriority().getId());
5140 analysisResultsStatement.setString(5, (configuration != null) ? configuration :
"");
5141 analysisResultsStatement.setString(6, (justification != null) ? justification :
"");
5143 connection.executeUpdate(analysisResultsStatement);
5146 return new AnalysisResult(
this, artifactID, objId, artifactObjId, dataSourceObjId, artifactType.getTypeID(),
5147 artifactType.getTypeName(), artifactType.getDisplayName(),
5148 BlackboardArtifact.ReviewStatus.UNDECIDED,
true,
5149 score, (conclusion != null) ? conclusion :
"",
5150 (configuration != null) ? configuration :
"", (justification != null) ? justification :
"");
5153 closeResultSet(resultSet);
5156 }
catch (SQLException ex) {
5157 throw new TskCoreException(
"Error creating a analysis result", ex);
5175 boolean getContentHasChildren(Content content)
throws TskCoreException {
5176 CaseDbConnection connection = null;
5177 ResultSet rs = null;
5180 connection = connections.getConnection();
5183 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
5184 statement.clearParameters();
5185 statement.setLong(1, content.getId());
5186 rs = connection.executeQuery(statement);
5187 boolean hasChildren =
false;
5189 hasChildren = rs.getInt(
"count") > 0;
5192 }
catch (SQLException e) {
5193 throw new TskCoreException(
"Error checking for children of parent " + content, e);
5196 closeConnection(connection);
5213 int getContentChildrenCount(Content content)
throws TskCoreException {
5215 if (!this.getHasChildren(content)) {
5219 CaseDbConnection connection = null;
5220 ResultSet rs = null;
5223 connection = connections.getConnection();
5226 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
5227 statement.clearParameters();
5228 statement.setLong(1, content.getId());
5229 rs = connection.executeQuery(statement);
5230 int countChildren = -1;
5232 countChildren = rs.getInt(
"count");
5234 return countChildren;
5235 }
catch (SQLException e) {
5236 throw new TskCoreException(
"Error checking for children of parent " + content, e);
5239 closeConnection(connection);
5255 List<Content> getAbstractFileChildren(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
5256 CaseDbConnection connection = null;
5257 ResultSet rs = null;
5260 connection = connections.getConnection();
5262 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT_AND_TYPE);
5263 statement.clearParameters();
5264 long parentId = parent.getId();
5265 statement.setLong(1, parentId);
5266 statement.setShort(2, type.getFileType());
5267 rs = connection.executeQuery(statement);
5268 return fileChildren(rs, connection, parentId);
5269 }
catch (SQLException ex) {
5270 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
5273 closeConnection(connection);
5287 List<Content> getAbstractFileChildren(Content parent)
throws TskCoreException {
5288 CaseDbConnection connection = null;
5289 ResultSet rs = null;
5292 connection = connections.getConnection();
5294 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT);
5295 statement.clearParameters();
5296 long parentId = parent.getId();
5297 statement.setLong(1, parentId);
5298 rs = connection.executeQuery(statement);
5299 return fileChildren(rs, connection, parentId);
5300 }
catch (SQLException ex) {
5301 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
5304 closeConnection(connection);
5320 List<Long> getAbstractFileChildrenIds(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
5321 CaseDbConnection connection = null;
5322 ResultSet rs = null;
5325 connection = connections.getConnection();
5327 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT_AND_TYPE);
5328 statement.clearParameters();
5329 statement.setLong(1, parent.getId());
5330 statement.setShort(2, type.getFileType());
5331 rs = connection.executeQuery(statement);
5332 List<Long> children =
new ArrayList<Long>();
5334 children.add(rs.getLong(
"obj_id"));
5337 }
catch (SQLException ex) {
5338 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
5341 closeConnection(connection);
5355 List<Long> getAbstractFileChildrenIds(Content parent)
throws TskCoreException {
5356 CaseDbConnection connection = null;
5357 ResultSet rs = null;
5360 connection = connections.getConnection();
5362 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT);
5363 statement.clearParameters();
5364 statement.setLong(1, parent.getId());
5365 rs = connection.executeQuery(statement);
5366 List<Long> children =
new ArrayList<Long>();
5368 children.add(rs.getLong(
"obj_id"));
5371 }
catch (SQLException ex) {
5372 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
5375 closeConnection(connection);
5390 List<Long> getBlackboardArtifactChildrenIds(Content parent)
throws TskCoreException {
5391 CaseDbConnection connection = null;
5392 ResultSet rs = null;
5395 connection = connections.getConnection();
5397 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_OBJECTIDS_BY_PARENT);
5398 statement.clearParameters();
5399 statement.setLong(1, parent.getId());
5400 rs = connection.executeQuery(statement);
5401 List<Long> children =
new ArrayList<Long>();
5403 children.add(rs.getLong(
"obj_id"));
5406 }
catch (SQLException ex) {
5407 throw new TskCoreException(
"Error getting children for BlackboardArtifact", ex);
5410 closeConnection(connection);
5424 List<Content> getBlackboardArtifactChildren(Content parent)
throws TskCoreException {
5425 long parentId = parent.getId();
5426 List<Content> lc =
new ArrayList<>();
5428 lc.addAll(blackboard.getDataArtifactsBySource(parentId));
5440 Collection<ObjectInfo> getChildrenInfo(Content c)
throws TskCoreException {
5441 CaseDbConnection connection = null;
5443 ResultSet rs = null;
5446 connection = connections.getConnection();
5447 s = connection.createStatement();
5448 rs = connection.executeQuery(s,
"SELECT tsk_objects.obj_id AS obj_id, tsk_objects.type AS type "
5449 +
"FROM tsk_objects LEFT JOIN tsk_files "
5450 +
"ON tsk_objects.obj_id = tsk_files.obj_id "
5451 +
"WHERE tsk_objects.par_obj_id = " + c.getId()
5452 +
" ORDER BY tsk_objects.obj_id");
5453 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
5455 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type"))));
5458 }
catch (SQLException ex) {
5459 throw new TskCoreException(
"Error getting Children Info for Content", ex);
5463 closeConnection(connection);
5478 ObjectInfo getParentInfo(Content c)
throws TskCoreException {
5479 return getParentInfo(c.getId());
5492 ObjectInfo getParentInfo(
long contentId)
throws TskCoreException {
5494 CaseDbConnection connection = null;
5496 ResultSet rs = null;
5498 connection = connections.getConnection();
5499 s = connection.createStatement();
5500 rs = connection.executeQuery(s,
"SELECT parent.obj_id AS obj_id, parent.type AS type "
5501 +
"FROM tsk_objects AS parent INNER JOIN tsk_objects AS child "
5502 +
"ON child.par_obj_id = parent.obj_id "
5503 +
"WHERE child.obj_id = " + contentId);
5505 return new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type")));
5509 }
catch (SQLException ex) {
5510 throw new TskCoreException(
"Error getting Parent Info for Content: " + contentId, ex);
5514 closeConnection(connection);
5529 Directory getParentDirectory(FsContent fsc)
throws TskCoreException {
5534 ObjectInfo parentInfo = getParentInfo(fsc);
5535 if (parentInfo == null) {
5538 Directory parent = null;
5539 if (parentInfo.type == ObjectType.ABSTRACTFILE) {
5540 parent = getDirectoryById(parentInfo.id, fsc.getFileSystem());
5542 throw new TskCoreException(
"Parent of FsContent (id: " + fsc.getId() +
") has wrong type to be directory: " + parentInfo.type);
5561 Content content = frequentlyUsedContentMap.get(
id);
5562 if (null != content) {
5569 CaseDbConnection connection = null;
5571 ResultSet rs = null;
5574 connection = connections.getConnection();
5575 s = connection.createStatement();
5576 rs = connection.executeQuery(s,
"SELECT * FROM tsk_objects WHERE obj_id = " +
id +
" LIMIT 1");
5580 parentId = rs.getLong(
"par_obj_id");
5582 }
catch (SQLException ex) {
5583 throw new TskCoreException(
"Error getting Content by ID.", ex);
5587 closeConnection(connection);
5595 frequentlyUsedContentMap.put(
id, content);
5598 content = getVolumeSystemById(
id, parentId);
5601 content = getVolumeById(
id, parentId);
5602 frequentlyUsedContentMap.put(
id, content);
5605 content = getPoolById(
id, parentId);
5608 content = getFileSystemById(
id, parentId);
5609 frequentlyUsedContentMap.put(
id, content);
5620 frequentlyUsedContentMap.put(
id, content);
5649 String getFilePath(
long id) {
5651 String filePath = null;
5652 CaseDbConnection connection = null;
5653 ResultSet rs = null;
5656 connection = connections.getConnection();
5658 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_FOR_FILE);
5659 statement.clearParameters();
5660 statement.setLong(1,
id);
5661 rs = connection.executeQuery(statement);
5663 filePath = rs.getString(
"path");
5665 }
catch (SQLException | TskCoreException ex) {
5666 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
5669 closeConnection(connection);
5682 TskData.EncodingType getEncodingType(
long id) {
5684 TskData.EncodingType type = TskData.EncodingType.NONE;
5685 CaseDbConnection connection = null;
5686 ResultSet rs = null;
5689 connection = connections.getConnection();
5690 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ENCODING_FOR_FILE);
5691 statement.clearParameters();
5692 statement.setLong(1,
id);
5693 rs = connection.executeQuery(statement);
5695 type = TskData.EncodingType.valueOf(rs.getInt(1));
5697 }
catch (SQLException | TskCoreException ex) {
5698 logger.log(Level.SEVERE,
"Error getting encoding type for file " +
id, ex);
5701 closeConnection(connection);
5715 String getFileParentPath(
long objectId, CaseDbConnection connection) {
5716 String parentPath = null;
5718 ResultSet rs = null;
5720 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_PATH_FOR_FILE);
5721 statement.clearParameters();
5722 statement.setLong(1, objectId);
5723 rs = connection.executeQuery(statement);
5725 parentPath = rs.getString(
"parent_path");
5727 }
catch (SQLException ex) {
5728 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
5744 String getFileName(
long objectId, CaseDbConnection connection) {
5745 String fileName = null;
5747 ResultSet rs = null;
5749 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_NAME);
5750 statement.clearParameters();
5751 statement.setLong(1, objectId);
5752 rs = connection.executeQuery(statement);
5754 fileName = rs.getString(
"name");
5756 }
catch (SQLException ex) {
5757 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
5775 DerivedFile.DerivedMethod getDerivedMethod(
long id)
throws TskCoreException {
5777 DerivedFile.DerivedMethod method = null;
5778 CaseDbConnection connection = null;
5779 ResultSet rs1 = null;
5780 ResultSet rs2 = null;
5783 connection = connections.getConnection();
5785 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_DERIVED_FILE);
5786 statement.clearParameters();
5787 statement.setLong(1,
id);
5788 rs1 = connection.executeQuery(statement);
5790 int method_id = rs1.getInt(
"derived_id");
5791 String rederive = rs1.getString(
"rederive");
5792 method =
new DerivedFile.DerivedMethod(method_id, rederive);
5793 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_DERIVATION_METHOD);
5794 statement.clearParameters();
5795 statement.setInt(1, method_id);
5796 rs2 = connection.executeQuery(statement);
5798 method.setToolName(rs2.getString(
"tool_name"));
5799 method.setToolVersion(rs2.getString(
"tool_version"));
5800 method.setOther(rs2.getString(
"other"));
5803 }
catch (SQLException e) {
5804 logger.log(Level.SEVERE,
"Error getting derived method for file: " +
id, e);
5806 closeResultSet(rs2);
5807 closeResultSet(rs1);
5808 closeConnection(connection);
5825 CaseDbConnection connection = connections.getConnection();
5829 closeConnection(connection);
5847 ResultSet rs = null;
5849 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_BY_ID);
5850 statement.clearParameters();
5851 statement.setLong(1, objectId);
5852 rs = connection.executeQuery(statement);
5853 List<AbstractFile> files = resultSetToAbstractFiles(rs, connection);
5854 if (files.size() > 0) {
5855 return files.get(0);
5859 }
catch (SQLException ex) {
5860 throw new TskCoreException(
"Error getting file by id, id = " + objectId, ex);
5880 CaseDbConnection connection = null;
5881 ResultSet rs = null;
5884 connection = connections.getConnection();
5887 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TYPE_BY_ARTIFACT_OBJ_ID);
5888 statement.clearParameters();
5889 statement.setLong(1,
id);
5891 rs = connection.executeQuery(statement);
5893 throw new TskCoreException(
"Error getting artifacttype for artifact with artifact_obj_id = " +
id);
5898 switch (artifactType.getCategory()) {
5899 case ANALYSIS_RESULT:
5904 throw new TskCoreException(String.format(
"Unknown artifact category for artifact with artifact_obj_id = %d, and artifact type = %s",
id, artifactType.getTypeName()));
5907 }
catch (SQLException ex) {
5908 throw new TskCoreException(
"Error getting artifacts by artifact_obj_id, artifact_obj_id = " +
id, ex);
5911 closeConnection(connection);
5931 String query =
"SELECT artifact_type_id, artifact_obj_id FROM blackboard_artifacts WHERE artifact_id = " + id;
5934 try (CaseDbConnection connection = connections.getConnection();
5935 Statement statement = connection.createStatement();
5936 ResultSet resultSet = statement.executeQuery(query);) {
5937 if (resultSet != null && resultSet.next()) {
5939 long artifactObjId = resultSet.getLong(
"artifact_obj_id");
5940 switch (artifactType.getCategory()) {
5941 case ANALYSIS_RESULT:
5948 }
catch (SQLException ex) {
5949 throw new TskCoreException(
"Error getting artifacts by artifact id, artifact id = " +
id, ex);
5967 private long getFileSystemId(
long fileId, CaseDbConnection connection) {
5969 ResultSet rs = null;
5972 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_SYSTEM_BY_OBJECT);
5973 statement.clearParameters();
5974 statement.setLong(1, fileId);
5975 rs = connection.executeQuery(statement);
5977 ret = rs.getLong(
"fs_obj_id");
5982 }
catch (SQLException e) {
5983 logger.log(Level.SEVERE,
"Error checking file system id of a file, id = " + fileId, e);
6003 String query = String.format(
"SELECT COUNT(*) AS count FROM tsk_files WHERE obj_id = %d AND data_source_obj_id = %d", fileId, dataSource.getId());
6004 CaseDbConnection connection = null;
6005 Statement statement = null;
6006 ResultSet resultSet = null;
6009 connection = connections.getConnection();
6010 statement = connection.createStatement();
6011 resultSet = connection.executeQuery(statement, query);
6013 return (resultSet.getLong(
"count") > 0L);
6014 }
catch (SQLException ex) {
6015 throw new TskCoreException(String.format(
"Error executing query %s", query), ex);
6017 closeResultSet(resultSet);
6018 closeStatement(statement);
6019 closeConnection(connection);
6033 private static boolean containsLikeWildcard(String str) {
6037 return str.contains(
"%") || str.contains(
"_");
6052 public List<AbstractFile>
findFiles(
Content dataSource, String fileName)
throws TskCoreException {
6054 if (!containsLikeWildcard(fileName)) {
6058 List<AbstractFile> files =
new ArrayList<>();
6059 CaseDbConnection connection = null;
6060 ResultSet resultSet = null;
6063 connection = connections.getConnection();
6065 PreparedStatement statement;
6066 if (ext.isEmpty()) {
6067 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_NAME);
6068 statement.clearParameters();
6069 statement.setString(1, fileName.toLowerCase());
6070 statement.setLong(2, dataSource.getId());
6072 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_EXTENSION_AND_DATA_SOURCE_AND_NAME);
6073 statement.clearParameters();
6074 statement.setString(1, ext);
6075 statement.setString(2, fileName.toLowerCase());
6076 statement.setLong(3, dataSource.getId());
6079 resultSet = connection.executeQuery(statement);
6080 files.addAll(resultSetToAbstractFiles(resultSet, connection));
6081 }
catch (SQLException e) {
6082 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles.exception.msg3.text"), e);
6084 closeResultSet(resultSet);
6085 closeConnection(connection);
6104 public List<AbstractFile>
findFiles(
Content dataSource, String fileName, String dirSubString)
throws TskCoreException {
6106 if (!containsLikeWildcard(fileName)) {
6110 List<AbstractFile> files =
new ArrayList<>();
6111 CaseDbConnection connection = null;
6112 ResultSet resultSet = null;
6115 connection = connections.getConnection();
6116 PreparedStatement statement;
6117 if (ext.isEmpty()) {
6118 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME);
6119 statement.clearParameters();
6120 statement.setString(1, fileName.toLowerCase());
6121 statement.setString(2,
"%" + dirSubString.toLowerCase() +
"%");
6122 statement.setLong(3, dataSource.getId());
6124 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_EXTENSION_AND_DATA_SOURCE_AND_PARENT_PATH_AND_NAME);
6125 statement.clearParameters();
6126 statement.setString(1, ext);
6127 statement.setString(2, fileName.toLowerCase());
6128 statement.setString(3,
"%" + dirSubString.toLowerCase() +
"%");
6129 statement.setLong(4, dataSource.getId());
6132 resultSet = connection.executeQuery(statement);
6133 files.addAll(resultSetToAbstractFiles(resultSet, connection));
6134 }
catch (SQLException e) {
6135 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles3.exception.msg3.text"), e);
6137 closeResultSet(resultSet);
6138 closeConnection(connection);
6163 if (null != localTrans) {
6166 }
catch (TskCoreException ex2) {
6167 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6185 long addObject(
long parentId,
int objectType, CaseDbConnection connection)
throws SQLException {
6186 ResultSet resultSet = null;
6190 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OBJECT, Statement.RETURN_GENERATED_KEYS);
6191 statement.clearParameters();
6192 if (parentId != 0) {
6193 statement.setLong(1, parentId);
6195 statement.setNull(1, java.sql.Types.BIGINT);
6197 statement.setInt(2, objectType);
6198 connection.executeUpdate(statement);
6199 resultSet = statement.getGeneratedKeys();
6201 if (resultSet.next()) {
6202 if (parentId != 0) {
6203 setHasChildren(parentId);
6205 return resultSet.getLong(1);
6207 throw new SQLException(
"Error inserting object with parent " + parentId +
" into tsk_objects");
6210 closeResultSet(resultSet);
6233 if (transaction == null) {
6234 throw new TskCoreException(
"Passed null CaseDbTransaction");
6237 ResultSet resultSet = null;
6240 CaseDbConnection connection = transaction.getConnection();
6245 if (isRootDirectory((AbstractFile) parent, transaction)) {
6246 if (parent.
getName().isEmpty()) {
6249 parentPath =
"/" + parent.
getName() +
"/";
6252 parentPath = ((AbstractFile) parent).getParentPath() + parent.
getName() +
"/";
6266 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6267 statement.clearParameters();
6268 statement.setLong(1, newObjId);
6271 Long fileSystemObjectId = null;
6272 if (0 != parentId) {
6273 fileSystemObjectId = this.getFileSystemId(parentId, connection);
6274 if (fileSystemObjectId != -1) {
6275 statement.setLong(2, fileSystemObjectId);
6277 statement.setNull(2, java.sql.Types.BIGINT);
6278 fileSystemObjectId = null;
6281 statement.setNull(2, java.sql.Types.BIGINT);
6285 statement.setString(3, directoryName);
6289 statement.setShort(5, (
short) 1);
6293 statement.setShort(6, dirType.
getValue());
6295 statement.setShort(7, metaType.
getValue());
6299 statement.setShort(8, dirFlag.
getValue());
6302 statement.setShort(9, metaFlags);
6305 statement.setLong(10, 0);
6308 statement.setNull(11, java.sql.Types.BIGINT);
6309 statement.setNull(12, java.sql.Types.BIGINT);
6310 statement.setNull(13, java.sql.Types.BIGINT);
6311 statement.setNull(14, java.sql.Types.BIGINT);
6313 statement.setNull(15, java.sql.Types.VARCHAR);
6314 statement.setNull(16, java.sql.Types.VARCHAR);
6315 statement.setNull(17, java.sql.Types.VARCHAR);
6318 statement.setNull(19, java.sql.Types.VARCHAR);
6321 statement.setString(20, parentPath);
6324 long dataSourceObjectId;
6325 if (0 == parentId) {
6326 dataSourceObjectId = newObjId;
6328 dataSourceObjectId = getDataSourceObjectId(connection, parentId);
6330 statement.setLong(21, dataSourceObjectId);
6333 statement.setString(22, null);
6335 statement.setString(23,
OsAccount.NO_OWNER_ID);
6336 statement.setNull(24, java.sql.Types.BIGINT);
6338 connection.executeUpdate(statement);
6340 return new VirtualDirectory(
this, newObjId, dataSourceObjectId, fileSystemObjectId, directoryName, dirType,
6343 }
catch (SQLException e) {
6344 throw new TskCoreException(
"Error creating virtual directory '" + directoryName +
"'", e);
6346 closeResultSet(resultSet);
6368 }
catch (TskCoreException ex) {
6371 }
catch (TskCoreException ex2) {
6372 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
6396 if (transaction == null) {
6397 throw new TskCoreException(
"Passed null CaseDbTransaction");
6400 ResultSet resultSet = null;
6403 CaseDbConnection connection = transaction.getConnection();
6406 if ((parent == null) || isRootDirectory(parent, transaction)) {
6419 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6420 statement.clearParameters();
6421 statement.setLong(1, newObjId);
6424 statement.setNull(2, java.sql.Types.BIGINT);
6427 statement.setString(3, directoryName);
6431 statement.setShort(5, (
short) 1);
6435 statement.setShort(6, dirType.
getValue());
6437 statement.setShort(7, metaType.
getValue());
6441 statement.setShort(8, dirFlag.
getValue());
6444 statement.setShort(9, metaFlags);
6447 statement.setLong(10, 0);
6450 statement.setNull(11, java.sql.Types.BIGINT);
6451 statement.setNull(12, java.sql.Types.BIGINT);
6452 statement.setNull(13, java.sql.Types.BIGINT);
6453 statement.setNull(14, java.sql.Types.BIGINT);
6455 statement.setNull(15, java.sql.Types.VARCHAR);
6456 statement.setNull(16, java.sql.Types.VARCHAR);
6457 statement.setNull(17, java.sql.Types.VARCHAR);
6460 statement.setNull(19, java.sql.Types.VARCHAR);
6463 statement.setString(20, parentPath);
6466 long dataSourceObjectId = getDataSourceObjectId(connection, parentId);
6467 statement.setLong(21, dataSourceObjectId);
6470 statement.setString(22, null);
6472 statement.setString(23,
OsAccount.NO_OWNER_ID);
6473 statement.setNull(24, java.sql.Types.BIGINT);
6475 connection.executeUpdate(statement);
6477 return new LocalDirectory(
this, newObjId, dataSourceObjectId, directoryName, dirType,
6480 }
catch (SQLException e) {
6481 throw new TskCoreException(
"Error creating local directory '" + directoryName +
"'", e);
6483 closeResultSet(resultSet);
6532 Statement statement = null;
6534 CaseDbConnection connection = transaction.getConnection();
6547 statement = connection.createStatement();
6548 statement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone, host_id) "
6549 +
"VALUES(" + newObjId +
", '" + deviceId +
"', '" + timeZone +
"', " + host.getHostId() +
");");
6558 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6559 preparedStatement.clearParameters();
6560 preparedStatement.setLong(1, newObjId);
6561 preparedStatement.setNull(2, java.sql.Types.BIGINT);
6562 preparedStatement.setString(3, rootDirectoryName);
6564 preparedStatement.setShort(5, (
short) 1);
6568 preparedStatement.setShort(7, metaType.
getValue());
6570 preparedStatement.setShort(8, dirFlag.
getValue());
6573 preparedStatement.setShort(9, metaFlags);
6574 preparedStatement.setLong(10, 0);
6575 preparedStatement.setNull(11, java.sql.Types.BIGINT);
6576 preparedStatement.setNull(12, java.sql.Types.BIGINT);
6577 preparedStatement.setNull(13, java.sql.Types.BIGINT);
6578 preparedStatement.setNull(14, java.sql.Types.BIGINT);
6579 preparedStatement.setNull(15, java.sql.Types.VARCHAR);
6580 preparedStatement.setNull(16, java.sql.Types.VARCHAR);
6581 preparedStatement.setNull(17, java.sql.Types.VARCHAR);
6583 preparedStatement.setNull(19, java.sql.Types.VARCHAR);
6584 String parentPath =
"/";
6585 preparedStatement.setString(20, parentPath);
6586 preparedStatement.setLong(21, newObjId);
6587 preparedStatement.setString(22, null);
6588 preparedStatement.setString(23,
OsAccount.NO_OWNER_ID);
6589 preparedStatement.setNull(24, java.sql.Types.BIGINT);
6592 connection.executeUpdate(preparedStatement);
6594 return new LocalFilesDataSource(
this, newObjId, newObjId, deviceId, rootDirectoryName, dirType, metaType, dirFlag, metaFlags, timeZone, null, null, null,
FileKnown.
UNKNOWN, parentPath);
6596 }
catch (SQLException ex) {
6597 throw new TskCoreException(String.format(
"Error creating local files data source with device id %s and directory name %s", deviceId, rootDirectoryName), ex);
6599 closeStatement(statement);
6623 String timezone, String md5, String sha1, String sha256,
6626 return addImage(type, sectorSize, size, displayName, imagePaths, timezone, md5, sha1, sha256, deviceId, null, transaction);
6650 String timezone, String md5, String sha1, String sha256,
6651 String deviceId,
Host host,
6653 Statement statement = null;
6656 CaseDbConnection connection = transaction.getConnection();
6661 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_INFO);
6662 preparedStatement.clearParameters();
6663 preparedStatement.setLong(1, newObjId);
6664 preparedStatement.setShort(2, (
short) type.getValue());
6665 preparedStatement.setLong(3, sectorSize);
6666 preparedStatement.setString(4, timezone);
6668 long savedSize = size < 0 ? 0 : size;
6669 preparedStatement.setLong(5, savedSize);
6670 preparedStatement.setString(6, md5);
6671 preparedStatement.setString(7, sha1);
6672 preparedStatement.setString(8, sha256);
6673 preparedStatement.setString(9, displayName);
6674 connection.executeUpdate(preparedStatement);
6677 for (
int i = 0; i < imagePaths.size(); i++) {
6678 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
6679 preparedStatement.clearParameters();
6680 preparedStatement.setLong(1, newObjId);
6681 preparedStatement.setString(2, imagePaths.get(i));
6682 preparedStatement.setLong(3, i);
6683 connection.executeUpdate(preparedStatement);
6687 String name = displayName;
6688 if (name == null || name.isEmpty()) {
6689 if (imagePaths.size() > 0) {
6690 String path = imagePaths.get(0);
6691 name = (
new java.io.File(path)).getName();
6699 if (name.isEmpty()) {
6707 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DATA_SOURCE_INFO);
6708 statement = connection.createStatement();
6709 preparedStatement.setLong(1, newObjId);
6710 preparedStatement.setString(2, deviceId);
6711 preparedStatement.setString(3, timezone);
6712 preparedStatement.setLong(4,
new Date().getTime());
6713 preparedStatement.setLong(5, host.getHostId());
6714 connection.executeUpdate(preparedStatement);
6717 return new Image(
this, newObjId, type.getValue(), deviceId, sectorSize, name,
6718 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, savedSize);
6719 }
catch (SQLException ex) {
6720 if (!imagePaths.isEmpty()) {
6721 throw new TskCoreException(String.format(
"Error adding image with path %s to database", imagePaths.get(0)), ex);
6723 throw new TskCoreException(String.format(
"Error adding image with display name %s to database", displayName), ex);
6726 closeStatement(statement);
6747 CaseDbConnection connection = transaction.getConnection();
6748 long newObjId = addObject(parentObjId,
TskData.
ObjectType.
VS.getObjectType(), connection);
6752 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_INFO);
6753 preparedStatement.clearParameters();
6754 preparedStatement.setLong(1, newObjId);
6755 preparedStatement.setShort(2, (
short) type.getVsType());
6756 preparedStatement.setLong(3, imgOffset);
6757 preparedStatement.setLong(4, blockSize);
6758 connection.executeUpdate(preparedStatement);
6761 return new VolumeSystem(
this, newObjId,
"", type.getVsType(), imgOffset, blockSize);
6762 }
catch (SQLException ex) {
6763 throw new TskCoreException(String.format(
"Error creating volume system with parent ID %d and image offset %d",
6764 parentObjId, imgOffset), ex);
6783 public Volume addVolume(
long parentObjId,
long addr,
long start,
long length, String desc,
6787 CaseDbConnection connection = transaction.getConnection();
6792 PreparedStatement preparedStatement;
6794 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_PART_POSTGRESQL);
6796 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_PART_SQLITE);
6798 preparedStatement.clearParameters();
6799 preparedStatement.setLong(1, newObjId);
6800 preparedStatement.setLong(2, addr);
6801 preparedStatement.setLong(3, start);
6802 preparedStatement.setLong(4, length);
6803 preparedStatement.setString(5, desc);
6804 preparedStatement.setShort(6, (
short) flags);
6805 connection.executeUpdate(preparedStatement);
6808 return new Volume(
this, newObjId, addr, start, length, flags, desc);
6809 }
catch (SQLException ex) {
6810 throw new TskCoreException(String.format(
"Error creating volume with address %d and parent ID %d", addr, parentObjId), ex);
6828 CaseDbConnection connection = transaction.getConnection();
6833 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_POOL_INFO);
6834 preparedStatement.clearParameters();
6835 preparedStatement.setLong(1, newObjId);
6836 preparedStatement.setShort(2, type.getValue());
6837 connection.executeUpdate(preparedStatement);
6840 return new Pool(
this, newObjId, type.getName(), type.getValue());
6841 }
catch (SQLException ex) {
6842 throw new TskCoreException(String.format(
"Error creating pool with type %d and parent ID %d", type.getValue(), parentObjId), ex);
6865 long rootInum,
long firstInum,
long lastInum, String displayName,
6869 CaseDbConnection connection = transaction.getConnection();
6870 long newObjId = addObject(parentObjId,
TskData.
ObjectType.
FS.getObjectType(), connection);
6873 long dataSourceId = getDataSourceObjectId(connection, newObjId);
6877 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FS_INFO);
6878 preparedStatement.clearParameters();
6879 preparedStatement.setLong(1, newObjId);
6880 preparedStatement.setLong(2, dataSourceId);
6881 preparedStatement.setLong(3, imgOffset);
6882 preparedStatement.setInt(4, type.getValue());
6883 preparedStatement.setLong(5, blockSize);
6884 preparedStatement.setLong(6, blockCount);
6885 preparedStatement.setLong(7, rootInum);
6886 preparedStatement.setLong(8, firstInum);
6887 preparedStatement.setLong(9, lastInum);
6888 preparedStatement.setString(10, displayName);
6889 connection.executeUpdate(preparedStatement);
6892 return new FileSystem(
this, newObjId, displayName, imgOffset, type, blockSize, blockCount, rootInum,
6893 firstInum, lastInum);
6894 }
catch (SQLException ex) {
6895 throw new TskCoreException(String.format(
"Error creating file system with image offset %d and parent ID %d",
6896 imgOffset, parentObjId), ex);
6927 long metaAddr,
int metaSeq,
6930 long ctime,
long crtime,
long atime,
long mtime,
6931 boolean isFile,
Content parent)
throws TskCoreException {
6937 metaAddr, metaSeq, attrType, attrId, dirFlag, metaFlags, size,
6938 ctime, crtime, atime, mtime, null, null, null, isFile, parent,
6940 Collections.emptyList(), transaction);
6944 return fileSystemFile;
6946 if (null != transaction) {
6949 }
catch (TskCoreException ex2) {
6950 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6995 long metaAddr,
int metaSeq,
6998 long ctime,
long crtime,
long atime,
long mtime,
6999 String md5Hash, String sha256Hash, String mimeType,
7000 boolean isFile,
Content parent, String ownerUid,
7001 OsAccount osAccount, List<Attribute> fileAttributes,
7008 dirFlag, metaFlags, size,
7009 ctime, crtime, atime, mtime,
7010 md5Hash, sha256Hash, null,
7012 isFile, parent, ownerUid,
7013 osAccount, fileAttributes,
7058 long metaAddr,
int metaSeq,
7061 long ctime,
long crtime,
long atime,
long mtime,
7062 String md5Hash, String sha256Hash, String sha1Hash,
7063 String mimeType,
boolean isFile,
7064 Content parent, String ownerUid,
7065 OsAccount osAccount, List<Attribute> fileAttributes,
7070 Statement queryStatement = null;
7071 String parentPath =
"/";
7073 CaseDbConnection connection = transaction.getConnection();
7080 AbstractFile parentFile = (AbstractFile) parent;
7081 if (isRootDirectory(parentFile, transaction)) {
7084 parentPath = parentFile.
getParentPath() + parent.getName() +
"/";
7090 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE_SYSTEM_FILE);
7091 statement.clearParameters();
7092 statement.setLong(1, objectId);
7093 statement.setLong(2, fsObjId);
7094 statement.setLong(3, dataSourceObjId);
7095 statement.setShort(4, (
short) attrType.getValue());
7096 statement.setInt(5, attrId);
7097 statement.setString(6, fileName);
7098 statement.setLong(7, metaAddr);
7099 statement.setInt(8, metaSeq);
7101 statement.setShort(10, (
short) 1);
7103 statement.setShort(11, dirType.
getValue());
7105 statement.setShort(12, metaType.
getValue());
7106 statement.setShort(13, dirFlag.getValue());
7107 statement.setShort(14, metaFlags);
7108 statement.setLong(15, size < 0 ? 0 : size);
7109 statement.setLong(16, ctime);
7110 statement.setLong(17, crtime);
7111 statement.setLong(18, atime);
7112 statement.setLong(19, mtime);
7113 statement.setString(20, md5Hash);
7114 statement.setString(21, sha256Hash);
7115 statement.setString(22, sha1Hash);
7116 statement.setString(23, mimeType);
7117 statement.setString(24, parentPath);
7118 final String extension = extractExtension(fileName);
7119 statement.setString(25, extension);
7120 statement.setString(26, ownerUid);
7121 if (null != osAccount) {
7122 statement.setLong(27, osAccount.getId());
7124 statement.setNull(27, java.sql.Types.BIGINT);
7127 connection.executeUpdate(statement);
7129 Long osAccountId = (osAccount != null) ? osAccount.getId() : null;
7130 DerivedFile derivedFile =
new DerivedFile(
this, objectId, dataSourceObjId, fsObjId, fileName, dirType, metaType, dirFlag, metaFlags,
7131 size, ctime, crtime, atime, mtime, md5Hash, sha256Hash, sha1Hash, null, parentPath, null, parent.getId(), mimeType, null, extension, ownerUid, osAccountId);
7133 if (!timelineEventsDisabled.get()) {
7134 timelineManager.addEventsForNewFile(derivedFile, connection);
7137 for (
Attribute fileAttribute : fileAttributes) {
7138 fileAttribute.setAttributeParentId(objectId);
7139 fileAttribute.setCaseDatabase(
this);
7140 addFileAttribute(fileAttribute, connection);
7143 if (osAccount != null) {
7148 attrType, attrId, fileName, metaAddr, metaSeq,
7149 dirType, metaType, dirFlag, metaFlags,
7150 size, ctime, crtime, atime, mtime,
7151 (
short) 0, 0, 0, md5Hash, sha256Hash, sha1Hash, null, parentPath, mimeType,
7152 extension, ownerUid, osAccountId, fileAttributes);
7154 }
catch (SQLException ex) {
7155 throw new TskCoreException(String.format(
"Failed to INSERT file system file %s (%s) with parent id %d in tsk_files table", fileName, parentPath, parent.getId()), ex);
7157 closeStatement(queryStatement);
7170 CaseDbConnection connection = null;
7172 ResultSet rs = null;
7175 connection = connections.getConnection();
7176 s = connection.createStatement();
7177 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE"
7179 +
" AND obj_id = data_source_obj_id"
7180 +
" ORDER BY dir_type, LOWER(name)");
7181 List<VirtualDirectory> virtDirRootIds =
new ArrayList<VirtualDirectory>();
7183 virtDirRootIds.add(virtualDirectory(rs, connection));
7185 return virtDirRootIds;
7186 }
catch (SQLException ex) {
7187 throw new TskCoreException(
"Error getting local files virtual folder id", ex);
7191 closeConnection(connection);
7209 assert (null != fileRanges);
7210 if (null == fileRanges) {
7211 throw new TskCoreException(
"TskFileRange object is null");
7214 assert (null != parent);
7215 if (null == parent) {
7216 throw new TskCoreException(
"Conent is null");
7221 parentPath = ((AbstractFile) parent).getParentPath() + parent.getName() +
'/';
7227 Statement statement = null;
7228 ResultSet resultSet = null;
7232 CaseDbConnection connection = transaction.getConnection();
7235 Long fileSystemObjectId;
7236 if (0 != parent.getId()) {
7237 fileSystemObjectId = this.getFileSystemId(parent.getId(), connection);
7238 if (fileSystemObjectId == -1) {
7239 fileSystemObjectId = null;
7242 fileSystemObjectId = null;
7245 List<LayoutFile> fileRangeLayoutFiles =
new ArrayList<>();
7253 long end_byte_in_parent = fileRange.getByteStart() + fileRange.getByteLen() - 1;
7263 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
7264 prepStmt.clearParameters();
7265 prepStmt.setLong(1, fileRangeId);
7266 if (fileSystemObjectId != null) {
7267 prepStmt.setLong(2, fileSystemObjectId);
7269 prepStmt.setNull(2, java.sql.Types.BIGINT);
7271 prepStmt.setString(3,
"Unalloc_" + parent.getId() +
"_" + fileRange.getByteStart() +
"_" + end_byte_in_parent);
7273 prepStmt.setNull(5, java.sql.Types.BIGINT);
7278 prepStmt.setLong(10, fileRange.getByteLen());
7279 prepStmt.setNull(11, java.sql.Types.BIGINT);
7280 prepStmt.setNull(12, java.sql.Types.BIGINT);
7281 prepStmt.setNull(13, java.sql.Types.BIGINT);
7282 prepStmt.setNull(14, java.sql.Types.BIGINT);
7283 prepStmt.setNull(15, java.sql.Types.VARCHAR);
7284 prepStmt.setNull(16, java.sql.Types.VARCHAR);
7285 prepStmt.setNull(17, java.sql.Types.VARCHAR);
7288 prepStmt.setNull(19, java.sql.Types.VARCHAR);
7289 prepStmt.setString(20, parentPath);
7290 prepStmt.setLong(21, parent.getId());
7293 prepStmt.setString(22, null);
7295 prepStmt.setString(23,
OsAccount.NO_OWNER_ID);
7296 prepStmt.setNull(24, java.sql.Types.BIGINT);
7298 connection.executeUpdate(prepStmt);
7305 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
7306 prepStmt.clearParameters();
7307 prepStmt.setLong(1, fileRangeId);
7308 prepStmt.setLong(2, fileRange.getByteStart());
7309 prepStmt.setLong(3, fileRange.getByteLen());
7310 prepStmt.setLong(4, fileRange.getSequence());
7311 connection.executeUpdate(prepStmt);
7316 fileRangeLayoutFiles.add(
new LayoutFile(
this,
7320 Long.toString(fileRange.getSequence()),
7326 fileRange.getByteLen(),
7330 parent.getUniquePath(),
7338 return fileRangeLayoutFiles;
7340 }
catch (SQLException ex) {
7341 throw new TskCoreException(
"Failed to add layout files to case database", ex);
7343 closeResultSet(resultSet);
7344 closeStatement(statement);
7346 if (null != transaction) {
7349 }
catch (TskCoreException ex2) {
7350 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
7362 private class CarvedFileDirInfo {
7365 AtomicInteger count;
7368 this.currentFolder = currentFolder;
7369 count =
new AtomicInteger(0);
7372 CarvedFileDirInfo(VirtualDirectory currentFolder,
int count) {
7373 this.currentFolder = currentFolder;
7374 this.count =
new AtomicInteger(count);
7384 return count.get() >= MAX_CARVED_FILES_PER_FOLDER;
7390 void incrementFileCounter() {
7391 count.incrementAndGet();
7404 private CarvedFileDirInfo getMostRecentCarvedDirInfo(VirtualDirectory carvedFilesBaseDir)
throws TskCoreException {
7405 VirtualDirectory mostRecentDir = null;
7406 for (Content child : carvedFilesBaseDir.getChildren()) {
7407 if (isValidCarvedFileSubfolder(child)) {
7408 if (mostRecentDir == null
7409 || (mostRecentDir.getId() < child.getId())) {
7410 mostRecentDir = (VirtualDirectory) child;
7415 if (mostRecentDir != null) {
7416 return new CarvedFileDirInfo(mostRecentDir, mostRecentDir.getChildrenCount());
7429 private boolean isValidCarvedFileSubfolder(Content subfolder) {
7430 if (!(subfolder instanceof VirtualDirectory)) {
7433 return subfolder.getName().matches(
"^[0-9]+$");
7449 private CarvedFileDirInfo createCarvedFilesSubfolder(Content carvedFilesBaseDir, CarvedFileDirInfo currentSubfolderInfo)
throws TskCoreException {
7451 if (currentSubfolderInfo != null) {
7453 int currentIndex = Integer.parseInt(currentSubfolderInfo.currentFolder.getName());
7454 nextIndex = currentIndex + 1;
7455 }
catch (NumberFormatException ex) {
7456 throw new TskCoreException(
"Unexpected name format for carved files subdirectory with ID: " + currentSubfolderInfo.currentFolder.getId() +
" (" + currentSubfolderInfo.currentFolder.getName() +
")", ex);
7460 VirtualDirectory carvedFilesSubdir =
addVirtualDirectory(carvedFilesBaseDir.getId(), Integer.toString(nextIndex));
7461 return new CarvedFileDirInfo(carvedFilesSubdir);
7476 assert (null != carvingResult);
7477 if (null == carvingResult) {
7478 throw new TskCoreException(
"Carving is null");
7480 assert (null != carvingResult.getParent());
7481 if (null == carvingResult.getParent()) {
7482 throw new TskCoreException(
"Carving result has null parent");
7484 assert (null != carvingResult.getCarvedFiles());
7485 if (null == carvingResult.getCarvedFiles()) {
7486 throw new TskCoreException(
"Carving result has null carved files");
7489 Statement statement = null;
7490 ResultSet resultSet = null;
7500 while (null != root) {
7514 CarvedFileDirInfo carvedFilesDirInfo = null;
7515 synchronized (carvedFileDirsLock) {
7517 carvedFilesDirInfo = rootIdsToCarvedFileDirs.get(root.
getId());
7518 if (carvedFilesDirInfo != null) {
7519 carvedFilesDirInfo.incrementFileCounter();
7522 if (carvedFilesDirInfo.isFull()) {
7523 carvedFilesDirInfo = createCarvedFilesSubfolder(carvedFilesDirInfo.currentFolder.getParent(), carvedFilesDirInfo);
7527 if (null == carvedFilesDirInfo) {
7528 List<Content> rootChildren;
7530 rootChildren = ((FileSystem) root).getRootDirectory().getChildren();
7534 for (
Content child : rootChildren) {
7535 if (child instanceof VirtualDirectory && child.getName().equals(VirtualDirectory.NAME_CARVED)) {
7537 VirtualDirectory baseDir = (VirtualDirectory) child;
7540 carvedFilesDirInfo = getMostRecentCarvedDirInfo(baseDir);
7543 if (carvedFilesDirInfo == null) {
7544 carvedFilesDirInfo = createCarvedFilesSubfolder(baseDir, null);
7548 if (carvedFilesDirInfo.isFull()) {
7549 carvedFilesDirInfo = createCarvedFilesSubfolder(baseDir, carvedFilesDirInfo);
7552 rootIdsToCarvedFileDirs.put(root.
getId(), carvedFilesDirInfo);
7556 if (carvedFilesDirInfo == null) {
7560 long parId = root.
getId();
7562 if (root instanceof FileSystem) {
7563 Content rootDir = ((FileSystem) root).getRootDirectory();
7564 parId = rootDir.
getId();
7566 VirtualDirectory carvedFilesBaseDir =
addVirtualDirectory(parId, VirtualDirectory.NAME_CARVED);
7567 carvedFilesDirInfo = createCarvedFilesSubfolder(carvedFilesBaseDir, null);
7568 rootIdsToCarvedFileDirs.put(root.
getId(), carvedFilesDirInfo);
7577 VirtualDirectory carvedFilesBaseDir = (VirtualDirectory) carvedFilesDirInfo.currentFolder.getParent();
7579 CaseDbConnection connection = transaction.getConnection();
7580 String parentPath = getFileParentPath(carvedFilesDirInfo.currentFolder.getId(), connection) + carvedFilesDirInfo.currentFolder.getName() +
"/";
7581 List<LayoutFile> carvedFiles =
new ArrayList<>();
7587 VirtualDirectory carvedFilesDir = carvedFilesDirInfo.currentFolder;
7588 if (carvedFilesDirInfo.isFull()) {
7594 synchronized (carvedFileDirsLock) {
7596 carvedFilesDirInfo = rootIdsToCarvedFileDirs.get(root.
getId());
7597 if (carvedFilesDirInfo.isFull()) {
7598 carvedFilesDirInfo = createCarvedFilesSubfolder(carvedFilesBaseDir, carvedFilesDirInfo);
7599 rootIdsToCarvedFileDirs.put(root.
getId(), carvedFilesDirInfo);
7600 carvedFilesDir = carvedFilesDirInfo.currentFolder;
7606 connection = transaction.getConnection();
7607 parentPath = getFileParentPath(carvedFilesDir.
getId(), connection) + carvedFilesDir.
getName() +
"/";
7610 carvedFilesDirInfo.incrementFileCounter();
7628 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
7629 prepStmt.clearParameters();
7630 prepStmt.setLong(1, carvedFileId);
7631 Long fileSystemObjectId;
7633 prepStmt.setLong(2, root.
getId());
7634 fileSystemObjectId = root.
getId();
7636 prepStmt.setNull(2, java.sql.Types.BIGINT);
7637 fileSystemObjectId = null;
7639 prepStmt.setString(3, carvedFile.getName());
7641 prepStmt.setShort(5, (
short) 1);
7646 prepStmt.setLong(10, carvedFile.getSizeInBytes());
7647 prepStmt.setNull(11, java.sql.Types.BIGINT);
7648 prepStmt.setNull(12, java.sql.Types.BIGINT);
7649 prepStmt.setNull(13, java.sql.Types.BIGINT);
7650 prepStmt.setNull(14, java.sql.Types.BIGINT);
7651 prepStmt.setNull(15, java.sql.Types.VARCHAR);
7652 prepStmt.setNull(16, java.sql.Types.VARCHAR);
7653 prepStmt.setNull(17, java.sql.Types.VARCHAR);
7656 prepStmt.setNull(19, java.sql.Types.VARCHAR);
7657 prepStmt.setString(20, parentPath);
7659 prepStmt.setString(22, extractExtension(carvedFile.getName()));
7661 prepStmt.setString(23,
OsAccount.NO_OWNER_ID);
7662 prepStmt.setNull(24, java.sql.Types.BIGINT);
7664 connection.executeUpdate(prepStmt);
7671 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
7672 for (
TskFileRange tskFileRange : carvedFile.getLayoutInParent()) {
7673 prepStmt.clearParameters();
7674 prepStmt.setLong(1, carvedFileId);
7675 prepStmt.setLong(2, tskFileRange.getByteStart());
7676 prepStmt.setLong(3, tskFileRange.getByteLen());
7677 prepStmt.setLong(4, tskFileRange.getSequence());
7678 connection.executeUpdate(prepStmt);
7688 carvedFile.getName(),
7694 carvedFile.getSizeInBytes(),
7708 }
catch (SQLException ex) {
7709 throw new TskCoreException(
"Failed to add carved files to case database", ex);
7711 closeResultSet(resultSet);
7712 closeStatement(statement);
7714 if (null != transaction) {
7717 }
catch (TskCoreException ex2) {
7718 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
7755 long size,
long ctime,
long crtime,
long atime,
long mtime,
7756 boolean isFile,
Content parentObj,
7757 String rederiveDetails, String toolName, String toolVersion,
7762 size, ctime, crtime, atime, mtime,
7764 rederiveDetails, toolName, toolVersion,
7765 otherDetails, encodingType, transaction);
7768 }
catch (TskCoreException ex) {
7775 long size,
long ctime,
long crtime,
long atime,
long mtime,
7776 boolean isFile,
Content parentObj,
7777 String rederiveDetails, String toolName, String toolVersion,
7780 localPath = localPath.replaceAll(
"^[/\\\\]+",
"");
7784 CaseDbConnection connection = transaction.getConnection();
7786 final long parentId = parentObj.getId();
7787 String parentPath =
"";
7789 parentPath = parentObj.getUniquePath() +
'/' + parentObj.getName() +
'/';
7791 parentPath = ((AbstractFile) parentObj).getParentPath() + parentObj.getName() +
'/';
7803 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
7804 statement.clearParameters();
7805 statement.setLong(1, newObjId);
7808 Long fsObjId = this.getFileSystemId(parentId, connection);
7809 if (fsObjId != -1) {
7810 statement.setLong(2, fsObjId);
7813 statement.setNull(2, java.sql.Types.BIGINT);
7815 statement.setString(3, fileName);
7819 statement.setShort(5, (
short) 1);
7823 statement.setShort(6, dirType.
getValue());
7825 statement.setShort(7, metaType.
getValue());
7829 statement.setShort(8, dirFlag.
getValue());
7832 statement.setShort(9, metaFlags);
7836 long savedSize = size < 0 ? 0 : size;
7837 statement.setLong(10, savedSize);
7841 statement.setLong(11, ctime);
7842 statement.setLong(12, crtime);
7843 statement.setLong(13, atime);
7844 statement.setLong(14, mtime);
7846 statement.setNull(15, java.sql.Types.VARCHAR);
7847 statement.setNull(16, java.sql.Types.VARCHAR);
7848 statement.setNull(17, java.sql.Types.VARCHAR);
7851 statement.setNull(19, java.sql.Types.VARCHAR);
7854 statement.setString(20, parentPath);
7857 long dataSourceObjId = getDataSourceObjectId(connection, parentObj);
7858 statement.setLong(21, dataSourceObjId);
7859 final String extension = extractExtension(fileName);
7861 statement.setString(22, extension);
7863 statement.setString(23,
OsAccount.NO_OWNER_ID);
7864 statement.setNull(24, java.sql.Types.BIGINT);
7866 connection.executeUpdate(statement);
7869 addFilePath(connection, newObjId, localPath, encodingType);
7871 DerivedFile derivedFile =
new DerivedFile(
this, newObjId, dataSourceObjId, fsObjId, fileName, dirType, metaType, dirFlag, metaFlags,
7872 savedSize, ctime, crtime, atime, mtime, null, null, null, null, parentPath, localPath, parentId, null, encodingType, extension,
OsAccount.NO_OWNER_ID,
OsAccount.NO_ACCOUNT);
7874 if (!timelineEventsDisabled.get()) {
7875 timelineManager.addEventsForNewFile(derivedFile, connection);
7880 }
catch (SQLException ex) {
7881 throw new TskCoreException(
"Failed to add derived file to case database", ex);
7916 long size,
long ctime,
long crtime,
long atime,
long mtime,
7917 boolean isFile, String mimeType,
7918 String rederiveDetails, String toolName, String toolVersion,
7927 size, ctime, crtime, atime, mtime,
7929 rederiveDetails, toolName, toolVersion,
7930 otherDetails, encodingType, parentObj, trans);
7933 }
catch (TskCoreException ex) {
7934 if (trans != null) {
7942 long size,
long ctime,
long crtime,
long atime,
long mtime,
7943 boolean isFile, String mimeType,
7944 String rederiveDetails, String toolName, String toolVersion,
7949 localPath = localPath.replaceAll(
"^[/\\\\]+",
"");
7951 ResultSet rs = null;
7953 final long parentId = parentObj.
getId();
7954 String parentPath =
"";
7956 parentPath = parentObj.getUniquePath() +
'/' + parentObj.getName() +
'/';
7958 parentPath = ((AbstractFile) parentObj).getParentPath() + parentObj.getName() +
'/';
7962 PreparedStatement statement = trans.getConnection().getPreparedStatement(PREPARED_STATEMENT.UPDATE_DERIVED_FILE);
7963 statement.clearParameters();
7970 statement.setShort(2, dirType.
getValue());
7972 statement.setShort(3, metaType.
getValue());
7976 statement.setShort(4, dirFlag.
getValue());
7979 statement.setShort(5, metaFlags);
7983 long savedSize = size < 0 ? 0 : size;
7984 statement.setLong(6, savedSize);
7988 statement.setLong(7, ctime);
7989 statement.setLong(8, crtime);
7990 statement.setLong(9, atime);
7991 statement.setLong(10, mtime);
7992 statement.setString(11, mimeType);
7993 statement.setString(12, String.valueOf(derivedFile.
getId()));
7994 trans.getConnection().executeUpdate(statement);
7997 updateFilePath(trans.getConnection(), derivedFile.
getId(), localPath, encodingType);
7999 long dataSourceObjId = getDataSourceObjectId(trans.getConnection(), parentObj);
8001 final String extension = extractExtension(derivedFile.
getName());
8002 return new DerivedFile(
this, derivedFile.
getId(), dataSourceObjId, fileSystemObjId, derivedFile.
getName(), dirType, metaType, dirFlag, metaFlags,
8003 savedSize, ctime, crtime, atime, mtime, null, null, null, null, parentPath, localPath, parentId, null, encodingType, extension,
8005 }
catch (SQLException ex) {
8006 throw new TskCoreException(
"Failed to add derived file to case database", ex);
8032 long size,
long ctime,
long crtime,
long atime,
long mtime,
8038 LocalFile created =
addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, encodingType, parent, localTrans);
8043 if (null != localTrans) {
8046 }
catch (TskCoreException ex2) {
8047 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
8078 long size,
long ctime,
long crtime,
long atime,
long mtime,
8083 size, ctime, crtime, atime, mtime,
8085 isFile, encodingType,
8086 parent, transaction);
8118 long size,
long ctime,
long crtime,
long atime,
long mtime,
8119 String md5, String sha256,
FileKnown known, String mimeType,
8123 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime,
8124 md5, sha256, known, mimeType, isFile, encodingType,
8160 long size,
long ctime,
long crtime,
long atime,
long mtime,
8161 String md5, String sha256,
FileKnown known, String mimeType,
8166 size, ctime, crtime, atime, mtime,
8167 md5, sha256, null, known, mimeType,
8168 isFile, encodingType, osAccountId, ownerAccount,
8169 parent, transaction);
8206 long size,
long ctime,
long crtime,
long atime,
long mtime,
8207 String md5, String sha256, String sha1Hash,
FileKnown known, String mimeType,
8210 CaseDbConnection connection = transaction.getConnection();
8211 Statement queryStatement = null;
8223 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
8224 statement.clearParameters();
8225 statement.setLong(1, objectId);
8226 statement.setNull(2, java.sql.Types.BIGINT);
8227 statement.setString(3, fileName);
8229 statement.setShort(5, (
short) 1);
8231 statement.setShort(6, dirType.
getValue());
8233 statement.setShort(7, metaType.
getValue());
8235 statement.setShort(8, dirFlag.
getValue());
8237 statement.setShort(9, metaFlags);
8239 long savedSize = size < 0 ? 0 : size;
8240 statement.setLong(10, savedSize);
8241 statement.setLong(11, ctime);
8242 statement.setLong(12, crtime);
8243 statement.setLong(13, atime);
8244 statement.setLong(14, mtime);
8245 statement.setString(15, md5);
8246 statement.setString(16, sha256);
8247 statement.setString(17, sha1Hash);
8249 if (known != null) {
8250 statement.setByte(18, known.getFileKnownValue());
8254 statement.setString(19, mimeType);
8256 long dataSourceObjId;
8259 AbstractFile parentFile = (AbstractFile) parent;
8260 if (isRootDirectory(parentFile, transaction)) {
8263 parentPath = parentFile.
getParentPath() + parent.getName() +
"/";
8268 dataSourceObjId = getDataSourceObjectId(connection, parent);
8270 statement.setString(20, parentPath);
8271 statement.setLong(21, dataSourceObjId);
8272 final String extension = extractExtension(fileName);
8273 statement.setString(22, extension);
8275 if (ownerAccount != null) {
8276 statement.setString(23, ownerAccount);
8278 statement.setNull(23, java.sql.Types.VARCHAR);
8281 if (osAccountId != null) {
8282 statement.setLong(24, osAccountId);
8284 statement.setNull(24, java.sql.Types.BIGINT);
8287 connection.executeUpdate(statement);
8288 addFilePath(connection, objectId, localPath, encodingType);
8298 ctime, crtime, atime, mtime,
8299 mimeType, md5, sha256, sha1Hash, known,
8300 parent.getId(), parentPath,
8303 encodingType, extension,
8304 ownerAccount, osAccountId);
8305 if (!timelineEventsDisabled.get()) {
8310 }
catch (SQLException ex) {
8311 throw new TskCoreException(String.format(
"Failed to INSERT local file %s (%s) with parent id %d in tsk_files table", fileName, localPath, parent.getId()), ex);
8313 closeStatement(queryStatement);
8322 private class RootDirectoryKey {
8324 private long dataSourceId;
8325 private Long fileSystemId;
8327 RootDirectoryKey(
long dataSourceId, Long fileSystemId) {
8328 this.dataSourceId = dataSourceId;
8329 this.fileSystemId = fileSystemId;
8333 public int hashCode() {
8335 hash = 41 * hash + Objects.hashCode(dataSourceId);
8336 hash = 41 * hash + Objects.hashCode(fileSystemId);
8341 public boolean equals(Object obj) {
8348 if (getClass() != obj.getClass()) {
8352 RootDirectoryKey otherKey = (RootDirectoryKey) obj;
8353 if (dataSourceId != otherKey.dataSourceId) {
8357 if (fileSystemId != null) {
8358 return fileSystemId.equals(otherKey.fileSystemId);
8360 return (otherKey.fileSystemId == null);
8376 private boolean isRootDirectory(AbstractFile file, CaseDbTransaction transaction)
throws TskCoreException {
8381 Long fsObjId = null;
8382 if (file instanceof FsContent) {
8383 fsObjId = ((FsContent) file).getFileSystemId();
8386 synchronized (rootDirectoryMapLock) {
8387 if (rootDirectoryMap.containsKey(key)) {
8388 return rootDirectoryMap.get(key).equals(file.
getId());
8395 Boolean isRoot = isRootDirectoryCache.getIfPresent(file.
getId());
8396 if (isRoot != null) {
8400 CaseDbConnection connection = transaction.getConnection();
8401 Statement statement = null;
8402 ResultSet resultSet = null;
8405 String query = String.format(
"SELECT ParentRow.type AS parent_type, ParentRow.obj_id AS parent_object_id "
8406 +
"FROM tsk_objects ParentRow JOIN tsk_objects ChildRow ON ChildRow.par_obj_id = ParentRow.obj_id "
8407 +
"WHERE ChildRow.obj_id = %s;", file.
getId());
8409 statement = connection.createStatement();
8410 resultSet = statement.executeQuery(query);
8411 if (resultSet.next()) {
8412 long parentId = resultSet.getLong(
"parent_object_id");
8413 if (parentId == 0) {
8416 int type = resultSet.getInt(
"parent_type");
8417 boolean result = type == TskData.ObjectType.IMG.getObjectType()
8418 || type == TskData.ObjectType.VS.getObjectType()
8419 || type == TskData.ObjectType.VOL.getObjectType()
8420 || type == TskData.ObjectType.FS.getObjectType();
8421 if (result ==
true) {
8422 synchronized (rootDirectoryMapLock) {
8424 rootDirectoryMap.put(key, file.
getId());
8427 isRootDirectoryCache.put(file.
getId(), result);
8432 synchronized (rootDirectoryMapLock) {
8433 rootDirectoryMap.put(key, file.
getId());
8435 isRootDirectoryCache.put(file.
getId(),
true);
8440 }
catch (SQLException ex) {
8441 throw new TskCoreException(String.format(
"Failed to lookup parent of file (%s) with id %d", file.
getName(), file.
getId()), ex);
8443 closeResultSet(resultSet);
8444 closeStatement(statement);
8470 long ctime,
long crtime,
long atime,
long mtime,
8471 List<TskFileRange> fileRanges,
8472 Content parent)
throws TskCoreException {
8474 if (null == parent) {
8475 throw new TskCoreException(
"Parent can not be null");
8480 parentPath = ((AbstractFile) parent).getParentPath() + parent.getName() +
'/';
8486 Statement statement = null;
8487 ResultSet resultSet = null;
8490 CaseDbConnection connection = transaction.getConnection();
8506 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
8507 prepStmt.clearParameters();
8508 prepStmt.setLong(1, newFileId);
8511 Long fileSystemObjectId;
8512 if (0 != parent.getId()) {
8513 fileSystemObjectId = this.getFileSystemId(parent.getId(), connection);
8514 if (fileSystemObjectId != -1) {
8515 prepStmt.setLong(2, fileSystemObjectId);
8517 prepStmt.setNull(2, java.sql.Types.BIGINT);
8518 fileSystemObjectId = null;
8521 prepStmt.setNull(2, java.sql.Types.BIGINT);
8522 fileSystemObjectId = null;
8524 prepStmt.setString(3, fileName);
8526 prepStmt.setShort(5, (
short) 0);
8529 prepStmt.setShort(8, dirFlag.getValue());
8530 prepStmt.setShort(9, metaFlag.getValue());
8532 long savedSize = size < 0 ? 0 : size;
8533 prepStmt.setLong(10, savedSize);
8534 prepStmt.setLong(11, ctime);
8535 prepStmt.setLong(12, crtime);
8536 prepStmt.setLong(13, atime);
8537 prepStmt.setLong(14, mtime);
8538 prepStmt.setNull(15, java.sql.Types.VARCHAR);
8539 prepStmt.setNull(16, java.sql.Types.VARCHAR);
8540 prepStmt.setNull(17, java.sql.Types.VARCHAR);
8543 prepStmt.setNull(19, java.sql.Types.VARCHAR);
8544 prepStmt.setString(20, parentPath);
8545 prepStmt.setLong(21, parent.getDataSource().getId());
8547 prepStmt.setString(22, extractExtension(fileName));
8549 prepStmt.setString(23,
OsAccount.NO_OWNER_ID);
8550 prepStmt.setNull(24, java.sql.Types.BIGINT);
8552 connection.executeUpdate(prepStmt);
8559 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
8561 prepStmt.clearParameters();
8562 prepStmt.setLong(1, newFileId);
8563 prepStmt.setLong(2, tskFileRange.getByteStart());
8564 prepStmt.setLong(3, tskFileRange.getByteLen());
8565 prepStmt.setLong(4, tskFileRange.getSequence());
8566 connection.executeUpdate(prepStmt);
8574 parent.getDataSource().getId(),
8581 metaFlag.getValue(),
8583 ctime, crtime, atime, mtime,
8595 }
catch (SQLException ex) {
8596 throw new TskCoreException(
"Failed to add layout file " + fileName +
" to case database", ex);
8598 closeResultSet(resultSet);
8599 closeStatement(statement);
8601 if (null != transaction) {
8604 }
catch (TskCoreException ex2) {
8605 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
8620 private long getDataSourceObjectId(CaseDbConnection connection,
Content content)
throws TskCoreException {
8621 if (content == null) {
8622 throw new TskCoreException(
"Null Content parameter given");
8624 if (content instanceof AbstractFile) {
8625 return ((AbstractFile) content).getDataSourceObjectId();
8627 return getDataSourceObjectId(connection, content.getId());
8643 private long getDataSourceObjectId(CaseDbConnection connection,
long objectId)
throws TskCoreException {
8645 Statement statement = null;
8646 ResultSet resultSet = null;
8648 statement = connection.createStatement();
8649 long dataSourceObjId;
8650 long ancestorId = objectId;
8652 dataSourceObjId = ancestorId;
8653 String query = String.format(
"SELECT par_obj_id FROM tsk_objects WHERE obj_id = %s;", ancestorId);
8654 resultSet = statement.executeQuery(query);
8655 if (resultSet.next()) {
8656 ancestorId = resultSet.getLong(
"par_obj_id");
8658 throw new TskCoreException(String.format(
"tsk_objects table is corrupt, SQL query returned no result: %s", query));
8662 }
while (0 != ancestorId);
8663 return dataSourceObjId;
8664 }
catch (SQLException ex) {
8665 throw new TskCoreException(String.format(
"Error finding root data source for object (obj_id = %d)", objectId), ex);
8667 closeResultSet(resultSet);
8668 closeStatement(statement);
8684 private void addFilePath(CaseDbConnection connection,
long objId, String path, TskData.EncodingType type) throws SQLException {
8685 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LOCAL_PATH);
8686 statement.clearParameters();
8687 statement.setLong(1, objId);
8688 statement.setString(2, path);
8689 statement.setInt(3, type.getType());
8690 connection.executeUpdate(statement);
8704 private void updateFilePath(CaseDbConnection connection,
long objId, String path, TskData.EncodingType type) throws SQLException {
8705 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_LOCAL_PATH);
8706 statement.clearParameters();
8707 statement.setString(1, path);
8708 statement.setInt(2, type.getType());
8709 statement.setLong(3, objId);
8710 connection.executeUpdate(statement);
8726 public List<AbstractFile>
findFilesInFolder(String fileName, AbstractFile parentFile)
throws TskCoreException {
8728 if (!containsLikeWildcard(fileName)) {
8732 CaseDbConnection connection = null;
8733 ResultSet rs = null;
8734 long parentId = parentFile.getId();
8738 connection = connections.getConnection();
8740 PreparedStatement statement;
8741 if (ext.isEmpty()) {
8742 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT_AND_NAME);
8743 statement.clearParameters();
8744 statement.setLong(1, parentId);
8745 statement.setString(2, fileName);
8747 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_EXTENSION_AND_PARENT_AND_NAME);
8748 statement.clearParameters();
8749 statement.setString(1, ext);
8750 statement.setLong(2, parentId);
8751 statement.setString(3, fileName);
8754 rs = connection.executeQuery(statement);
8755 return resultSetToAbstractFiles(rs, connection);
8756 }
catch (SQLException ex) {
8757 throw new TskCoreException(
"Error getting AbstractFile children with name=" + fileName +
" for Content parent with ID=" + parentFile.getId(), ex);
8760 closeConnection(connection);
8777 CaseDbConnection connection = null;
8779 ResultSet rs = null;
8782 connection = connections.getConnection();
8783 s = connection.createStatement();
8784 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE " + sqlWhereClause);
8786 return rs.getLong(
"count");
8787 }
catch (SQLException e) {
8788 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.countFilesWhere().", e);
8792 closeConnection(connection);
8815 CaseDbConnection connection = null;
8817 ResultSet rs = null;
8820 connection = connections.getConnection();
8821 s = connection.createStatement();
8822 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
8823 return resultSetToAbstractFiles(rs, connection);
8824 }
catch (SQLException e) {
8825 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFilesWhere(): " + sqlWhereClause, e);
8829 closeConnection(connection);
8853 String queryTemplate =
"SELECT tsk_files.* FROM tsk_files JOIN tsk_objects ON tsk_objects.obj_id = tsk_files.obj_id WHERE par_obj_id = %d AND %s";
8855 try (CaseDbConnection connection = connections.getConnection()) {
8856 String query = String.format(queryTemplate, parentId, sqlWhereClause);
8857 try (Statement s = connection.createStatement(); ResultSet rs = connection.executeQuery(s, query)) {
8858 return resultSetToAbstractFiles(rs, connection);
8859 }
catch (SQLException ex) {
8860 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFilesInFolderWhere(): " + query, ex);
8880 CaseDbConnection connection = null;
8882 ResultSet rs = null;
8885 connection = connections.getConnection();
8886 s = connection.createStatement();
8887 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_files WHERE " + sqlWhereClause);
8888 List<Long> ret =
new ArrayList<>();
8890 ret.add(rs.getLong(
"obj_id"));
8893 }
catch (SQLException e) {
8894 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFileIdsWhere(): " + sqlWhereClause, e);
8898 closeConnection(connection);
8914 public List<AbstractFile>
openFiles(
Content dataSource, String filePath)
throws TskCoreException {
8918 String path = AbstractFile.createNonUniquePath(filePath).toLowerCase();
8921 int lastSlash = path.lastIndexOf(
'/');
8924 if (lastSlash == path.length()) {
8925 path = path.substring(0, lastSlash - 1);
8926 lastSlash = path.lastIndexOf(
'/');
8929 String parentPath = path.substring(0, lastSlash);
8930 String fileName = path.substring(lastSlash);
8932 return findFiles(dataSource, fileName, parentPath);
8946 CaseDbConnection connection = null;
8948 ResultSet rs = null;
8951 connection = connections.getConnection();
8952 s = connection.createStatement();
8953 rs = connection.executeQuery(s,
"SELECT * FROM tsk_file_layout WHERE obj_id = " +
id +
" ORDER BY sequence");
8954 List<TskFileRange> ranges =
new ArrayList<TskFileRange>();
8957 rs.getLong(
"byte_len"), rs.getLong(
"sequence"));
8961 }
catch (SQLException ex) {
8962 throw new TskCoreException(
"Error getting TskFileLayoutRanges by id, id = " +
id, ex);
8966 closeConnection(connection);
8982 CaseDbConnection connection = null;
8984 ResultSet rs = null;
8987 connection = connections.getConnection();
8988 s = connection.createStatement();
8989 rs = connection.executeQuery(s,
"SELECT tsk_image_info.type, tsk_image_info.ssize, tsk_image_info.tzone, tsk_image_info.size, tsk_image_info.md5, tsk_image_info.sha1, tsk_image_info.sha256, tsk_image_info.display_name, data_source_info.device_id, tsk_image_names.name "
8990 +
"FROM tsk_image_info "
8991 +
"INNER JOIN data_source_info ON tsk_image_info.obj_id = data_source_info.obj_id "
8992 +
"LEFT JOIN tsk_image_names ON tsk_image_names.obj_id = data_source_info.obj_id "
8993 +
"WHERE tsk_image_info.obj_id = " +
id);
8995 List<String> imagePaths =
new ArrayList<>();
8996 long type, ssize, size;
8997 String tzone, md5, sha1, sha256, name, device_id, imagePath;
9000 imagePath = rs.getString(
"name");
9001 if (imagePath != null) {
9002 imagePaths.add(imagePath);
9004 type = rs.getLong(
"type");
9005 ssize = rs.getLong(
"ssize");
9006 tzone = rs.getString(
"tzone");
9007 size = rs.getLong(
"size");
9008 md5 = rs.getString(
"md5");
9009 sha1 = rs.getString(
"sha1");
9010 sha256 = rs.getString(
"sha256");
9011 name = rs.getString(
"display_name");
9013 if (imagePaths.size() > 0) {
9014 String path = imagePaths.get(0);
9015 name = (
new java.io.File(path)).getName();
9020 device_id = rs.getString(
"device_id");
9022 throw new TskCoreException(
"No image found for id: " +
id);
9027 imagePath = rs.getString(
"name");
9028 if (imagePath != null) {
9029 imagePaths.add(imagePath);
9033 return new Image(
this,
id, type, device_id, ssize, name,
9034 imagePaths.toArray(
new String[imagePaths.size()]), tzone, md5, sha1, sha256, size);
9035 }
catch (SQLException ex) {
9036 throw new TskCoreException(
"Error getting Image by id, id = " +
id, ex);
9040 closeConnection(connection);
9057 CaseDbConnection connection = null;
9059 ResultSet rs = null;
9062 connection = connections.getConnection();
9063 s = connection.createStatement();
9064 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_info "
9065 +
"where obj_id = " +
id);
9067 long type = rs.getLong(
"vs_type");
9068 long imgOffset = rs.getLong(
"img_offset");
9069 long blockSize = rs.getLong(
"block_size");
9071 vs.setParent(parent);
9074 throw new TskCoreException(
"No volume system found for id:" +
id);
9076 }
catch (SQLException ex) {
9077 throw new TskCoreException(
"Error getting Volume System by ID.", ex);
9081 closeConnection(connection);
9094 VolumeSystem getVolumeSystemById(
long id,
long parentId)
throws TskCoreException {
9095 VolumeSystem vs = getVolumeSystemById(
id, null);
9096 vs.setParentId(parentId);
9111 FileSystem getFileSystemById(
long id, Image parent)
throws TskCoreException {
9112 return getFileSystemByIdHelper(
id, parent);
9123 FileSystem getFileSystemById(
long id,
long parentId)
throws TskCoreException {
9125 FileSystem fs = getFileSystemById(
id, vol);
9126 fs.setParentId(parentId);
9141 FileSystem getFileSystemById(
long id, Volume parent)
throws TskCoreException {
9142 return getFileSystemByIdHelper(
id, parent);
9156 Pool getPoolById(
long id, Content parent)
throws TskCoreException {
9157 return getPoolByIdHelper(
id, parent);
9168 Pool getPoolById(
long id,
long parentId)
throws TskCoreException {
9169 Pool pool = getPoolById(
id, null);
9170 pool.setParentId(parentId);
9185 private Pool getPoolByIdHelper(
long id, Content parent)
throws TskCoreException {
9188 try (CaseDbConnection connection = connections.getConnection();
9189 Statement s = connection.createStatement();
9190 ResultSet rs = connection.executeQuery(s,
"SELECT * FROM tsk_pool_info "
9191 +
"where obj_id = " +
id);) {
9193 Pool pool =
new Pool(
this, rs.getLong(
"obj_id"), TskData.TSK_POOL_TYPE_ENUM.valueOf(rs.getLong(
"pool_type")).getName(), rs.getLong(
"pool_type"));
9194 pool.setParent(parent);
9198 throw new TskCoreException(
"No pool found for ID:" +
id);
9200 }
catch (SQLException ex) {
9201 throw new TskCoreException(
"Error getting Pool by ID", ex);
9218 private FileSystem getFileSystemByIdHelper(
long id, Content parent)
throws TskCoreException {
9222 synchronized (fileSystemIdMap) {
9223 if (fileSystemIdMap.containsKey(
id)) {
9224 return fileSystemIdMap.get(
id);
9227 CaseDbConnection connection = null;
9229 ResultSet rs = null;
9232 connection = connections.getConnection();
9233 s = connection.createStatement();
9234 rs = connection.executeQuery(s,
"SELECT * FROM tsk_fs_info "
9235 +
"where obj_id = " +
id);
9237 TskData.TSK_FS_TYPE_ENUM fsType = TskData.TSK_FS_TYPE_ENUM.valueOf(rs.getInt(
"fs_type"));
9238 FileSystem fs =
new FileSystem(
this, rs.getLong(
"obj_id"),
"", rs.getLong(
"img_offset"),
9239 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
9240 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
9241 fs.setParent(parent);
9243 synchronized (fileSystemIdMap) {
9244 fileSystemIdMap.put(
id, fs);
9248 throw new TskCoreException(
"No file system found for id:" +
id);
9250 }
catch (SQLException ex) {
9251 throw new TskCoreException(
"Error getting File System by ID", ex);
9255 closeConnection(connection);
9271 Volume getVolumeById(
long id, VolumeSystem parent)
throws TskCoreException {
9272 CaseDbConnection connection = null;
9274 ResultSet rs = null;
9277 connection = connections.getConnection();
9278 s = connection.createStatement();
9279 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_parts "
9280 +
"where obj_id = " +
id);
9291 description = rs.getString(
"desc");
9292 }
catch (Exception ex) {
9293 description = rs.getString(
"descr");
9295 Volume vol =
new Volume(
this, rs.getLong(
"obj_id"), rs.getLong(
"addr"),
9296 rs.getLong(
"start"), rs.getLong(
"length"), rs.getLong(
"flags"),
9298 vol.setParent(parent);
9301 throw new TskCoreException(
"No volume found for id:" +
id);
9303 }
catch (SQLException ex) {
9304 throw new TskCoreException(
"Error getting Volume by ID", ex);
9308 closeConnection(connection);
9321 Volume getVolumeById(
long id,
long parentId)
throws TskCoreException {
9322 Volume vol = getVolumeById(
id, null);
9323 vol.setParentId(parentId);
9338 Directory getDirectoryById(
long id, FileSystem parentFs)
throws TskCoreException {
9339 CaseDbConnection connection = null;
9341 ResultSet rs = null;
9344 connection = connections.getConnection();
9345 s = connection.createStatement();
9346 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files "
9347 +
"WHERE obj_id = " +
id);
9348 Directory temp = null;
9350 final short type = rs.getShort(
"type");
9351 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()) {
9352 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()
9353 || rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) {
9354 temp = directory(rs, parentFs);
9356 }
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()) {
9357 throw new TskCoreException(
"Expecting an FS-type directory, got virtual, id: " +
id);
9360 throw new TskCoreException(
"No Directory found for id:" +
id);
9363 }
catch (SQLException ex) {
9364 throw new TskCoreException(
"Error getting Directory by ID", ex);
9368 closeConnection(connection);
9383 List<FileSystem> fileSystems =
new ArrayList<>();
9384 String queryStr =
"SELECT * FROM tsk_fs_info WHERE data_source_obj_id = " + image.getId();
9386 CaseDbConnection connection = null;
9388 ResultSet rs = null;
9391 connection = connections.getConnection();
9392 s = connection.createStatement();
9393 rs = connection.executeQuery(s, queryStr);
9397 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
9398 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
9400 fileSystems.add(fs);
9402 }
catch (SQLException ex) {
9403 throw new TskCoreException(
"Error looking up files systems. Query: " + queryStr, ex);
9407 closeConnection(connection);
9423 List<Content> getImageChildren(
Image img)
throws TskCoreException {
9424 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
9425 List<Content> children =
new ArrayList<Content>();
9426 for (ObjectInfo info : childInfos) {
9427 if (null != info.type) {
9428 switch (info.type) {
9430 children.add(getVolumeSystemById(info.id, img));
9433 children.add(getPoolById(info.id, img));
9436 children.add(getFileSystemById(info.id, img));
9454 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
9471 List<Long> getImageChildrenIds(Image img)
throws TskCoreException {
9472 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
9473 List<Long> children =
new ArrayList<Long>();
9474 for (ObjectInfo info : childInfos) {
9475 if (info.type == ObjectType.VS
9476 || info.type == ObjectType.POOL
9477 || info.type == ObjectType.FS
9478 || info.type == ObjectType.ABSTRACTFILE
9479 || info.type == ObjectType.ARTIFACT) {
9480 children.add(info.id);
9481 }
else if (info.type == ObjectType.REPORT) {
9484 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
9500 List<Content> getPoolChildren(Pool pool)
throws TskCoreException {
9501 Collection<ObjectInfo> childInfos = getChildrenInfo(pool);
9502 List<Content> children =
new ArrayList<Content>();
9503 for (ObjectInfo info : childInfos) {
9504 if (null != info.type) {
9505 switch (info.type) {
9507 children.add(getVolumeSystemById(info.id, pool));
9522 throw new TskCoreException(
"Pool has child of invalid type: " + info.type);
9539 List<Long> getPoolChildrenIds(Pool pool)
throws TskCoreException {
9540 Collection<ObjectInfo> childInfos = getChildrenInfo(pool);
9541 List<Long> children =
new ArrayList<Long>();
9542 for (ObjectInfo info : childInfos) {
9543 if (info.type == ObjectType.VS || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
9544 children.add(info.id);
9546 throw new TskCoreException(
"Pool has child of invalid type: " + info.type);
9562 List<Content> getVolumeSystemChildren(VolumeSystem vs)
throws TskCoreException {
9563 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
9564 List<Content> children =
new ArrayList<Content>();
9565 for (ObjectInfo info : childInfos) {
9566 if (null != info.type) {
9567 switch (info.type) {
9569 children.add(getVolumeById(info.id, vs));
9584 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
9601 List<Long> getVolumeSystemChildrenIds(VolumeSystem vs)
throws TskCoreException {
9602 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
9603 List<Long> children =
new ArrayList<Long>();
9604 for (ObjectInfo info : childInfos) {
9605 if (info.type == ObjectType.VOL || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
9606 children.add(info.id);
9608 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
9624 List<Content> getVolumeChildren(Volume vol)
throws TskCoreException {
9625 Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
9626 List<Content> children =
new ArrayList<Content>();
9627 for (ObjectInfo info : childInfos) {
9628 if (null != info.type) {
9629 switch (info.type) {
9631 children.add(getPoolById(info.id, vol));
9634 children.add(getFileSystemById(info.id, vol));
9649 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
9666 List<Long> getVolumeChildrenIds(Volume vol)
throws TskCoreException {
9667 final Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
9668 final List<Long> children =
new ArrayList<Long>();
9669 for (ObjectInfo info : childInfos) {
9670 if (info.type == ObjectType.FS || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
9671 children.add(info.id);
9673 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
9692 public Image addImageInfo(
long deviceObjId, List<String> imageFilePaths, String timeZone)
throws TskCoreException {
9693 return addImageInfo(deviceObjId, imageFilePaths, timeZone, null);
9710 public Image addImageInfo(
long deviceObjId, List<String> imageFilePaths, String timeZone,
Host host)
throws TskCoreException {
9711 long imageId = this.caseHandle.addImageInfo(deviceObjId, imageFilePaths, timeZone, host,
this);
9725 CaseDbConnection connection = null;
9726 Statement s1 = null;
9727 ResultSet rs1 = null;
9730 connection = connections.getConnection();
9731 s1 = connection.createStatement();
9732 rs1 = connection.executeQuery(s1,
"SELECT tsk_image_info.obj_id, tsk_image_names.name FROM tsk_image_info "
9733 +
"LEFT JOIN tsk_image_names ON tsk_image_info.obj_id = tsk_image_names.obj_id");
9734 Map<Long, List<String>> imgPaths =
new LinkedHashMap<Long, List<String>>();
9735 while (rs1.next()) {
9736 long obj_id = rs1.getLong(
"obj_id");
9737 String name = rs1.getString(
"name");
9738 List<String> imagePaths = imgPaths.get(obj_id);
9739 if (imagePaths == null) {
9740 List<String> paths =
new ArrayList<String>();
9744 imgPaths.put(obj_id, paths);
9747 imagePaths.add(name);
9752 }
catch (SQLException ex) {
9753 throw new TskCoreException(
"Error getting image paths.", ex);
9755 closeResultSet(rs1);
9757 closeConnection(connection);
9773 private List<String> getImagePathsById(
long objectId, CaseDbConnection connection)
throws TskCoreException {
9774 List<String> imagePaths =
new ArrayList<>();
9776 Statement statement = null;
9777 ResultSet resultSet = null;
9779 statement = connection.createStatement();
9780 resultSet = connection.executeQuery(statement,
"SELECT name FROM tsk_image_names WHERE tsk_image_names.obj_id = " + objectId);
9781 while (resultSet.next()) {
9782 imagePaths.add(resultSet.getString(
"name"));
9784 }
catch (SQLException ex) {
9785 throw new TskCoreException(String.format(
"Error getting image names with obj_id = %d", objectId), ex);
9787 closeResultSet(resultSet);
9788 closeStatement(statement);
9802 CaseDbConnection connection = null;
9804 ResultSet rs = null;
9807 connection = connections.getConnection();
9808 s = connection.createStatement();
9809 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_image_info");
9810 Collection<Long> imageIDs =
new ArrayList<Long>();
9812 imageIDs.add(rs.getLong(
"obj_id"));
9814 List<Image> images =
new ArrayList<Image>();
9815 for (
long id : imageIDs) {
9819 }
catch (SQLException ex) {
9820 throw new TskCoreException(
"Error retrieving images.", ex);
9824 closeConnection(connection);
9839 public void setImagePaths(
long obj_id, List<String> paths)
throws TskCoreException {
9840 CaseDbConnection connection = null;
9842 PreparedStatement statement;
9844 connection = connections.getConnection();
9845 connection.beginTransaction();
9846 statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_IMAGE_NAME);
9847 statement.clearParameters();
9848 statement.setLong(1, obj_id);
9849 connection.executeUpdate(statement);
9850 for (
int i = 0; i < paths.size(); i++) {
9851 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
9852 statement.clearParameters();
9853 statement.setLong(1, obj_id);
9854 statement.setString(2, paths.get(i));
9855 statement.setLong(3, i);
9856 connection.executeUpdate(statement);
9858 connection.commitTransaction();
9859 }
catch (SQLException ex) {
9860 rollbackTransaction(connection);
9861 throw new TskCoreException(
"Error updating image paths.", ex);
9863 closeConnection(connection);
9879 void deleteDataSource(
long dataSourceObjectId)
throws TskCoreException {
9885 Host hostToDelete = null;
9889 if (major > 9 || (major == 9 && minor >= 1)) {
9891 if (
getHostManager().getDataSourcesForHost(hostToDelete).size() != 1) {
9892 hostToDelete = null;
9896 CaseDbConnection connection = null;
9897 Statement statement;
9900 connection = connections.getConnection();
9901 statement = connection.createStatement();
9902 connection.beginTransaction();
9905 statement.execute(
"DELETE FROM tsk_objects WHERE obj_id = " + dataSourceObjectId);
9908 String accountSql =
"DELETE FROM accounts WHERE account_id in (SELECT account_id FROM accounts "
9909 +
"WHERE account_id NOT IN (SELECT account1_id FROM account_relationships) "
9910 +
"AND account_id NOT IN (SELECT account2_id FROM account_relationships))";
9911 statement.execute(accountSql);
9915 if (hostToDelete != null) {
9916 statement.execute(
"DELETE FROM tsk_hosts WHERE id = " + hostToDelete.
getHostId());
9919 String deleteOsAcctObjectsQuery =
"DELETE FROM tsk_objects "
9920 +
"WHERE type=" + TskData.ObjectType.OS_ACCOUNT.getObjectType() +
" "
9921 +
"AND obj_id NOT IN (SELECT os_account_obj_id FROM tsk_os_accounts WHERE os_account_obj_id IS NOT NULL)";
9922 statement.execute(deleteOsAcctObjectsQuery);
9925 connection.commitTransaction();
9926 }
catch (SQLException ex) {
9927 rollbackTransaction(connection);
9928 throw new TskCoreException(
"Error deleting data source.", ex);
9930 closeConnection(connection);
9960 List<AbstractFile> resultSetToAbstractFiles(ResultSet rs, CaseDbConnection connection)
throws SQLException {
9961 ArrayList<AbstractFile> results =
new ArrayList<AbstractFile>();
9964 final short type = rs.getShort(
"type");
9965 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()
9966 && (rs.getShort(
"meta_type") != TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue())) {
9968 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
9969 result = directory(rs, null);
9971 result = file(rs, null);
9973 results.add(result);
9974 }
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()
9975 || (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue())) {
9976 final VirtualDirectory virtDir = virtualDirectory(rs, connection);
9977 results.add(virtDir);
9978 }
else if (type == TSK_DB_FILES_TYPE_ENUM.LOCAL_DIR.getFileType()) {
9979 final LocalDirectory localDir = localDirectory(rs);
9980 results.add(localDir);
9981 }
else if (type == TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS.getFileType()
9982 || type == TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS.getFileType()
9983 || type == TSK_DB_FILES_TYPE_ENUM.CARVED.getFileType()
9984 || type == TSK_DB_FILES_TYPE_ENUM.LAYOUT_FILE.getFileType()) {
9985 TSK_DB_FILES_TYPE_ENUM atype = TSK_DB_FILES_TYPE_ENUM.valueOf(type);
9986 String parentPath = rs.getString(
"parent_path");
9987 if (parentPath == null) {
9991 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
9993 osAccountObjId = null;
9996 LayoutFile lf =
new LayoutFile(
this,
9997 rs.getLong(
"obj_id"),
9998 rs.getLong(
"data_source_obj_id"),
9999 rs.getLong(
"fs_obj_id"),
10000 rs.getString(
"name"),
10002 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")), TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10003 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
10004 rs.getLong(
"size"),
10005 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10006 rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10007 FileKnown.valueOf(rs.getByte(
"known")), parentPath,
10008 rs.getString(
"mime_type"),
10009 rs.getString(
"owner_uid"), osAccountObjId);
10011 }
else if (type == TSK_DB_FILES_TYPE_ENUM.DERIVED.getFileType()) {
10012 final DerivedFile df;
10013 df = derivedFile(rs, connection, AbstractContent.UNKNOWN_ID);
10015 }
else if (type == TSK_DB_FILES_TYPE_ENUM.LOCAL.getFileType()) {
10016 final LocalFile lf;
10017 lf = localFile(rs, connection, AbstractContent.UNKNOWN_ID);
10019 }
else if (type == TSK_DB_FILES_TYPE_ENUM.SLACK.getFileType()) {
10020 final SlackFile sf = slackFile(rs, null);
10024 }
catch (SQLException e) {
10025 logger.log(Level.SEVERE,
"Error getting abstract files from result set", e);
10044 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10045 if (rs.wasNull()) {
10046 osAccountObjId = null;
10050 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
10051 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
10052 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
10053 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10054 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10055 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
10056 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
10057 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10058 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
10059 rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10060 FileKnown.valueOf(rs.getByte(
"known")),
10061 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension"), rs.getString(
"owner_uid"),
10062 osAccountObjId, Collections.emptyList());
10063 f.setFileSystem(fs);
10078 Directory directory(ResultSet rs, FileSystem fs)
throws SQLException {
10079 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10080 if (rs.wasNull()) {
10081 osAccountObjId = null;
10084 Directory dir =
new Directory(
this, rs.getLong(
"obj_id"), rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
10085 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
10086 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
10087 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10088 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10089 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
10090 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
10091 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10092 rs.getShort(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
10093 rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10094 FileKnown.valueOf(rs.getByte(
"known")),
10095 rs.getString(
"parent_path"), rs.getString(
"owner_uid"), osAccountObjId);
10096 dir.setFileSystem(fs);
10110 VirtualDirectory virtualDirectory(ResultSet rs, CaseDbConnection connection)
throws SQLException {
10111 String parentPath = rs.getString(
"parent_path");
10112 if (parentPath == null) {
10116 long objId = rs.getLong(
"obj_id");
10117 long dsObjId = rs.getLong(
"data_source_obj_id");
10118 if (objId == dsObjId) {
10120 String deviceId =
"";
10121 String timeZone =
"";
10122 Statement s = null;
10123 ResultSet rsDataSourceInfo = null;
10127 s = connection.createStatement();
10128 rsDataSourceInfo = connection.executeQuery(s,
"SELECT device_id, time_zone FROM data_source_info WHERE obj_id = " + objId);
10129 if (rsDataSourceInfo.next()) {
10130 deviceId = rsDataSourceInfo.getString(
"device_id");
10131 timeZone = rsDataSourceInfo.getString(
"time_zone");
10133 }
catch (SQLException ex) {
10134 logger.log(Level.SEVERE,
"Error data source info for datasource id " + objId, ex);
10136 closeResultSet(rsDataSourceInfo);
10141 return new LocalFilesDataSource(
this,
10144 rs.getString(
"name"),
10145 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10146 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10147 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
10148 rs.getShort(
"meta_flags"),
10150 rs.getString(
"md5"),
10151 rs.getString(
"sha256"),
10152 rs.getString(
"sha1"),
10153 FileKnown.valueOf(rs.getByte(
"known")),
10156 final VirtualDirectory vd =
new VirtualDirectory(
this,
10158 rs.getLong(
"fs_obj_id"),
10159 rs.getString(
"name"),
10160 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10161 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10162 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
10163 rs.getShort(
"meta_flags"), rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10164 FileKnown.valueOf(rs.getByte(
"known")), parentPath);
10178 LocalDirectory localDirectory(ResultSet rs)
throws SQLException {
10179 String parentPath = rs.getString(
"parent_path");
10180 if (parentPath == null) {
10183 final LocalDirectory ld =
new LocalDirectory(
this, rs.getLong(
"obj_id"),
10184 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"),
10185 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10186 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10187 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
10188 rs.getShort(
"meta_flags"), rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10189 FileKnown.valueOf(rs.getByte(
"known")), parentPath);
10206 private DerivedFile derivedFile(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
10207 boolean hasLocalPath = rs.getBoolean(
"has_path");
10208 long objId = rs.getLong(
"obj_id");
10209 String localPath = null;
10210 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
10211 if (hasLocalPath) {
10212 ResultSet rsFilePath = null;
10215 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
10216 statement.clearParameters();
10217 statement.setLong(1, objId);
10218 rsFilePath = connection.executeQuery(statement);
10219 if (rsFilePath.next()) {
10220 localPath = rsFilePath.getString(
"path");
10221 encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
10223 }
catch (SQLException ex) {
10224 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
10226 closeResultSet(rsFilePath);
10230 String parentPath = rs.getString(
"parent_path");
10231 if (parentPath == null) {
10235 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10236 if (rs.wasNull()) {
10237 osAccountObjId = null;
10240 final DerivedFile df =
new DerivedFile(
this, objId, rs.getLong(
"data_source_obj_id"),
10241 rs.getLong(
"fs_obj_id"),
10242 rs.getString(
"name"),
10243 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10244 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10245 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
10246 rs.getLong(
"size"),
10247 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10248 rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10249 FileKnown.valueOf(rs.getByte(
"known")),
10250 parentPath, localPath, parentId, rs.getString(
"mime_type"),
10251 encodingType, rs.getString(
"extension"),
10252 rs.getString(
"owner_uid"), osAccountObjId);
10269 private LocalFile localFile(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
10270 long objId = rs.getLong(
"obj_id");
10271 String localPath = null;
10272 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
10273 if (rs.getBoolean(
"has_path")) {
10274 ResultSet rsFilePath = null;
10277 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
10278 statement.clearParameters();
10279 statement.setLong(1, objId);
10280 rsFilePath = connection.executeQuery(statement);
10281 if (rsFilePath.next()) {
10282 localPath = rsFilePath.getString(
"path");
10283 encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
10285 }
catch (SQLException ex) {
10286 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
10288 closeResultSet(rsFilePath);
10292 String parentPath = rs.getString(
"parent_path");
10293 if (null == parentPath) {
10296 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10297 if (rs.wasNull()) {
10298 osAccountObjId = null;
10301 LocalFile file =
new LocalFile(
this, objId, rs.getString(
"name"),
10302 TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type")),
10303 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10304 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10305 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
10306 rs.getLong(
"size"),
10307 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10308 rs.getString(
"mime_type"), rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10309 FileKnown.valueOf(rs.getByte(
"known")),
10310 parentId, parentPath, rs.getLong(
"data_source_obj_id"),
10311 localPath, encodingType, rs.getString(
"extension"),
10312 rs.getString(
"owner_uid"), osAccountObjId);
10328 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10329 if (rs.wasNull()) {
10330 osAccountObjId = null;
10333 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
10334 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
10335 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
10336 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10337 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10338 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
10339 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
10340 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10341 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
10342 rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10343 FileKnown.valueOf(rs.getByte(
"known")),
10344 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension"),
10345 rs.getString(
"owner_uid"), osAccountObjId);
10346 f.setFileSystem(fs);
10361 List<Content> fileChildren(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
10362 List<Content> children =
new ArrayList<Content>();
10364 while (rs.next()) {
10365 TskData.TSK_DB_FILES_TYPE_ENUM type = TskData.TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type"));
10367 if (null != type) {
10370 if (rs.getShort(
"meta_type") != TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) {
10372 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
10373 result = directory(rs, null);
10375 result = file(rs, null);
10377 children.add(result);
10379 VirtualDirectory virtDir = virtualDirectory(rs, connection);
10380 children.add(virtDir);
10384 VirtualDirectory virtDir = virtualDirectory(rs, connection);
10385 children.add(virtDir);
10388 LocalDirectory localDir = localDirectory(rs);
10389 children.add(localDir);
10391 case UNALLOC_BLOCKS:
10392 case UNUSED_BLOCKS:
10394 case LAYOUT_FILE: {
10395 String parentPath = rs.getString(
"parent_path");
10396 if (parentPath == null) {
10399 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10400 if (rs.wasNull()) {
10401 osAccountObjId = null;
10403 final LayoutFile lf =
new LayoutFile(
this, rs.getLong(
"obj_id"),
10404 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
10405 rs.getString(
"name"), type,
10406 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10407 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10408 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
10409 rs.getLong(
"size"),
10410 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10411 rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10412 FileKnown.valueOf(rs.getByte(
"known")), parentPath, rs.getString(
"mime_type"),
10413 rs.getString(
"owner_uid"), osAccountObjId);
10418 final DerivedFile df = derivedFile(rs, connection, parentId);
10422 final LocalFile lf = localFile(rs, connection, parentId);
10427 final SlackFile sf = slackFile(rs, null);
10496 CaseDbConnection getConnection() throws TskCoreException {
10497 return connections.getConnection();
10507 String getCaseHandleIdentifier() {
10508 return caseHandleIdentifier;
10511 @SuppressWarnings(
"deprecation")
10528 connections.close();
10529 }
catch (TskCoreException ex) {
10530 logger.log(Level.SEVERE,
"Error closing database connection pool.", ex);
10533 fileSystemIdMap.clear();
10536 if (this.caseHandle != null) {
10537 this.caseHandle.free();
10538 this.caseHandle = null;
10540 }
catch (TskCoreException ex) {
10541 logger.log(Level.SEVERE,
"Error freeing case handle.", ex);
10560 long id = file.getId();
10561 FileKnown currentKnown = file.getKnown();
10562 if (currentKnown.compareTo(fileKnown) > 0) {
10566 try (CaseDbConnection connection = connections.getConnection();
10567 Statement statement = connection.createStatement();) {
10568 connection.executeUpdate(statement,
"UPDATE tsk_files "
10569 +
"SET known='" + fileKnown.getFileKnownValue() +
"' "
10570 +
"WHERE obj_id=" + id);
10572 file.setKnown(fileKnown);
10573 }
catch (SQLException ex) {
10574 throw new TskCoreException(
"Error setting Known status.", ex);
10589 void setFileName(String name,
long objId)
throws TskCoreException {
10591 try (CaseDbConnection connection = connections.getConnection();) {
10593 preparedStatement.clearParameters();
10594 preparedStatement.setString(1, name);
10595 preparedStatement.setLong(2, objId);
10596 connection.executeUpdate(preparedStatement);
10597 }
catch (SQLException ex) {
10598 throw new TskCoreException(String.format(
"Error updating while the name for object ID %d to %s", objId, name), ex);
10612 void setImageName(String name,
long objId)
throws TskCoreException {
10614 try (CaseDbConnection connection = connections.getConnection();) {
10615 PreparedStatement preparedStatement = connection.getPreparedStatement(SleuthkitCase.PREPARED_STATEMENT.UPDATE_IMAGE_NAME);
10616 preparedStatement.clearParameters();
10617 preparedStatement.setString(1, name);
10618 preparedStatement.setLong(2, objId);
10619 connection.executeUpdate(preparedStatement);
10620 }
catch (SQLException ex) {
10621 throw new TskCoreException(String.format(
"Error updating while the name for object ID %d to %s", objId, name), ex);
10641 void setImageSizes(Image image,
long totalSize,
long sectorSize)
throws TskCoreException {
10644 try (CaseDbConnection connection = connections.getConnection();) {
10645 PreparedStatement preparedStatement = connection.getPreparedStatement(SleuthkitCase.PREPARED_STATEMENT.UPDATE_IMAGE_SIZES);
10646 preparedStatement.clearParameters();
10647 preparedStatement.setLong(1, totalSize);
10648 preparedStatement.setLong(2, sectorSize);
10649 preparedStatement.setLong(3, image.getId());
10650 connection.executeUpdate(preparedStatement);
10651 }
catch (SQLException ex) {
10652 throw new TskCoreException(String.format(
"Error updating image sizes to %d and sector size to %d for object ID %d ", totalSize, sectorSize, image.getId()), ex);
10669 try (CaseDbConnection connection = connections.getConnection();
10670 Statement statement = connection.createStatement()) {
10671 connection.executeUpdate(statement, String.format(
"UPDATE tsk_files SET mime_type = '%s' WHERE obj_id = %d", mimeType, file.getId()));
10672 file.setMIMEType(mimeType);
10673 }
catch (SQLException ex) {
10674 throw new TskCoreException(String.format(
"Error setting MIME type for file (obj_id = %s)", file.getId()), ex);
10693 short metaFlag = file.getMetaFlagsAsInt();
10702 try (CaseDbConnection connection = connections.getConnection();
10703 Statement statement = connection.createStatement();) {
10704 connection.executeUpdate(statement, String.format(
"UPDATE tsk_files SET meta_flags = '%d', dir_flags = '%d' WHERE obj_id = %d", newMetaFlgs, newDirFlags, file.getId()));
10711 }
catch (SQLException ex) {
10712 throw new TskCoreException(String.format(
"Error setting unalloc meta flag for file (obj_id = %s)", file.getId()), ex);
10727 void setMd5Hash(AbstractFile file, String md5Hash)
throws TskCoreException {
10728 if (md5Hash == null) {
10731 long id = file.getId();
10733 try (CaseDbConnection connection = connections.getConnection();) {
10734 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_FILE_MD5);
10735 statement.clearParameters();
10736 statement.setString(1, md5Hash.toLowerCase());
10737 statement.setLong(2,
id);
10738 connection.executeUpdate(statement);
10739 file.setMd5Hash(md5Hash.toLowerCase());
10740 }
catch (SQLException ex) {
10741 throw new TskCoreException(
"Error setting MD5 hash", ex);
10756 void setMd5ImageHash(Image img, String md5Hash)
throws TskCoreException {
10757 if (md5Hash == null) {
10760 long id = img.getId();
10762 try (CaseDbConnection connection = connections.getConnection();) {
10763 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_MD5);
10764 statement.clearParameters();
10765 statement.setString(1, md5Hash.toLowerCase());
10766 statement.setLong(2,
id);
10767 connection.executeUpdate(statement);
10768 }
catch (SQLException ex) {
10769 throw new TskCoreException(
"Error setting MD5 hash", ex);
10785 String getMd5ImageHash(Image img)
throws TskCoreException {
10786 long id = img.getId();
10787 CaseDbConnection connection = null;
10788 ResultSet rs = null;
10792 connection = connections.getConnection();
10794 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_MD5);
10795 statement.clearParameters();
10796 statement.setLong(1,
id);
10797 rs = connection.executeQuery(statement);
10799 hash = rs.getString(
"md5");
10802 }
catch (SQLException ex) {
10803 throw new TskCoreException(
"Error getting MD5 hash", ex);
10805 closeResultSet(rs);
10806 closeConnection(connection);
10820 void setSha1ImageHash(Image img, String sha1Hash)
throws TskCoreException {
10821 if (sha1Hash == null) {
10824 long id = img.getId();
10826 try (CaseDbConnection connection = connections.getConnection();) {
10827 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_SHA1);
10828 statement.clearParameters();
10829 statement.setString(1, sha1Hash.toLowerCase());
10830 statement.setLong(2,
id);
10831 connection.executeUpdate(statement);
10832 }
catch (SQLException ex) {
10833 throw new TskCoreException(
"Error setting SHA1 hash", ex);
10849 String getSha1ImageHash(Image img)
throws TskCoreException {
10850 long id = img.getId();
10851 CaseDbConnection connection = null;
10852 ResultSet rs = null;
10856 connection = connections.getConnection();
10858 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_SHA1);
10859 statement.clearParameters();
10860 statement.setLong(1,
id);
10861 rs = connection.executeQuery(statement);
10863 hash = rs.getString(
"sha1");
10866 }
catch (SQLException ex) {
10867 throw new TskCoreException(
"Error getting SHA1 hash", ex);
10869 closeResultSet(rs);
10870 closeConnection(connection);
10884 void setSha256ImageHash(Image img, String sha256Hash)
throws TskCoreException {
10885 if (sha256Hash == null) {
10888 long id = img.getId();
10890 try (CaseDbConnection connection = connections.getConnection();) {
10891 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_SHA256);
10892 statement.clearParameters();
10893 statement.setString(1, sha256Hash.toLowerCase());
10894 statement.setLong(2,
id);
10895 connection.executeUpdate(statement);
10896 }
catch (SQLException ex) {
10897 throw new TskCoreException(
"Error setting SHA256 hash", ex);
10913 String getSha256ImageHash(Image img)
throws TskCoreException {
10914 long id = img.getId();
10915 CaseDbConnection connection = null;
10916 ResultSet rs = null;
10920 connection = connections.getConnection();
10922 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_SHA256);
10923 statement.clearParameters();
10924 statement.setLong(1,
id);
10925 rs = connection.executeQuery(statement);
10927 hash = rs.getString(
"sha256");
10930 }
catch (SQLException ex) {
10931 throw new TskCoreException(
"Error setting SHA256 hash", ex);
10933 closeResultSet(rs);
10934 closeConnection(connection);
10947 void setAcquisitionDetails(DataSource datasource, String details)
throws TskCoreException {
10949 long id = datasource.getId();
10951 try (CaseDbConnection connection = connections.getConnection();) {
10952 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ACQUISITION_DETAILS);
10953 statement.clearParameters();
10954 statement.setString(1, details);
10955 statement.setLong(2,
id);
10956 connection.executeUpdate(statement);
10957 }
catch (SQLException ex) {
10958 throw new TskCoreException(
"Error setting acquisition details", ex);
10975 void setAcquisitionToolDetails(DataSource datasource, String name, String version, String settings)
throws TskCoreException {
10977 long id = datasource.getId();
10979 try (CaseDbConnection connection = connections.getConnection();) {
10980 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ACQUISITION_TOOL_SETTINGS);
10981 statement.clearParameters();
10982 statement.setString(1, settings);
10983 statement.setString(2, name);
10984 statement.setString(3, version);
10985 statement.setLong(4,
id);
10986 connection.executeUpdate(statement);
10987 }
catch (SQLException ex) {
10988 throw new TskCoreException(
"Error setting acquisition details", ex);
11003 void setAcquisitionDetails(
long dataSourceId, String details, CaseDbTransaction trans)
throws TskCoreException {
11005 CaseDbConnection connection = trans.getConnection();
11006 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ACQUISITION_DETAILS);
11007 statement.clearParameters();
11008 statement.setString(1, details);
11009 statement.setLong(2, dataSourceId);
11010 connection.executeUpdate(statement);
11011 }
catch (SQLException ex) {
11012 throw new TskCoreException(
"Error setting acquisition details", ex);
11025 String getAcquisitionDetails(DataSource datasource)
throws TskCoreException {
11026 long id = datasource.getId();
11027 CaseDbConnection connection = null;
11028 ResultSet rs = null;
11032 connection = connections.getConnection();
11034 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ACQUISITION_DETAILS);
11035 statement.clearParameters();
11036 statement.setLong(1,
id);
11037 rs = connection.executeQuery(statement);
11039 hash = rs.getString(
"acquisition_details");
11042 }
catch (SQLException ex) {
11043 throw new TskCoreException(
"Error setting acquisition details", ex);
11045 closeResultSet(rs);
11046 closeConnection(connection);
11061 String getDataSourceInfoString(DataSource datasource, String columnName)
throws TskCoreException {
11062 long id = datasource.getId();
11063 CaseDbConnection connection = null;
11064 ResultSet rs = null;
11065 String returnValue =
"";
11068 connection = connections.getConnection();
11070 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ACQUISITION_TOOL_SETTINGS);
11071 statement.clearParameters();
11072 statement.setLong(1,
id);
11073 rs = connection.executeQuery(statement);
11075 returnValue = rs.getString(columnName);
11077 return returnValue;
11078 }
catch (SQLException ex) {
11079 throw new TskCoreException(
"Error setting acquisition details", ex);
11081 closeResultSet(rs);
11082 closeConnection(connection);
11097 Long getDataSourceInfoLong(DataSource datasource, String columnName)
throws TskCoreException {
11098 long id = datasource.getId();
11099 CaseDbConnection connection = null;
11100 ResultSet rs = null;
11101 Long returnValue = null;
11104 connection = connections.getConnection();
11106 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ACQUISITION_TOOL_SETTINGS);
11107 statement.clearParameters();
11108 statement.setLong(1,
id);
11109 rs = connection.executeQuery(statement);
11111 returnValue = rs.getLong(columnName);
11113 return returnValue;
11114 }
catch (SQLException ex) {
11115 throw new TskCoreException(
"Error setting acquisition details", ex);
11117 closeResultSet(rs);
11118 closeConnection(connection);
11134 if (newStatus == null) {
11138 try (CaseDbConnection connection = connections.getConnection();
11139 Statement statement = connection.createStatement();) {
11140 connection.executeUpdate(statement,
"UPDATE blackboard_artifacts "
11141 +
" SET review_status_id=" + newStatus.getID()
11142 +
" WHERE blackboard_artifacts.artifact_id = " + artifact.
getArtifactID());
11143 }
catch (SQLException ex) {
11144 throw new TskCoreException(
"Error setting review status", ex);
11161 CaseDbConnection connection = null;
11162 Statement s = null;
11163 ResultSet rs = null;
11166 connection = connections.getConnection();
11167 s = connection.createStatement();
11168 Short contentShort = contentType.getValue();
11169 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE meta_type = '" + contentShort.toString() +
"'");
11172 count = rs.getInt(
"count");
11175 }
catch (SQLException ex) {
11176 throw new TskCoreException(
"Error getting number of objects.", ex);
11178 closeResultSet(rs);
11180 closeConnection(connection);
11194 String escapedText = null;
11195 if (text != null) {
11196 escapedText = text.replaceAll(
"'",
"''");
11198 return escapedText;
11209 if (md5Hash == null) {
11210 return Collections.<AbstractFile>emptyList();
11213 CaseDbConnection connection = null;
11214 Statement s = null;
11215 ResultSet rs = null;
11218 connection = connections.getConnection();
11219 s = connection.createStatement();
11220 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE "
11221 +
" md5 = '" + md5Hash.toLowerCase() +
"' "
11223 return resultSetToAbstractFiles(rs, connection);
11224 }
catch (SQLException | TskCoreException ex) {
11225 logger.log(Level.WARNING,
"Error querying database.", ex);
11227 closeResultSet(rs);
11229 closeConnection(connection);
11232 return Collections.<AbstractFile>emptyList();
11242 boolean allFilesAreHashed =
false;
11244 CaseDbConnection connection = null;
11245 Statement s = null;
11246 ResultSet rs = null;
11249 connection = connections.getConnection();
11250 s = connection.createStatement();
11251 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
11253 +
"AND md5 IS NULL "
11254 +
"AND size > '0'");
11255 if (rs.next() && rs.getInt(
"count") == 0) {
11256 allFilesAreHashed =
true;
11258 }
catch (SQLException | TskCoreException ex) {
11259 logger.log(Level.WARNING,
"Failed to query whether all files have MD5 hashes", ex);
11261 closeResultSet(rs);
11263 closeConnection(connection);
11266 return allFilesAreHashed;
11278 CaseDbConnection connection = null;
11279 Statement s = null;
11280 ResultSet rs = null;
11282 connection = connections.getConnection();
11283 s = connection.createStatement();
11284 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
11285 +
"WHERE md5 IS NOT NULL "
11286 +
"AND size > '0'");
11288 count = rs.getInt(
"count");
11290 }
catch (SQLException | TskCoreException ex) {
11291 logger.log(Level.WARNING,
"Failed to query for all the files.", ex);
11293 closeResultSet(rs);
11295 closeConnection(connection);
11311 CaseDbConnection connection = null;
11312 ResultSet resultSet = null;
11315 connection = connections.getConnection();
11318 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES);
11319 resultSet = connection.executeQuery(statement);
11320 ArrayList<TagName> tagNames =
new ArrayList<>();
11321 while (resultSet.next()) {
11322 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11324 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank")));
11327 }
catch (SQLException ex) {
11328 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
11330 closeResultSet(resultSet);
11331 closeConnection(connection);
11347 CaseDbConnection connection = null;
11348 ResultSet resultSet = null;
11351 connection = connections.getConnection();
11354 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE);
11355 resultSet = connection.executeQuery(statement);
11356 ArrayList<TagName> tagNames =
new ArrayList<>();
11357 while (resultSet.next()) {
11358 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11360 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank")));
11363 }
catch (SQLException ex) {
11364 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
11366 closeResultSet(resultSet);
11367 closeConnection(connection);
11386 ArrayList<TagName> tagNames =
new ArrayList<>();
11392 CaseDbConnection connection = null;
11393 ResultSet resultSet = null;
11396 connection = connections.getConnection();
11398 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE_BY_DATASOURCE);
11399 statement.setLong(1, dsObjId);
11400 statement.setLong(2, dsObjId);
11401 resultSet = connection.executeQuery(statement);
11402 while (resultSet.next()) {
11403 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11405 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank")));
11408 }
catch (SQLException ex) {
11409 throw new TskCoreException(
"Failed to get tag names in use for data source objID : " + dsObjId, ex);
11411 closeResultSet(resultSet);
11412 closeConnection(connection);
11431 @SuppressWarnings(
"deprecation")
11485 PreparedStatement statement = trans.getConnection().getPreparedStatement(PREPARED_STATEMENT.DELETE_CONTENT_TAG);
11486 statement.clearParameters();
11487 statement.setLong(1, tag.getId());
11488 trans.getConnection().executeUpdate(statement);
11491 Long contentId = tag.getContent() != null ? tag.getContent().getId() : null;
11492 Long dataSourceId = tag.getContent() != null && tag.getContent().getDataSource() != null
11493 ? tag.getContent().getDataSource().getId()
11496 this.
getScoringManager().updateAggregateScoreAfterDeletion(contentId, dataSourceId, trans);
11500 }
catch (SQLException ex) {
11501 throw new TskCoreException(
"Error deleting row from content_tags table (id = " + tag.getId() +
")", ex);
11503 if (trans != null) {
11518 CaseDbConnection connection = null;
11519 ResultSet resultSet = null;
11522 connection = connections.getConnection();
11528 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS);
11529 resultSet = connection.executeQuery(statement);
11530 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
11531 while (resultSet.next()) {
11532 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11534 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
11536 tags.add(
new ContentTag(resultSet.getLong(
"tag_id"), content, tagName, resultSet.getString(
"comment"),
11537 resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name")));
11540 }
catch (SQLException ex) {
11541 throw new TskCoreException(
"Error selecting rows from content_tags table", ex);
11543 closeResultSet(resultSet);
11544 closeConnection(connection);
11560 if (tagName.getId() ==
Tag.ID_NOT_SET) {
11561 throw new TskCoreException(
"TagName object is invalid, id not set");
11563 CaseDbConnection connection = null;
11564 ResultSet resultSet = null;
11567 connection = connections.getConnection();
11570 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME);
11571 statement.clearParameters();
11572 statement.setLong(1, tagName.getId());
11573 resultSet = connection.executeQuery(statement);
11574 if (resultSet.next()) {
11575 return resultSet.getLong(
"count");
11577 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
11579 }
catch (SQLException ex) {
11580 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
11582 closeResultSet(resultSet);
11583 closeConnection(connection);
11605 if (tagName.getId() ==
Tag.ID_NOT_SET) {
11606 throw new TskCoreException(
"TagName object is invalid, id not set");
11609 CaseDbConnection connection = null;
11610 ResultSet resultSet = null;
11613 connection = connections.getConnection();
11618 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
11619 statement.clearParameters();
11620 statement.setLong(1, tagName.getId());
11621 statement.setLong(2, dsObjId);
11623 resultSet = connection.executeQuery(statement);
11624 if (resultSet.next()) {
11625 return resultSet.getLong(
"count");
11627 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")" +
" for dsObjId = " + dsObjId);
11629 }
catch (SQLException ex) {
11630 throw new TskCoreException(
"Failed to get content_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
11632 closeResultSet(resultSet);
11633 closeConnection(connection);
11650 CaseDbConnection connection = null;
11651 ResultSet resultSet = null;
11655 connection = connections.getConnection();
11662 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAG_BY_ID);
11663 statement.clearParameters();
11664 statement.setLong(1, contentTagID);
11665 resultSet = connection.executeQuery(statement);
11667 while (resultSet.next()) {
11668 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11670 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
11672 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
11676 }
catch (SQLException ex) {
11677 throw new TskCoreException(
"Error getting content tag with id = " + contentTagID, ex);
11679 closeResultSet(resultSet);
11680 closeConnection(connection);
11698 if (tagName.getId() ==
Tag.ID_NOT_SET) {
11699 throw new TskCoreException(
"TagName object is invalid, id not set");
11701 CaseDbConnection connection = null;
11702 ResultSet resultSet = null;
11705 connection = connections.getConnection();
11711 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME);
11712 statement.clearParameters();
11713 statement.setLong(1, tagName.getId());
11714 resultSet = connection.executeQuery(statement);
11715 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
11716 while (resultSet.next()) {
11718 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
11723 }
catch (SQLException ex) {
11724 throw new TskCoreException(
"Error getting content_tags rows (tag_name_id = " + tagName.getId() +
")", ex);
11726 closeResultSet(resultSet);
11727 closeConnection(connection);
11746 CaseDbConnection connection = null;
11747 ResultSet resultSet = null;
11750 connection = connections.getConnection();
11758 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
11759 statement.clearParameters();
11760 statement.setLong(1, tagName.getId());
11761 statement.setLong(2, dsObjId);
11762 resultSet = connection.executeQuery(statement);
11763 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
11764 while (resultSet.next()) {
11766 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
11771 }
catch (SQLException ex) {
11772 throw new TskCoreException(
"Failed to get content_tags row count for tag_name_id = " + tagName.getId() +
" data source objID : " + dsObjId, ex);
11774 closeResultSet(resultSet);
11775 closeConnection(connection);
11792 CaseDbConnection connection = null;
11793 ResultSet resultSet = null;
11796 connection = connections.getConnection();
11803 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_CONTENT);
11804 statement.clearParameters();
11805 statement.setLong(1, content.getId());
11806 resultSet = connection.executeQuery(statement);
11807 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
11808 while (resultSet.next()) {
11809 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11811 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
11813 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
11817 }
catch (SQLException ex) {
11818 throw new TskCoreException(
"Error getting content tags data for content (obj_id = " + content.getId() +
")", ex);
11820 closeResultSet(resultSet);
11821 closeConnection(connection);
11854 PreparedStatement statement = trans.getConnection().getPreparedStatement(PREPARED_STATEMENT.DELETE_ARTIFACT_TAG);
11855 statement.clearParameters();
11856 statement.setLong(1, tag.getId());
11857 trans.getConnection().executeUpdate(statement);
11860 Long artifactObjId = tag.getArtifact().getId();
11861 Long dataSourceId = tag.getContent() != null && tag.getContent().getDataSource() != null
11862 ? tag.getContent().getDataSource().getId()
11865 this.
getScoringManager().updateAggregateScoreAfterDeletion(artifactObjId, dataSourceId, trans);
11869 }
catch (SQLException ex) {
11870 throw new TskCoreException(
"Error deleting row from blackboard_artifact_tags table (id = " + tag.getId() +
")", ex);
11872 if (trans != null) {
11888 CaseDbConnection connection = null;
11889 ResultSet resultSet = null;
11892 connection = connections.getConnection();
11898 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS);
11899 resultSet = connection.executeQuery(statement);
11900 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<>();
11901 while (resultSet.next()) {
11902 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11904 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
11908 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
11912 }
catch (SQLException ex) {
11913 throw new TskCoreException(
"Error selecting rows from blackboard_artifact_tags table", ex);
11915 closeResultSet(resultSet);
11916 closeConnection(connection);
11932 if (tagName.getId() ==
Tag.ID_NOT_SET) {
11933 throw new TskCoreException(
"TagName object is invalid, id not set");
11935 CaseDbConnection connection = null;
11936 ResultSet resultSet = null;
11939 connection = connections.getConnection();
11942 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME);
11943 statement.clearParameters();
11944 statement.setLong(1, tagName.getId());
11945 resultSet = connection.executeQuery(statement);
11946 if (resultSet.next()) {
11947 return resultSet.getLong(
"count");
11949 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
11951 }
catch (SQLException ex) {
11952 throw new TskCoreException(
"Error getting blackboard artifact_content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
11954 closeResultSet(resultSet);
11955 closeConnection(connection);
11976 if (tagName.getId() ==
Tag.ID_NOT_SET) {
11977 throw new TskCoreException(
"TagName object is invalid, id not set");
11980 CaseDbConnection connection = null;
11981 ResultSet resultSet = null;
11984 connection = connections.getConnection();
11989 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME_BY_DATASOURCE);
11990 statement.clearParameters();
11991 statement.setLong(1, tagName.getId());
11992 statement.setLong(2, dsObjId);
11993 resultSet = connection.executeQuery(statement);
11994 if (resultSet.next()) {
11995 return resultSet.getLong(
"count");
11997 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() +
")" +
" for dsObjId = " + dsObjId);
11999 }
catch (SQLException ex) {
12000 throw new TskCoreException(
"Failed to get blackboard_artifact_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
12002 closeResultSet(resultSet);
12003 closeConnection(connection);
12020 if (tagName.getId() ==
Tag.ID_NOT_SET) {
12021 throw new TskCoreException(
"TagName object is invalid, id not set");
12023 CaseDbConnection connection = null;
12024 ResultSet resultSet = null;
12027 connection = connections.getConnection();
12033 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME);
12034 statement.clearParameters();
12035 statement.setLong(1, tagName.getId());
12036 resultSet = connection.executeQuery(statement);
12037 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
12038 while (resultSet.next()) {
12042 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
12046 }
catch (SQLException ex) {
12047 throw new TskCoreException(
"Error getting blackboard artifact tags data (tag_name_id = " + tagName.getId() +
")", ex);
12049 closeResultSet(resultSet);
12050 closeConnection(connection);
12071 if (tagName.getId() ==
Tag.ID_NOT_SET) {
12072 throw new TskCoreException(
"TagName object is invalid, id not set");
12075 CaseDbConnection connection = null;
12076 ResultSet resultSet = null;
12079 connection = connections.getConnection();
12087 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
12088 statement.clearParameters();
12089 statement.setLong(1, tagName.getId());
12090 statement.setLong(2, dsObjId);
12091 resultSet = connection.executeQuery(statement);
12092 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
12093 while (resultSet.next()) {
12097 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
12101 }
catch (SQLException ex) {
12102 throw new TskCoreException(
"Failed to get blackboard_artifact_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
12104 closeResultSet(resultSet);
12105 closeConnection(connection);
12124 CaseDbConnection connection = null;
12125 ResultSet resultSet = null;
12129 connection = connections.getConnection();
12136 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAG_BY_ID);
12137 statement.clearParameters();
12138 statement.setLong(1, artifactTagID);
12139 resultSet = connection.executeQuery(statement);
12141 while (resultSet.next()) {
12142 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
12144 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
12148 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
12152 }
catch (SQLException ex) {
12153 throw new TskCoreException(
"Error getting blackboard artifact tag with id = " + artifactTagID, ex);
12155 closeResultSet(resultSet);
12156 closeConnection(connection);
12175 CaseDbConnection connection = null;
12176 ResultSet resultSet = null;
12179 connection = connections.getConnection();
12186 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_ARTIFACT);
12187 statement.clearParameters();
12188 statement.setLong(1, artifact.getArtifactID());
12189 resultSet = connection.executeQuery(statement);
12190 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<>();
12191 while (resultSet.next()) {
12192 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
12194 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
12197 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
12201 }
catch (SQLException ex) {
12202 throw new TskCoreException(
"Error getting blackboard artifact tags data (artifact_id = " + artifact.getArtifactID() +
")", ex);
12204 closeResultSet(resultSet);
12205 closeConnection(connection);
12220 try (CaseDbConnection connection = connections.getConnection();) {
12222 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_PATH);
12223 statement.clearParameters();
12224 statement.setString(1, newPath);
12225 statement.setLong(2, objectId);
12226 connection.executeUpdate(statement);
12227 }
catch (SQLException ex) {
12228 throw new TskCoreException(
"Error updating image path in database for object " + objectId, ex);
12247 public Report addReport(String localPath, String sourceModuleName, String reportName)
throws TskCoreException {
12248 return addReport(localPath, sourceModuleName, reportName, null);
12269 String relativePath =
"";
12270 long createTime = 0;
12271 String localPathLower = localPath.toLowerCase();
12273 if (localPathLower.startsWith(
"http")) {
12274 relativePath = localPathLower;
12275 createTime = System.currentTimeMillis() / 1000;
12286 int length =
new File(casePathLower).toURI().relativize(
new File(localPathLower).toURI()).getPath().length();
12287 relativePath =
new File(localPath.substring(localPathLower.length() - length)).getPath();
12288 }
catch (IllegalArgumentException ex) {
12289 String errorMessage = String.format(
"Local path %s not in the database directory or one of its subdirectories", localPath);
12290 throw new TskCoreException(errorMessage, ex);
12294 java.io.File tempFile =
new java.io.File(localPath);
12296 createTime = tempFile.lastModified() / 1000;
12297 }
catch (Exception ex) {
12298 throw new TskCoreException(
"Could not get create time for report at " + localPath, ex);
12304 try (CaseDbConnection connection = connections.getConnection();) {
12307 long parentObjId = 0;
12308 if (parent != null) {
12309 parentObjId = parent.getId();
12314 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_REPORT);
12315 statement.clearParameters();
12316 statement.setLong(1, objectId);
12317 statement.setString(2, relativePath);
12318 statement.setLong(3, createTime);
12319 statement.setString(4, sourceModuleName);
12320 statement.setString(5, reportName);
12321 connection.executeUpdate(statement);
12322 return new Report(
this, objectId, localPath, createTime, sourceModuleName, reportName, parent);
12323 }
catch (SQLException ex) {
12324 throw new TskCoreException(
"Error adding report " + localPath +
" to reports table", ex);
12339 CaseDbConnection connection = null;
12340 ResultSet resultSet = null;
12341 ResultSet parentResultSet = null;
12342 PreparedStatement statement = null;
12343 Statement parentStatement = null;
12346 connection = connections.getConnection();
12349 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_REPORTS);
12350 parentStatement = connection.createStatement();
12351 resultSet = connection.executeQuery(statement);
12352 ArrayList<Report> reports =
new ArrayList<Report>();
12353 while (resultSet.next()) {
12354 String localpath = resultSet.getString(
"path");
12355 if (localpath.toLowerCase().startsWith(
"http") ==
false) {
12357 localpath = Paths.get(
getDbDirPath(), localpath).normalize().toString();
12362 long reportId = resultSet.getLong(
"obj_id");
12363 String parentQuery = String.format(
"SELECT * FROM tsk_objects WHERE obj_id = %s;", reportId);
12364 parentResultSet = parentStatement.executeQuery(parentQuery);
12365 if (parentResultSet.next()) {
12366 long parentId = parentResultSet.getLong(
"par_obj_id");
12369 parentResultSet.close();
12371 reports.add(
new Report(
this,
12374 resultSet.getLong(
"crtime"),
12375 resultSet.getString(
"src_module_name"),
12376 resultSet.getString(
"report_name"),
12380 }
catch (SQLException ex) {
12381 throw new TskCoreException(
"Error querying reports table", ex);
12383 closeResultSet(resultSet);
12384 closeResultSet(parentResultSet);
12385 closeStatement(statement);
12386 closeStatement(parentStatement);
12388 closeConnection(connection);
12403 CaseDbConnection connection = null;
12404 PreparedStatement statement = null;
12405 Statement parentStatement = null;
12406 ResultSet resultSet = null;
12407 ResultSet parentResultSet = null;
12411 connection = connections.getConnection();
12414 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_REPORT_BY_ID);
12415 parentStatement = connection.createStatement();
12416 statement.clearParameters();
12417 statement.setLong(1,
id);
12418 resultSet = connection.executeQuery(statement);
12420 if (resultSet.next()) {
12423 String parentQuery = String.format(
"SELECT * FROM tsk_objects WHERE obj_id = %s;",
id);
12424 parentResultSet = parentStatement.executeQuery(parentQuery);
12425 if (parentResultSet.next()) {
12426 long parentId = parentResultSet.getLong(
"par_obj_id");
12430 report =
new Report(
this, resultSet.getLong(
"obj_id"),
12431 Paths.get(
getDbDirPath(), resultSet.getString(
"path")).normalize().toString(),
12432 resultSet.getLong(
"crtime"),
12433 resultSet.getString(
"src_module_name"),
12434 resultSet.getString(
"report_name"),
12437 throw new TskCoreException(
"No report found for id: " +
id);
12439 }
catch (SQLException ex) {
12440 throw new TskCoreException(
"Error querying reports table for id: " +
id, ex);
12442 closeResultSet(resultSet);
12443 closeResultSet(parentResultSet);
12444 closeStatement(statement);
12445 closeStatement(parentStatement);
12446 closeConnection(connection);
12462 try (CaseDbConnection connection = connections.getConnection();) {
12464 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_REPORT);
12465 statement.setLong(1, report.getId());
12466 connection.executeUpdate(statement);
12468 statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_REPORT_TSK_OBJECT);
12469 statement.setLong(1, report.getId());
12471 connection.executeUpdate(statement);
12472 }
catch (SQLException ex) {
12473 throw new TskCoreException(
"Error querying reports table", ex);
12479 static void closeResultSet(ResultSet resultSet) {
12480 if (resultSet != null) {
12483 }
catch (SQLException ex) {
12484 logger.log(Level.SEVERE,
"Error closing ResultSet", ex);
12489 static void closeStatement(Statement statement) {
12490 if (statement != null) {
12493 }
catch (SQLException ex) {
12494 logger.log(Level.SEVERE,
"Error closing Statement", ex);
12500 static void closeConnection(CaseDbConnection connection) {
12501 if (connection != null) {
12502 connection.close();
12506 private static void rollbackTransaction(CaseDbConnection connection) {
12507 if (connection != null) {
12508 connection.rollbackTransaction();
12520 void setIngestJobEndDateTime(
long ingestJobId,
long endDateTime)
throws TskCoreException {
12522 try (CaseDbConnection connection = connections.getConnection();) {
12523 Statement statement = connection.createStatement();
12524 statement.executeUpdate(
"UPDATE ingest_jobs SET end_date_time=" + endDateTime +
" WHERE ingest_job_id=" + ingestJobId +
";");
12525 }
catch (SQLException ex) {
12526 throw new TskCoreException(
"Error updating the end date (ingest_job_id = " + ingestJobId +
".", ex);
12532 void setIngestJobStatus(
long ingestJobId, IngestJobStatusType status)
throws TskCoreException {
12534 try (CaseDbConnection connection = connections.getConnection();
12535 Statement statement = connection.createStatement();) {
12536 statement.executeUpdate(
"UPDATE ingest_jobs SET status_id=" + status.ordinal() +
" WHERE ingest_job_id=" + ingestJobId +
";");
12537 }
catch (SQLException ex) {
12538 throw new TskCoreException(
"Error ingest job status (ingest_job_id = " + ingestJobId +
".", ex);
12561 CaseDbConnection connection = null;
12563 ResultSet resultSet = null;
12564 Statement statement;
12566 connection = connections.getConnection();
12567 connection.beginTransaction();
12568 statement = connection.createStatement();
12569 PreparedStatement insertStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INGEST_JOB, Statement.RETURN_GENERATED_KEYS);
12570 insertStatement.setLong(1, dataSource.getId());
12571 insertStatement.setString(2, hostName);
12572 insertStatement.setLong(3, jobStart.getTime());
12573 insertStatement.setLong(4, jobEnd.getTime());
12574 insertStatement.setInt(5, status.ordinal());
12575 insertStatement.setString(6, settingsDir);
12576 connection.executeUpdate(insertStatement);
12577 resultSet = insertStatement.getGeneratedKeys();
12579 long id = resultSet.getLong(1);
12580 for (
int i = 0; i < ingestModules.size(); i++) {
12582 statement.executeUpdate(
"INSERT INTO ingest_job_modules (ingest_job_id, ingest_module_id, pipeline_position) "
12583 +
"VALUES (" +
id +
", " + ingestModule.
getIngestModuleId() +
", " + i +
");");
12587 connection.commitTransaction();
12588 return new IngestJobInfo(
id, dataSource.getId(), hostName, jobStart,
"", ingestModules,
this);
12589 }
catch (SQLException ex) {
12590 rollbackTransaction(connection);
12591 throw new TskCoreException(
"Error adding the ingest job.", ex);
12593 closeResultSet(resultSet);
12594 closeConnection(connection);
12613 CaseDbConnection connection = null;
12614 ResultSet resultSet = null;
12615 Statement statement = null;
12616 String uniqueName = factoryClassName +
"-" + displayName +
"-" + version;
12619 connection = connections.getConnection();
12620 statement = connection.createStatement();
12621 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
12622 if (!resultSet.next()) {
12625 PreparedStatement insertStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INGEST_MODULE, Statement.RETURN_GENERATED_KEYS);
12626 insertStatement.setString(1, displayName);
12627 insertStatement.setString(2, uniqueName);
12628 insertStatement.setInt(3, type.ordinal());
12629 insertStatement.setString(4, version);
12630 connection.executeUpdate(insertStatement);
12631 resultSet = statement.getGeneratedKeys();
12633 long id = resultSet.getLong(1);
12638 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
12639 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version"));
12641 }
catch (SQLException ex) {
12643 closeStatement(statement);
12644 if (connection != null) {
12645 statement = connection.createStatement();
12646 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
12647 if (resultSet.next()) {
12648 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
12652 throw new TskCoreException(
"Couldn't add new module to database.", ex);
12653 }
catch (SQLException ex1) {
12654 throw new TskCoreException(
"Couldn't add new module to database.", ex1);
12657 closeResultSet(resultSet);
12658 closeStatement(statement);
12659 closeConnection(connection);
12672 CaseDbConnection connection = null;
12673 ResultSet resultSet = null;
12674 Statement statement = null;
12675 List<IngestJobInfo> ingestJobs =
new ArrayList<>();
12678 connection = connections.getConnection();
12679 statement = connection.createStatement();
12680 resultSet = statement.executeQuery(
"SELECT * FROM ingest_jobs");
12681 while (resultSet.next()) {
12682 ingestJobs.add(
new IngestJobInfo(resultSet.getInt(
"ingest_job_id"), resultSet.getLong(
"obj_id"),
12683 resultSet.getString(
"host_name"),
new Date(resultSet.getLong(
"start_date_time")),
12685 resultSet.getString(
"settings_dir"), this.getIngestModules(resultSet.getInt(
"ingest_job_id"), connection),
this));
12688 }
catch (SQLException ex) {
12689 throw new TskCoreException(
"Couldn't get the ingest jobs.", ex);
12691 closeResultSet(resultSet);
12692 closeStatement(statement);
12693 closeConnection(connection);
12708 private List<IngestModuleInfo> getIngestModules(
int ingestJobId, CaseDbConnection connection)
throws SQLException {
12709 ResultSet resultSet = null;
12710 Statement statement = null;
12711 List<IngestModuleInfo> ingestModules =
new ArrayList<>();
12714 statement = connection.createStatement();
12715 resultSet = statement.executeQuery(
"SELECT ingest_job_modules.ingest_module_id AS ingest_module_id, "
12716 +
"ingest_job_modules.pipeline_position AS pipeline_position, "
12717 +
"ingest_modules.display_name AS display_name, ingest_modules.unique_name AS unique_name, "
12718 +
"ingest_modules.type_id AS type_id, ingest_modules.version AS version "
12719 +
"FROM ingest_job_modules, ingest_modules "
12720 +
"WHERE ingest_job_modules.ingest_job_id = " + ingestJobId +
" "
12721 +
"AND ingest_modules.ingest_module_id = ingest_job_modules.ingest_module_id "
12722 +
"ORDER BY (ingest_job_modules.pipeline_position);");
12723 while (resultSet.next()) {
12724 ingestModules.add(
new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
12725 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version")));
12727 return ingestModules;
12729 closeResultSet(resultSet);
12730 closeStatement(statement);
12745 String getInsertOrIgnoreSQL(String sql) {
12748 return " INSERT " + sql +
" ON CONFLICT DO NOTHING ";
12750 return " INSERT OR IGNORE " + sql;
12752 throw new UnsupportedOperationException(
"Unsupported DB type: " +
getDatabaseType().name());
12776 private List<? extends BlackboardArtifact> getArtifactsForValues(BlackboardArtifact.Category category, String dbColumn, List<? extends Number> values, CaseDbConnection connection)
throws TskCoreException {
12780 for (Number value : values) {
12781 if (!where.isEmpty()) {
12784 where += dbColumn +
" = " + value;
12789 if (category == BlackboardArtifact.Category.DATA_ARTIFACT) {
12799 static class ObjectInfo {
12802 private TskData.ObjectType type;
12804 ObjectInfo(
long id, ObjectType type) {
12813 TskData.ObjectType getType() {
12818 private interface DbCommand {
12820 void execute() throws SQLException;
12823 private enum PREPARED_STATEMENT {
12825 SELECT_ARTIFACTS_BY_TYPE(
"SELECT artifact_id, obj_id FROM blackboard_artifacts "
12826 +
"WHERE artifact_type_id = ?"),
12827 COUNT_ARTIFACTS_OF_TYPE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
12828 COUNT_ARTIFACTS_OF_TYPE_BY_DATA_SOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE data_source_obj_id = ? AND artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
12829 COUNT_ARTIFACTS_FROM_SOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE obj_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
12830 COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE obj_id = ? AND artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
12831 SELECT_FILES_BY_PARENT(
"SELECT tsk_files.* "
12832 +
"FROM tsk_objects INNER JOIN tsk_files "
12833 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
12834 +
"WHERE (tsk_objects.par_obj_id = ? ) "
12835 +
"ORDER BY tsk_files.meta_type DESC, LOWER(tsk_files.name)"),
12836 SELECT_FILES_BY_PARENT_AND_TYPE(
"SELECT tsk_files.* "
12837 +
"FROM tsk_objects INNER JOIN tsk_files "
12838 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
12839 +
"WHERE (tsk_objects.par_obj_id = ? AND tsk_files.type = ? ) "
12840 +
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"),
12841 SELECT_FILES_BY_PARENT_AND_NAME(
"SELECT tsk_files.* "
12842 +
"FROM tsk_objects INNER JOIN tsk_files "
12843 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
12844 +
"WHERE (tsk_objects.par_obj_id = ? AND "
12845 +
"LOWER(tsk_files.name) LIKE LOWER(?) AND LOWER(tsk_files.name) NOT LIKE LOWER('%journal%')) "
12846 +
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"),
12847 SELECT_FILES_BY_EXTENSION_AND_PARENT_AND_NAME(
"SELECT tsk_files.* "
12848 +
"FROM tsk_objects INNER JOIN tsk_files "
12849 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
12850 +
"WHERE tsk_files.extension = ? AND "
12851 +
"(tsk_objects.par_obj_id = ? AND "
12852 +
"LOWER(tsk_files.name) LIKE LOWER(?) AND LOWER(tsk_files.name) NOT LIKE LOWER('%journal%')) "
12853 +
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"),
12854 SELECT_FILE_IDS_BY_PARENT(
"SELECT tsk_files.obj_id AS obj_id "
12855 +
"FROM tsk_objects INNER JOIN tsk_files "
12856 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
12857 +
"WHERE (tsk_objects.par_obj_id = ?)"),
12858 SELECT_FILE_IDS_BY_PARENT_AND_TYPE(
"SELECT tsk_files.obj_id AS obj_id "
12859 +
"FROM tsk_objects INNER JOIN tsk_files "
12860 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
12861 +
"WHERE (tsk_objects.par_obj_id = ? "
12862 +
"AND tsk_files.type = ? )"),
12863 SELECT_FILE_BY_ID(
"SELECT * FROM tsk_files WHERE obj_id = ? LIMIT 1"),
12864 SELECT_ARTIFACT_BY_ARTIFACT_OBJ_ID(
"SELECT * FROM blackboard_artifacts WHERE artifact_obj_id = ? LIMIT 1"),
12865 SELECT_ARTIFACT_TYPE_BY_ARTIFACT_OBJ_ID(
"SELECT artifact_type_id FROM blackboard_artifacts WHERE artifact_obj_id = ? LIMIT 1"),
12866 SELECT_ARTIFACT_BY_ARTIFACT_ID(
"SELECT * FROM blackboard_artifacts WHERE artifact_id = ? LIMIT 1"),
12867 INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, review_status_id) "
12868 +
"VALUES (?, ?, ?, ?, ?," + BlackboardArtifact.ReviewStatus.UNDECIDED.getID() +
")"),
12869 POSTGRESQL_INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, review_status_id) "
12870 +
"VALUES (DEFAULT, ?, ?, ?, ?," + BlackboardArtifact.ReviewStatus.UNDECIDED.getID() +
")"),
12871 INSERT_ANALYSIS_RESULT(
"INSERT INTO tsk_analysis_results (artifact_obj_id, conclusion, significance, priority, configuration, justification) "
12872 +
"VALUES (?, ?, ?, ?, ?, ?)"),
12873 INSERT_STRING_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_text) "
12874 +
"VALUES (?,?,?,?,?,?,?)"),
12875 INSERT_BYTE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_byte) "
12876 +
"VALUES (?,?,?,?,?,?,?)"),
12877 INSERT_INT_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int32) "
12878 +
"VALUES (?,?,?,?,?,?,?)"),
12879 INSERT_LONG_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int64) "
12880 +
"VALUES (?,?,?,?,?,?,?)"),
12881 INSERT_DOUBLE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_double) "
12882 +
"VALUES (?,?,?,?,?,?,?)"),
12883 INSERT_FILE_ATTRIBUTE(
"INSERT INTO tsk_file_attributes (obj_id, attribute_type_id, value_type, value_byte, value_text, value_int32, value_int64, value_double) "
12884 +
"VALUES (?,?,?,?,?,?,?,?)"),
12885 SELECT_FILES_BY_DATA_SOURCE_AND_NAME(
"SELECT * FROM tsk_files WHERE LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND data_source_obj_id = ?"),
12886 SELECT_FILES_BY_EXTENSION_AND_DATA_SOURCE_AND_NAME(
"SELECT * FROM tsk_files WHERE extension = ? AND LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND data_source_obj_id = ?"),
12887 SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME(
"SELECT * FROM tsk_files WHERE LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND LOWER(parent_path) LIKE LOWER(?) AND data_source_obj_id = ?"),
12888 SELECT_FILES_BY_EXTENSION_AND_DATA_SOURCE_AND_PARENT_PATH_AND_NAME(
"SELECT * FROM tsk_files WHERE extension = ? AND LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND LOWER(parent_path) LIKE LOWER(?) AND data_source_obj_id = ?"),
12889 UPDATE_FILE_MD5(
"UPDATE tsk_files SET md5 = ? WHERE obj_id = ?"),
12890 UPDATE_IMAGE_MD5(
"UPDATE tsk_image_info SET md5 = ? WHERE obj_id = ?"),
12891 UPDATE_IMAGE_SHA1(
"UPDATE tsk_image_info SET sha1 = ? WHERE obj_id = ?"),
12892 UPDATE_IMAGE_SHA256(
"UPDATE tsk_image_info SET sha256 = ? WHERE obj_id = ?"),
12893 SELECT_IMAGE_MD5(
"SELECT md5 FROM tsk_image_info WHERE obj_id = ?"),
12894 SELECT_IMAGE_SHA1(
"SELECT sha1 FROM tsk_image_info WHERE obj_id = ?"),
12895 SELECT_IMAGE_SHA256(
"SELECT sha256 FROM tsk_image_info WHERE obj_id = ?"),
12896 UPDATE_ACQUISITION_DETAILS(
"UPDATE data_source_info SET acquisition_details = ? WHERE obj_id = ?"),
12897 UPDATE_ACQUISITION_TOOL_SETTINGS(
"UPDATE data_source_info SET acquisition_tool_settings = ?, acquisition_tool_name = ?, acquisition_tool_version = ? WHERE obj_id = ?"),
12898 SELECT_ACQUISITION_DETAILS(
"SELECT acquisition_details FROM data_source_info WHERE obj_id = ?"),
12899 SELECT_ACQUISITION_TOOL_SETTINGS(
"SELECT acquisition_tool_settings, acquisition_tool_name, acquisition_tool_version, added_date_time FROM data_source_info WHERE obj_id = ?"),
12900 SELECT_LOCAL_PATH_FOR_FILE(
"SELECT path FROM tsk_files_path WHERE obj_id = ?"),
12901 SELECT_ENCODING_FOR_FILE(
"SELECT encoding_type FROM tsk_files_path WHERE obj_id = ?"),
12902 SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE(
"SELECT path, encoding_type FROM tsk_files_path WHERE obj_id = ?"),
12903 SELECT_PATH_FOR_FILE(
"SELECT parent_path FROM tsk_files WHERE obj_id = ?"),
12904 SELECT_FILE_NAME(
"SELECT name FROM tsk_files WHERE obj_id = ?"),
12905 SELECT_DERIVED_FILE(
"SELECT derived_id, rederive FROM tsk_files_derived WHERE obj_id = ?"),
12906 SELECT_FILE_DERIVATION_METHOD(
"SELECT tool_name, tool_version, other FROM tsk_files_derived_method WHERE derived_id = ?"),
12907 SELECT_MAX_OBJECT_ID(
"SELECT MAX(obj_id) AS max_obj_id FROM tsk_objects"),
12908 INSERT_OBJECT(
"INSERT INTO tsk_objects (par_obj_id, type) VALUES (?, ?)"),
12909 INSERT_FILE(
"INSERT INTO tsk_files (obj_id, fs_obj_id, name, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, md5, sha256, sha1, known, mime_type, parent_path, data_source_obj_id, extension, owner_uid, os_account_obj_id) "
12910 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
12911 INSERT_FILE_SYSTEM_FILE(
"INSERT INTO tsk_files(obj_id, fs_obj_id, data_source_obj_id, attr_type, attr_id, name, meta_addr, meta_seq, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, md5, sha256, sha1, mime_type, parent_path, extension, owner_uid, os_account_obj_id)"
12912 +
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
12913 UPDATE_DERIVED_FILE(
"UPDATE tsk_files SET type = ?, dir_type = ?, meta_type = ?, dir_flags = ?, meta_flags = ?, size= ?, ctime= ?, crtime= ?, atime= ?, mtime= ?, mime_type = ? "
12914 +
"WHERE obj_id = ?"),
12915 INSERT_LAYOUT_FILE(
"INSERT INTO tsk_file_layout (obj_id, byte_start, byte_len, sequence) "
12916 +
"VALUES (?, ?, ?, ?)"),
12917 INSERT_LOCAL_PATH(
"INSERT INTO tsk_files_path (obj_id, path, encoding_type) VALUES (?, ?, ?)"),
12918 UPDATE_LOCAL_PATH(
"UPDATE tsk_files_path SET path = ?, encoding_type = ? WHERE obj_id = ?"),
12919 COUNT_CHILD_OBJECTS_BY_PARENT(
"SELECT COUNT(obj_id) AS count FROM tsk_objects WHERE par_obj_id = ?"),
12920 SELECT_FILE_SYSTEM_BY_OBJECT(
"SELECT fs_obj_id from tsk_files WHERE obj_id=?"),
12921 SELECT_TAG_NAMES(
"SELECT * FROM tag_names"),
12922 SELECT_TAG_NAMES_IN_USE(
"SELECT * FROM tag_names "
12923 +
"WHERE tag_name_id IN "
12924 +
"(SELECT tag_name_id from content_tags UNION SELECT tag_name_id FROM blackboard_artifact_tags)"),
12925 SELECT_TAG_NAMES_IN_USE_BY_DATASOURCE(
"SELECT * FROM tag_names "
12926 +
"WHERE tag_name_id IN "
12927 +
"( SELECT content_tags.tag_name_id as tag_name_id "
12928 +
"FROM content_tags as content_tags, tsk_files as tsk_files"
12929 +
" WHERE content_tags.obj_id = tsk_files.obj_id"
12930 +
" AND tsk_files.data_source_obj_id = ?"
12932 +
"SELECT artifact_tags.tag_name_id as tag_name_id "
12933 +
" FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts "
12934 +
" WHERE artifact_tags.artifact_id = arts.artifact_id"
12935 +
" AND arts.data_source_obj_id = ?"
12937 INSERT_TAG_NAME(
"INSERT INTO tag_names (display_name, description, color, knownStatus) VALUES (?, ?, ?, ?)"),
12938 INSERT_CONTENT_TAG(
"INSERT INTO content_tags (obj_id, tag_name_id, comment, begin_byte_offset, end_byte_offset, examiner_id) VALUES (?, ?, ?, ?, ?, ?)"),
12939 DELETE_CONTENT_TAG(
"DELETE FROM content_tags WHERE tag_id = ?"),
12940 COUNT_CONTENT_TAGS_BY_TAG_NAME(
"SELECT COUNT(*) AS count FROM content_tags WHERE tag_name_id = ?"),
12941 COUNT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
12942 "SELECT COUNT(*) AS count FROM content_tags as content_tags, tsk_files as tsk_files WHERE content_tags.obj_id = tsk_files.obj_id"
12943 +
" AND content_tags.tag_name_id = ? "
12944 +
" AND tsk_files.data_source_obj_id = ? "
12946 SELECT_CONTENT_TAGS(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
12947 +
"FROM content_tags "
12948 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
12949 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id"),
12950 SELECT_CONTENT_TAGS_BY_TAG_NAME(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tsk_examiners.login_name "
12951 +
"FROM content_tags "
12952 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
12953 +
"WHERE tag_name_id = ?"),
12954 SELECT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id "
12955 +
"FROM content_tags as content_tags, tsk_files as tsk_files, tag_names as tag_names, tsk_examiners as tsk_examiners "
12956 +
"WHERE content_tags.examiner_id = tsk_examiners.examiner_id"
12957 +
" AND content_tags.obj_id = tsk_files.obj_id"
12958 +
" AND content_tags.tag_name_id = tag_names.tag_name_id"
12959 +
" AND content_tags.tag_name_id = ?"
12960 +
" AND tsk_files.data_source_obj_id = ? "),
12961 SELECT_CONTENT_TAG_BY_ID(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
12962 +
"FROM content_tags "
12963 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
12964 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
12965 +
"WHERE tag_id = ?"),
12966 SELECT_CONTENT_TAGS_BY_CONTENT(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
12967 +
"FROM content_tags "
12968 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
12969 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
12970 +
"WHERE content_tags.obj_id = ?"),
12971 INSERT_ARTIFACT_TAG(
"INSERT INTO blackboard_artifact_tags (artifact_id, tag_name_id, comment, examiner_id) "
12972 +
"VALUES (?, ?, ?, ?)"),
12973 DELETE_ARTIFACT_TAG(
"DELETE FROM blackboard_artifact_tags WHERE tag_id = ?"),
12974 SELECT_ARTIFACT_TAGS(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tag_names.tag_set_id, tsk_examiners.login_name, tag_names.rank "
12975 +
"FROM blackboard_artifact_tags "
12976 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
12977 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id"),
12978 COUNT_ARTIFACTS_BY_TAG_NAME(
"SELECT COUNT(*) AS count FROM blackboard_artifact_tags WHERE tag_name_id = ?"),
12979 COUNT_ARTIFACTS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts WHERE artifact_tags.artifact_id = arts.artifact_id"
12980 +
" AND artifact_tags.tag_name_id = ?"
12981 +
" AND arts.data_source_obj_id = ? "),
12982 SELECT_ARTIFACT_TAGS_BY_TAG_NAME(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tsk_examiners.login_name "
12983 +
"FROM blackboard_artifact_tags "
12984 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
12985 +
"WHERE tag_name_id = ?"),
12986 SELECT_ARTIFACT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT artifact_tags.tag_id, artifact_tags.artifact_id, artifact_tags.tag_name_id, artifact_tags.comment, arts.obj_id, arts.artifact_obj_id, arts.data_source_obj_id, arts.artifact_type_id, arts.review_status_id, tsk_examiners.login_name "
12987 +
"FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts, tsk_examiners AS tsk_examiners "
12988 +
"WHERE artifact_tags.examiner_id = tsk_examiners.examiner_id"
12989 +
" AND artifact_tags.artifact_id = arts.artifact_id"
12990 +
" AND artifact_tags.tag_name_id = ? "
12991 +
" AND arts.data_source_obj_id = ? "),
12992 SELECT_ARTIFACT_TAG_BY_ID(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
12993 +
"FROM blackboard_artifact_tags "
12994 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
12995 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
12996 +
"WHERE blackboard_artifact_tags.tag_id = ?"),
12997 SELECT_ARTIFACT_TAGS_BY_ARTIFACT(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
12998 +
"FROM blackboard_artifact_tags "
12999 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
13000 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
13001 +
"WHERE blackboard_artifact_tags.artifact_id = ?"),
13002 SELECT_REPORTS(
"SELECT * FROM reports"),
13003 SELECT_REPORT_BY_ID(
"SELECT * FROM reports WHERE obj_id = ?"),
13004 INSERT_REPORT(
"INSERT INTO reports (obj_id, path, crtime, src_module_name, report_name) VALUES (?, ?, ?, ?, ?)"),
13005 DELETE_REPORT(
"DELETE FROM reports WHERE reports.obj_id = ?"),
13006 DELETE_REPORT_TSK_OBJECT(
"DELETE FROM tsk_objects where tsk_objects.obj_id = ? and tsk_objects.type = ?"),
13007 INSERT_INGEST_JOB(
"INSERT INTO ingest_jobs (obj_id, host_name, start_date_time, end_date_time, status_id, settings_dir) VALUES (?, ?, ?, ?, ?, ?)"),
13008 INSERT_INGEST_MODULE(
"INSERT INTO ingest_modules (display_name, unique_name, type_id, version) VALUES(?, ?, ?, ?)"),
13009 SELECT_ATTR_BY_VALUE_BYTE(
"SELECT source FROM blackboard_attributes WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
13010 UPDATE_ATTR_BY_VALUE_BYTE(
"UPDATE blackboard_attributes SET source = ? WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
13011 UPDATE_IMAGE_PATH(
"UPDATE tsk_image_names SET name = ? WHERE obj_id = ?"),
13012 SELECT_ARTIFACT_OBJECTIDS_BY_PARENT(
"SELECT blackboard_artifacts.artifact_obj_id AS artifact_obj_id "
13013 +
"FROM tsk_objects INNER JOIN blackboard_artifacts "
13014 +
"ON tsk_objects.obj_id=blackboard_artifacts.obj_id "
13015 +
"WHERE (tsk_objects.par_obj_id = ?)"),
13016 SELECT_EXAMINER_BY_ID(
"SELECT * FROM tsk_examiners WHERE examiner_id = ?"),
13017 SELECT_EXAMINER_BY_LOGIN_NAME(
"SELECT * FROM tsk_examiners WHERE login_name = ?"),
13018 INSERT_EXAMINER_POSTGRESQL(
"INSERT INTO tsk_examiners (login_name) VALUES (?) ON CONFLICT DO NOTHING"),
13019 INSERT_EXAMINER_SQLITE(
"INSERT OR IGNORE INTO tsk_examiners (login_name) VALUES (?)"),
13020 UPDATE_FILE_NAME(
"UPDATE tsk_files SET name = ? WHERE obj_id = ?"),
13021 UPDATE_IMAGE_NAME(
"UPDATE tsk_image_info SET display_name = ? WHERE obj_id = ?"),
13022 UPDATE_IMAGE_SIZES(
"UPDATE tsk_image_info SET size = ?, ssize = ? WHERE obj_id = ?"),
13023 DELETE_IMAGE_NAME(
"DELETE FROM tsk_image_names WHERE obj_id = ?"),
13024 INSERT_IMAGE_NAME(
"INSERT INTO tsk_image_names (obj_id, name, sequence) VALUES (?, ?, ?)"),
13025 INSERT_IMAGE_INFO(
"INSERT INTO tsk_image_info (obj_id, type, ssize, tzone, size, md5, sha1, sha256, display_name)"
13026 +
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"),
13027 INSERT_DATA_SOURCE_INFO(
"INSERT INTO data_source_info (obj_id, device_id, time_zone, added_date_time, host_id) VALUES (?, ?, ?, ?, ?)"),
13028 INSERT_VS_INFO(
"INSERT INTO tsk_vs_info (obj_id, vs_type, img_offset, block_size) VALUES (?, ?, ?, ?)"),
13029 INSERT_VS_PART_SQLITE(
"INSERT INTO tsk_vs_parts (obj_id, addr, start, length, desc, flags) VALUES (?, ?, ?, ?, ?, ?)"),
13030 INSERT_VS_PART_POSTGRESQL(
"INSERT INTO tsk_vs_parts (obj_id, addr, start, length, descr, flags) VALUES (?, ?, ?, ?, ?, ?)"),
13031 INSERT_POOL_INFO(
"INSERT INTO tsk_pool_info (obj_id, pool_type) VALUES (?, ?)"),
13032 INSERT_FS_INFO(
"INSERT INTO tsk_fs_info (obj_id, data_source_obj_id, img_offset, fs_type, block_size, block_count, root_inum, first_inum, last_inum, display_name)"
13033 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
13034 SELECT_TAG_NAME_BY_ID(
"SELECT * FROM tag_names where tag_name_id = ?");
13036 private final String sql;
13038 private PREPARED_STATEMENT(String sql) {
13052 abstract private class ConnectionPool {
13054 private PooledDataSource pooledDataSource;
13056 public ConnectionPool() {
13057 pooledDataSource = null;
13060 CaseDbConnection getConnection() throws TskCoreException {
13061 if (pooledDataSource == null) {
13062 throw new TskCoreException(
"Error getting case database connection - case is closed");
13065 return getPooledConnection();
13066 }
catch (SQLException exp) {
13067 throw new TskCoreException(exp.getMessage());
13071 void close() throws TskCoreException {
13072 if (pooledDataSource != null) {
13074 pooledDataSource.close();
13075 }
catch (SQLException exp) {
13076 throw new TskCoreException(exp.getMessage());
13078 pooledDataSource = null;
13083 abstract CaseDbConnection getPooledConnection() throws SQLException;
13085 public PooledDataSource getPooledDataSource() {
13086 return pooledDataSource;
13089 public void setPooledDataSource(PooledDataSource pooledDataSource) {
13090 this.pooledDataSource = pooledDataSource;
13098 private final class SQLiteConnections
extends ConnectionPool {
13100 private final Map<String, String> configurationOverrides =
new HashMap<String, String>();
13102 SQLiteConnections(String dbPath)
throws SQLException {
13103 configurationOverrides.put(
"acquireIncrement",
"2");
13104 configurationOverrides.put(
"initialPoolSize",
"5");
13105 configurationOverrides.put(
"minPoolSize",
"5");
13110 configurationOverrides.put(
"maxPoolSize",
"20");
13111 configurationOverrides.put(
"maxStatements",
"200");
13112 configurationOverrides.put(
"maxStatementsPerConnection",
"20");
13114 SQLiteConfig config =
new SQLiteConfig();
13115 config.setSynchronous(SQLiteConfig.SynchronousMode.OFF);
13116 config.setReadUncommited(
true);
13117 config.enforceForeignKeys(
true);
13118 SQLiteDataSource unpooled =
new SQLiteDataSource(config);
13119 unpooled.setUrl(
"jdbc:sqlite:" + dbPath);
13120 setPooledDataSource((PooledDataSource) DataSources.pooledDataSource(unpooled, configurationOverrides));
13124 public CaseDbConnection getPooledConnection() throws SQLException {
13126 if (CaseDbTransaction.hasOpenTransaction(Thread.currentThread().getId())) {
13128 if (!Thread.currentThread().getName().contains(
"ImageGallery")) {
13129 logger.log(Level.WARNING, String.format(
"Thread %s (ID = %d) already has an open transaction. New connection may encounter SQLITE_BUSY error. ", Thread.currentThread().getName(), Thread.currentThread().getId()),
new Throwable());
13132 return new SQLiteConnection(getPooledDataSource().getConnection());
13140 private final class PostgreSQLConnections
extends ConnectionPool {
13142 PostgreSQLConnections(String host,
int port, String dbName, String userName, String password)
throws PropertyVetoException, UnsupportedEncodingException {
13143 ComboPooledDataSource comboPooledDataSource =
new ComboPooledDataSource();
13144 comboPooledDataSource.setDriverClass(
"org.postgresql.Driver");
13145 comboPooledDataSource.setJdbcUrl(
"jdbc:postgresql://" + host +
":" + port +
"/"
13146 + URLEncoder.encode(dbName, StandardCharsets.UTF_8.toString()));
13147 comboPooledDataSource.setUser(userName);
13148 comboPooledDataSource.setPassword(password);
13149 comboPooledDataSource.setAcquireIncrement(2);
13150 comboPooledDataSource.setInitialPoolSize(5);
13151 comboPooledDataSource.setMinPoolSize(5);
13156 comboPooledDataSource.setMaxPoolSize(20);
13157 comboPooledDataSource.setMaxStatements(200);
13158 comboPooledDataSource.setMaxStatementsPerConnection(20);
13159 setPooledDataSource(comboPooledDataSource);
13163 public CaseDbConnection getPooledConnection() throws SQLException {
13164 return new PostgreSQLConnection(getPooledDataSource().getConnection());
13171 abstract class CaseDbConnection
implements AutoCloseable {
13173 static final int SLEEP_LENGTH_IN_MILLISECONDS = 5000;
13174 static final int MAX_RETRIES = 20;
13176 private class CreateStatement
implements DbCommand {
13178 private final Connection connection;
13179 private Statement statement = null;
13181 CreateStatement(Connection connection) {
13182 this.connection = connection;
13185 Statement getStatement() {
13190 public void execute() throws SQLException {
13191 statement = connection.createStatement();
13195 private class SetAutoCommit
implements DbCommand {
13197 private final Connection connection;
13198 private final boolean mode;
13200 SetAutoCommit(Connection connection,
boolean mode) {
13201 this.connection = connection;
13206 public void execute() throws SQLException {
13207 connection.setAutoCommit(mode);
13211 private class Commit
implements DbCommand {
13213 private final Connection connection;
13215 Commit(Connection connection) {
13216 this.connection = connection;
13220 public void execute() throws SQLException {
13221 connection.commit();
13233 private class AggregateScoreTablePostgreSQLWriteLock
implements DbCommand {
13235 private final Connection connection;
13237 AggregateScoreTablePostgreSQLWriteLock(Connection connection) {
13238 this.connection = connection;
13242 public void execute() throws SQLException {
13243 PreparedStatement preparedStatement = connection.prepareStatement(
"LOCK TABLE ONLY tsk_aggregate_score in SHARE ROW EXCLUSIVE MODE");
13244 preparedStatement.execute();
13249 private class ExecuteQuery
implements DbCommand {
13251 private final Statement statement;
13252 private final String query;
13253 private ResultSet resultSet;
13255 ExecuteQuery(Statement statement, String query) {
13256 this.statement = statement;
13257 this.query = query;
13260 ResultSet getResultSet() {
13265 public void execute() throws SQLException {
13266 resultSet = statement.executeQuery(query);
13270 private class ExecutePreparedStatementQuery
implements DbCommand {
13272 private final PreparedStatement preparedStatement;
13273 private ResultSet resultSet;
13275 ExecutePreparedStatementQuery(PreparedStatement preparedStatement) {
13276 this.preparedStatement = preparedStatement;
13279 ResultSet getResultSet() {
13284 public void execute() throws SQLException {
13285 resultSet = preparedStatement.executeQuery();
13289 private class ExecutePreparedStatementUpdate
implements DbCommand {
13291 private final PreparedStatement preparedStatement;
13293 ExecutePreparedStatementUpdate(PreparedStatement preparedStatement) {
13294 this.preparedStatement = preparedStatement;
13298 public void execute() throws SQLException {
13299 preparedStatement.executeUpdate();
13303 private class ExecuteStatementUpdate
implements DbCommand {
13305 private final Statement statement;
13306 private final String updateCommand;
13308 ExecuteStatementUpdate(Statement statement, String updateCommand) {
13309 this.statement = statement;
13310 this.updateCommand = updateCommand;
13314 public void execute() throws SQLException {
13315 statement.executeUpdate(updateCommand);
13319 private class ExecuteStatementUpdateGenerateKeys
implements DbCommand {
13321 private final Statement statement;
13322 private final int generateKeys;
13323 private final String updateCommand;
13325 ExecuteStatementUpdateGenerateKeys(Statement statement, String updateCommand,
int generateKeys) {
13326 this.statement = statement;
13327 this.generateKeys = generateKeys;
13328 this.updateCommand = updateCommand;
13332 public void execute() throws SQLException {
13333 statement.executeUpdate(updateCommand, generateKeys);
13337 private class PrepareStatement
implements DbCommand {
13339 private final Connection connection;
13340 private final String input;
13341 private PreparedStatement preparedStatement = null;
13343 PrepareStatement(Connection connection, String input) {
13344 this.connection = connection;
13345 this.input = input;
13348 PreparedStatement getPreparedStatement() {
13349 return preparedStatement;
13353 public void execute() throws SQLException {
13354 preparedStatement = connection.prepareStatement(input);
13358 private class PrepareStatementGenerateKeys
implements DbCommand {
13360 private final Connection connection;
13361 private final String input;
13362 private final int generateKeys;
13363 private PreparedStatement preparedStatement = null;
13365 PrepareStatementGenerateKeys(Connection connection, String input,
int generateKeysInput) {
13366 this.connection = connection;
13367 this.input = input;
13368 this.generateKeys = generateKeysInput;
13371 PreparedStatement getPreparedStatement() {
13372 return preparedStatement;
13376 public void execute() throws SQLException {
13377 preparedStatement = connection.prepareStatement(input, generateKeys);
13381 abstract void executeCommand(DbCommand command)
throws SQLException;
13383 private final Connection connection;
13384 private final Map<PREPARED_STATEMENT, PreparedStatement> preparedStatements;
13385 private final Map<String, PreparedStatement> adHocPreparedStatements;
13387 CaseDbConnection(Connection connection) {
13388 this.connection = connection;
13389 preparedStatements =
new EnumMap<PREPARED_STATEMENT, PreparedStatement>(PREPARED_STATEMENT.class);
13390 adHocPreparedStatements =
new HashMap<>();
13394 return this.connection != null;
13397 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey)
throws SQLException {
13398 return getPreparedStatement(statementKey, Statement.NO_GENERATED_KEYS);
13401 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey,
int generateKeys)
throws SQLException {
13403 PreparedStatement statement;
13404 if (this.preparedStatements.containsKey(statementKey)) {
13405 statement = this.preparedStatements.get(statementKey);
13407 statement = prepareStatement(statementKey.getSQL(), generateKeys);
13408 this.preparedStatements.put(statementKey, statement);
13424 PreparedStatement getPreparedStatement(String sqlStatement,
int generateKeys)
throws SQLException {
13425 PreparedStatement statement;
13426 String statementKey =
"SQL:" + sqlStatement +
" Key:" + generateKeys;
13427 if (adHocPreparedStatements.containsKey(statementKey) && !adHocPreparedStatements.get(statementKey).isClosed()) {
13428 statement = this.adHocPreparedStatements.get(statementKey);
13430 statement = prepareStatement(sqlStatement, generateKeys);
13431 this.adHocPreparedStatements.put(statementKey, statement);
13436 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
13437 PrepareStatement prepareStatement =
new PrepareStatement(this.getConnection(), sqlStatement);
13438 executeCommand(prepareStatement);
13439 return prepareStatement.getPreparedStatement();
13442 Statement createStatement() throws SQLException {
13443 CreateStatement createStatement =
new CreateStatement(this.connection);
13444 executeCommand(createStatement);
13445 return createStatement.getStatement();
13449 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
false);
13450 executeCommand(setAutoCommit);
13453 void commitTransaction() throws SQLException {
13454 Commit commit =
new Commit(connection);
13455 executeCommand(commit);
13457 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
true);
13458 executeCommand(setAutoCommit);
13466 void rollbackTransaction() {
13468 connection.rollback();
13469 }
catch (SQLException e) {
13470 logger.log(Level.SEVERE,
"Error rolling back transaction", e);
13473 connection.setAutoCommit(
true);
13474 }
catch (SQLException e) {
13475 logger.log(Level.SEVERE,
"Error restoring auto-commit", e);
13486 void rollbackTransactionWithThrow() throws SQLException {
13488 connection.rollback();
13490 connection.setAutoCommit(
true);
13502 void getAggregateScoreTableWriteLock() throws SQLException, TskCoreException {
13505 AggregateScoreTablePostgreSQLWriteLock tableWriteLock =
new AggregateScoreTablePostgreSQLWriteLock(connection);
13506 executeCommand(tableWriteLock);
13513 throw new TskCoreException(
"Unknown DB Type: " +
getDatabaseType().name());
13517 ResultSet
executeQuery(Statement statement, String query)
throws SQLException {
13518 ExecuteQuery queryCommand =
new ExecuteQuery(statement, query);
13519 executeCommand(queryCommand);
13520 return queryCommand.getResultSet();
13532 ResultSet
executeQuery(PreparedStatement statement)
throws SQLException {
13533 ExecutePreparedStatementQuery executePreparedStatementQuery =
new ExecutePreparedStatementQuery(statement);
13534 executeCommand(executePreparedStatementQuery);
13535 return executePreparedStatementQuery.getResultSet();
13538 void executeUpdate(Statement statement, String update)
throws SQLException {
13539 executeUpdate(statement, update, Statement.NO_GENERATED_KEYS);
13542 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
13543 ExecuteStatementUpdate executeStatementUpdate =
new ExecuteStatementUpdate(statement, update);
13544 executeCommand(executeStatementUpdate);
13547 void executeUpdate(PreparedStatement statement)
throws SQLException {
13548 ExecutePreparedStatementUpdate executePreparedStatementUpdate =
new ExecutePreparedStatementUpdate(statement);
13549 executeCommand(executePreparedStatementUpdate);
13556 public void close() {
13558 for (PreparedStatement stmt : preparedStatements.values()) {
13559 closeStatement(stmt);
13561 for (PreparedStatement stmt : adHocPreparedStatements.values()) {
13562 closeStatement(stmt);
13564 connection.close();
13565 }
catch (SQLException ex) {
13566 logger.log(Level.SEVERE,
"Unable to close connection to case database", ex);
13570 Connection getConnection() {
13571 return this.connection;
13578 private final class SQLiteConnection
extends CaseDbConnection {
13580 private static final int DATABASE_LOCKED_ERROR = 0;
13581 private static final int SQLITE_BUSY_ERROR = 5;
13583 SQLiteConnection(Connection conn) {
13588 void executeCommand(DbCommand command)
throws SQLException {
13589 int retryCounter = 0;
13594 }
catch (SQLException ex) {
13595 if ((ex.getErrorCode() == SQLITE_BUSY_ERROR || ex.getErrorCode() == DATABASE_LOCKED_ERROR) && retryCounter < MAX_RETRIES) {
13602 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
13603 }
catch (InterruptedException exp) {
13604 Logger.getLogger(SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
13617 private final class PostgreSQLConnection
extends CaseDbConnection {
13619 private final String COMMUNICATION_ERROR = PSQLState.COMMUNICATION_ERROR.getState();
13620 private final String SYSTEM_ERROR = PSQLState.SYSTEM_ERROR.getState();
13621 private final String UNKNOWN_STATE = PSQLState.UNKNOWN_STATE.getState();
13622 private static final int MAX_RETRIES = 3;
13624 PostgreSQLConnection(Connection conn) {
13629 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
13630 CaseDbConnection.ExecuteStatementUpdateGenerateKeys executeStatementUpdateGenerateKeys =
new CaseDbConnection.ExecuteStatementUpdateGenerateKeys(statement, update, generateKeys);
13631 executeCommand(executeStatementUpdateGenerateKeys);
13635 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
13636 CaseDbConnection.PrepareStatementGenerateKeys prepareStatementGenerateKeys =
new CaseDbConnection.PrepareStatementGenerateKeys(this.getConnection(), sqlStatement, generateKeys);
13637 executeCommand(prepareStatementGenerateKeys);
13638 return prepareStatementGenerateKeys.getPreparedStatement();
13642 void executeCommand(DbCommand command)
throws SQLException {
13643 SQLException lastException = null;
13644 for (
int retries = 0; retries < MAX_RETRIES; retries++) {
13647 lastException = null;
13649 }
catch (SQLException ex) {
13650 lastException = ex;
13651 String sqlState = ex.getSQLState();
13652 if (sqlState == null || sqlState.equals(COMMUNICATION_ERROR) || sqlState.equals(SYSTEM_ERROR) || sqlState.equals(UNKNOWN_STATE)) {
13654 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
13655 }
catch (InterruptedException exp) {
13656 Logger.getLogger(SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
13665 if (lastException != null) {
13666 throw lastException;
13704 private final CaseDbConnection connection;
13712 private Map<Long, ScoreChange> scoreChangeMap =
new HashMap<>();
13713 private List<Host> hostsAdded =
new ArrayList<>();
13714 private List<OsAccount> accountsChanged =
new ArrayList<>();
13715 private List<OsAccount> accountsAdded =
new ArrayList<>();
13717 private List<Long> deletedOsAccountObjectIds =
new ArrayList<>();
13718 private List<Long> deletedResultObjectIds =
new ArrayList<>();
13721 private static Set<Long> threadsWithOpenTransaction =
new HashSet<>();
13722 private static final Object threadsWithOpenTransactionLock =
new Object();
13725 this.sleuthkitCase = sleuthkitCase;
13728 this.connection = sleuthkitCase.getConnection();
13730 synchronized (threadsWithOpenTransactionLock) {
13731 this.connection.beginTransaction();
13732 threadsWithOpenTransaction.add(Thread.currentThread().getId());
13734 }
catch (SQLException ex) {
13736 throw new TskCoreException(
"Failed to create transaction on case database", ex);
13748 CaseDbConnection getConnection() {
13749 return this.connection;
13757 void registerScoreChange(
ScoreChange scoreChange) {
13758 scoreChangeMap.put(scoreChange.
getObjectId(), scoreChange);
13766 void registerAddedHost(
Host host) {
13767 if (host != null) {
13768 this.hostsAdded.add(host);
13777 void registerChangedOsAccount(
OsAccount account) {
13778 if (account != null) {
13779 accountsChanged.add(account);
13788 void registerDeletedOsAccount(
long osAccountObjId) {
13789 deletedOsAccountObjectIds.add(osAccountObjId);
13797 void registerAddedOsAccount(
OsAccount account) {
13798 if (account != null) {
13799 accountsAdded.add(account);
13809 void registerDeletedAnalysisResult(
long analysisResultObjId) {
13810 this.deletedResultObjectIds.add(analysisResultObjId);
13821 private static boolean hasOpenTransaction(
long threadId) {
13822 synchronized (threadsWithOpenTransactionLock) {
13823 return threadsWithOpenTransaction.contains(threadId);
13835 this.connection.commitTransaction();
13836 }
catch (SQLException ex) {
13837 throw new TskCoreException(
"Failed to commit transaction on case database", ex);
13841 if (!scoreChangeMap.isEmpty()) {
13842 Map<Long, List<ScoreChange>> changesByDataSource = scoreChangeMap.values().stream()
13844 for (Map.Entry<Long, List<ScoreChange>> entry : changesByDataSource.entrySet()) {
13848 if (!hostsAdded.isEmpty()) {
13851 if (!accountsAdded.isEmpty()) {
13854 if (!accountsChanged.isEmpty()) {
13857 if (!deletedOsAccountObjectIds.isEmpty()) {
13860 if (!deletedResultObjectIds.isEmpty()) {
13874 this.connection.rollbackTransactionWithThrow();
13875 }
catch (SQLException ex) {
13876 throw new TskCoreException(
"Case database transaction rollback failed", ex);
13887 this.connection.close();
13889 synchronized (threadsWithOpenTransactionLock) {
13890 threadsWithOpenTransaction.remove(Thread.currentThread().getId());
13906 private ResultSet resultSet;
13907 private CaseDbConnection connection;
13909 private CaseDbQuery(String query)
throws TskCoreException {
13910 this(query,
false);
13913 private CaseDbQuery(String query,
boolean allowWriteQuery)
throws TskCoreException {
13914 if (!allowWriteQuery) {
13915 if (!query.regionMatches(
true, 0,
"SELECT", 0,
"SELECT".length())) {
13916 throw new TskCoreException(
"Unsupported query: Only SELECT queries are supported.");
13922 connection = connections.getConnection();
13923 resultSet = connection.executeQuery(connection.createStatement(), query);
13924 }
catch (SQLException ex) {
13926 throw new TskCoreException(
"Error executing query: ", ex);
13927 }
catch (TskCoreException ex) {
13943 public void close() throws TskCoreException {
13945 if (resultSet != null) {
13946 final Statement statement = resultSet.getStatement();
13947 if (statement != null) {
13952 closeConnection(connection);
13953 }
catch (SQLException ex) {
13954 throw new TskCoreException(
"Error closing query: ", ex);
13970 sleuthkitCaseErrorObservers.add(observer);
13982 int i = sleuthkitCaseErrorObservers.indexOf(observer);
13984 sleuthkitCaseErrorObservers.remove(i);
13998 for (
ErrorObserver observer : sleuthkitCaseErrorObservers) {
13999 if (observer != null) {
14001 observer.receiveError(context, errorMessage);
14002 }
catch (Exception ex) {
14003 logger.log(Level.SEVERE,
"Observer client unable to receive message: {0}, {1}",
new Object[]{context, errorMessage, ex});
14035 private final String contextString;
14037 private Context(String context) {
14038 this.contextString = context;
14042 return contextString;
14046 void receiveError(String context, String errorMessage);
14060 long getDataSourceObjectId(
long objectId) {
14062 CaseDbConnection connection = connections.getConnection();
14064 return getDataSourceObjectId(connection, objectId);
14066 closeConnection(connection);
14068 }
catch (TskCoreException ex) {
14069 logger.log(Level.SEVERE,
"Error getting data source object id for a file", ex);
14085 CaseDbConnection connection = null;
14086 ResultSet rs = null;
14089 connection = connections.getConnection();
14092 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_MAX_OBJECT_ID);
14093 rs = connection.executeQuery(statement);
14096 id = rs.getLong(
"max_obj_id");
14099 }
catch (SQLException e) {
14100 throw new TskCoreException(
"Error getting last object id", e);
14102 closeResultSet(rs);
14103 closeConnection(connection);
14123 CaseDbConnection connection = null;
14124 Statement s = null;
14125 ResultSet rs = null;
14128 connection = connections.getConnection();
14129 s = connection.createStatement();
14130 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
14131 List<FsContent> results =
new ArrayList<FsContent>();
14132 List<AbstractFile> temp = resultSetToAbstractFiles(rs, connection);
14133 for (AbstractFile f : temp) {
14136 results.add((FsContent) f);
14140 }
catch (SQLException e) {
14141 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findFilesWhere().", e);
14143 closeResultSet(rs);
14145 closeConnection(connection);
14163 CaseDbConnection connection = null;
14164 Statement s = null;
14165 ResultSet rs = null;
14168 connection = connections.getConnection();
14169 s = connection.createStatement();
14170 rs = connection.executeQuery(s,
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName +
"'");
14173 typeId = rs.getInt(
"artifact_type_id");
14176 }
catch (SQLException ex) {
14177 throw new TskCoreException(
"Error getting artifact type id", ex);
14179 closeResultSet(rs);
14181 closeConnection(connection);
14214 public int addArtifactType(String artifactTypeName, String displayName)
throws TskCoreException {
14217 }
catch (TskDataException ex) {
14218 throw new TskCoreException(
"Failed to add artifact type.", ex);
14236 public int addAttrType(String attrTypeString, String displayName)
throws TskCoreException {
14239 }
catch (TskDataException ex) {
14240 throw new TskCoreException(
"Couldn't add new attribute type");
14256 CaseDbConnection connection = null;
14257 Statement s = null;
14258 ResultSet rs = null;
14261 connection = connections.getConnection();
14262 s = connection.createStatement();
14263 rs = connection.executeQuery(s,
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName +
"'");
14266 typeId = rs.getInt(
"attribute_type_id");
14269 }
catch (SQLException ex) {
14270 throw new TskCoreException(
"Error getting attribute type id", ex);
14272 closeResultSet(rs);
14274 closeConnection(connection);
14293 CaseDbConnection connection = null;
14294 Statement s = null;
14295 ResultSet rs = null;
14298 connection = connections.getConnection();
14299 s = connection.createStatement();
14300 rs = connection.executeQuery(s,
"SELECT type_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
14302 return rs.getString(
"type_name");
14304 throw new TskCoreException(
"No type with that id");
14306 }
catch (SQLException ex) {
14307 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
14309 closeResultSet(rs);
14311 closeConnection(connection);
14330 CaseDbConnection connection = null;
14331 Statement s = null;
14332 ResultSet rs = null;
14335 connection = connections.getConnection();
14336 s = connection.createStatement();
14337 rs = connection.executeQuery(s,
"SELECT display_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
14339 return rs.getString(
"display_name");
14341 throw new TskCoreException(
"No type with that id");
14343 }
catch (SQLException ex) {
14344 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
14346 closeResultSet(rs);
14348 closeConnection(connection);
14383 public ResultSet
runQuery(String query)
throws SQLException {
14384 CaseDbConnection connection = null;
14387 connection = connections.getConnection();
14388 return connection.executeQuery(connection.createStatement(), query);
14389 }
catch (TskCoreException ex) {
14390 throw new SQLException(
"Error getting connection for ad hoc query", ex);
14394 closeConnection(connection);
14410 final Statement statement = resultSet.getStatement();
14412 if (statement != null) {
14434 public LayoutFile addCarvedFile(String carvedFileName,
long carvedFileSize,
long containerId, List<TskFileRange> data)
throws TskCoreException {
14437 files.add(carvedFile);
14441 || parent instanceof
Volume
14442 || parent instanceof
Image) {
14445 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", containerId));
14464 public List<LayoutFile>
addCarvedFiles(List<CarvedFileContainer> filesToAdd)
throws TskCoreException {
14468 carvedFiles.add(carvedFile);
14473 || parent instanceof
Volume
14474 || parent instanceof
Image) {
14477 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", parent.
getId()));
14513 long size,
long ctime,
long crtime,
long atime,
long mtime,
14514 boolean isFile, AbstractFile parentFile,
14515 String rederiveDetails, String toolName, String toolVersion, String otherDetails)
throws TskCoreException {
14516 return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime,
14517 isFile, parentFile, rederiveDetails, toolName, toolVersion,
14552 long size,
long ctime,
long crtime,
long atime,
long mtime,
14553 String md5,
FileKnown known, String mimeType,
14557 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime,
14558 md5, null, known, mimeType, isFile, encodingType,
14559 parent, transaction);
14588 long size,
long ctime,
long crtime,
long atime,
long mtime,
14591 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile,
14616 long size,
long ctime,
long crtime,
long atime,
long mtime,
14618 AbstractFile parent)
throws TskCoreException {
14619 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime,
14641 return this.caseHandle.initAddImageProcess(timezone, addUnallocSpace, noFatFsOrphans,
"",
this);
14658 }
catch (TskCoreException ex) {
14659 logger.log(Level.SEVERE,
"Error loading all file systems for image with ID {0}", image.
getId());
14660 return new ArrayList<>();
14682 public List<AbstractFile>
findFiles(
Content dataSource, String fileName, AbstractFile parentFile)
throws TskCoreException {
Image addImageInfo(long deviceObjId, List< String > imageFilePaths, String timeZone, Host host)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, long value)
final IngestJobInfo addIngestJob(Content dataSource, String hostName, List< IngestModuleInfo > ingestModules, Date jobStart, Date jobEnd, IngestJobStatusType status, String settingsDir)
static Priority fromID(int id)
static ARTIFACT_TYPE fromID(int id)
FS
File that can be found in file system tree.
static FileKnown valueOf(byte known)
TagName addOrUpdateTagName(String displayName, String description, TagName.HTML_COLOR color, TskData.FileKnown knownStatus)
static Significance fromID(int id)
BlackboardArtifact getArtifactByArtifactId(long id)
AddImageProcess makeAddImageProcess(String timezone, boolean addUnallocSpace, boolean noFatFsOrphans)
BlackboardArtifact getArtifactById(long id)
List< Report > getAllReports()
ArrayList< BlackboardAttribute > getBlackboardAttributes(final BlackboardArtifact artifact)
long getBlackboardArtifactsCount(long objId)
int getArtifactTypeID(String artifactTypeName)
Host getHostByDataSource(DataSource dataSource)
long getBlackboardArtifactTagsCountByTagName(TagName tagName)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType)
LocalDirectory addLocalDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, int value)
void addBlackboardAttributes(Collection< BlackboardAttribute > attributes, int artifactTypeId)
Optional< HostAddress > getHostAddress(HostAddress.HostAddressType type, String address)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID, long obj_id)
static final Score SCORE_UNKNOWN
CommunicationsManager getCommunicationsManager()
AnalysisResult getAnalysisResultById(long artifactObjId)
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
CaseDbTransaction beginTransaction()
OsAccount getOsAccountByObjectId(long osAccountObjId)
boolean isCompatible(CaseDbSchemaVersionNumber dbSchemaVersion)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent)
ALLOC
Metadata structure is currently in an allocated state.
int countFilesMd5Hashed()
static TSK_FS_TYPE_ENUM valueOf(int fsTypeValue)
CaseDbSchemaVersionNumber getDBSchemaCreationVersion()
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID)
void addErrorObserver(ErrorObserver observer)
DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, String mimeType, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType, Content parentObj, CaseDbTransaction trans)
DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, String mimeType, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
Blackboard getBlackboard()
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
TSK_FS_META_TYPE_DIR
Directory file NON-NLS.
List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parentFile)
synchronized void close()
static Category fromID(int id)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, String sha256, String sha1Hash, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Long osAccountId, String ownerAccount, Content parent, CaseDbTransaction transaction)
TagName addOrUpdateTagName(String displayName, String description, TagName.HTML_COLOR color, TskData.FileKnown knownStatus)
void setFileMIMEType(AbstractFile file, String mimeType)
UNALLOC
Metadata structure is currently in an unallocated state.
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, long sourceObjId, Long dataSourceObjId, Collection< BlackboardAttribute > attributes, Long osAccountId)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, String sha256, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Long osAccountId, String ownerAccount, Content parent, CaseDbTransaction transaction)
void addBlackboardAttribute(BlackboardAttribute attr, int artifactTypeId)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent, CaseDbTransaction transaction)
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList)
final List< LayoutFile > addLayoutFiles(Content parent, List< TskFileRange > fileRanges)
ArrayList< BlackboardAttribute > getBlackboardAttributes(final BlackboardArtifact artifact)
int addArtifactType(String artifactTypeName, String displayName)
List< DataSource > getDataSources()
BlackboardArtifactTagChange addArtifactTag(BlackboardArtifact artifact, TagName tagName, String comment)
synchronized CaseDbAccessManager getCaseDbAccessManager()
DataArtifact getDataArtifactById(long artifactObjId)
BlackboardArtifactTag getBlackboardArtifactTagByID(long artifactTagID)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, double value)
List< AbstractFile > openFiles(Content dataSource, String filePath)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByArtifact(BlackboardArtifact artifact)
final IngestModuleInfo addIngestModule(String displayName, String factoryClassName, IngestModuleType type, String version)
long getBlackboardArtifactsCount(String artifactTypeName, long obj_id)
Content getContentById(long id)
BlackboardArtifactTag getAddedTag()
VersionNumber getDBSchemaVersion()
static IngestJobStatusType fromID(int typeId)
List< TagName > getTagNamesInUse()
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, byte value)
LAYOUT_FILE
Set of blocks from an image that have been designated as a file.
List< AbstractFile > findAllFilesInFolderWhere(long parentId, String sqlWhereClause)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, String sha256, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
static SleuthkitCase openCase(String databaseName, CaseDbConnectionInfo info, String caseDir)
static IngestModuleType fromID(int typeId)
List< ContentTag > getAllContentTags()
long getDataSourceObjectId()
List< VirtualDirectory > getVirtualDirectoryRoots()
LayoutFile addLayoutFile(String fileName, long size, TSK_FS_NAME_FLAG_ENUM dirFlag, TSK_FS_META_FLAG_ENUM metaFlag, long ctime, long crtime, long atime, long mtime, List< TskFileRange > fileRanges, Content parent)
long getBlackboardArtifactTagsCountByTagName(TagName tagName, long dsObjId)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypes()
ContentTag getContentTagByID(long contentTagID)
LOCAL
Local file that was added (not from a disk image)
HostAddressManager getHostAddressManager()
Map< Long, List< String > > getImagePaths()
List< Long > findAllFileIdsWhere(String sqlWhereClause)
synchronized TaggingManager getTaggingManager()
BlackboardArtifact getBlackboardArtifact(long artifactID)
List< BlackboardArtifact.Type > getArtifactTypesInUse()
OsAccountRealmManager getOsAccountRealmManager()
BlackboardAttribute.Type addArtifactAttributeType(String attrTypeString, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName)
AbstractFile getAbstractFileById(long id)
CARVED
Set of blocks for a file found from carving. Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS ra...
BlackboardArtifactTag addBlackboardArtifactTag(BlackboardArtifact artifact, TagName tagName, String comment)
List< AnalysisResult > getAnalysisResults(long dataSourceObjId, Integer artifactTypeID)
long countFilesWhere(String sqlWhereClause)
List< AnalysisResult > getAnalysisResultsWhere(String whereClause)
long getBlackboardArtifactsCount(ARTIFACT_TYPE artifactType, long obj_id)
FS
File System - see tsk_fs_info for more details.
Pool addPool(long parentObjId, TskData.TSK_POOL_TYPE_ENUM type, CaseDbTransaction transaction)
boolean isFileFromSource(Content dataSource, long fileId)
ArrayList< BlackboardArtifact > getMatchingArtifacts(String whereClause)
VirtualDirectory addVirtualDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypesInUse()
void deleteReport(Report report)
List< Image > getImages()
int getAttrTypeID(String attrTypeName)
synchronized BlackboardAttribute.Type getOrAddAttributeType(String typeName, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName)
Image getImageById(long id)
Report addReport(String localPath, String sourceModuleName, String reportName, Content parent)
List< Content > getChildren()
USED
Metadata structure has been allocated at least once.
void unregisterForEvents(Object listener)
LOCAL_DIR
Local directory that was added (not from a disk image)
TimelineManager getTimelineManager()
final List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
void releaseSingleUserCaseReadLock()
PersonManager getPersonManager()
FsContent addFileSystemFile(long dataSourceObjId, long fsObjId, String fileName, long metaAddr, int metaSeq, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, String md5Hash, String sha256Hash, String sha1Hash, String mimeType, boolean isFile, Content parent, String ownerUid, OsAccount osAccount, List< Attribute > fileAttributes, CaseDbTransaction transaction)
VOL
Volume - see tsk_vs_parts for more details.
void closeRunQuery(ResultSet resultSet)
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
void disableTimelineEventCreation()
int addAttrType(String attrTypeString, String displayName)
void deleteBlackboardArtifactTag(BlackboardArtifactTag tag)
long getContentTagsCountByTagName(TagName tagName, long dsObjId)
List< ContentTag > getContentTagsByTagName(TagName tagName)
BlackboardArtifact newBlackboardArtifact(int artifactTypeID, long obj_id)
static String escapeSingleQuotes(String text)
String getAttrTypeDisplayName(int attrTypeID)
List< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
void setFileUnalloc(AbstractFile file)
List< AbstractFile > findFiles(Content dataSource, String fileName)
List< AbstractFile > findFilesInFolder(String fileName, AbstractFile parentFile)
List< TagName > getAllTagNames()
HostManager getHostManager()
Report getReportById(long id)
BlackboardAttribute.Type getAttributeType(String attrTypeName)
Image addImageInfo(long deviceObjId, List< String > imageFilePaths, String timeZone)
BlackboardArtifact.Type getArtifactType(String artTypeName)
static HTML_COLOR getColorByName(String colorName)
void acquireSingleUserCaseWriteLock()
REPORT
Artifact - see blackboard_artifacts for more details.
List< AbstractFile > findFilesByMd5(String md5Hash)
OsAccountInstance newOsAccountInstance(OsAccount osAccount, DataSource dataSource, OsAccountInstance.OsAccountInstanceType instanceType)
long getBlackboardArtifactsTypeCount(int artifactTypeID, long dataSourceID)
BlackboardArtifact.Type getArtifactType(String artTypeName)
void releaseSingleUserCaseWriteLock()
DERIVED
File derived from a parent file (i.e. from ZIP)
Host newHost(String name)
List< LayoutFile > addCarvedFiles(List< CarvedFileContainer > filesToAdd)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName)
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromType(long typeId)
static SleuthkitCase newCase(String caseName, CaseDbConnectionInfo info, String caseDirPath)
Report addReport(String localPath, String sourceModuleName, String reportName)
void releaseExclusiveLock()
List< BlackboardArtifactTag > getAllBlackboardArtifactTags()
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName, long obj_id)
Image addImage(TskData.TSK_IMG_TYPE_ENUM type, long sectorSize, long size, String displayName, List< String > imagePaths, String timezone, String md5, String sha1, String sha256, String deviceId, CaseDbTransaction transaction)
void removeErrorObserver(ErrorObserver observer)
String getContextString()
List< Content > getRootObjects()
List< AbstractFile > findFiles(Content dataSource, String fileName, String dirSubString)
static short toInt(Set< TSK_FS_META_FLAG_ENUM > metaFlags)
ContentTagChange addContentTag(Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset)
FileSystem addFileSystem(long parentObjId, long imgOffset, TskData.TSK_FS_TYPE_ENUM type, long blockSize, long blockCount, long rootInum, long firstInum, long lastInum, String displayName, CaseDbTransaction transaction)
void acquireExclusiveLock()
boolean allFilesMd5Hashed()
String getAttrTypeString(int attrTypeID)
int getBlackboardAttributeTypesCount()
LayoutFile addCarvedFile(String carvedFileName, long carvedFileSize, long containerId, List< TskFileRange > data)
ArrayList< BlackboardAttribute.ATTRIBUTE_TYPE > getBlackboardAttributeTypes()
List< DataArtifact > getDataArtifactsWhere(String whereClause)
UNALLOC_BLOCKS
Set of blocks not allocated by file system. Parent should be image, volume, or file system...
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, AbstractFile parent)
AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, long objId, Long dataSourceObjId, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList)
ArrayList< BlackboardAttribute > getMatchingAttributes(String whereClause)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
long getBlackboardArtifactsTypeCount(int artifactTypeID)
List< ContentTag > getContentTagsByTagName(TagName tagName, long dsObjId)
void deleteContentTag(ContentTag tag)
AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList)
BlackboardArtifact.Type getOrAddArtifactType(String typeName, String displayName)
static ObjectType valueOf(short objectType)
Optional< String > getOwnerUid()
long getContentTagsCountByTagName(TagName tagName)
FsContent addFileSystemFile(long dataSourceObjId, long fsObjId, String fileName, long metaAddr, int metaSeq, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parent)
Optional< Long > getFileSystemObjectId()
Collection< FileSystem > getImageFileSystems(Image image)
void updateImagePath(String newPath, long objectId)
VolumeSystem addVolumeSystem(long parentObjId, TskData.TSK_VS_TYPE_ENUM type, long imgOffset, long blockSize, CaseDbTransaction transaction)
Examiner getCurrentExaminer()
LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootDirectoryName, String timeZone, Host host, CaseDbTransaction transaction)
UNKNOWN
File marked as unknown by hash db.
List< TagName > getTagNamesInUse(long dsObjId)
List< AbstractFile > findAllFilesWhere(String sqlWhereClause)
boolean setKnown(AbstractFile file, FileKnown fileKnown)
OsAccountManager getOsAccountManager()
static void tryConnect(CaseDbConnectionInfo info)
static SleuthkitCase openCase(String dbPath)
CaseDbQuery executeInsertOrUpdate(String query)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName, long dsObjId)
Volume addVolume(long parentObjId, long addr, long start, long length, String desc, long flags, CaseDbTransaction transaction)
long getBlackboardArtifactsCount(int artifactTypeID, long obj_id)
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType, CaseDbTransaction transaction)
void submitError(String context, String errorMessage)
final List< IngestJobInfo > getIngestJobs()
ALLOC
Name is in an allocated state.
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
static SleuthkitCase newCase(String dbPath)
String getBackupDatabasePath()
void acquireSingleUserCaseReadLock()
VirtualDirectory addVirtualDirectory(long parentId, String directoryName)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
List< ContentTag > getContentTagsByContent(Content content)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, long obj_id)
TagName addTagName(String displayName, String description, TagName.HTML_COLOR color)
int countFsContentType(TskData.TSK_FS_META_TYPE_ENUM contentType)
ABSTRACTFILE
File - see tsk_files for more details.
ContentTag addContentTag(Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset)
DataSource getDataSource(long objectId)
BlackboardAttribute.Type getAttributeType(String attrTypeName)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String subString, boolean startsWith)
TSK_FS_META_TYPE_REG
Regular file NON-NLS.
Iterable< BlackboardArtifact.Type > getArtifactTypes()
List< BlackboardAttribute.Type > getAttributeTypes()
LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootDirectoryName, String timeZone, CaseDbTransaction transaction)
FsContent addFileSystemFile(long dataSourceObjId, long fsObjId, String fileName, long metaAddr, int metaSeq, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, String md5Hash, String sha256Hash, String mimeType, boolean isFile, Content parent, String ownerUid, OsAccount osAccount, List< Attribute > fileAttributes, CaseDbTransaction transaction)
AddImageProcess makeAddImageProcess(String timeZone, boolean addUnallocSpace, boolean noFatFsOrphans, String imageCopyPath)
List< FsContent > findFilesWhere(String sqlWhereClause)
Long getDataSourceObjectId()
static ReviewStatus withID(int id)
void copyCaseDB(String newDBPath)
FileManager getFileManager()
Image addImage(TskData.TSK_IMG_TYPE_ENUM type, long sectorSize, long size, String displayName, List< String > imagePaths, String timezone, String md5, String sha1, String sha256, String deviceId, Host host, CaseDbTransaction transaction)
ResultSet runQuery(String query)
List< TskFileRange > getFileRanges(long id)
BlackboardArtifact.Type addBlackboardArtifactType(String artifactTypeName, String displayName)
void registerForEvents(Object listener)
CaseDbQuery executeQuery(String query)
ScoringManager getScoringManager()
void setReviewStatus(BlackboardArtifact artifact, BlackboardArtifact.ReviewStatus newStatus)
void setImagePaths(long obj_id, List< String > paths)
VS
Volume System - see tsk_vs_info for more details.
IMG
Disk Image - see tsk_image_info for more details.
UNALLOC
Name is in an unallocated state.
Collection< FileSystem > getFileSystems(Image image)
LocalDirectory addLocalDirectory(long parentId, String directoryName)
Optional< Long > getOsAccountObjectId()