19 package org.sleuthkit.datamodel;
21 import com.google.common.annotations.Beta;
22 import com.google.common.cache.Cache;
23 import com.google.common.cache.CacheBuilder;
24 import com.google.common.collect.ImmutableSet;
25 import com.google.common.eventbus.EventBus;
26 import com.mchange.v2.c3p0.ComboPooledDataSource;
27 import com.mchange.v2.c3p0.DataSources;
28 import com.mchange.v2.c3p0.PooledDataSource;
29 import com.zaxxer.sparsebits.SparseBitSet;
30 import java.beans.PropertyVetoException;
31 import java.io.BufferedInputStream;
32 import java.io.BufferedOutputStream;
34 import java.io.FileInputStream;
35 import java.io.FileOutputStream;
36 import java.io.IOException;
37 import java.io.InputStream;
38 import java.io.OutputStream;
39 import java.io.UnsupportedEncodingException;
40 import java.net.InetAddress;
41 import java.net.URLEncoder;
42 import java.nio.charset.StandardCharsets;
43 import java.nio.file.Paths;
44 import java.sql.Connection;
45 import java.sql.DriverManager;
46 import java.sql.PreparedStatement;
47 import java.sql.ResultSet;
48 import java.sql.SQLException;
49 import java.sql.Statement;
50 import java.text.SimpleDateFormat;
51 import java.util.ArrayList;
52 import java.util.Arrays;
53 import java.util.Collection;
54 import java.util.Collections;
55 import java.util.concurrent.atomic.AtomicBoolean;
56 import java.util.concurrent.atomic.AtomicInteger;
57 import java.util.Date;
58 import java.util.EnumMap;
59 import java.util.HashMap;
60 import java.util.HashSet;
61 import java.util.LinkedHashMap;
62 import java.util.List;
64 import java.util.MissingResourceException;
65 import java.util.Objects;
66 import java.util.Properties;
67 import java.util.ResourceBundle;
69 import java.util.UUID;
70 import java.util.concurrent.TimeUnit;
71 import java.util.concurrent.locks.ReentrantReadWriteLock;
72 import java.util.logging.Level;
73 import java.util.logging.Logger;
74 import java.util.stream.Collectors;
75 import org.apache.commons.lang3.StringUtils;
76 import org.postgresql.util.PSQLState;
95 import org.sqlite.SQLiteConfig;
96 import org.sqlite.SQLiteDataSource;
97 import org.sqlite.SQLiteJDBCLoader;
105 private static final int MAX_DB_NAME_LEN_BEFORE_TIMESTAMP = 47;
110 private static final long BASE_ARTIFACT_ID = Long.MIN_VALUE;
111 private static final Logger logger = Logger.getLogger(
SleuthkitCase.class.getName());
112 private static final ResourceBundle bundle = ResourceBundle.getBundle(
"org.sleuthkit.datamodel.Bundle");
113 private static final int IS_REACHABLE_TIMEOUT_MS = 1000;
114 private static final String SQL_ERROR_CONNECTION_GROUP =
"08";
115 private static final String SQL_ERROR_AUTHENTICATION_GROUP =
"28";
116 private static final String SQL_ERROR_PRIVILEGE_GROUP =
"42";
117 private static final String SQL_ERROR_RESOURCE_GROUP =
"53";
118 private static final String SQL_ERROR_LIMIT_GROUP =
"54";
119 private static final String SQL_ERROR_INTERNAL_GROUP =
"xx";
121 private static final Set<String> CORE_TABLE_NAMES = ImmutableSet.of(
123 "tsk_event_descriptions",
136 "tsk_files_derived_method",
139 "blackboard_artifact_tags",
140 "blackboard_artifacts",
141 "blackboard_attributes",
142 "blackboard_artifact_types",
143 "blackboard_attribute_types",
145 "file_encoding_types",
146 "file_collection_status_types",
147 "ingest_module_types",
148 "ingest_job_status_types",
151 "ingest_job_modules",
154 "account_relationships",
158 private static final Set<String> CORE_INDEX_NAMES = ImmutableSet.of(
162 "artifact_artifact_objID",
167 "relationships_account1",
168 "relationships_account2",
169 "relationships_relationship_source_obj_id",
170 "relationships_date_time",
171 "relationships_relationship_type",
172 "relationships_data_source_obj_id",
175 "events_data_source_obj_id",
176 "events_file_obj_id",
177 "events_artifact_id");
179 private static final String TSK_VERSION_KEY =
"TSK_VER";
180 private static final String SCHEMA_MAJOR_VERSION_KEY =
"SCHEMA_MAJOR_VERSION";
181 private static final String SCHEMA_MINOR_VERSION_KEY =
"SCHEMA_MINOR_VERSION";
182 private static final String CREATION_SCHEMA_MAJOR_VERSION_KEY =
"CREATION_SCHEMA_MAJOR_VERSION";
183 private static final String CREATION_SCHEMA_MINOR_VERSION_KEY =
"CREATION_SCHEMA_MINOR_VERSION";
185 private final ConnectionPool connections;
186 private final Object carvedFileDirsLock =
new Object();
187 private final static int MAX_CARVED_FILES_PER_FOLDER = 2000;
188 private final Map<Long, CarvedFileDirInfo> rootIdsToCarvedFileDirs =
new HashMap<>();
189 private final Map<Long, FileSystem> fileSystemIdMap =
new HashMap<>();
190 private final List<ErrorObserver> sleuthkitCaseErrorObservers =
new ArrayList<>();
191 private final String databaseName;
192 private final String dbPath;
193 private final DbType dbType;
194 private final String caseDirPath;
196 private final String caseHandleIdentifier;
197 private String dbBackupPath;
198 private AtomicBoolean timelineEventsDisabled =
new AtomicBoolean(
false);
203 private final Object rootDirectoryMapLock =
new Object();
204 private final Map<RootDirectoryKey, Long> rootDirectoryMap =
new HashMap<>();
205 private final Cache<Long, Boolean> isRootDirectoryCache
206 = CacheBuilder.newBuilder().maximumSize(200000).expireAfterAccess(5, TimeUnit.MINUTES).build();
214 private final Map<Long, SparseBitSet> hasChildrenBitSetMap =
new HashMap<>();
216 private long nextArtifactId;
221 private final ReentrantReadWriteLock rwLock =
new ReentrantReadWriteLock(
true);
236 private final Map<String, Set<Long>> deviceIdToDatasourceObjIdMap =
new HashMap<>();
238 private final EventBus eventBus =
new EventBus(
"SleuthkitCase-EventBus");
241 eventBus.register(listener);
245 eventBus.unregister(listener);
248 void fireTSKEvent(Object event) {
249 eventBus.post(event);
253 private final Map<Long, Content> frequentlyUsedContentMap =
new HashMap<>();
255 private Examiner cachedCurrentExaminer = null;
258 Properties p =
new Properties(System.getProperties());
259 p.put(
"com.mchange.v2.log.MLog",
"com.mchange.v2.log.FallbackMLog");
260 p.put(
"com.mchange.v2.log.FallbackMLog.DEFAULT_CUTOFF_LEVEL",
"SEVERE");
261 System.setProperties(p);
280 if (info.getHost() == null || info.getHost().isEmpty()) {
281 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingHostname"));
282 }
else if (info.getPort() == null || info.getPort().isEmpty()) {
283 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPort"));
284 }
else if (info.getUserName() == null || info.getUserName().isEmpty()) {
285 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingUsername"));
286 }
else if (info.getPassword() == null || info.getPassword().isEmpty()) {
287 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.MissingPassword"));
291 Class.forName(
"org.postgresql.Driver");
292 Connection conn = DriverManager.getConnection(
"jdbc:postgresql://" + info.getHost() +
":" + info.getPort() +
"/postgres", info.getUserName(), info.getPassword());
296 }
catch (SQLException ex) {
298 String sqlState = ex.getSQLState().toLowerCase();
299 if (sqlState.startsWith(SQL_ERROR_CONNECTION_GROUP)) {
301 if (InetAddress.getByName(info.getHost()).isReachable(IS_REACHABLE_TIMEOUT_MS)) {
303 result = bundle.getString(
"DatabaseConnectionCheck.Port");
305 result = bundle.getString(
"DatabaseConnectionCheck.HostnameOrPort");
307 }
catch (IOException | MissingResourceException any) {
309 result = bundle.getString(
"DatabaseConnectionCheck.Everything");
311 }
else if (sqlState.startsWith(SQL_ERROR_AUTHENTICATION_GROUP)) {
312 result = bundle.getString(
"DatabaseConnectionCheck.Authentication");
313 }
else if (sqlState.startsWith(SQL_ERROR_PRIVILEGE_GROUP)) {
314 result = bundle.getString(
"DatabaseConnectionCheck.Access");
315 }
else if (sqlState.startsWith(SQL_ERROR_RESOURCE_GROUP)) {
316 result = bundle.getString(
"DatabaseConnectionCheck.ServerDiskSpace");
317 }
else if (sqlState.startsWith(SQL_ERROR_LIMIT_GROUP)) {
318 result = bundle.getString(
"DatabaseConnectionCheck.ServerRestart");
319 }
else if (sqlState.startsWith(SQL_ERROR_INTERNAL_GROUP)) {
320 result = bundle.getString(
"DatabaseConnectionCheck.InternalServerIssue");
322 result = bundle.getString(
"DatabaseConnectionCheck.Connection");
325 }
catch (ClassNotFoundException ex) {
326 throw new TskCoreException(bundle.getString(
"DatabaseConnectionCheck.Installation"));
343 Class.forName(
"org.sqlite.JDBC");
344 this.dbPath = dbPath;
345 this.dbType = dbType;
347 this.caseDirPath = dbFile.getParentFile().getAbsolutePath();
348 this.databaseName = dbFile.
getName();
349 this.connections =
new SQLiteConnections(dbPath);
350 this.caseHandle = caseHandle;
351 this.caseHandleIdentifier = caseHandle.getCaseDbIdentifier();
352 this.contentProvider = contentProvider;
354 logSQLiteJDBCDriverInfo();
375 private SleuthkitCase(String host,
int port, String dbName, String userName, String password, SleuthkitJNI.CaseDbHandle caseHandle, String caseDirPath, DbType dbType, ContentStreamProvider contentProvider)
throws Exception {
377 this.databaseName = dbName;
378 this.dbType = dbType;
379 this.caseDirPath = caseDirPath;
380 this.connections =
new PostgreSQLConnections(host, port, dbName, userName, password);
381 this.caseHandle = caseHandle;
382 this.caseHandleIdentifier = caseHandle.getCaseDbIdentifier();
383 this.contentProvider = contentProvider;
387 private void init() throws Exception {
388 blackboard =
new Blackboard(
this);
389 updateDatabaseSchema(null);
390 try (CaseDbConnection connection = connections.getConnection()) {
391 blackboard.initBlackboardArtifactTypes(connection);
392 blackboard.initBlackboardAttributeTypes(connection);
393 initNextArtifactId(connection);
394 initIngestModuleTypes(connection);
395 initIngestStatusTypes(connection);
396 initReviewStatuses(connection);
397 initEncodingTypes(connection);
398 initCollectedStatusTypes(connection);
399 populateHasChildrenMap(connection);
400 updateExaminers(connection);
401 initDBSchemaCreationVersion(connection);
404 fileManager =
new FileManager(
this);
405 communicationsMgr =
new CommunicationsManager(
this);
406 timelineMgr =
new TimelineManager(
this);
407 dbAccessManager =
new CaseDbAccessManager(
this);
408 taggingMgr =
new TaggingManager(
this);
409 scoringManager =
new ScoringManager(
this);
410 osAccountRealmManager =
new OsAccountRealmManager(
this);
411 osAccountManager =
new OsAccountManager(
this);
412 hostManager =
new HostManager(
this);
413 personManager =
new PersonManager(
this);
414 hostAddressManager =
new HostAddressManager(
this);
424 ContentStreamProvider getContentProvider() {
425 return this.contentProvider;
433 static Set<String> getCoreTableNames() {
434 return Collections.unmodifiableSet(CORE_TABLE_NAMES);
442 static Set<String> getCoreIndexNames() {
443 return Collections.unmodifiableSet(CORE_INDEX_NAMES);
454 boolean getHasChildren(Content content) {
455 long objId = content.getId();
456 long mapIndex = objId / Integer.MAX_VALUE;
457 int mapValue = (int) (objId % Integer.MAX_VALUE);
459 synchronized (hasChildrenBitSetMap) {
460 if (hasChildrenBitSetMap.containsKey(mapIndex)) {
461 return hasChildrenBitSetMap.get(mapIndex).get(mapValue);
472 private void setHasChildren(Long objId) {
473 long mapIndex = objId / Integer.MAX_VALUE;
474 int mapValue = (int) (objId % Integer.MAX_VALUE);
476 synchronized (hasChildrenBitSetMap) {
477 if (hasChildrenBitSetMap.containsKey(mapIndex)) {
478 hasChildrenBitSetMap.get(mapIndex).set(mapValue);
480 SparseBitSet bitSet =
new SparseBitSet();
481 bitSet.set(mapValue);
482 hasChildrenBitSetMap.put(mapIndex, bitSet);
495 return communicationsMgr;
535 return dbAccessManager;
555 return scoringManager;
566 return osAccountRealmManager;
577 return osAccountManager;
599 return personManager;
610 return hostAddressManager;
622 private void initNextArtifactId(CaseDbConnection connection)
throws SQLException {
624 try (Statement statement = connection.createStatement()) {
625 ResultSet resultSet = connection.executeQuery(statement,
"SELECT MAX(artifact_id) AS max_artifact_id FROM blackboard_artifacts");
627 nextArtifactId = resultSet.getLong(
"max_artifact_id") + 1;
628 if (nextArtifactId == 1) {
629 nextArtifactId = BASE_ARTIFACT_ID;
643 private void initIngestModuleTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
644 Statement statement = null;
645 ResultSet resultSet = null;
648 statement = connection.createStatement();
649 for (IngestModuleType type : IngestModuleType.values()) {
651 String query =
"INSERT INTO ingest_module_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"')";
653 query +=
" ON CONFLICT ON CONSTRAINT ingest_module_types_pkey DO NOTHING";
655 statement.execute(query);
656 }
catch (SQLException ex) {
657 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_module_types WHERE type_id = " + type.ordinal() +
";");
659 if (resultSet.getLong(
"count") == 0) {
667 closeResultSet(resultSet);
668 closeStatement(statement);
680 private void initIngestStatusTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
681 Statement statement = null;
682 ResultSet resultSet = null;
685 statement = connection.createStatement();
686 for (IngestJobStatusType type : IngestJobStatusType.values()) {
688 String query =
"INSERT INTO ingest_job_status_types (type_id, type_name) VALUES (" + type.ordinal() +
", '" + type.toString() +
"')";
690 query +=
" ON CONFLICT ON CONSTRAINT ingest_job_status_types_pkey DO NOTHING";
692 statement.execute(query);
693 }
catch (SQLException ex) {
694 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM ingest_job_status_types WHERE type_id = " + type.ordinal() +
";");
696 if (resultSet.getLong(
"count") == 0) {
704 closeResultSet(resultSet);
705 closeStatement(statement);
716 private void initReviewStatuses(CaseDbConnection connection)
throws SQLException, TskCoreException {
717 Statement statement = null;
718 ResultSet resultSet = null;
721 statement = connection.createStatement();
722 for (BlackboardArtifact.ReviewStatus status : BlackboardArtifact.ReviewStatus.values()) {
724 String query =
"INSERT INTO review_statuses (review_status_id, review_status_name, display_name) "
725 +
"VALUES (" + status.getID() +
",'" + status.getName() +
"','" + status.getDisplayName() +
"')";
727 query +=
" ON CONFLICT ON CONSTRAINT review_statuses_pkey DO NOTHING";
729 statement.execute(query);
730 }
catch (SQLException ex) {
731 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM review_statuses WHERE review_status_id = " + status.getID());
733 if (resultSet.getLong(
"count") == 0) {
741 closeResultSet(resultSet);
742 closeStatement(statement);
754 private void initEncodingTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
755 Statement statement = null;
756 ResultSet resultSet = null;
759 statement = connection.createStatement();
760 for (TskData.EncodingType type : TskData.EncodingType.values()) {
762 String query =
"INSERT INTO file_encoding_types (encoding_type, name) VALUES (" + type.getType() +
" , '" + type.name() +
"')";
764 query +=
" ON CONFLICT ON CONSTRAINT file_encoding_types_pkey DO NOTHING";
766 statement.execute(query);
767 }
catch (SQLException ex) {
768 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM file_encoding_types WHERE encoding_type = " + type.getType());
770 if (resultSet.getLong(
"count") == 0) {
778 closeResultSet(resultSet);
779 closeStatement(statement);
791 private void initCollectedStatusTypes(CaseDbConnection connection)
throws SQLException, TskCoreException {
792 Statement statement = null;
793 ResultSet resultSet = null;
796 statement = connection.createStatement();
797 for (TskData.CollectedStatus type : TskData.CollectedStatus.values()) {
799 String query =
"INSERT INTO file_collection_status_types (collection_status_type, name) VALUES (" + type.getType() +
" , '" + type.name() +
"')";
801 query +=
" ON CONFLICT ON CONSTRAINT file_collection_status_types_pkey DO NOTHING";
803 statement.execute(query);
804 }
catch (SQLException ex) {
805 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) as count FROM file_collection_status_types WHERE collection_status_type = " + type.getType());
807 if (resultSet.getLong(
"count") == 0) {
815 closeResultSet(resultSet);
816 closeStatement(statement);
829 private void updateExaminers(CaseDbConnection connection)
throws SQLException, TskCoreException {
831 String loginName = System.getProperty(
"user.name");
832 if (loginName.isEmpty()) {
833 logger.log(Level.SEVERE,
"Cannot determine logged in user name");
839 PreparedStatement statement;
842 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_EXAMINER_POSTGRESQL);
845 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_EXAMINER_SQLITE);
848 throw new TskCoreException(
"Unknown DB Type: " +
getDatabaseType().name());
850 statement.clearParameters();
851 statement.setString(1, loginName);
852 connection.executeUpdate(statement);
853 }
catch (SQLException ex) {
854 throw new TskCoreException(
"Error inserting row in tsk_examiners. login name: " + loginName, ex);
867 private void populateHasChildrenMap(CaseDbConnection connection)
throws TskCoreException {
868 long timestamp = System.currentTimeMillis();
870 Statement statement = null;
871 ResultSet resultSet = null;
874 statement = connection.createStatement();
875 resultSet = statement.executeQuery(
"select distinct par_obj_id from tsk_objects");
877 synchronized (hasChildrenBitSetMap) {
878 while (resultSet.next()) {
879 setHasChildren(resultSet.getLong(
"par_obj_id"));
882 long delay = System.currentTimeMillis() - timestamp;
883 logger.log(Level.INFO,
"Time to initialize parent node cache: {0} ms", delay);
884 }
catch (SQLException ex) {
885 throw new TskCoreException(
"Error populating parent node cache", ex);
887 closeResultSet(resultSet);
888 closeStatement(statement);
899 void addDataSourceToHasChildrenMap() throws TskCoreException {
901 CaseDbConnection connection = connections.getConnection();
903 populateHasChildrenMap(connection);
905 closeConnection(connection);
918 private void updateDatabaseSchema(String dbPath)
throws Exception {
919 CaseDbConnection connection = null;
920 ResultSet resultSet = null;
921 Statement statement = null;
924 connection = connections.getConnection();
925 connection.beginTransaction();
927 boolean hasMinorVersion =
false;
928 ResultSet columns = connection.getConnection().getMetaData().getColumns(null, null,
"tsk_db_info",
"schema%");
929 while (columns.next()) {
930 if (columns.getString(
"COLUMN_NAME").equals(
"schema_minor_ver")) {
931 hasMinorVersion =
true;
936 int dbSchemaMajorVersion;
937 int dbSchemaMinorVersion = 0;
939 statement = connection.createStatement();
940 resultSet = connection.executeQuery(statement,
"SELECT schema_ver"
941 + (hasMinorVersion ?
", schema_minor_ver" :
"")
942 +
" FROM tsk_db_info");
943 if (resultSet.next()) {
944 dbSchemaMajorVersion = resultSet.getInt(
"schema_ver");
945 if (hasMinorVersion) {
947 dbSchemaMinorVersion = resultSet.getInt(
"schema_minor_ver");
950 throw new TskCoreException();
952 CaseDbSchemaVersionNumber dbSchemaVersion =
new CaseDbSchemaVersionNumber(dbSchemaMajorVersion, dbSchemaMinorVersion);
959 if (
false == CURRENT_DB_SCHEMA_VERSION.
isCompatible(dbSchemaVersion)) {
961 throw new TskUnsupportedSchemaVersionException(
962 "Unsupported DB schema version " + dbSchemaVersion +
", the highest supported schema version is " + CURRENT_DB_SCHEMA_VERSION.
getMajor() +
".X");
963 }
else if (dbSchemaVersion.compareTo(CURRENT_DB_SCHEMA_VERSION) < 0) {
966 if (null != dbPath) {
969 String backupFilePath = dbPath +
".schemaVer" + dbSchemaVersion.toString() +
".backup";
971 dbBackupPath = backupFilePath;
978 dbSchemaVersion = updateFromSchema2toSchema3(dbSchemaVersion, connection);
979 dbSchemaVersion = updateFromSchema3toSchema4(dbSchemaVersion, connection);
980 dbSchemaVersion = updateFromSchema4toSchema5(dbSchemaVersion, connection);
981 dbSchemaVersion = updateFromSchema5toSchema6(dbSchemaVersion, connection);
982 dbSchemaVersion = updateFromSchema6toSchema7(dbSchemaVersion, connection);
983 dbSchemaVersion = updateFromSchema7toSchema7dot1(dbSchemaVersion, connection);
984 dbSchemaVersion = updateFromSchema7dot1toSchema7dot2(dbSchemaVersion, connection);
985 dbSchemaVersion = updateFromSchema7dot2toSchema8dot0(dbSchemaVersion, connection);
986 dbSchemaVersion = updateFromSchema8dot0toSchema8dot1(dbSchemaVersion, connection);
987 dbSchemaVersion = updateFromSchema8dot1toSchema8dot2(dbSchemaVersion, connection);
988 dbSchemaVersion = updateFromSchema8dot2toSchema8dot3(dbSchemaVersion, connection);
989 dbSchemaVersion = updateFromSchema8dot3toSchema8dot4(dbSchemaVersion, connection);
990 dbSchemaVersion = updateFromSchema8dot4toSchema8dot5(dbSchemaVersion, connection);
991 dbSchemaVersion = updateFromSchema8dot5toSchema8dot6(dbSchemaVersion, connection);
992 dbSchemaVersion = updateFromSchema8dot6toSchema9dot0(dbSchemaVersion, connection);
993 dbSchemaVersion = updateFromSchema9dot0toSchema9dot1(dbSchemaVersion, connection);
994 dbSchemaVersion = updateFromSchema9dot1toSchema9dot2(dbSchemaVersion, connection);
995 dbSchemaVersion = updateFromSchema9dot2toSchema9dot3(dbSchemaVersion, connection);
996 dbSchemaVersion = updateFromSchema9dot3toSchema9dot4(dbSchemaVersion, connection);
1000 statement = connection.createStatement();
1001 connection.executeUpdate(statement,
"UPDATE tsk_db_info SET schema_ver = " + dbSchemaVersion.getMajor() +
", schema_minor_ver = " + dbSchemaVersion.getMinor());
1002 connection.executeUpdate(statement,
"UPDATE tsk_db_info_extended SET value = " + dbSchemaVersion.getMajor() +
" WHERE name = '" + SCHEMA_MAJOR_VERSION_KEY +
"'");
1003 connection.executeUpdate(statement,
"UPDATE tsk_db_info_extended SET value = " + dbSchemaVersion.getMinor() +
" WHERE name = '" + SCHEMA_MINOR_VERSION_KEY +
"'");
1008 connection.commitTransaction();
1009 }
catch (Exception ex) {
1010 rollbackTransaction(connection);
1013 closeResultSet(resultSet);
1014 closeStatement(statement);
1015 closeConnection(connection);
1027 private void initDBSchemaCreationVersion(CaseDbConnection connection)
throws SQLException {
1029 Statement statement = null;
1030 ResultSet resultSet = null;
1031 String createdSchemaMajorVersion =
"0";
1032 String createdSchemaMinorVersion =
"0";
1035 statement = connection.createStatement();
1036 resultSet = connection.executeQuery(statement,
"SELECT name, value FROM tsk_db_info_extended");
1037 while (resultSet.next()) {
1038 String name = resultSet.getString(
"name");
1039 if (name.equals(CREATION_SCHEMA_MAJOR_VERSION_KEY) || name.equals(
"CREATED_SCHEMA_MAJOR_VERSION")) {
1040 createdSchemaMajorVersion = resultSet.getString(
"value");
1041 }
else if (name.equals(CREATION_SCHEMA_MINOR_VERSION_KEY) || name.equals(
"CREATED_SCHEMA_MINOR_VERSION")) {
1042 createdSchemaMinorVersion = resultSet.getString(
"value");
1047 closeResultSet(resultSet);
1048 closeStatement(statement);
1052 caseDBSchemaCreationVersion =
new CaseDbSchemaVersionNumber(Integer.parseInt(createdSchemaMajorVersion), Integer.parseInt(createdSchemaMinorVersion));
1065 if (dbPath.isEmpty()) {
1066 throw new IOException(
"Copying case database files is not supported for this type of case database");
1068 InputStream in = null;
1069 OutputStream out = null;
1072 InputStream inFile =
new FileInputStream(dbPath);
1073 in =
new BufferedInputStream(inFile);
1074 OutputStream outFile =
new FileOutputStream(newDBPath);
1075 out =
new BufferedOutputStream(outFile);
1076 int bytesRead = in.read();
1077 while (bytesRead != -1) {
1078 out.write(bytesRead);
1079 bytesRead = in.read();
1090 }
catch (IOException e) {
1091 logger.log(Level.WARNING,
"Could not close streams after db copy", e);
1100 private void logSQLiteJDBCDriverInfo() {
1102 SleuthkitCase.logger.info(String.format(
"sqlite-jdbc version %s loaded in %s mode",
1103 SQLiteJDBCLoader.getVersion(), SQLiteJDBCLoader.isNativeMode()
1104 ?
"native" :
"pure-java"));
1105 }
catch (Exception ex) {
1106 SleuthkitCase.logger.log(Level.SEVERE,
"Error querying case database mode", ex);
1123 @SuppressWarnings(
"deprecation")
1124 private CaseDbSchemaVersionNumber updateFromSchema2toSchema3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) throws SQLException, TskCoreException {
1125 if (schemaVersion.getMajor() != 2) {
1126 return schemaVersion;
1128 Statement statement = null;
1129 Statement statement2 = null;
1130 Statement updateStatement = null;
1131 ResultSet resultSet = null;
1134 statement = connection.createStatement();
1135 statement2 = connection.createStatement();
1138 statement.execute(
"CREATE TABLE tag_names (tag_name_id INTEGER PRIMARY KEY, display_name TEXT UNIQUE, description TEXT NOT NULL, color TEXT NOT NULL)");
1139 statement.execute(
"CREATE TABLE content_tags (tag_id INTEGER PRIMARY KEY, obj_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL, begin_byte_offset INTEGER NOT NULL, end_byte_offset INTEGER NOT NULL)");
1140 statement.execute(
"CREATE TABLE blackboard_artifact_tags (tag_id INTEGER PRIMARY KEY, artifact_id INTEGER NOT NULL, tag_name_id INTEGER NOT NULL, comment TEXT NOT NULL)");
1143 statement.execute(
"CREATE TABLE reports (report_id INTEGER PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL)");
1146 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN size INTEGER;");
1147 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN md5 TEXT;");
1148 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN display_name TEXT;");
1151 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN display_name TEXT;");
1154 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN meta_seq INTEGER;");
1159 statement.execute(
"ALTER TABLE blackboard_attributes ADD COLUMN artifact_type_id INTEGER NULL NOT NULL DEFAULT -1;");
1160 statement.execute(
"CREATE INDEX attribute_artifactTypeId ON blackboard_attributes(artifact_type_id);");
1161 statement.execute(
"CREATE INDEX attribute_valueText ON blackboard_attributes(value_text);");
1162 statement.execute(
"CREATE INDEX attribute_valueInt32 ON blackboard_attributes(value_int32);");
1163 statement.execute(
"CREATE INDEX attribute_valueInt64 ON blackboard_attributes(value_int64);");
1164 statement.execute(
"CREATE INDEX attribute_valueDouble ON blackboard_attributes(value_double);");
1165 resultSet = statement.executeQuery(
"SELECT attrs.artifact_id AS artifact_id, "
1166 +
"arts.artifact_type_id AS artifact_type_id "
1167 +
"FROM blackboard_attributes AS attrs "
1168 +
"INNER JOIN blackboard_artifacts AS arts "
1169 +
"WHERE attrs.artifact_id = arts.artifact_id;");
1170 updateStatement = connection.createStatement();
1171 while (resultSet.next()) {
1172 long artifactId = resultSet.getLong(
"artifact_id");
1173 int artifactTypeId = resultSet.getInt(
"artifact_type_id");
1174 updateStatement.executeUpdate(
1175 "UPDATE blackboard_attributes "
1176 +
"SET artifact_type_id = " + artifactTypeId
1177 +
" WHERE blackboard_attributes.artifact_id = " + artifactId +
";");
1182 Map<String, Long> tagNames =
new HashMap<>();
1183 long tagNameCounter = 1;
1187 resultSet = statement.executeQuery(
"SELECT * FROM \n"
1188 +
"(SELECT blackboard_artifacts.obj_id AS objId, blackboard_attributes.artifact_id AS artifactId, blackboard_attributes.value_text AS name\n"
1189 +
"FROM blackboard_artifacts INNER JOIN blackboard_attributes \n"
1190 +
"ON blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id \n"
1191 +
"WHERE blackboard_artifacts.artifact_type_id = "
1192 + BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
1193 +
" AND blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TAG_NAME.getTypeID()
1194 +
") AS tagNames \n"
1196 +
"(SELECT tsk_files.obj_id as objId2, tsk_files.size AS fileSize \n"
1197 +
"FROM blackboard_artifacts INNER JOIN tsk_files \n"
1198 +
"ON blackboard_artifacts.obj_id = tsk_files.obj_id) AS fileData \n"
1199 +
"ON tagNames.objId = fileData.objId2 \n"
1201 +
"(SELECT value_text AS comment, artifact_id AS tagArtifactId FROM blackboard_attributes WHERE attribute_type_id = "
1202 + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID() +
") AS tagComments \n"
1203 +
"ON tagNames.artifactId = tagComments.tagArtifactId");
1205 while (resultSet.next()) {
1206 long objId = resultSet.getLong(
"objId");
1207 long fileSize = resultSet.getLong(
"fileSize");
1208 String tagName = resultSet.getString(
"name");
1209 String tagComment = resultSet.getString(
"comment");
1210 if (tagComment == null) {
1214 if (tagName != null && !tagName.isEmpty()) {
1217 if (tagNames.containsKey(tagName)) {
1218 tagNameIndex = tagNames.get(tagName);
1220 statement2.execute(
"INSERT INTO tag_names (display_name, description, color) "
1221 +
"VALUES(\"" + tagName +
"\", \"\", \"None\")");
1222 tagNames.put(tagName, tagNameCounter);
1223 tagNameIndex = tagNameCounter;
1227 statement2.execute(
"INSERT INTO content_tags (obj_id, tag_name_id, comment, begin_byte_offset, end_byte_offset) "
1228 +
"VALUES(" + objId +
", " + tagNameIndex +
", \"" + tagComment +
"\", 0, " + fileSize +
")");
1235 resultSet = statement.executeQuery(
"SELECT * FROM \n"
1236 +
"(SELECT blackboard_artifacts.obj_id AS objId, blackboard_attributes.artifact_id AS artifactId, "
1237 +
"blackboard_attributes.value_text AS name\n"
1238 +
"FROM blackboard_artifacts INNER JOIN blackboard_attributes \n"
1239 +
"ON blackboard_artifacts.artifact_id = blackboard_attributes.artifact_id \n"
1240 +
"WHERE blackboard_artifacts.artifact_type_id = "
1241 + BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID()
1242 +
" AND blackboard_attributes.attribute_type_id = " + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TAG_NAME.getTypeID()
1243 +
") AS tagNames \n"
1245 +
"(SELECT value_int64 AS taggedArtifactId, artifact_id AS associatedArtifactId FROM blackboard_attributes WHERE attribute_type_id = "
1246 + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_TAGGED_ARTIFACT.getTypeID() +
") AS tagArtifacts \n"
1247 +
"ON tagNames.artifactId = tagArtifacts.associatedArtifactId \n"
1249 +
"(SELECT value_text AS comment, artifact_id AS commentArtifactId FROM blackboard_attributes WHERE attribute_type_id = "
1250 + BlackboardAttribute.ATTRIBUTE_TYPE.TSK_COMMENT.getTypeID() +
") AS tagComments \n"
1251 +
"ON tagNames.artifactId = tagComments.commentArtifactId");
1253 while (resultSet.next()) {
1254 long artifactId = resultSet.getLong(
"taggedArtifactId");
1255 String tagName = resultSet.getString(
"name");
1256 String tagComment = resultSet.getString(
"comment");
1257 if (tagComment == null) {
1260 if (tagName != null && !tagName.isEmpty()) {
1263 if (tagNames.containsKey(tagName)) {
1264 tagNameIndex = tagNames.get(tagName);
1266 statement2.execute(
"INSERT INTO tag_names (display_name, description, color) "
1267 +
"VALUES(\"" + tagName +
"\", \"\", \"None\")");
1268 tagNames.put(tagName, tagNameCounter);
1269 tagNameIndex = tagNameCounter;
1273 statement2.execute(
"INSERT INTO blackboard_artifact_tags (artifact_id, tag_name_id, comment) "
1274 +
"VALUES(" + artifactId +
", " + tagNameIndex +
", \"" + tagComment +
"\")");
1280 "DELETE FROM blackboard_attributes WHERE artifact_id IN "
1281 +
"(SELECT artifact_id FROM blackboard_artifacts WHERE artifact_type_id = "
1282 + ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
1283 +
" OR artifact_type_id = " + ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() +
");");
1285 "DELETE FROM blackboard_artifacts WHERE artifact_type_id = "
1286 + ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID()
1287 +
" OR artifact_type_id = " + ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() +
";");
1289 return new CaseDbSchemaVersionNumber(3, 0);
1291 closeStatement(updateStatement);
1292 closeResultSet(resultSet);
1293 closeStatement(statement);
1294 closeStatement(statement2);
1312 private CaseDbSchemaVersionNumber updateFromSchema3toSchema4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1313 if (schemaVersion.getMajor() != 3) {
1314 return schemaVersion;
1317 Statement statement = null;
1318 ResultSet resultSet = null;
1319 Statement queryStatement = null;
1320 ResultSet queryResultSet = null;
1321 Statement updateStatement = null;
1326 statement = connection.createStatement();
1327 updateStatement = connection.createStatement();
1328 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN mime_type TEXT;");
1329 resultSet = statement.executeQuery(
"SELECT files.obj_id AS obj_id, attrs.value_text AS value_text "
1330 +
"FROM tsk_files AS files, blackboard_attributes AS attrs, blackboard_artifacts AS arts "
1331 +
"WHERE files.obj_id = arts.obj_id AND "
1332 +
"arts.artifact_id = attrs.artifact_id AND "
1333 +
"arts.artifact_type_id = 1 AND "
1334 +
"attrs.attribute_type_id = 62");
1335 while (resultSet.next()) {
1336 updateStatement.executeUpdate(
1338 +
"SET mime_type = '" + resultSet.getString(
"value_text") +
"' "
1339 +
"WHERE tsk_files.obj_id = " + resultSet.getInt(
"obj_id") +
";");
1344 statement.execute(
"ALTER TABLE blackboard_attribute_types ADD COLUMN value_type INTEGER NOT NULL DEFAULT -1;");
1345 resultSet = statement.executeQuery(
"SELECT * FROM blackboard_attribute_types AS types");
1346 while (resultSet.next()) {
1347 int attributeTypeId = resultSet.getInt(
"attribute_type_id");
1348 String attributeLabel = resultSet.getString(
"type_name");
1349 if (attributeTypeId < Blackboard.MIN_USER_DEFINED_TYPE_ID) {
1350 updateStatement.executeUpdate(
1351 "UPDATE blackboard_attribute_types "
1352 +
"SET value_type = " + ATTRIBUTE_TYPE.fromLabel(attributeLabel).getValueType().getType() +
" "
1353 +
"WHERE blackboard_attribute_types.attribute_type_id = " + attributeTypeId +
";");
1359 queryStatement = connection.createStatement();
1360 statement.execute(
"CREATE TABLE data_source_info (obj_id INTEGER PRIMARY KEY, device_id TEXT NOT NULL, time_zone TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id));");
1361 resultSet = statement.executeQuery(
"SELECT * FROM tsk_objects WHERE par_obj_id IS NULL");
1362 while (resultSet.next()) {
1363 long objectId = resultSet.getLong(
"obj_id");
1364 String timeZone =
"";
1365 queryResultSet = queryStatement.executeQuery(
"SELECT tzone FROM tsk_image_info WHERE obj_id = " + objectId);
1366 if (queryResultSet.next()) {
1367 timeZone = queryResultSet.getString(
"tzone");
1369 queryResultSet.close();
1370 updateStatement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone) "
1371 +
"VALUES(" + objectId +
", '" + UUID.randomUUID().toString() +
"' , '" + timeZone +
"');");
1385 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN data_source_obj_id BIGINT NOT NULL DEFAULT -1;");
1386 resultSet = statement.executeQuery(
"SELECT tsk_files.obj_id AS obj_id, par_obj_id FROM tsk_files, tsk_objects WHERE tsk_files.obj_id = tsk_objects.obj_id");
1387 while (resultSet.next()) {
1388 long fileId = resultSet.getLong(
"obj_id");
1389 long dataSourceId = getDataSourceObjectId(connection, fileId);
1390 updateStatement.executeUpdate(
"UPDATE tsk_files SET data_source_obj_id = " + dataSourceId +
" WHERE obj_id = " + fileId +
";");
1393 statement.execute(
"CREATE TABLE ingest_module_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
1394 statement.execute(
"CREATE TABLE ingest_job_status_types (type_id INTEGER PRIMARY KEY, type_name TEXT NOT NULL)");
1395 if (this.dbType.equals(DbType.SQLITE)) {
1396 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id INTEGER PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
1397 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id INTEGER PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
1399 statement.execute(
"CREATE TABLE ingest_modules (ingest_module_id BIGSERIAL PRIMARY KEY, display_name TEXT NOT NULL, unique_name TEXT UNIQUE NOT NULL, type_id INTEGER NOT NULL, version TEXT NOT NULL, FOREIGN KEY(type_id) REFERENCES ingest_module_types(type_id));");
1400 statement.execute(
"CREATE TABLE ingest_jobs (ingest_job_id BIGSERIAL PRIMARY KEY, obj_id BIGINT NOT NULL, host_name TEXT NOT NULL, start_date_time BIGINT NOT NULL, end_date_time BIGINT NOT NULL, status_id INTEGER NOT NULL, settings_dir TEXT, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(status_id) REFERENCES ingest_job_status_types(type_id));");
1403 statement.execute(
"CREATE TABLE ingest_job_modules (ingest_job_id INTEGER, ingest_module_id INTEGER, pipeline_position INTEGER, PRIMARY KEY(ingest_job_id, ingest_module_id), FOREIGN KEY(ingest_job_id) REFERENCES ingest_jobs(ingest_job_id), FOREIGN KEY(ingest_module_id) REFERENCES ingest_modules(ingest_module_id));");
1404 initIngestModuleTypes(connection);
1405 initIngestStatusTypes(connection);
1407 return new CaseDbSchemaVersionNumber(4, 0);
1410 closeResultSet(queryResultSet);
1411 closeStatement(queryStatement);
1412 closeStatement(updateStatement);
1413 closeResultSet(resultSet);
1414 closeStatement(statement);
1432 private CaseDbSchemaVersionNumber updateFromSchema4toSchema5(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1433 if (schemaVersion.getMajor() != 4) {
1434 return schemaVersion;
1437 Statement statement = null;
1441 statement = connection.createStatement();
1442 statement.execute(
"CREATE TABLE review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
1452 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN review_status_id INTEGER NOT NULL DEFAULT " + BlackboardArtifact.ReviewStatus.UNDECIDED.getID());
1455 statement.execute(
"CREATE TABLE file_encoding_types (encoding_type INTEGER PRIMARY KEY, name TEXT NOT NULL);");
1456 initEncodingTypes(connection);
1463 initReviewStatuses(connection);
1468 statement.execute(
"ALTER TABLE tsk_files_path ADD COLUMN encoding_type INTEGER NOT NULL DEFAULT 0;");
1470 return new CaseDbSchemaVersionNumber(5, 0);
1473 closeStatement(statement);
1491 private CaseDbSchemaVersionNumber updateFromSchema5toSchema6(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1492 if (schemaVersion.getMajor() != 5) {
1493 return schemaVersion;
1500 Statement statement = null;
1501 ResultSet resultSet = null;
1507 statement = connection.createStatement();
1508 statement.execute(
"CREATE TABLE IF NOT EXISTS review_statuses (review_status_id INTEGER PRIMARY KEY, review_status_name TEXT NOT NULL, display_name TEXT NOT NULL)");
1510 resultSet = connection.executeQuery(statement,
"SELECT COUNT(*) AS count FROM review_statuses");
1512 if (resultSet.getLong(
"count") == 0) {
1521 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN review_status_id INTEGER NOT NULL DEFAULT " + BlackboardArtifact.ReviewStatus.UNDECIDED.getID());
1524 return new CaseDbSchemaVersionNumber(6, 0);
1527 closeResultSet(resultSet);
1528 closeStatement(statement);
1546 private CaseDbSchemaVersionNumber updateFromSchema6toSchema7(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1547 if (schemaVersion.getMajor() != 6) {
1548 return schemaVersion;
1554 Statement statement = null;
1555 Statement updstatement = null;
1556 ResultSet resultSet = null;
1559 statement = connection.createStatement();
1560 updstatement = connection.createStatement();
1561 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN extension TEXT");
1563 resultSet = connection.executeQuery(statement,
"SELECT obj_id,name FROM tsk_files");
1564 while (resultSet.next()) {
1565 long objID = resultSet.getLong(
"obj_id");
1566 String name = resultSet.getString(
"name");
1567 updstatement.executeUpdate(
"UPDATE tsk_files SET extension = '" +
escapeSingleQuotes(extractExtension(name)) +
"' "
1568 +
"WHERE obj_id = " + objID);
1571 statement.execute(
"CREATE INDEX file_extension ON tsk_files ( extension )");
1574 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN artifact_obj_id INTEGER NOT NULL DEFAULT -1");
1576 return new CaseDbSchemaVersionNumber(7, 0);
1579 closeResultSet(resultSet);
1580 closeStatement(statement);
1581 closeStatement(updstatement);
1599 private CaseDbSchemaVersionNumber updateFromSchema7toSchema7dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1600 if (schemaVersion.getMajor() != 7) {
1601 return schemaVersion;
1604 if (schemaVersion.getMinor() != 0) {
1605 return schemaVersion;
1611 Statement statement = null;
1612 ResultSet resultSet = null;
1615 statement = connection.createStatement();
1618 if (schemaVersion.getMinor() == 0) {
1620 statement.execute(
"ALTER TABLE tsk_db_info ADD COLUMN schema_minor_ver INTEGER DEFAULT 1");
1622 return new CaseDbSchemaVersionNumber(7, 1);
1625 closeResultSet(resultSet);
1626 closeStatement(statement);
1644 private CaseDbSchemaVersionNumber updateFromSchema7dot1toSchema7dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1645 if (schemaVersion.getMajor() != 7) {
1646 return schemaVersion;
1649 if (schemaVersion.getMinor() != 1) {
1650 return schemaVersion;
1653 Statement statement = null;
1654 Statement updstatement = null;
1655 ResultSet resultSet = null;
1659 statement = connection.createStatement();
1660 statement.execute(
"ALTER TABLE blackboard_artifacts ADD COLUMN data_source_obj_id INTEGER NOT NULL DEFAULT -1");
1663 updstatement = connection.createStatement();
1664 resultSet = connection.executeQuery(statement,
"SELECT artifact_id, obj_id FROM blackboard_artifacts");
1665 while (resultSet.next()) {
1666 long artifact_id = resultSet.getLong(
"artifact_id");
1667 long obj_id = resultSet.getLong(
"obj_id");
1668 long data_source_obj_id = getDataSourceObjectId(connection, obj_id);
1669 updstatement.executeUpdate(
"UPDATE blackboard_artifacts SET data_source_obj_id = " + data_source_obj_id +
" "
1670 +
"WHERE artifact_id = " + artifact_id);
1672 closeResultSet(resultSet);
1673 closeStatement(statement);
1674 closeStatement(updstatement);
1679 statement = connection.createStatement();
1680 statement.execute(
"ALTER TABLE tag_names ADD COLUMN knownStatus INTEGER NOT NULL DEFAULT " + TskData.FileKnown.UNKNOWN.getFileKnownValue());
1683 if (this.dbType.equals(DbType.SQLITE)) {
1684 statement.execute(
"CREATE TABLE account_types (account_type_id INTEGER PRIMARY KEY, type_name TEXT UNIQUE NOT NULL, display_name TEXT NOT NULL)");
1685 statement.execute(
"CREATE TABLE accounts (account_id INTEGER PRIMARY KEY, account_type_id INTEGER NOT NULL, account_unique_identifier TEXT NOT NULL, UNIQUE(account_type_id, account_unique_identifier) , FOREIGN KEY(account_type_id) REFERENCES account_types(account_type_id))");
1686 statement.execute(
"CREATE TABLE account_relationships (relationship_id INTEGER PRIMARY KEY, account1_id INTEGER NOT NULL, account2_id INTEGER NOT NULL, relationship_source_obj_id INTEGER NOT NULL, date_time INTEGER, relationship_type INTEGER NOT NULL, data_source_obj_id INTEGER NOT NULL, UNIQUE(account1_id, account2_id, relationship_source_obj_id), FOREIGN KEY(account1_id) REFERENCES accounts(account_id), FOREIGN KEY(account2_id) REFERENCES accounts(account_id), FOREIGN KEY(relationship_source_obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id))");
1688 statement.execute(
"CREATE TABLE account_types (account_type_id BIGSERIAL PRIMARY KEY, type_name TEXT UNIQUE NOT NULL, display_name TEXT NOT NULL)");
1689 statement.execute(
"CREATE TABLE accounts (account_id BIGSERIAL PRIMARY KEY, account_type_id INTEGER NOT NULL, account_unique_identifier TEXT NOT NULL, UNIQUE(account_type_id, account_unique_identifier) , FOREIGN KEY(account_type_id) REFERENCES account_types(account_type_id))");
1690 statement.execute(
"CREATE TABLE account_relationships (relationship_id BIGSERIAL PRIMARY KEY, account1_id INTEGER NOT NULL, account2_id INTEGER NOT NULL, relationship_source_obj_id INTEGER NOT NULL, date_time BIGINT, relationship_type INTEGER NOT NULL, data_source_obj_id INTEGER NOT NULL, UNIQUE(account1_id, account2_id, relationship_source_obj_id), FOREIGN KEY(account1_id) REFERENCES accounts(account_id), FOREIGN KEY(account2_id) REFERENCES accounts(account_id), FOREIGN KEY(relationship_source_obj_id) REFERENCES tsk_objects(obj_id), FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id))");
1694 statement.execute(
"CREATE INDEX artifact_artifact_objID ON blackboard_artifacts(artifact_obj_id)");
1695 statement.execute(
"CREATE INDEX relationships_account1 ON account_relationships(account1_id)");
1696 statement.execute(
"CREATE INDEX relationships_account2 ON account_relationships(account2_id)");
1697 statement.execute(
"CREATE INDEX relationships_relationship_source_obj_id ON account_relationships(relationship_source_obj_id)");
1698 statement.execute(
"CREATE INDEX relationships_date_time ON account_relationships(date_time)");
1699 statement.execute(
"CREATE INDEX relationships_relationship_type ON account_relationships(relationship_type)");
1700 statement.execute(
"CREATE INDEX relationships_data_source_obj_id ON account_relationships(data_source_obj_id)");
1702 return new CaseDbSchemaVersionNumber(7, 2);
1704 closeResultSet(resultSet);
1705 closeStatement(statement);
1706 closeStatement(updstatement);
1724 private CaseDbSchemaVersionNumber updateFromSchema7dot2toSchema8dot0(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1725 if (schemaVersion.getMajor() != 7) {
1726 return schemaVersion;
1729 if (schemaVersion.getMinor() != 2) {
1730 return schemaVersion;
1733 Statement updateSchemaStatement = connection.createStatement();
1734 Statement getExistingReportsStatement = connection.createStatement();
1735 ResultSet resultSet = null;
1736 ResultSet existingReports = null;
1744 updateSchemaStatement.execute(
"ALTER TABLE reports RENAME TO old_reports");
1747 updateSchemaStatement.execute(
"CREATE TABLE reports (obj_id BIGSERIAL PRIMARY KEY, path TEXT NOT NULL, crtime INTEGER NOT NULL, src_module_name TEXT NOT NULL, report_name TEXT NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id))");
1750 existingReports = getExistingReportsStatement.executeQuery(
"SELECT * FROM old_reports");
1751 while (existingReports.next()) {
1752 String path = existingReports.getString(2);
1753 long crtime = existingReports.getInt(3);
1754 String sourceModule = existingReports.getString(4);
1755 String reportName = existingReports.getString(5);
1757 PreparedStatement insertObjectStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OBJECT, Statement.RETURN_GENERATED_KEYS);
1758 insertObjectStatement.clearParameters();
1759 insertObjectStatement.setNull(1, java.sql.Types.BIGINT);
1760 insertObjectStatement.setLong(2, TskData.ObjectType.REPORT.getObjectType());
1761 connection.executeUpdate(insertObjectStatement);
1762 resultSet = insertObjectStatement.getGeneratedKeys();
1763 if (!resultSet.next()) {
1764 throw new TskCoreException(String.format(
"Failed to INSERT report %s (%s) in tsk_objects table", reportName, path));
1766 long objectId = resultSet.getLong(1);
1769 PreparedStatement insertReportStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_REPORT);
1770 insertReportStatement.clearParameters();
1771 insertReportStatement.setLong(1, objectId);
1772 insertReportStatement.setString(2, path);
1773 insertReportStatement.setLong(3, crtime);
1774 insertReportStatement.setString(4, sourceModule);
1775 insertReportStatement.setString(5, reportName);
1776 connection.executeUpdate(insertReportStatement);
1780 updateSchemaStatement.execute(
"DROP TABLE old_reports");
1782 return new CaseDbSchemaVersionNumber(8, 0);
1784 closeResultSet(resultSet);
1785 closeResultSet(existingReports);
1786 closeStatement(updateSchemaStatement);
1787 closeStatement(getExistingReportsStatement);
1805 private CaseDbSchemaVersionNumber updateFromSchema8dot0toSchema8dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1806 if (schemaVersion.getMajor() != 8) {
1807 return schemaVersion;
1810 if (schemaVersion.getMinor() != 0) {
1811 return schemaVersion;
1816 try (Statement statement = connection.createStatement();) {
1818 if (this.dbType.equals(DbType.SQLITE)) {
1819 statement.execute(
"CREATE TABLE tsk_examiners (examiner_id INTEGER PRIMARY KEY, login_name TEXT NOT NULL, display_name TEXT, UNIQUE(login_name) )");
1820 statement.execute(
"ALTER TABLE content_tags ADD COLUMN examiner_id INTEGER REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1821 statement.execute(
"ALTER TABLE blackboard_artifact_tags ADD COLUMN examiner_id INTEGER REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1823 statement.execute(
"CREATE TABLE tsk_examiners (examiner_id BIGSERIAL PRIMARY KEY, login_name TEXT NOT NULL, display_name TEXT, UNIQUE(login_name))");
1824 statement.execute(
"ALTER TABLE content_tags ADD COLUMN examiner_id BIGINT REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1825 statement.execute(
"ALTER TABLE blackboard_artifact_tags ADD COLUMN examiner_id BIGINT REFERENCES tsk_examiners(examiner_id) DEFAULT NULL");
1828 return new CaseDbSchemaVersionNumber(8, 1);
1847 private CaseDbSchemaVersionNumber updateFromSchema8dot1toSchema8dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1848 if (schemaVersion.getMajor() != 8) {
1849 return schemaVersion;
1852 if (schemaVersion.getMinor() != 1) {
1853 return schemaVersion;
1858 try (Statement statement = connection.createStatement();) {
1859 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN sha1 TEXT DEFAULT NULL");
1860 statement.execute(
"ALTER TABLE tsk_image_info ADD COLUMN sha256 TEXT DEFAULT NULL");
1862 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_details TEXT");
1870 statement.execute(
"CREATE TABLE tsk_db_info_extended (name TEXT PRIMARY KEY, value TEXT NOT NULL)");
1871 ResultSet result = statement.executeQuery(
"SELECT tsk_ver FROM tsk_db_info");
1873 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + TSK_VERSION_KEY +
"', '" + result.getLong(
"tsk_ver") +
"')");
1874 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + SCHEMA_MAJOR_VERSION_KEY +
"', '8')");
1875 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + SCHEMA_MINOR_VERSION_KEY +
"', '2')");
1876 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + CREATION_SCHEMA_MAJOR_VERSION_KEY +
"', '0')");
1877 statement.execute(
"INSERT INTO tsk_db_info_extended (name, value) VALUES ('" + CREATION_SCHEMA_MINOR_VERSION_KEY +
"', '0')");
1879 String primaryKeyType;
1882 primaryKeyType =
"BIGSERIAL";
1885 primaryKeyType =
"INTEGER";
1888 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
1892 statement.execute(
"CREATE TABLE tsk_event_types ("
1893 +
" event_type_id " + primaryKeyType +
" PRIMARY KEY, "
1894 +
" display_name TEXT UNIQUE NOT NULL, "
1895 +
" super_type_id INTEGER REFERENCES tsk_event_types(event_type_id) )");
1896 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1897 +
" values( 0, 'Event Types', null)");
1898 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1899 +
" values(1, 'File System', 0)");
1900 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1901 +
" values(2, 'Web Activity', 0)");
1902 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1903 +
" values(3, 'Misc Types', 0)");
1904 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1905 +
" values(4, 'Modified', 1)");
1906 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1907 +
" values(5, 'Accessed', 1)");
1908 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1909 +
" values(6, 'Created', 1)");
1910 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
1911 +
" values(7, 'Changed', 1)");
1914 statement.execute(
"CREATE TABLE tsk_event_descriptions ("
1915 +
" event_description_id " + primaryKeyType +
" PRIMARY KEY, "
1916 +
" full_description TEXT NOT NULL, "
1917 +
" med_description TEXT, "
1918 +
" short_description TEXT,"
1919 +
" data_source_obj_id BIGINT NOT NULL, "
1920 +
" file_obj_id BIGINT NOT NULL, "
1921 +
" artifact_id BIGINT, "
1922 +
" hash_hit INTEGER NOT NULL, "
1923 +
" tagged INTEGER NOT NULL, "
1924 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
1925 +
" FOREIGN KEY(file_obj_id) REFERENCES tsk_files(obj_id), "
1926 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
1929 statement.execute(
"CREATE TABLE tsk_events ( "
1930 +
" event_id " + primaryKeyType +
" PRIMARY KEY, "
1931 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
1932 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id) ,"
1933 +
" time INTEGER NOT NULL) "
1937 statement.execute(
"CREATE INDEX events_time ON tsk_events(time)");
1938 statement.execute(
"CREATE INDEX events_type ON tsk_events(event_type_id)");
1939 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
1940 statement.execute(
"CREATE INDEX events_file_obj_id ON tsk_event_descriptions(file_obj_id) ");
1941 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
1942 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
1943 return new CaseDbSchemaVersionNumber(8, 2);
1963 private CaseDbSchemaVersionNumber updateFromSchema8dot2toSchema8dot3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
1964 if (schemaVersion.getMajor() != 8) {
1965 return schemaVersion;
1968 if (schemaVersion.getMinor() != 2) {
1969 return schemaVersion;
1974 ResultSet resultSet = null;
1976 try (Statement statement = connection.createStatement();) {
1981 String primaryKeyType;
1984 primaryKeyType =
"BIGSERIAL";
1987 primaryKeyType =
"INTEGER";
1990 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
1994 statement.execute(
"CREATE TABLE IF NOT EXISTS tsk_event_types ("
1995 +
" event_type_id " + primaryKeyType +
" PRIMARY KEY, "
1996 +
" display_name TEXT UNIQUE NOT NULL, "
1997 +
" super_type_id INTEGER REFERENCES tsk_event_types(event_type_id) )");
1999 resultSet = statement.executeQuery(
"SELECT * from tsk_event_types");
2003 if (!resultSet.next()) {
2005 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2006 +
" values( 0, 'Event Types', null)");
2007 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2008 +
" values(1, 'File System', 0)");
2009 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2010 +
" values(2, 'Web Activity', 0)");
2011 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2012 +
" values(3, 'Misc Types', 0)");
2013 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2014 +
" values(4, 'Modified', 1)");
2015 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2016 +
" values(5, 'Accessed', 1)");
2017 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2018 +
" values(6, 'Created', 1)");
2019 statement.execute(
"insert into tsk_event_types(event_type_id, display_name, super_type_id)"
2020 +
" values(7, 'Changed', 1)");
2025 statement.execute(
"DROP TABLE IF EXISTS tsk_events");
2029 statement.execute(
"DROP TABLE IF EXISTS tsk_event_descriptions");
2032 statement.execute(
"CREATE TABLE tsk_event_descriptions ("
2033 +
" event_description_id " + primaryKeyType +
" PRIMARY KEY, "
2034 +
" full_description TEXT NOT NULL, "
2035 +
" med_description TEXT, "
2036 +
" short_description TEXT,"
2037 +
" data_source_obj_id BIGINT NOT NULL, "
2038 +
" file_obj_id BIGINT NOT NULL, "
2039 +
" artifact_id BIGINT, "
2040 +
" hash_hit INTEGER NOT NULL, "
2041 +
" tagged INTEGER NOT NULL, "
2042 +
" UNIQUE(full_description, file_obj_id, artifact_id), "
2043 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
2044 +
" FOREIGN KEY(file_obj_id) REFERENCES tsk_files(obj_id), "
2045 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
2049 statement.execute(
"CREATE TABLE tsk_events ( "
2050 +
" event_id " + primaryKeyType +
" PRIMARY KEY, "
2051 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
2052 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id) ,"
2053 +
" time INTEGER NOT NULL, "
2054 +
" UNIQUE (event_type_id, event_description_id, time))"
2058 statement.execute(
"UPDATE tsk_db_info_extended SET name = 'CREATION_SCHEMA_MAJOR_VERSION' WHERE name = 'CREATED_SCHEMA_MAJOR_VERSION'");
2059 statement.execute(
"UPDATE tsk_db_info_extended SET name = 'CREATION_SCHEMA_MINOR_VERSION' WHERE name = 'CREATED_SCHEMA_MINOR_VERSION'");
2061 return new CaseDbSchemaVersionNumber(8, 3);
2063 closeResultSet(resultSet);
2089 private CaseDbSchemaVersionNumber updateFromSchema8dot3toSchema8dot4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2090 if (schemaVersion.getMajor() != 8) {
2091 return schemaVersion;
2094 if (schemaVersion.getMinor() != 3) {
2095 return schemaVersion;
2098 Statement statement = connection.createStatement();
2099 ResultSet results = null;
2106 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
2112 results = statement.executeQuery(
"SELECT column_name FROM information_schema.columns "
2113 +
"WHERE table_name='tsk_event_descriptions' and column_name='file_obj_id'");
2114 if (results.next()) {
2116 statement.execute(
"ALTER TABLE tsk_event_descriptions "
2117 +
"RENAME COLUMN file_obj_id TO content_obj_id");
2121 statement.execute(
"CREATE TABLE temp_tsk_events ( "
2122 +
" event_id BIGSERIAL PRIMARY KEY, "
2123 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
2124 +
" event_description_id BIGINT NOT NULL REFERENCES tsk_event_descriptions(event_description_id),"
2125 +
" time BIGINT NOT NULL, "
2126 +
" UNIQUE (event_type_id, event_description_id, time))"
2130 statement.execute(
"INSERT INTO temp_tsk_events(event_id, event_type_id, "
2131 +
"event_description_id, time) SELECT * FROM tsk_events");
2134 statement.execute(
"DROP TABLE tsk_events");
2137 statement.execute(
"ALTER TABLE temp_tsk_events RENAME TO tsk_events");
2140 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
2141 statement.execute(
"CREATE INDEX events_content_obj_id ON tsk_event_descriptions(content_obj_id) ");
2142 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
2143 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
2144 statement.execute(
"CREATE INDEX events_time ON tsk_events(time) ");
2148 boolean hasMisnamedColumn =
false;
2149 results = statement.executeQuery(
"pragma table_info('tsk_event_descriptions')");
2150 while (results.next()) {
2151 if (results.getString(
"name") != null && results.getString(
"name").equals(
"file_obj_id")) {
2152 hasMisnamedColumn =
true;
2157 if (hasMisnamedColumn) {
2159 statement.execute(
"CREATE TABLE temp_tsk_event_descriptions ("
2160 +
" event_description_id INTEGER PRIMARY KEY, "
2161 +
" full_description TEXT NOT NULL, "
2162 +
" med_description TEXT, "
2163 +
" short_description TEXT,"
2164 +
" data_source_obj_id BIGINT NOT NULL, "
2165 +
" content_obj_id BIGINT NOT NULL, "
2166 +
" artifact_id BIGINT, "
2167 +
" hash_hit INTEGER NOT NULL, "
2168 +
" tagged INTEGER NOT NULL, "
2169 +
" UNIQUE(full_description, content_obj_id, artifact_id), "
2170 +
" FOREIGN KEY(data_source_obj_id) REFERENCES data_source_info(obj_id), "
2171 +
" FOREIGN KEY(content_obj_id) REFERENCES tsk_files(obj_id), "
2172 +
" FOREIGN KEY(artifact_id) REFERENCES blackboard_artifacts(artifact_id))"
2175 statement.execute(
"CREATE TABLE temp_tsk_events ( "
2176 +
" event_id INTEGER PRIMARY KEY, "
2177 +
" event_type_id BIGINT NOT NULL REFERENCES tsk_event_types(event_type_id) ,"
2178 +
" event_description_id BIGINT NOT NULL REFERENCES temp_tsk_event_descriptions(event_description_id),"
2179 +
" time INTEGER NOT NULL, "
2180 +
" UNIQUE (event_type_id, event_description_id, time))"
2184 statement.execute(
"INSERT INTO temp_tsk_event_descriptions(event_description_id, full_description, "
2185 +
"med_description, short_description, data_source_obj_id, content_obj_id, artifact_id, "
2186 +
"hash_hit, tagged) SELECT * FROM tsk_event_descriptions");
2188 statement.execute(
"INSERT INTO temp_tsk_events(event_id, event_type_id, "
2189 +
"event_description_id, time) SELECT * FROM tsk_events");
2192 statement.execute(
"DROP TABLE tsk_events");
2193 statement.execute(
"DROP TABLE tsk_event_descriptions");
2196 statement.execute(
"ALTER TABLE temp_tsk_event_descriptions RENAME TO tsk_event_descriptions");
2197 statement.execute(
"ALTER TABLE temp_tsk_events RENAME TO tsk_events");
2200 statement.execute(
"CREATE INDEX events_data_source_obj_id ON tsk_event_descriptions(data_source_obj_id) ");
2201 statement.execute(
"CREATE INDEX events_content_obj_id ON tsk_event_descriptions(content_obj_id) ");
2202 statement.execute(
"CREATE INDEX events_artifact_id ON tsk_event_descriptions(artifact_id) ");
2203 statement.execute(
"CREATE INDEX events_sub_type_time ON tsk_events(event_type_id, time) ");
2204 statement.execute(
"CREATE INDEX events_time ON tsk_events(time) ");
2208 throw new TskCoreException(
"Unsupported data base type: " +
getDatabaseType().toString());
2212 if (this.dbType.equals(DbType.SQLITE)) {
2213 statement.execute(
"CREATE TABLE tsk_pool_info (obj_id INTEGER PRIMARY KEY, pool_type INTEGER NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE)");
2215 statement.execute(
"CREATE TABLE tsk_pool_info (obj_id BIGSERIAL PRIMARY KEY, pool_type INTEGER NOT NULL, FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE)");
2219 insertAccountTypeIfNotExists(statement,
"IMO",
"IMO");
2220 insertAccountTypeIfNotExists(statement,
"LINE",
"LINE");
2221 insertAccountTypeIfNotExists(statement,
"SKYPE",
"Skype");
2222 insertAccountTypeIfNotExists(statement,
"TANGO",
"Tango");
2223 insertAccountTypeIfNotExists(statement,
"TEXTNOW",
"TextNow");
2224 insertAccountTypeIfNotExists(statement,
"THREEMA",
"ThreeMa");
2225 insertAccountTypeIfNotExists(statement,
"VIBER",
"Viber");
2226 insertAccountTypeIfNotExists(statement,
"XENDER",
"Xender");
2227 insertAccountTypeIfNotExists(statement,
"ZAPYA",
"Zapya");
2228 insertAccountTypeIfNotExists(statement,
"SHAREIT",
"ShareIt");
2230 return new CaseDbSchemaVersionNumber(8, 4);
2232 closeResultSet(results);
2233 closeStatement(statement);
2238 private CaseDbSchemaVersionNumber updateFromSchema8dot4toSchema8dot5(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2239 if (schemaVersion.getMajor() != 8) {
2240 return schemaVersion;
2243 if (schemaVersion.getMinor() != 4) {
2244 return schemaVersion;
2247 Statement statement = connection.createStatement();
2252 statement.execute(
"CREATE TABLE tsk_tag_sets (tag_set_id BIGSERIAL PRIMARY KEY, name TEXT UNIQUE)");
2253 statement.execute(
"ALTER TABLE tag_names ADD COLUMN tag_set_id BIGINT REFERENCES tsk_tag_sets(tag_set_id)");
2256 statement.execute(
"CREATE TABLE tsk_tag_sets (tag_set_id INTEGER PRIMARY KEY, name TEXT UNIQUE)");
2257 statement.execute(
"ALTER TABLE tag_names ADD COLUMN tag_set_id INTEGER REFERENCES tsk_tag_sets(tag_set_id)");
2261 statement.execute(
"ALTER TABLE tag_names ADD COLUMN rank INTEGER");
2269 String insertStmt =
"INSERT INTO tsk_tag_sets (name) VALUES ('Project VIC')";
2271 statement.execute(insertStmt, Statement.RETURN_GENERATED_KEYS);
2273 statement.execute(insertStmt);
2275 try (ResultSet resultSet = statement.getGeneratedKeys()) {
2276 if (resultSet != null && resultSet.next()) {
2277 int tagSetId = resultSet.getInt(1);
2279 String updateQuery =
"UPDATE tag_names SET tag_set_id = %d, color = '%s', rank = %d, display_name = '%s' WHERE display_name = '%s'";
2280 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Red", 1,
"Child Exploitation (Illegal)",
"CAT-1: Child Exploitation (Illegal)"));
2281 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Lime", 2,
"Child Exploitation (Non-Illegal/Age Difficult)",
"CAT-2: Child Exploitation (Non-Illegal/Age Difficult)"));
2282 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Yellow", 3,
"CGI/Animation (Child Exploitive)",
"CAT-3: CGI/Animation (Child Exploitive)"));
2283 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Purple", 4,
"Exemplar/Comparison (Internal Use Only)",
"CAT-4: Exemplar/Comparison (Internal Use Only)"));
2284 statement.executeUpdate(String.format(updateQuery, tagSetId,
"Fuchsia", 5,
"Non-pertinent",
"CAT-5: Non-pertinent"));
2286 String
deleteContentTag =
"DELETE FROM content_tags WHERE tag_name_id IN (SELECT tag_name_id from tag_names WHERE display_name LIKE 'CAT-0: Uncategorized')";
2287 String deleteArtifactTag =
"DELETE FROM blackboard_artifact_tags WHERE tag_name_id IN (SELECT tag_name_id from tag_names WHERE display_name LIKE 'CAT-0: Uncategorized')";
2288 String deleteCat0 =
"DELETE FROM tag_names WHERE display_name = 'CAT-0: Uncategorized'";
2289 statement.executeUpdate(deleteContentTag);
2290 statement.executeUpdate(deleteArtifactTag);
2291 statement.executeUpdate(deleteCat0);
2294 throw new TskCoreException(
"Failed to retrieve the default tag_set_id from DB");
2304 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN data_source_obj_id BIGINT NOT NULL DEFAULT -1;");
2307 statement.execute(
"ALTER TABLE tsk_fs_info ADD COLUMN data_source_obj_id INTEGER NOT NULL DEFAULT -1;");
2310 Statement updateStatement = connection.createStatement();
2311 try (ResultSet resultSet = statement.executeQuery(
"SELECT obj_id FROM tsk_fs_info")) {
2312 while (resultSet.next()) {
2313 long fsId = resultSet.getLong(
"obj_id");
2314 long dataSourceId = getDataSourceObjectId(connection, fsId);
2315 updateStatement.executeUpdate(
"UPDATE tsk_fs_info SET data_source_obj_id = " + dataSourceId +
" WHERE obj_id = " + fsId +
";");
2318 closeStatement(updateStatement);
2321 return new CaseDbSchemaVersionNumber(8, 5);
2324 closeStatement(statement);
2329 private CaseDbSchemaVersionNumber updateFromSchema8dot5toSchema8dot6(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2330 if (schemaVersion.getMajor() != 8) {
2331 return schemaVersion;
2334 if (schemaVersion.getMinor() != 5) {
2335 return schemaVersion;
2338 Statement statement = connection.createStatement();
2341 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN sha256 TEXT");
2343 return new CaseDbSchemaVersionNumber(8, 6);
2346 closeStatement(statement);
2351 @SuppressWarnings(
"deprecation")
2352 private CaseDbSchemaVersionNumber updateFromSchema8dot6toSchema9dot0(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection) throws SQLException, TskCoreException {
2353 if (schemaVersion.getMajor() != 8) {
2354 return schemaVersion;
2357 if (schemaVersion.getMinor() != 6) {
2358 return schemaVersion;
2361 Statement statement = connection.createStatement();
2364 String dateDataType =
"BIGINT";
2365 String bigIntDataType =
"BIGINT";
2366 String blobDataType =
"BYTEA";
2367 String primaryKeyType =
"BIGSERIAL";
2369 if (this.dbType.equals(DbType.SQLITE)) {
2370 dateDataType =
"INTEGER";
2371 bigIntDataType =
"INTEGER";
2372 blobDataType =
"BLOB";
2373 primaryKeyType =
"INTEGER";
2375 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN added_date_time " + dateDataType);
2376 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_tool_settings TEXT");
2377 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_tool_name TEXT");
2378 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN acquisition_tool_version TEXT");
2383 statement.execute(
"ALTER TABLE blackboard_artifact_types ADD COLUMN category_type INTEGER DEFAULT 0");
2384 String analysisTypeObjIdList
2385 = BlackboardArtifact.ARTIFACT_TYPE.TSK_KEYWORD_HIT.getTypeID() +
", "
2386 + BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT.getTypeID() +
", "
2387 + BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT.getTypeID() +
", "
2388 + BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_FILE.getTypeID() +
", "
2389 + BlackboardArtifact.ARTIFACT_TYPE.TSK_TAG_ARTIFACT.getTypeID() +
", "
2390 + BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_DETECTED.getTypeID() +
", "
2391 + BlackboardArtifact.ARTIFACT_TYPE.TSK_EXT_MISMATCH_DETECTED.getTypeID() +
", "
2392 + BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_ARTIFACT_HIT.getTypeID() +
", "
2393 + BlackboardArtifact.ARTIFACT_TYPE.TSK_FACE_DETECTED.getTypeID() +
", "
2394 + BlackboardArtifact.ARTIFACT_TYPE.TSK_ENCRYPTION_SUSPECTED.getTypeID() +
", "
2395 + BlackboardArtifact.ARTIFACT_TYPE.TSK_OBJECT_DETECTED.getTypeID() +
", "
2396 + BlackboardArtifact.ARTIFACT_TYPE.TSK_VERIFICATION_FAILED.getTypeID() +
", "
2397 + BlackboardArtifact.ARTIFACT_TYPE.TSK_DATA_SOURCE_USAGE.getTypeID() +
", "
2398 + BlackboardArtifact.ARTIFACT_TYPE.TSK_USER_CONTENT_SUSPECTED.getTypeID() +
", "
2399 + BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_ACCOUNT_TYPE.getTypeID() +
", "
2400 + BlackboardArtifact.ARTIFACT_TYPE.TSK_YARA_HIT.getTypeID() +
", "
2401 + BlackboardArtifact.ARTIFACT_TYPE.TSK_WEB_CATEGORIZATION.getTypeID();
2402 statement.execute(
"UPDATE blackboard_artifact_types SET category_type = " + BlackboardArtifact.Category.ANALYSIS_RESULT.getID()
2403 +
" WHERE artifact_type_id IN (" + analysisTypeObjIdList +
")");
2406 statement.execute(
"CREATE TABLE tsk_file_attributes (id " + primaryKeyType +
" PRIMARY KEY, "
2407 +
"obj_id " + bigIntDataType +
" NOT NULL, "
2408 +
"attribute_type_id " + bigIntDataType +
" NOT NULL, "
2409 +
"value_type INTEGER NOT NULL, value_byte " + blobDataType +
", "
2410 +
"value_text TEXT, value_int32 INTEGER, value_int64 " + bigIntDataType +
", value_double NUMERIC(20, 10), "
2411 +
"FOREIGN KEY(obj_id) REFERENCES tsk_files(obj_id) ON DELETE CASCADE, "
2412 +
"FOREIGN KEY(attribute_type_id) REFERENCES blackboard_attribute_types(attribute_type_id))");
2415 statement.execute(
"CREATE TABLE tsk_analysis_results (artifact_obj_id " + bigIntDataType +
" PRIMARY KEY, "
2416 +
"conclusion TEXT, "
2417 +
"significance INTEGER NOT NULL, "
2425 +
"configuration TEXT, justification TEXT, "
2426 +
"ignore_score INTEGER DEFAULT 0 "
2429 statement.execute(
"CREATE TABLE tsk_aggregate_score( obj_id " + bigIntDataType +
" PRIMARY KEY, "
2430 +
"data_source_obj_id " + bigIntDataType +
", "
2431 +
"significance INTEGER NOT NULL, "
2434 +
"UNIQUE (obj_id),"
2435 +
"FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE, "
2436 +
"FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE "
2440 statement.execute(
"CREATE TABLE tsk_persons (id " + primaryKeyType +
" PRIMARY KEY, "
2441 +
"name TEXT NOT NULL, "
2442 +
"UNIQUE(name)) ");
2445 statement.execute(
"CREATE TABLE tsk_hosts (id " + primaryKeyType +
" PRIMARY KEY, "
2446 +
"name TEXT NOT NULL, "
2447 +
"db_status INTEGER DEFAULT 0, "
2448 +
"person_id INTEGER, "
2449 +
"merged_into " + bigIntDataType +
", "
2450 +
"FOREIGN KEY(person_id) REFERENCES tsk_persons(id) ON DELETE SET NULL, "
2451 +
"FOREIGN KEY(merged_into) REFERENCES tsk_hosts(id), "
2452 +
"UNIQUE(name)) ");
2455 statement.execute(
"CREATE TABLE tsk_os_account_realms (id " + primaryKeyType +
" PRIMARY KEY, "
2456 +
"realm_name TEXT DEFAULT NULL, "
2457 +
"realm_addr TEXT DEFAULT NULL, "
2458 +
"realm_signature TEXT NOT NULL, "
2459 +
"scope_host_id " + bigIntDataType +
" DEFAULT NULL, "
2460 +
"scope_confidence INTEGER, "
2461 +
"db_status INTEGER DEFAULT 0, "
2462 +
"merged_into " + bigIntDataType +
" DEFAULT NULL, "
2463 +
"UNIQUE(realm_signature), "
2464 +
"FOREIGN KEY(scope_host_id) REFERENCES tsk_hosts(id),"
2465 +
"FOREIGN KEY(merged_into) REFERENCES tsk_os_account_realms(id) )");
2470 statement.execute(
"ALTER TABLE data_source_info ADD COLUMN host_id INTEGER REFERENCES tsk_hosts(id)");
2471 Statement updateStatement = connection.createStatement();
2472 try (ResultSet resultSet = statement.executeQuery(
"SELECT obj_id, device_id FROM data_source_info")) {
2473 Map<String, Long> hostMap =
new HashMap<>();
2475 while (resultSet.next()) {
2476 long objId = resultSet.getLong(
"obj_id");
2477 String deviceId = resultSet.getString(
"device_id");
2479 if (!hostMap.containsKey(deviceId)) {
2480 String hostName =
"Host " + hostIndex;
2481 updateStatement.execute(
"INSERT INTO tsk_hosts (name, db_status) VALUES ('" + hostName +
"', 0)");
2482 hostMap.put(deviceId, hostIndex);
2485 updateStatement.execute(
"UPDATE data_source_info SET host_id = " + hostMap.get(deviceId) +
" WHERE obj_id = " + objId);
2488 closeStatement(updateStatement);
2491 statement.execute(
"CREATE TABLE tsk_os_accounts (os_account_obj_id " + bigIntDataType +
" PRIMARY KEY, "
2492 +
"login_name TEXT DEFAULT NULL, "
2493 +
"full_name TEXT DEFAULT NULL, "
2494 +
"realm_id " + bigIntDataType +
" NOT NULL, "
2495 +
"addr TEXT DEFAULT NULL, "
2496 +
"signature TEXT NOT NULL, "
2497 +
"status INTEGER, "
2499 +
"created_date " + bigIntDataType +
" DEFAULT NULL, "
2500 +
"db_status INTEGER DEFAULT 0, "
2501 +
"merged_into " + bigIntDataType +
" DEFAULT NULL, "
2502 +
"UNIQUE(signature, realm_id), "
2503 +
"FOREIGN KEY(os_account_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE, "
2504 +
"FOREIGN KEY(realm_id) REFERENCES tsk_os_account_realms(id),"
2505 +
"FOREIGN KEY(merged_into) REFERENCES tsk_os_accounts(os_account_obj_id) )");
2507 statement.execute(
"CREATE TABLE tsk_os_account_attributes (id " + primaryKeyType +
" PRIMARY KEY, "
2508 +
"os_account_obj_id " + bigIntDataType +
" NOT NULL, "
2509 +
"host_id " + bigIntDataType +
", "
2510 +
"source_obj_id " + bigIntDataType +
", "
2511 +
"attribute_type_id " + bigIntDataType +
" NOT NULL, "
2512 +
"value_type INTEGER NOT NULL, "
2513 +
"value_byte " + bigIntDataType +
", "
2514 +
"value_text TEXT, "
2515 +
"value_int32 INTEGER, value_int64 " + bigIntDataType +
", "
2516 +
"value_double NUMERIC(20, 10), "
2517 +
"FOREIGN KEY(os_account_obj_id) REFERENCES tsk_os_accounts(os_account_obj_id), "
2518 +
"FOREIGN KEY(host_id) REFERENCES tsk_hosts(id), "
2519 +
"FOREIGN KEY(source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE SET NULL, "
2520 +
"FOREIGN KEY(attribute_type_id) REFERENCES blackboard_attribute_types(attribute_type_id))");
2522 statement.execute(
"CREATE TABLE tsk_os_account_instances (id " + primaryKeyType +
" PRIMARY KEY, "
2523 +
"os_account_obj_id " + bigIntDataType +
" NOT NULL, "
2524 +
"data_source_obj_id " + bigIntDataType +
" NOT NULL, "
2525 +
"instance_type INTEGER NOT NULL, "
2526 +
"UNIQUE(os_account_obj_id, data_source_obj_id), "
2527 +
"FOREIGN KEY(os_account_obj_id) REFERENCES tsk_os_accounts(os_account_obj_id), "
2528 +
"FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE )");
2530 statement.execute(
"CREATE TABLE tsk_data_artifacts ( "
2531 +
"artifact_obj_id " + bigIntDataType +
" PRIMARY KEY, "
2532 +
"os_account_obj_id " + bigIntDataType +
", "
2533 +
"FOREIGN KEY(os_account_obj_id) REFERENCES tsk_os_accounts(os_account_obj_id)) ");
2536 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN owner_uid TEXT DEFAULT NULL");
2537 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN os_account_obj_id " + bigIntDataType +
" DEFAULT NULL REFERENCES tsk_os_accounts(os_account_obj_id) ");
2540 statement.execute(
"CREATE TABLE tsk_host_addresses (id " + primaryKeyType +
" PRIMARY KEY, "
2541 +
"address_type INTEGER NOT NULL, "
2542 +
"address TEXT NOT NULL, "
2543 +
"UNIQUE(address_type, address)) ");
2545 statement.execute(
"CREATE TABLE tsk_host_address_map (id " + primaryKeyType +
" PRIMARY KEY, "
2546 +
"host_id " + bigIntDataType +
" NOT NULL, "
2547 +
"addr_obj_id " + bigIntDataType +
" NOT NULL, "
2548 +
"source_obj_id " + bigIntDataType +
", "
2549 +
"time " + bigIntDataType +
", "
2550 +
"UNIQUE(host_id, addr_obj_id, time), "
2551 +
"FOREIGN KEY(host_id) REFERENCES tsk_hosts(id) ON DELETE CASCADE, "
2552 +
"FOREIGN KEY(addr_obj_id) REFERENCES tsk_host_addresses(id), "
2553 +
"FOREIGN KEY(source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE SET NULL )");
2556 statement.execute(
"CREATE TABLE tsk_host_address_dns_ip_map (id " + primaryKeyType +
" PRIMARY KEY, "
2557 +
"dns_address_id " + bigIntDataType +
" NOT NULL, "
2558 +
"ip_address_id " + bigIntDataType +
" NOT NULL, "
2559 +
"source_obj_id " + bigIntDataType +
", "
2560 +
"time " + bigIntDataType +
", "
2561 +
"UNIQUE(dns_address_id, ip_address_id, time), "
2562 +
"FOREIGN KEY(dns_address_id) REFERENCES tsk_host_addresses(id) ON DELETE CASCADE, "
2563 +
"FOREIGN KEY(ip_address_id) REFERENCES tsk_host_addresses(id) ON DELETE CASCADE,"
2564 +
"FOREIGN KEY(source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE SET NULL )");
2567 statement.execute(
"CREATE TABLE tsk_host_address_usage (id " + primaryKeyType +
" PRIMARY KEY, "
2568 +
"addr_obj_id " + bigIntDataType +
" NOT NULL, "
2569 +
"obj_id " + bigIntDataType +
" NOT NULL, "
2570 +
"data_source_obj_id " + bigIntDataType +
" NOT NULL, "
2571 +
"UNIQUE(addr_obj_id, obj_id), "
2572 +
"FOREIGN KEY(addr_obj_id) REFERENCES tsk_host_addresses(id) ON DELETE CASCADE, "
2573 +
"FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE )");
2575 return new CaseDbSchemaVersionNumber(9, 0);
2578 closeStatement(statement);
2583 private CaseDbSchemaVersionNumber updateFromSchema9dot0toSchema9dot1(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2584 if (schemaVersion.getMajor() != 9) {
2585 return schemaVersion;
2588 if (schemaVersion.getMinor() != 0) {
2589 return schemaVersion;
2592 Statement statement = connection.createStatement();
2593 ResultSet results = null;
2601 results = statement.executeQuery(
"SELECT column_name FROM information_schema.columns "
2602 +
"WHERE table_name='tsk_analysis_results' and column_name='method_category'");
2603 if (results.next()) {
2605 statement.execute(
"ALTER TABLE tsk_analysis_results "
2606 +
"DROP COLUMN method_category");
2607 statement.execute(
"ALTER TABLE tsk_aggregate_score "
2608 +
"DROP COLUMN method_category");
2614 boolean hasMisnamedColumn =
false;
2615 results = statement.executeQuery(
"pragma table_info('tsk_analysis_results')");
2616 while (results.next()) {
2617 if (results.getString(
"name") != null && results.getString(
"name").equals(
"method_category")) {
2618 hasMisnamedColumn =
true;
2623 if (hasMisnamedColumn) {
2626 statement.execute(
"CREATE TABLE temp_tsk_analysis_results (artifact_obj_id INTEGER PRIMARY KEY, "
2627 +
"conclusion TEXT, "
2628 +
"significance INTEGER NOT NULL, "
2629 +
"configuration TEXT, justification TEXT, "
2630 +
"ignore_score INTEGER DEFAULT 0 "
2632 statement.execute(
"CREATE TABLE temp_tsk_aggregate_score( obj_id INTEGER PRIMARY KEY, "
2633 +
"data_source_obj_id INTEGER, "
2634 +
"significance INTEGER NOT NULL, "
2635 +
"UNIQUE (obj_id),"
2636 +
"FOREIGN KEY(obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE, "
2637 +
"FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE "
2641 statement.execute(
"INSERT INTO temp_tsk_analysis_results(artifact_obj_id, "
2642 +
"conclusion, justification, significance, configuration, ignore_score) "
2643 +
"SELECT artifact_obj_id, conclusion, justification, significance, configuration, ignore_score FROM tsk_analysis_results");
2644 statement.execute(
"INSERT INTO temp_tsk_aggregate_score(obj_id, "
2645 +
"data_source_obj_id, significance) "
2646 +
"SELECT obj_id, data_source_obj_id, significance FROM tsk_aggregate_score");
2649 statement.execute(
"DROP TABLE tsk_analysis_results");
2650 statement.execute(
"DROP TABLE tsk_aggregate_score");
2653 statement.execute(
"ALTER TABLE temp_tsk_analysis_results RENAME TO tsk_analysis_results");
2654 statement.execute(
"ALTER TABLE temp_tsk_aggregate_score RENAME TO tsk_aggregate_score");
2659 throw new TskCoreException(
"Unsupported database type: " +
getDatabaseType().toString());
2663 statement.execute(
"CREATE INDEX tsk_file_attributes_obj_id ON tsk_file_attributes(obj_id)");
2665 statement.execute(
"ALTER TABLE tsk_analysis_results ADD COLUMN priority INTEGER NOT NULL DEFAULT " + Score.Priority.NORMAL.getId());
2666 statement.execute(
"ALTER TABLE tsk_aggregate_score ADD COLUMN priority INTEGER NOT NULL DEFAULT " + Score.Priority.NORMAL.getId());
2668 statement.execute(
"UPDATE blackboard_artifact_types SET category_type = 1 WHERE artifact_type_id = 16");
2670 return new CaseDbSchemaVersionNumber(9, 1);
2672 closeResultSet(results);
2673 closeStatement(statement);
2691 private CaseDbSchemaVersionNumber updateFromSchema9dot1toSchema9dot2(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2692 if (schemaVersion.getMajor() != 9) {
2693 return schemaVersion;
2696 if (schemaVersion.getMinor() != 1) {
2697 return schemaVersion;
2700 Statement updateSchemaStatement = connection.createStatement();
2701 ResultSet results = null;
2705 String bigIntDataType =
"BIGINT";
2706 String primaryKeyType =
"BIGSERIAL";
2708 if (this.dbType.equals(DbType.SQLITE)) {
2709 bigIntDataType =
"INTEGER";
2710 primaryKeyType =
"INTEGER";
2716 updateSchemaStatement.execute(
"ALTER TABLE tsk_os_account_instances RENAME TO old_tsk_os_account_instances");
2719 updateSchemaStatement.execute(
"CREATE TABLE tsk_os_account_instances (id " + primaryKeyType +
" PRIMARY KEY, "
2720 +
"os_account_obj_id " + bigIntDataType +
" NOT NULL, "
2721 +
"data_source_obj_id " + bigIntDataType +
" NOT NULL, "
2722 +
"instance_type INTEGER NOT NULL, "
2723 +
"UNIQUE(os_account_obj_id, data_source_obj_id, instance_type), "
2724 +
"FOREIGN KEY(os_account_obj_id) REFERENCES tsk_os_accounts(os_account_obj_id) ON DELETE CASCADE, "
2725 +
"FOREIGN KEY(data_source_obj_id) REFERENCES tsk_objects(obj_id) ON DELETE CASCADE ) ");
2728 updateSchemaStatement.execute(
"INSERT INTO tsk_os_account_instances(os_account_obj_id, "
2729 +
"data_source_obj_id, instance_type) SELECT os_account_obj_id, data_source_obj_id, instance_type FROM old_tsk_os_account_instances ORDER BY id ASC");
2732 updateSchemaStatement.execute(
"DROP TABLE old_tsk_os_account_instances");
2734 return new CaseDbSchemaVersionNumber(9, 2);
2736 closeResultSet(results);
2737 closeStatement(updateSchemaStatement);
2742 private CaseDbSchemaVersionNumber updateFromSchema9dot2toSchema9dot3(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2743 if (schemaVersion.getMajor() != 9) {
2744 return schemaVersion;
2747 if (schemaVersion.getMinor() != 2) {
2748 return schemaVersion;
2751 Statement statement = connection.createStatement();
2755 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN sha1 TEXT");
2758 return new CaseDbSchemaVersionNumber(9, 3);
2761 closeStatement(statement);
2766 private CaseDbSchemaVersionNumber updateFromSchema9dot3toSchema9dot4(CaseDbSchemaVersionNumber schemaVersion, CaseDbConnection connection)
throws SQLException, TskCoreException {
2767 if (schemaVersion.getMajor() != 9) {
2768 return schemaVersion;
2771 if (schemaVersion.getMinor() != 3) {
2772 return schemaVersion;
2775 Statement statement = connection.createStatement();
2779 statement.execute(
"CREATE TABLE file_collection_status_types (collection_status_type INTEGER PRIMARY KEY, name TEXT NOT NULL);");
2780 initCollectedStatusTypes(connection);
2783 statement.execute(
"ALTER TABLE tsk_files ADD COLUMN collected INTEGER NOT NULL DEFAULT " +
2784 TskData.CollectedStatus.UNKNOWN.getType() +
";");
2786 return new CaseDbSchemaVersionNumber(9, 4);
2789 closeStatement(statement);
2805 private void insertAccountTypeIfNotExists(Statement statement, String type_name, String display_name)
throws TskCoreException, SQLException {
2807 String insertSQL = String.format(
"INTO account_types(type_name, display_name) VALUES ('%s', '%s')", type_name, display_name);
2810 insertSQL =
"INSERT " + insertSQL +
" ON CONFLICT DO NOTHING";
2813 insertSQL =
"INSERT OR IGNORE " + insertSQL;
2816 throw new TskCoreException(
"Unknown DB Type: " +
getDatabaseType().name());
2818 statement.execute(insertSQL);
2828 static String extractExtension(
final String fileName) {
2830 int i = fileName.lastIndexOf(
".");
2832 if ((i > 0) && ((i + 1) < fileName.length())) {
2833 ext = fileName.substring(i + 1);
2844 return ext.toLowerCase();
2868 return CURRENT_DB_SCHEMA_VERSION;
2878 return caseDBSchemaCreationVersion;
2897 return dbBackupPath;
2924 return databaseName;
2944 rwLock.writeLock().lock();
2955 rwLock.writeLock().unlock();
2966 rwLock.readLock().lock();
2977 rwLock.readLock().unlock();
3012 }
catch (Exception ex) {
3013 throw new TskCoreException(
"Failed to open case database at " + dbPath, ex);
3029 return openCase(databaseName, info, caseDir, null);
3060 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()), databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDir, info.getDbType(), contentProvider);
3061 }
catch (PropertyVetoException exp) {
3063 throw new TskCoreException(exp.getMessage(), exp);
3067 }
catch (Exception exp) {
3069 throw new TskCoreException(exp.getMessage(), exp);
3099 CaseDatabaseFactory factory =
new CaseDatabaseFactory(dbPath);
3100 factory.createCaseDatabase();
3104 }
catch (Exception ex) {
3105 throw new TskCoreException(
"Failed to create case database at " + dbPath, ex);
3125 return newCase(caseName, info, caseDirPath, null);
3147 String databaseName = createCaseDataBaseName(caseName);
3161 CaseDatabaseFactory factory =
new CaseDatabaseFactory(databaseName, info);
3162 factory.createCaseDatabase();
3165 return new SleuthkitCase(info.getHost(), Integer.parseInt(info.getPort()),
3166 databaseName, info.getUserName(), info.getPassword(), caseHandle, caseDirPath, info.getDbType(), contentProvider);
3167 }
catch (PropertyVetoException exp) {
3169 throw new TskCoreException(exp.getMessage(), exp);
3170 }
catch (Exception exp) {
3172 throw new TskCoreException(exp.getMessage(), exp);
3185 private static String createCaseDataBaseName(String candidateDbName) {
3187 if (!candidateDbName.isEmpty()) {
3191 dbName = candidateDbName.replaceAll(
"[^\\p{ASCII}]",
"_");
3196 dbName = dbName.replaceAll(
"[\\p{Cntrl}]",
"_");
3201 dbName = dbName.replaceAll(
"[ /?:'\"\\\\]",
"_");
3206 dbName = dbName.toLowerCase();
3212 if ((dbName.length() > 0 && !(Character.isLetter(dbName.codePointAt(0))) && !(dbName.codePointAt(0) ==
'_'))) {
3213 dbName =
"_" + dbName;
3220 if (dbName.length() > MAX_DB_NAME_LEN_BEFORE_TIMESTAMP) {
3221 dbName = dbName.substring(0, MAX_DB_NAME_LEN_BEFORE_TIMESTAMP);
3233 SimpleDateFormat dateFormat =
new SimpleDateFormat(
"yyyyMMdd_HHmmss");
3234 Date date =
new Date();
3235 dbName = dbName +
"_" + dateFormat.format(date);
3247 timelineEventsDisabled.set(
true);
3260 if (cachedCurrentExaminer != null) {
3261 return cachedCurrentExaminer;
3263 String loginName = System.getProperty(
"user.name");
3264 if (loginName == null || loginName.isEmpty()) {
3265 throw new TskCoreException(
"Failed to determine logged in user name.");
3268 ResultSet resultSet = null;
3269 CaseDbConnection connection = null;
3272 connection = connections.getConnection();
3273 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_EXAMINER_BY_LOGIN_NAME);
3274 statement.clearParameters();
3275 statement.setString(1, loginName);
3276 resultSet = connection.executeQuery(statement);
3277 if (resultSet.next()) {
3278 cachedCurrentExaminer =
new Examiner(resultSet.getLong(
"examiner_id"), resultSet.getString(
"login_name"), resultSet.getString(
"display_name"));
3279 return cachedCurrentExaminer;
3281 throw new TskCoreException(
"Error getting examaminer for name = " + loginName);
3284 }
catch (SQLException ex) {
3285 throw new TskCoreException(
"Error getting examaminer for name = " + loginName, ex);
3287 closeResultSet(resultSet);
3288 closeConnection(connection);
3303 Examiner getExaminerById(
long id)
throws TskCoreException {
3305 CaseDbConnection connection = null;
3306 ResultSet resultSet = null;
3309 connection = connections.getConnection();
3310 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_EXAMINER_BY_ID);
3311 statement.clearParameters();
3312 statement.setLong(1,
id);
3313 resultSet = connection.executeQuery(statement);
3314 if (resultSet.next()) {
3315 return new Examiner(resultSet.getLong(
"examiner_id"), resultSet.getString(
"login_name"), resultSet.getString(
"full_name"));
3317 throw new TskCoreException(
"Error getting examaminer for id = " +
id);
3319 }
catch (SQLException ex) {
3320 throw new TskCoreException(
"Error getting examaminer for id = " +
id, ex);
3322 closeResultSet(resultSet);
3323 closeConnection(connection);
3346 return this.caseHandle.initAddImageProcess(timeZone, addUnallocSpace, noFatFsOrphans, imageCopyPath,
this);
3358 CaseDbConnection connection = null;
3360 ResultSet rs = null;
3363 connection = connections.getConnection();
3364 s = connection.createStatement();
3365 rs = connection.executeQuery(s,
"SELECT obj_id, type FROM tsk_objects "
3366 +
"WHERE par_obj_id IS NULL");
3367 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
3369 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"),
ObjectType.
valueOf(rs.getShort(
"type"))));
3372 List<Content> rootObjs =
new ArrayList<Content>();
3373 for (ObjectInfo i : infos) {
3374 if (null != i.type) {
3385 throw new TskCoreException(
"Parentless object has wrong type to be a root (ABSTRACTFILE, but not VIRTUAL_DIRECTORY: " + i.type);
3397 throw new TskCoreException(
"Parentless object has wrong type to be a root: " + i.type);
3402 }
catch (SQLException ex) {
3403 throw new TskCoreException(
"Error getting root objects", ex);
3407 closeConnection(connection);
3423 List<Long> getDataSourceObjIds(String deviceId)
throws TskCoreException {
3426 synchronized (deviceIdToDatasourceObjIdMap) {
3427 if (deviceIdToDatasourceObjIdMap.containsKey(deviceId)) {
3428 return new ArrayList<Long>(deviceIdToDatasourceObjIdMap.get(deviceId));
3431 CaseDbConnection connection = null;
3433 ResultSet rs = null;
3436 connection = connections.getConnection();
3437 s = connection.createStatement();
3438 rs = connection.executeQuery(s,
"SELECT obj_id FROM data_source_info WHERE device_id = '" + deviceId +
"'");
3439 List<Long> dataSourceObjIds =
new ArrayList<Long>();
3441 dataSourceObjIds.add(rs.getLong(
"obj_id"));
3444 long ds_obj_id = rs.getLong(
"obj_id");
3445 if (deviceIdToDatasourceObjIdMap.containsKey(deviceId)) {
3446 deviceIdToDatasourceObjIdMap.get(deviceId).add(ds_obj_id);
3448 deviceIdToDatasourceObjIdMap.put(deviceId,
new HashSet<Long>(Arrays.asList(ds_obj_id)));
3451 return dataSourceObjIds;
3452 }
catch (SQLException ex) {
3453 throw new TskCoreException(
"Error getting data sources", ex);
3457 closeConnection(connection);
3480 CaseDbConnection connection = null;
3481 Statement statement = null;
3482 ResultSet resultSet = null;
3483 Statement statement2 = null;
3484 ResultSet resultSet2 = null;
3487 connection = connections.getConnection();
3488 statement = connection.createStatement();
3489 statement2 = connection.createStatement();
3490 resultSet = connection.executeQuery(statement,
3491 "SELECT ds.obj_id, ds.device_id, ds.time_zone, img.type, img.ssize, img.size, img.md5, img.sha1, img.sha256, img.display_name "
3492 +
"FROM data_source_info AS ds "
3493 +
"LEFT JOIN tsk_image_info AS img "
3494 +
"ON ds.obj_id = img.obj_id");
3496 List<DataSource> dataSourceList =
new ArrayList<DataSource>();
3499 while (resultSet.next()) {
3501 Long objectId = resultSet.getLong(
"obj_id");
3502 String deviceId = resultSet.getString(
"device_id");
3503 String timezone = resultSet.getString(
"time_zone");
3504 String type = resultSet.getString(
"type");
3512 resultSet2 = connection.executeQuery(statement2,
"SELECT name FROM tsk_files WHERE tsk_files.obj_id = " + objectId);
3513 String dsName = (resultSet2.next()) ? resultSet2.getString(
"name") :
"";
3521 String parentPath =
"/";
3522 dataSource =
new LocalFilesDataSource(
this, objectId, objectId, deviceId, dsName, dirType, metaType, dirFlag, metaFlags, timezone, null, null, null,
FileKnown.
UNKNOWN, parentPath);
3527 Long ssize = resultSet.getLong(
"ssize");
3528 Long size = resultSet.getLong(
"size");
3529 String md5 = resultSet.getString(
"md5");
3530 String sha1 = resultSet.getString(
"sha1");
3531 String sha256 = resultSet.getString(
"sha256");
3532 String name = resultSet.getString(
"display_name");
3534 List<String> imagePaths = imagePathsMap.get(objectId);
3536 if (imagePaths.size() > 0) {
3537 String path = imagePaths.get(0);
3538 name = (
new java.io.File(path)).getName();
3544 dataSource =
new Image(
this, objectId, Long.valueOf(type), deviceId, ssize, name,
3545 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, size);
3548 dataSourceList.add(dataSource);
3551 return dataSourceList;
3553 }
catch (SQLException ex) {
3554 throw new TskCoreException(
"Error getting data sources", ex);
3556 closeResultSet(resultSet);
3557 closeStatement(statement);
3558 closeResultSet(resultSet2);
3559 closeStatement(statement2);
3560 closeConnection(connection);
3586 CaseDbConnection connection = null;
3587 Statement statement = null;
3588 ResultSet resultSet = null;
3589 Statement statement2 = null;
3590 ResultSet resultSet2 = null;
3593 connection = connections.getConnection();
3594 statement = connection.createStatement();
3595 statement2 = connection.createStatement();
3596 resultSet = connection.executeQuery(statement,
3597 "SELECT ds.device_id, ds.time_zone, img.type, img.ssize, img.size, img.md5, img.sha1, img.sha256, img.display_name "
3598 +
"FROM data_source_info AS ds "
3599 +
"LEFT JOIN tsk_image_info AS img "
3600 +
"ON ds.obj_id = img.obj_id "
3601 +
"WHERE ds.obj_id = " + objectId);
3602 if (resultSet.next()) {
3603 String deviceId = resultSet.getString(
"device_id");
3604 String timezone = resultSet.getString(
"time_zone");
3605 String type = resultSet.getString(
"type");
3613 resultSet2 = connection.executeQuery(statement2,
"SELECT name FROM tsk_files WHERE tsk_files.obj_id = " + objectId);
3614 String dsName = (resultSet2.next()) ? resultSet2.getString(
"name") :
"";
3621 String parentPath =
"/";
3622 dataSource =
new LocalFilesDataSource(
this, objectId, objectId, deviceId, dsName, dirType, metaType, dirFlag, metaFlags, timezone, null, null, null,
FileKnown.
UNKNOWN, parentPath);
3627 Long ssize = resultSet.getLong(
"ssize");
3628 Long size = resultSet.getLong(
"size");
3629 String md5 = resultSet.getString(
"md5");
3630 String sha1 = resultSet.getString(
"sha1");
3631 String sha256 = resultSet.getString(
"sha256");
3632 String name = resultSet.getString(
"display_name");
3634 List<String> imagePaths = getImagePathsById(objectId, connection);
3636 if (imagePaths.size() > 0) {
3637 String path = imagePaths.get(0);
3638 name = (
new java.io.File(path)).getName();
3644 dataSource =
new Image(
this, objectId, Long.valueOf(type), deviceId, ssize, name,
3645 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, size);
3648 throw new TskDataException(String.format(
"There is no data source with obj_id = %d", objectId));
3650 }
catch (SQLException ex) {
3651 throw new TskCoreException(String.format(
"Error getting data source with obj_id = %d", objectId), ex);
3653 closeResultSet(resultSet);
3654 closeStatement(statement);
3655 closeResultSet(resultSet2);
3656 closeStatement(statement2);
3657 closeConnection(connection);
3678 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
3679 artifacts.addAll(blackboard.getArtifactsByType(blackboard.
getArtifactType(artifactTypeID)));
3694 CaseDbConnection connection = null;
3695 ResultSet rs = null;
3698 connection = connections.getConnection();
3701 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_FROM_SOURCE);
3702 statement.clearParameters();
3703 statement.setLong(1, objId);
3704 rs = connection.executeQuery(statement);
3707 count = rs.getLong(
"count");
3710 }
catch (SQLException ex) {
3711 throw new TskCoreException(
"Error getting number of blackboard artifacts by content", ex);
3714 closeConnection(connection);
3730 CaseDbConnection connection = null;
3731 ResultSet rs = null;
3734 connection = connections.getConnection();
3737 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_OF_TYPE);
3738 statement.clearParameters();
3739 statement.setInt(1, artifactTypeID);
3740 rs = connection.executeQuery(statement);
3743 count = rs.getLong(
"count");
3746 }
catch (SQLException ex) {
3747 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
3750 closeConnection(connection);
3767 CaseDbConnection connection = null;
3768 ResultSet rs = null;
3771 connection = connections.getConnection();
3774 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_OF_TYPE_BY_DATA_SOURCE);
3775 statement.clearParameters();
3776 statement.setInt(2, artifactTypeID);
3777 statement.setLong(1, dataSourceID);
3778 rs = connection.executeQuery(statement);
3781 count = rs.getLong(
"count");
3784 }
catch (SQLException ex) {
3785 throw new TskCoreException(String.format(
"Error getting number of blackboard artifacts by type (%d) and data source (%d)", artifactTypeID, dataSourceID), ex);
3788 closeConnection(connection);
3812 try (CaseDbConnection connection = connections.getConnection(); Statement statement = connection.createStatement();
3813 ResultSet resultSet = connection.executeQuery(statement,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3814 +
"arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3815 +
"types.type_name AS type_name, types.display_name AS display_name, "
3816 +
" arts.review_status_id AS review_status_id "
3817 +
"FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3818 +
"WHERE arts.artifact_id = attrs.artifact_id "
3819 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3820 +
" AND attrs.value_text = '" + value +
"'"
3821 +
" AND types.artifact_type_id=arts.artifact_type_id"
3824 List<Long> analysisArtifactObjIds =
new ArrayList<>();
3825 List<Long> dataArtifactObjIds =
new ArrayList<>();
3826 while (resultSet.next()) {
3829 analysisArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3831 dataArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3835 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
3836 if (!analysisArtifactObjIds.isEmpty()) {
3840 if (!dataArtifactObjIds.isEmpty()) {
3844 }
catch (SQLException ex) {
3845 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3871 String valSubStr =
"%" + subString;
3872 if (startsWith ==
false) {
3877 try (CaseDbConnection connection = connections.getConnection(); Statement statement = connection.createStatement();
3878 ResultSet resultSet = connection.executeQuery(statement,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3879 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3880 +
" types.type_name AS type_name, types.display_name AS display_name, "
3881 +
" arts.review_status_id AS review_status_id "
3882 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3883 +
" WHERE arts.artifact_id = attrs.artifact_id "
3884 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3885 +
" AND LOWER(attrs.value_text) LIKE LOWER('" + valSubStr +
"')"
3886 +
" AND types.artifact_type_id=arts.artifact_type_id "
3888 List<Long> analysisArtifactObjIds =
new ArrayList<>();
3889 List<Long> dataArtifactObjIds =
new ArrayList<>();
3890 while (resultSet.next()) {
3893 analysisArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3895 dataArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3899 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
3900 if (!analysisArtifactObjIds.isEmpty()) {
3904 if (!dataArtifactObjIds.isEmpty()) {
3908 }
catch (SQLException ex) {
3909 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
3933 try (CaseDbConnection connection = connections.getConnection(); Statement statement = connection.createStatement();
3934 ResultSet resultSet = connection.executeQuery(statement,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3935 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3936 +
" types.type_name AS type_name, types.display_name AS display_name, "
3937 +
" arts.review_status_id AS review_status_id "
3938 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3939 +
"WHERE arts.artifact_id = attrs.artifact_id "
3940 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3941 +
" AND attrs.value_int32 = " + value
3942 +
" AND types.artifact_type_id=arts.artifact_type_id "
3944 List<Long> analysisArtifactObjIds =
new ArrayList<>();
3945 List<Long> dataArtifactObjIds =
new ArrayList<>();
3946 while (resultSet.next()) {
3949 analysisArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3951 dataArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
3955 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
3956 if (!analysisArtifactObjIds.isEmpty()) {
3960 if (!dataArtifactObjIds.isEmpty()) {
3964 }
catch (SQLException ex) {
3965 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
3990 try (CaseDbConnection connection = connections.getConnection(); Statement statement = connection.createStatement();
3991 ResultSet resultSet = connection.executeQuery(statement,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
3992 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
3993 +
" types.type_name AS type_name, types.display_name AS display_name, "
3994 +
" arts.review_status_id AS review_status_id "
3995 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
3996 +
" WHERE arts.artifact_id = attrs.artifact_id "
3997 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
3998 +
" AND attrs.value_int64 = " + value
3999 +
" AND types.artifact_type_id=arts.artifact_type_id "
4001 List<Long> analysisArtifactObjIds =
new ArrayList<>();
4002 List<Long> dataArtifactObjIds =
new ArrayList<>();
4003 while (resultSet.next()) {
4006 analysisArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
4008 dataArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
4012 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
4013 if (!analysisArtifactObjIds.isEmpty()) {
4017 if (!dataArtifactObjIds.isEmpty()) {
4021 }
catch (SQLException ex) {
4022 throw new TskCoreException(
"Error getting blackboard artifacts by attribute. " + ex.getMessage(), ex);
4047 try (CaseDbConnection connection = connections.getConnection(); Statement statement = connection.createStatement();
4048 ResultSet resultSet = connection.executeQuery(statement,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
4049 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
4050 +
" types.type_name AS type_name, types.display_name AS display_name, "
4051 +
" arts.review_status_id AS review_status_id "
4052 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
4053 +
" WHERE arts.artifact_id = attrs.artifact_id "
4054 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
4055 +
" AND attrs.value_double = " + value
4056 +
" AND types.artifact_type_id=arts.artifact_type_id "
4058 List<Long> analysisArtifactObjIds =
new ArrayList<>();
4059 List<Long> dataArtifactObjIds =
new ArrayList<>();
4060 while (resultSet.next()) {
4063 analysisArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
4065 dataArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
4069 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
4070 if (!analysisArtifactObjIds.isEmpty()) {
4074 if (!dataArtifactObjIds.isEmpty()) {
4078 }
catch (SQLException ex) {
4079 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
4105 try (CaseDbConnection connection = connections.getConnection(); Statement statement = connection.createStatement();
4106 ResultSet resultSet = connection.executeQuery(statement,
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
4107 +
" arts.obj_id AS obj_id, arts.artifact_obj_id AS artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
4108 +
" types.type_name AS type_name, types.display_name AS display_name, "
4109 +
" arts.review_status_id AS review_status_id "
4110 +
" FROM blackboard_artifacts AS arts, blackboard_attributes AS attrs, blackboard_artifact_types AS types "
4111 +
" WHERE arts.artifact_id = attrs.artifact_id "
4112 +
" AND attrs.attribute_type_id = " + attrType.getTypeID()
4113 +
" AND attrs.value_byte = " + value
4114 +
" AND types.artifact_type_id=arts.artifact_type_id "
4116 List<Long> analysisArtifactObjIds =
new ArrayList<>();
4117 List<Long> dataArtifactObjIds =
new ArrayList<>();
4118 while (resultSet.next()) {
4121 analysisArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
4123 dataArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
4127 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
4128 if (!analysisArtifactObjIds.isEmpty()) {
4132 if (!dataArtifactObjIds.isEmpty()) {
4136 }
catch (SQLException ex) {
4137 throw new TskCoreException(
"Error getting blackboard artifacts by attribute", ex);
4151 CaseDbConnection connection = null;
4153 ResultSet rs = null;
4156 connection = connections.getConnection();
4157 s = connection.createStatement();
4158 rs = connection.executeQuery(s,
"SELECT artifact_type_id, type_name, display_name, category_type FROM blackboard_artifact_types");
4162 rs.getString(
"type_name"), rs.getString(
"display_name"),
4165 return artifactTypes;
4166 }
catch (SQLException ex) {
4167 throw new TskCoreException(
"Error getting artifact types", ex);
4171 closeConnection(connection);
4185 String typeIdList =
"";
4192 String query =
"SELECT DISTINCT artifact_type_id FROM blackboard_artifacts "
4193 +
"WHERE artifact_type_id IN (" + typeIdList +
")";
4194 CaseDbConnection connection = null;
4196 ResultSet rs = null;
4199 connection = connections.getConnection();
4200 s = connection.createStatement();
4201 rs = connection.executeQuery(s, query);
4207 }
catch (SQLException ex) {
4208 throw new TskCoreException(
"Error getting artifact types in use", ex);
4212 closeConnection(connection);
4228 CaseDbConnection connection = null;
4230 ResultSet rs = null;
4233 connection = connections.getConnection();
4234 s = connection.createStatement();
4235 rs = connection.executeQuery(s,
4236 "SELECT DISTINCT arts.artifact_type_id AS artifact_type_id, "
4237 +
"types.type_name AS type_name, "
4238 +
"types.display_name AS display_name, "
4239 +
"types.category_type AS category_type "
4240 +
"FROM blackboard_artifact_types AS types "
4241 +
"INNER JOIN blackboard_artifacts AS arts "
4242 +
"ON arts.artifact_type_id = types.artifact_type_id");
4246 rs.getString(
"type_name"), rs.getString(
"display_name"),
4249 return uniqueArtifactTypes;
4250 }
catch (SQLException ex) {
4251 throw new TskCoreException(
"Error getting attribute types", ex);
4255 closeConnection(connection);
4268 CaseDbConnection connection = null;
4270 ResultSet rs = null;
4273 connection = connections.getConnection();
4274 s = connection.createStatement();
4275 rs = connection.executeQuery(s,
"SELECT attribute_type_id, type_name, display_name, value_type FROM blackboard_attribute_types");
4281 return attribute_types;
4282 }
catch (SQLException ex) {
4283 throw new TskCoreException(
"Error getting attribute types", ex);
4287 closeConnection(connection);
4304 CaseDbConnection connection = null;
4306 ResultSet rs = null;
4309 connection = connections.getConnection();
4310 s = connection.createStatement();
4311 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM blackboard_attribute_types");
4314 count = rs.getInt(
"count");
4317 }
catch (SQLException ex) {
4318 throw new TskCoreException(
"Error getting number of blackboard artifacts by type", ex);
4322 closeConnection(connection);
4339 private long getArtifactsCountHelper(
int artifactTypeID,
long obj_id)
throws TskCoreException {
4340 CaseDbConnection connection = null;
4341 ResultSet rs = null;
4344 connection = connections.getConnection();
4347 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE);
4348 statement.clearParameters();
4349 statement.setLong(1, obj_id);
4350 statement.setInt(2, artifactTypeID);
4351 rs = connection.executeQuery(statement);
4354 count = rs.getLong(
"count");
4357 }
catch (SQLException ex) {
4358 throw new TskCoreException(
"Error getting blackboard artifact count", ex);
4361 closeConnection(connection);
4379 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
4380 artifacts.addAll(blackboard.getArtifactsBySourceId(
getArtifactType(artifactTypeName), obj_id));
4397 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
4398 artifacts.addAll(blackboard.getArtifactsBySourceId(blackboard.
getArtifactType(artifactTypeID), obj_id));
4431 int artifactTypeID = this.
getArtifactType(artifactTypeName).getTypeID();
4432 if (artifactTypeID == -1) {
4435 return getArtifactsCountHelper(artifactTypeID, obj_id);
4451 return getArtifactsCountHelper(artifactTypeID, obj_id);
4467 return getArtifactsCountHelper(artifactType.getTypeID(), obj_id);
4482 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
4483 artifacts.addAll(blackboard.getArtifactsByType(
getArtifactType(artifactTypeName)));
4499 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
4500 artifacts.addAll(blackboard.getArtifactsByType(blackboard.
getArtifactType(artifactType.getTypeID())));
4522 String dataArtifactJoin =
"tsk_data_artifacts AS datarts ON datarts.artifact_obj_id = arts.artifact_obj_id";
4523 String analysisResultJoin =
"tsk_analysis_results AS anresult ON anresult.artifact_obj_id = arts.artifact_obj_id";
4524 String dataArtifactColumns =
", datarts.os_account_obj_id AS os_account_obj_id";
4525 String analysResultColumns =
", anresult.conclusion AS conclusion, anresult.significance AS significance, anresult.priority AS priority, anresult.configuration AS configuration, anresult.justification AS justification ";
4527 String formatQuery =
"SELECT DISTINCT arts.artifact_id AS artifact_id, "
4528 +
"arts.obj_id AS obj_id, arts.artifact_obj_id as artifact_obj_id, arts.data_source_obj_id AS data_source_obj_id, arts.artifact_type_id AS artifact_type_id, "
4529 +
"types.type_name AS type_name, types.display_name AS display_name,"
4530 +
"arts.review_status_id AS review_status_id %s "
4531 +
"FROM blackboard_artifacts AS arts "
4532 +
"JOIN blackboard_attributes AS attrs ON arts.artifact_id = attrs.artifact_id "
4533 +
"JOIN blackboard_artifact_types AS types ON types.artifact_type_id = arts.artifact_type_id "
4535 +
"WHERE arts.artifact_id = attrs.artifact_id "
4536 +
"AND attrs.attribute_type_id = %d "
4537 +
" AND arts.artifact_type_id = %d "
4538 +
" AND attrs.value_text = '%s' "
4539 +
" AND types.artifact_type_id=arts.artifact_type_id "
4540 +
" AND arts.review_status_id != %d";
4542 String query = String.format(formatQuery,
4545 attrType.getTypeID(),
4546 artifactType.getTypeID(),
4551 try (CaseDbConnection connection = connections.getConnection(); Statement s = connection.createStatement(); ResultSet rs = connection.executeQuery(s, query)) {
4552 ArrayList<BlackboardArtifact> artifacts =
new ArrayList<>();
4555 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
4557 osAccountObjId = null;
4560 artifacts.add(
new DataArtifact(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"),
4561 rs.getLong(
"artifact_obj_id"),
4562 rs.getObject(
"data_source_obj_id") != null ? rs.getLong(
"data_source_obj_id") : null,
4563 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
4566 artifacts.add(
new AnalysisResult(
this, rs.getLong(
"artifact_id"), rs.getLong(
"obj_id"),
4567 rs.getLong(
"artifact_obj_id"),
4568 rs.getObject(
"data_source_obj_id") != null ? rs.getLong(
"data_source_obj_id") : null,
4569 rs.getInt(
"artifact_type_id"), rs.getString(
"type_name"), rs.getString(
"display_name"),
4572 rs.getString(
"conclusion"), rs.getString(
"configuration"), rs.getString(
"justification")));
4576 }
catch (SQLException ex) {
4577 throw new TskCoreException(
"Error getting blackboard artifacts by artifact type and attribute. " + ex.getMessage(), ex);
4595 List<DataArtifact> dataArtifacts = blackboard.
getDataArtifactsWhere(
"artifacts.artifact_id = " + artifactID);
4596 if (!dataArtifacts.isEmpty()) {
4597 return dataArtifacts.get(0);
4600 List<AnalysisResult> analysisResults = blackboard.
getAnalysisResultsWhere(
"artifacts.artifact_id = " + artifactID);
4601 if (!analysisResults.isEmpty()) {
4602 return analysisResults.get(0);
4605 throw new TskCoreException(
"No blackboard artifact with id " + artifactID);
4618 try (CaseDbConnection connection = connections.getConnection();) {
4619 addBlackBoardAttribute(attr, artifactTypeId, connection);
4620 }
catch (SQLException ex) {
4621 throw new TskCoreException(
"Error adding blackboard attribute " + attr.toString(), ex);
4637 CaseDbConnection connection = null;
4640 connection = connections.getConnection();
4641 connection.beginTransaction();
4643 addBlackBoardAttribute(attr, artifactTypeId, connection);
4645 connection.commitTransaction();
4646 }
catch (SQLException ex) {
4647 rollbackTransaction(connection);
4648 throw new TskCoreException(
"Error adding blackboard attributes", ex);
4650 closeConnection(connection);
4655 void addBlackBoardAttribute(
BlackboardAttribute attr,
int artifactTypeId, CaseDbConnection connection)
throws SQLException, TskCoreException {
4656 PreparedStatement statement;
4657 switch (attr.getAttributeType().getValueType()) {
4660 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_STRING_ATTRIBUTE);
4661 statement.clearParameters();
4662 statement.setString(7, attr.getValueString());
4665 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_BYTE_ATTRIBUTE);
4666 statement.clearParameters();
4667 statement.setBytes(7, attr.getValueBytes());
4670 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INT_ATTRIBUTE);
4671 statement.clearParameters();
4672 statement.setInt(7, attr.getValueInt());
4675 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LONG_ATTRIBUTE);
4676 statement.clearParameters();
4677 statement.setLong(7, attr.getValueLong());
4680 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DOUBLE_ATTRIBUTE);
4681 statement.clearParameters();
4682 statement.setDouble(7, attr.getValueDouble());
4685 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LONG_ATTRIBUTE);
4686 statement.clearParameters();
4687 statement.setLong(7, attr.getValueLong());
4690 throw new TskCoreException(
"Unrecognized artifact attribute value type");
4692 statement.setLong(1, attr.getArtifactID());
4693 statement.setInt(2, artifactTypeId);
4694 statement.setString(3, attr.getSourcesCSV());
4695 statement.setString(4,
"");
4696 statement.setInt(5, attr.getAttributeType().getTypeID());
4697 statement.setLong(6, attr.getAttributeType().getValueType().getType());
4698 connection.executeUpdate(statement);
4701 void addFileAttribute(Attribute attr, CaseDbConnection connection)
throws SQLException, TskCoreException {
4702 PreparedStatement statement;
4703 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE_ATTRIBUTE, Statement.RETURN_GENERATED_KEYS);
4704 statement.clearParameters();
4706 statement.setLong(1, attr.getAttributeParentId());
4707 statement.setInt(2, attr.getAttributeType().getTypeID());
4708 statement.setLong(3, attr.getAttributeType().getValueType().getType());
4710 if (attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE) {
4711 statement.setBytes(4, attr.getValueBytes());
4713 statement.setBytes(4, null);
4716 if (attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.STRING
4717 || attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.JSON) {
4718 statement.setString(5, attr.getValueString());
4720 statement.setString(5, null);
4722 if (attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER) {
4723 statement.setInt(6, attr.getValueInt());
4725 statement.setNull(6, java.sql.Types.INTEGER);
4728 if (attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DATETIME
4729 || attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.LONG) {
4730 statement.setLong(7, attr.getValueLong());
4732 statement.setNull(7, java.sql.Types.BIGINT);
4735 if (attr.getAttributeType().getValueType() == TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.DOUBLE) {
4736 statement.setDouble(8, attr.getValueDouble());
4738 statement.setNull(8, java.sql.Types.DOUBLE);
4741 connection.executeUpdate(statement);
4742 try (ResultSet resultSet = statement.getGeneratedKeys()) {
4743 if (!resultSet.next()) {
4744 throw new TskCoreException(String.format(
"Failed to insert file attribute "
4745 +
"with id=%d. The expected key was not generated", attr.getId()));
4748 attr.setId(resultSet.getLong(1));
4762 String addSourceToArtifactAttribute(BlackboardAttribute attr, String source)
throws TskCoreException {
4770 if (null == source || source.isEmpty()) {
4771 throw new TskCoreException(
"Attempt to add null or empty source module name to artifact attribute");
4773 CaseDbConnection connection = null;
4775 Statement queryStmt = null;
4776 Statement updateStmt = null;
4777 ResultSet result = null;
4778 String newSources =
"";
4780 connection = connections.getConnection();
4781 connection.beginTransaction();
4782 String valueClause =
"";
4783 BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType = attr.getAttributeType().getValueType();
4784 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
4785 switch (valueType) {
4791 valueClause =
" value_int32 = " + attr.getValueInt();
4795 valueClause =
" value_int64 = " + attr.getValueLong();
4798 valueClause =
" value_double = " + attr.getValueDouble();
4801 throw new TskCoreException(String.format(
"Unrecognized value type for attribute %s", attr.getDisplayString()));
4803 String query =
"SELECT source FROM blackboard_attributes WHERE"
4804 +
" artifact_id = " + attr.getArtifactID()
4805 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
4806 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
4807 +
" AND " + valueClause +
";";
4808 queryStmt = connection.createStatement();
4809 updateStmt = connection.createStatement();
4810 result = connection.executeQuery(queryStmt, query);
4817 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ATTR_BY_VALUE_BYTE);
4818 statement.clearParameters();
4819 statement.setLong(1, attr.getArtifactID());
4820 statement.setLong(2, attr.getAttributeType().getTypeID());
4821 statement.setBytes(3, attr.getValueBytes());
4822 result = connection.executeQuery(statement);
4824 while (result.next()) {
4825 String oldSources = result.getString(
"source");
4826 if (null != oldSources && !oldSources.isEmpty()) {
4827 Set<String> uniqueSources =
new HashSet<String>(Arrays.asList(oldSources.split(
",")));
4828 if (!uniqueSources.contains(source)) {
4829 newSources = oldSources +
"," + source;
4831 newSources = oldSources;
4834 newSources = source;
4836 if (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.BYTE != valueType) {
4837 String update =
"UPDATE blackboard_attributes SET source = '" + newSources +
"' WHERE"
4838 +
" artifact_id = " + attr.getArtifactID()
4839 +
" AND attribute_type_id = " + attr.getAttributeType().getTypeID()
4840 +
" AND value_type = " + attr.getAttributeType().getValueType().getType()
4841 +
" AND " + valueClause +
";";
4842 connection.executeUpdate(updateStmt, update);
4849 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ATTR_BY_VALUE_BYTE);
4850 statement.clearParameters();
4851 statement.setString(1, newSources);
4852 statement.setLong(2, attr.getArtifactID());
4853 statement.setLong(3, attr.getAttributeType().getTypeID());
4854 statement.setBytes(4, attr.getValueBytes());
4855 connection.executeUpdate(statement);
4858 connection.commitTransaction();
4860 }
catch (SQLException ex) {
4861 rollbackTransaction(connection);
4862 throw new TskCoreException(String.format(
"Error adding source module to attribute %s", attr.getDisplayString()), ex);
4864 closeResultSet(result);
4865 closeStatement(updateStmt);
4866 closeStatement(queryStmt);
4867 closeConnection(connection);
4891 throw new TskCoreException(
"Error adding artifact type: " + attrTypeString, ex);
4967 }
catch (BlackboardException ex) {
4968 throw new TskCoreException(
"Error getting or adding artifact type with name: " + artifactTypeName, ex);
5002 CaseDbConnection connection = null;
5004 ResultSet rs = null;
5007 connection = connections.getConnection();
5008 s = connection.createStatement();
5009 rs = connection.executeQuery(s,
"SELECT blackboard_attributes.artifact_id AS artifact_id, "
5010 +
"blackboard_attributes.source AS source, blackboard_attributes.context AS context, "
5011 +
"blackboard_attributes.attribute_type_id AS attribute_type_id, "
5012 +
"blackboard_attributes.value_type AS value_type, blackboard_attributes.value_byte AS value_byte, "
5013 +
"blackboard_attributes.value_text AS value_text, blackboard_attributes.value_int32 AS value_int32, "
5014 +
"blackboard_attributes.value_int64 AS value_int64, blackboard_attributes.value_double AS value_double "
5015 +
"FROM blackboard_attributes " + whereClause);
5016 ArrayList<BlackboardAttribute> matches =
new ArrayList<>();
5022 rs.getLong(
"artifact_id"),
5024 rs.getString(
"source"),
5025 rs.getString(
"context"),
5026 rs.getInt(
"value_int32"),
5027 rs.getLong(
"value_int64"),
5028 rs.getDouble(
"value_double"),
5029 rs.getString(
"value_text"),
5030 rs.getBytes(
"value_byte"), this
5035 }
catch (SQLException ex) {
5036 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
5040 closeConnection(connection);
5057 String query =
"SELECT blackboard_artifacts.artifact_id AS artifact_id, "
5058 +
"blackboard_artifacts.obj_id AS obj_id, blackboard_artifacts.artifact_obj_id AS artifact_obj_id, blackboard_artifacts.data_source_obj_id AS data_source_obj_id, blackboard_artifacts.artifact_type_id AS artifact_type_id, "
5059 +
"blackboard_artifacts.review_status_id AS review_status_id "
5060 +
"FROM blackboard_artifacts " + whereClause;
5062 try (CaseDbConnection connection = connections.getConnection(); Statement statement = connection.createStatement(); ResultSet resultSet = statement.executeQuery(query)) {
5064 List<Long> analysisArtifactObjIds =
new ArrayList<>();
5065 List<Long> dataArtifactObjIds =
new ArrayList<>();
5066 while (resultSet.next()) {
5069 analysisArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
5071 dataArtifactObjIds.add(resultSet.getLong(
"artifact_obj_id"));
5075 ArrayList<BlackboardArtifact> matches =
new ArrayList<>();
5076 if (!analysisArtifactObjIds.isEmpty()) {
5080 if (!dataArtifactObjIds.isEmpty()) {
5085 }
catch (SQLException ex) {
5086 throw new TskCoreException(
"Error getting attributes using this where clause: " + whereClause, ex);
5110 throw new TskCoreException(
"Unknown artifact type for id: " + artifactTypeID);
5113 Category category = type.getCategory();
5114 if (category == null) {
5115 throw new TskCoreException(String.format(
"No category for %s (id: %d)",
5116 type.getDisplayName() == null ?
"<null>" : type.getDisplayName(),
5121 if (content == null) {
5122 throw new TskCoreException(
"No content found for object id: " + obj_id);
5126 case ANALYSIS_RESULT:
5128 .getAnalysisResult();
5132 throw new TskCoreException(
"Unknown category type: " + category.
getName());
5149 @SuppressWarnings(
"deprecation")
5170 @SuppressWarnings(
"deprecation")
5173 try (CaseDbConnection connection = connections.getConnection()) {
5174 return newBlackboardArtifact(artifactTypeID, obj_id, type.getTypeName(), type.getDisplayName(), data_source_obj_id, connection);
5179 private BlackboardArtifact
newBlackboardArtifact(
int artifact_type_id,
long obj_id, String artifactTypeName, String artifactDisplayName)
throws TskCoreException {
5180 try (CaseDbConnection connection = connections.getConnection()) {
5181 long data_source_obj_id = getDataSourceObjectId(connection, obj_id);
5182 return this.
newBlackboardArtifact(artifact_type_id, obj_id, artifactTypeName, artifactDisplayName, data_source_obj_id, connection);
5186 PreparedStatement createInsertArtifactStatement(
int artifact_type_id,
long obj_id,
long artifact_obj_id,
long data_source_obj_id, CaseDbConnection connection)
throws TskCoreException, SQLException {
5188 PreparedStatement statement;
5190 statement = connection.getPreparedStatement(PREPARED_STATEMENT.POSTGRESQL_INSERT_ARTIFACT, Statement.RETURN_GENERATED_KEYS);
5191 statement.clearParameters();
5192 statement.setLong(1, obj_id);
5193 statement.setLong(2, artifact_obj_id);
5194 statement.setLong(3, data_source_obj_id);
5195 statement.setInt(4, artifact_type_id);
5197 statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_ARTIFACT, Statement.RETURN_GENERATED_KEYS);
5198 statement.clearParameters();
5199 this.nextArtifactId++;
5200 statement.setLong(1, this.nextArtifactId);
5201 statement.setLong(2, obj_id);
5202 statement.setLong(3, artifact_obj_id);
5203 statement.setLong(4, data_source_obj_id);
5204 statement.setInt(5, artifact_type_id);
5227 private BlackboardArtifact
newBlackboardArtifact(
int artifact_type_id,
long obj_id, String artifactTypeName, String artifactDisplayName,
long data_source_obj_id, CaseDbConnection connection)
throws TskCoreException {
5230 if (type.getCategory() == BlackboardArtifact.Category.ANALYSIS_RESULT) {
5231 return blackboard.
newAnalysisResult(type, obj_id, data_source_obj_id, Score.SCORE_UNKNOWN, null, null, null, Collections.emptyList()).getAnalysisResult();
5233 return blackboard.
newDataArtifact(type, obj_id, data_source_obj_id, Collections.emptyList(), null);
5235 }
catch (BlackboardException ex) {
5236 throw new TskCoreException(
"Error creating a blackboard artifact", ex);
5258 AnalysisResult newAnalysisResult(BlackboardArtifact.Type artifactType,
long objId, Long dataSourceObjId, Score score, String conclusion, String configuration, String justification, CaseDbConnection connection)
throws TskCoreException {
5260 if (artifactType.getCategory() != BlackboardArtifact.Category.ANALYSIS_RESULT) {
5261 throw new TskCoreException(String.format(
"Artifact type (name = %s) is not of the AnalysisResult category. ", artifactType.getTypeName()));
5268 long artifactObjId = addObject(objId, TskData.ObjectType.ARTIFACT.getObjectType(), connection);
5271 PreparedStatement insertArtifactstatement;
5272 ResultSet resultSet = null;
5274 insertArtifactstatement = createInsertArtifactStatement(artifactType.getTypeID(), objId, artifactObjId, dataSourceObjId, connection);
5275 connection.executeUpdate(insertArtifactstatement);
5276 resultSet = insertArtifactstatement.getGeneratedKeys();
5278 artifactID = resultSet.getLong(1);
5281 if (score.getSignificance() != Score.Significance.UNKNOWN
5282 || !StringUtils.isBlank(conclusion)
5283 || !StringUtils.isBlank(configuration)
5284 || !StringUtils.isBlank(justification)) {
5286 PreparedStatement analysisResultsStatement;
5288 analysisResultsStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_ANALYSIS_RESULT);
5289 analysisResultsStatement.clearParameters();
5291 analysisResultsStatement.setLong(1, artifactObjId);
5292 analysisResultsStatement.setString(2, (conclusion != null) ? conclusion :
"");
5293 analysisResultsStatement.setInt(3, score.getSignificance().getId());
5294 analysisResultsStatement.setInt(4, score.getPriority().getId());
5295 analysisResultsStatement.setString(5, (configuration != null) ? configuration :
"");
5296 analysisResultsStatement.setString(6, (justification != null) ? justification :
"");
5298 connection.executeUpdate(analysisResultsStatement);
5301 return new AnalysisResult(
this, artifactID, objId, artifactObjId, dataSourceObjId, artifactType.getTypeID(),
5302 artifactType.getTypeName(), artifactType.getDisplayName(),
5303 BlackboardArtifact.ReviewStatus.UNDECIDED,
true,
5304 score, (conclusion != null) ? conclusion :
"",
5305 (configuration != null) ? configuration :
"", (justification != null) ? justification :
"");
5308 closeResultSet(resultSet);
5311 }
catch (SQLException ex) {
5312 throw new TskCoreException(
"Error creating a analysis result", ex);
5330 boolean getContentHasChildren(Content content)
throws TskCoreException {
5331 CaseDbConnection connection = null;
5332 ResultSet rs = null;
5335 connection = connections.getConnection();
5338 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
5339 statement.clearParameters();
5340 statement.setLong(1, content.getId());
5341 rs = connection.executeQuery(statement);
5342 boolean hasChildren =
false;
5344 hasChildren = rs.getInt(
"count") > 0;
5347 }
catch (SQLException e) {
5348 throw new TskCoreException(
"Error checking for children of parent " + content, e);
5351 closeConnection(connection);
5368 int getContentChildrenCount(Content content)
throws TskCoreException {
5370 if (!this.getHasChildren(content)) {
5374 CaseDbConnection connection = null;
5375 ResultSet rs = null;
5378 connection = connections.getConnection();
5381 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CHILD_OBJECTS_BY_PARENT);
5382 statement.clearParameters();
5383 statement.setLong(1, content.getId());
5384 rs = connection.executeQuery(statement);
5385 int countChildren = -1;
5387 countChildren = rs.getInt(
"count");
5389 return countChildren;
5390 }
catch (SQLException e) {
5391 throw new TskCoreException(
"Error checking for children of parent " + content, e);
5394 closeConnection(connection);
5410 List<Content> getAbstractFileChildren(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
5411 CaseDbConnection connection = null;
5412 ResultSet rs = null;
5415 connection = connections.getConnection();
5417 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT_AND_TYPE);
5418 statement.clearParameters();
5419 long parentId = parent.getId();
5420 statement.setLong(1, parentId);
5421 statement.setShort(2, type.getFileType());
5422 rs = connection.executeQuery(statement);
5423 return fileChildren(rs, connection, parentId);
5424 }
catch (SQLException ex) {
5425 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
5428 closeConnection(connection);
5442 List<Content> getAbstractFileChildren(Content parent)
throws TskCoreException {
5443 CaseDbConnection connection = null;
5444 ResultSet rs = null;
5447 connection = connections.getConnection();
5449 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT);
5450 statement.clearParameters();
5451 long parentId = parent.getId();
5452 statement.setLong(1, parentId);
5453 rs = connection.executeQuery(statement);
5454 return fileChildren(rs, connection, parentId);
5455 }
catch (SQLException ex) {
5456 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
5459 closeConnection(connection);
5475 List<Long> getAbstractFileChildrenIds(Content parent, TSK_DB_FILES_TYPE_ENUM type)
throws TskCoreException {
5476 CaseDbConnection connection = null;
5477 ResultSet rs = null;
5480 connection = connections.getConnection();
5482 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT_AND_TYPE);
5483 statement.clearParameters();
5484 statement.setLong(1, parent.getId());
5485 statement.setShort(2, type.getFileType());
5486 rs = connection.executeQuery(statement);
5487 List<Long> children =
new ArrayList<Long>();
5489 children.add(rs.getLong(
"obj_id"));
5492 }
catch (SQLException ex) {
5493 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
5496 closeConnection(connection);
5510 List<Long> getAbstractFileChildrenIds(Content parent)
throws TskCoreException {
5511 CaseDbConnection connection = null;
5512 ResultSet rs = null;
5515 connection = connections.getConnection();
5517 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_IDS_BY_PARENT);
5518 statement.clearParameters();
5519 statement.setLong(1, parent.getId());
5520 rs = connection.executeQuery(statement);
5521 List<Long> children =
new ArrayList<Long>();
5523 children.add(rs.getLong(
"obj_id"));
5526 }
catch (SQLException ex) {
5527 throw new TskCoreException(
"Error getting AbstractFile children for Content", ex);
5530 closeConnection(connection);
5545 List<Long> getBlackboardArtifactChildrenIds(Content parent)
throws TskCoreException {
5546 CaseDbConnection connection = null;
5547 ResultSet rs = null;
5550 connection = connections.getConnection();
5552 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_OBJECTIDS_BY_PARENT);
5553 statement.clearParameters();
5554 statement.setLong(1, parent.getId());
5555 rs = connection.executeQuery(statement);
5556 List<Long> children =
new ArrayList<Long>();
5558 children.add(rs.getLong(
"obj_id"));
5561 }
catch (SQLException ex) {
5562 throw new TskCoreException(
"Error getting children for BlackboardArtifact", ex);
5565 closeConnection(connection);
5579 List<Content> getBlackboardArtifactChildren(Content parent)
throws TskCoreException {
5580 long parentId = parent.getId();
5581 List<Content> lc =
new ArrayList<>();
5583 lc.addAll(blackboard.getDataArtifactsBySource(parentId));
5595 Collection<ObjectInfo> getChildrenInfo(Content c)
throws TskCoreException {
5596 CaseDbConnection connection = null;
5598 ResultSet rs = null;
5601 connection = connections.getConnection();
5602 s = connection.createStatement();
5603 rs = connection.executeQuery(s,
"SELECT tsk_objects.obj_id AS obj_id, tsk_objects.type AS type "
5604 +
"FROM tsk_objects LEFT JOIN tsk_files "
5605 +
"ON tsk_objects.obj_id = tsk_files.obj_id "
5606 +
"WHERE tsk_objects.par_obj_id = " + c.getId()
5607 +
" ORDER BY tsk_objects.obj_id");
5608 Collection<ObjectInfo> infos =
new ArrayList<ObjectInfo>();
5610 infos.add(
new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type"))));
5613 }
catch (SQLException ex) {
5614 throw new TskCoreException(
"Error getting Children Info for Content", ex);
5618 closeConnection(connection);
5633 ObjectInfo getParentInfo(Content c)
throws TskCoreException {
5634 return getParentInfo(c.getId());
5647 ObjectInfo getParentInfo(
long contentId)
throws TskCoreException {
5649 CaseDbConnection connection = null;
5651 ResultSet rs = null;
5653 connection = connections.getConnection();
5654 s = connection.createStatement();
5655 rs = connection.executeQuery(s,
"SELECT parent.obj_id AS obj_id, parent.type AS type "
5656 +
"FROM tsk_objects AS parent INNER JOIN tsk_objects AS child "
5657 +
"ON child.par_obj_id = parent.obj_id "
5658 +
"WHERE child.obj_id = " + contentId);
5660 return new ObjectInfo(rs.getLong(
"obj_id"), ObjectType.valueOf(rs.getShort(
"type")));
5664 }
catch (SQLException ex) {
5665 throw new TskCoreException(
"Error getting Parent Info for Content: " + contentId, ex);
5669 closeConnection(connection);
5684 Directory getParentDirectory(FsContent fsc)
throws TskCoreException {
5689 ObjectInfo parentInfo = getParentInfo(fsc);
5690 if (parentInfo == null) {
5693 Directory parent = null;
5694 if (parentInfo.type == ObjectType.ABSTRACTFILE) {
5695 parent = getDirectoryById(parentInfo.id, fsc.getFileSystem());
5697 throw new TskCoreException(
"Parent of FsContent (id: " + fsc.getId() +
") has wrong type to be directory: " + parentInfo.type);
5716 Content content = frequentlyUsedContentMap.get(
id);
5717 if (null != content) {
5724 CaseDbConnection connection = null;
5726 ResultSet rs = null;
5729 connection = connections.getConnection();
5730 s = connection.createStatement();
5731 rs = connection.executeQuery(s,
"SELECT * FROM tsk_objects WHERE obj_id = " +
id +
" LIMIT 1");
5735 parentId = rs.getLong(
"par_obj_id");
5737 }
catch (SQLException ex) {
5738 throw new TskCoreException(
"Error getting Content by ID.", ex);
5742 closeConnection(connection);
5750 frequentlyUsedContentMap.put(
id, content);
5753 content = getVolumeSystemById(
id, parentId);
5756 content = getVolumeById(
id, parentId);
5757 frequentlyUsedContentMap.put(
id, content);
5760 content = getPoolById(
id, parentId);
5763 content = getFileSystemById(
id, parentId);
5764 frequentlyUsedContentMap.put(
id, content);
5775 frequentlyUsedContentMap.put(
id, content);
5804 String getFilePath(
long id) {
5806 String filePath = null;
5807 CaseDbConnection connection = null;
5808 ResultSet rs = null;
5811 connection = connections.getConnection();
5813 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_FOR_FILE);
5814 statement.clearParameters();
5815 statement.setLong(1,
id);
5816 rs = connection.executeQuery(statement);
5818 filePath = rs.getString(
"path");
5820 }
catch (SQLException | TskCoreException ex) {
5821 logger.log(Level.SEVERE,
"Error getting file path for file " +
id, ex);
5824 closeConnection(connection);
5837 TskData.EncodingType getEncodingType(
long id) {
5839 TskData.EncodingType type = TskData.EncodingType.NONE;
5840 CaseDbConnection connection = null;
5841 ResultSet rs = null;
5844 connection = connections.getConnection();
5845 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ENCODING_FOR_FILE);
5846 statement.clearParameters();
5847 statement.setLong(1,
id);
5848 rs = connection.executeQuery(statement);
5850 type = TskData.EncodingType.valueOf(rs.getInt(1));
5852 }
catch (SQLException | TskCoreException ex) {
5853 logger.log(Level.SEVERE,
"Error getting encoding type for file " +
id, ex);
5856 closeConnection(connection);
5870 String getFileParentPath(
long objectId, CaseDbConnection connection) {
5871 String parentPath = null;
5873 ResultSet rs = null;
5875 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_PATH_FOR_FILE);
5876 statement.clearParameters();
5877 statement.setLong(1, objectId);
5878 rs = connection.executeQuery(statement);
5880 parentPath = rs.getString(
"parent_path");
5882 }
catch (SQLException ex) {
5883 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
5899 String getFileName(
long objectId, CaseDbConnection connection) {
5900 String fileName = null;
5902 ResultSet rs = null;
5904 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_NAME);
5905 statement.clearParameters();
5906 statement.setLong(1, objectId);
5907 rs = connection.executeQuery(statement);
5909 fileName = rs.getString(
"name");
5911 }
catch (SQLException ex) {
5912 logger.log(Level.SEVERE,
"Error getting file parent_path for file " + objectId, ex);
5930 DerivedFile.DerivedMethod getDerivedMethod(
long id)
throws TskCoreException {
5932 DerivedFile.DerivedMethod method = null;
5933 CaseDbConnection connection = null;
5934 ResultSet rs1 = null;
5935 ResultSet rs2 = null;
5938 connection = connections.getConnection();
5940 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_DERIVED_FILE);
5941 statement.clearParameters();
5942 statement.setLong(1,
id);
5943 rs1 = connection.executeQuery(statement);
5945 int method_id = rs1.getInt(
"derived_id");
5946 String rederive = rs1.getString(
"rederive");
5947 method =
new DerivedFile.DerivedMethod(method_id, rederive);
5948 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_DERIVATION_METHOD);
5949 statement.clearParameters();
5950 statement.setInt(1, method_id);
5951 rs2 = connection.executeQuery(statement);
5953 method.setToolName(rs2.getString(
"tool_name"));
5954 method.setToolVersion(rs2.getString(
"tool_version"));
5955 method.setOther(rs2.getString(
"other"));
5958 }
catch (SQLException e) {
5959 logger.log(Level.SEVERE,
"Error getting derived method for file: " +
id, e);
5961 closeResultSet(rs2);
5962 closeResultSet(rs1);
5963 closeConnection(connection);
5980 CaseDbConnection connection = connections.getConnection();
5984 closeConnection(connection);
6002 ResultSet rs = null;
6004 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_BY_ID);
6005 statement.clearParameters();
6006 statement.setLong(1, objectId);
6007 rs = connection.executeQuery(statement);
6008 List<AbstractFile> files = resultSetToAbstractFiles(rs, connection);
6009 if (files.size() > 0) {
6010 return files.get(0);
6014 }
catch (SQLException ex) {
6015 throw new TskCoreException(
"Error getting file by id, id = " + objectId, ex);
6035 CaseDbConnection connection = null;
6036 ResultSet rs = null;
6039 connection = connections.getConnection();
6042 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TYPE_BY_ARTIFACT_OBJ_ID);
6043 statement.clearParameters();
6044 statement.setLong(1,
id);
6046 rs = connection.executeQuery(statement);
6048 throw new TskCoreException(
"Error getting artifacttype for artifact with artifact_obj_id = " +
id);
6053 switch (artifactType.getCategory()) {
6054 case ANALYSIS_RESULT:
6059 throw new TskCoreException(String.format(
"Unknown artifact category for artifact with artifact_obj_id = %d, and artifact type = %s",
id, artifactType.getTypeName()));
6062 }
catch (SQLException ex) {
6063 throw new TskCoreException(
"Error getting artifacts by artifact_obj_id, artifact_obj_id = " +
id, ex);
6066 closeConnection(connection);
6086 String query =
"SELECT artifact_type_id, artifact_obj_id FROM blackboard_artifacts WHERE artifact_id = " + id;
6089 try (CaseDbConnection connection = connections.getConnection();
6090 Statement statement = connection.createStatement();
6091 ResultSet resultSet = statement.executeQuery(query);) {
6092 if (resultSet != null && resultSet.next()) {
6094 long artifactObjId = resultSet.getLong(
"artifact_obj_id");
6095 switch (artifactType.getCategory()) {
6096 case ANALYSIS_RESULT:
6103 }
catch (SQLException ex) {
6104 throw new TskCoreException(
"Error getting artifacts by artifact id, artifact id = " +
id, ex);
6122 private long getFileSystemId(
long fileId, CaseDbConnection connection) {
6124 ResultSet rs = null;
6127 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILE_SYSTEM_BY_OBJECT);
6128 statement.clearParameters();
6129 statement.setLong(1, fileId);
6130 rs = connection.executeQuery(statement);
6132 ret = rs.getLong(
"fs_obj_id");
6137 }
catch (SQLException e) {
6138 logger.log(Level.SEVERE,
"Error checking file system id of a file, id = " + fileId, e);
6158 String query = String.format(
"SELECT COUNT(*) AS count FROM tsk_files WHERE obj_id = %d AND data_source_obj_id = %d", fileId, dataSource.getId());
6159 CaseDbConnection connection = null;
6160 Statement statement = null;
6161 ResultSet resultSet = null;
6164 connection = connections.getConnection();
6165 statement = connection.createStatement();
6166 resultSet = connection.executeQuery(statement, query);
6168 return (resultSet.getLong(
"count") > 0L);
6169 }
catch (SQLException ex) {
6170 throw new TskCoreException(String.format(
"Error executing query %s", query), ex);
6172 closeResultSet(resultSet);
6173 closeStatement(statement);
6174 closeConnection(connection);
6188 private static boolean containsLikeWildcard(String str) {
6192 return str.contains(
"%") || str.contains(
"_");
6207 public List<AbstractFile>
findFiles(
Content dataSource, String fileName)
throws TskCoreException {
6209 if (!containsLikeWildcard(fileName)) {
6213 List<AbstractFile> files =
new ArrayList<>();
6214 CaseDbConnection connection = null;
6215 ResultSet resultSet = null;
6218 connection = connections.getConnection();
6220 PreparedStatement statement;
6221 if (ext.isEmpty()) {
6222 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_NAME);
6223 statement.clearParameters();
6224 statement.setString(1, fileName.toLowerCase());
6225 statement.setLong(2, dataSource.getId());
6227 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_EXTENSION_AND_DATA_SOURCE_AND_NAME);
6228 statement.clearParameters();
6229 statement.setString(1, ext);
6230 statement.setString(2, fileName.toLowerCase());
6231 statement.setLong(3, dataSource.getId());
6234 resultSet = connection.executeQuery(statement);
6235 files.addAll(resultSetToAbstractFiles(resultSet, connection));
6236 }
catch (SQLException e) {
6237 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles.exception.msg3.text"), e);
6239 closeResultSet(resultSet);
6240 closeConnection(connection);
6259 public List<AbstractFile>
findFiles(
Content dataSource, String fileName, String dirSubString)
throws TskCoreException {
6261 if (!containsLikeWildcard(fileName)) {
6265 List<AbstractFile> files =
new ArrayList<>();
6266 CaseDbConnection connection = null;
6267 ResultSet resultSet = null;
6270 connection = connections.getConnection();
6271 PreparedStatement statement;
6272 if (ext.isEmpty()) {
6273 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME);
6274 statement.clearParameters();
6275 statement.setString(1, fileName.toLowerCase());
6276 statement.setString(2,
"%" + dirSubString.toLowerCase() +
"%");
6277 statement.setLong(3, dataSource.getId());
6279 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_EXTENSION_AND_DATA_SOURCE_AND_PARENT_PATH_AND_NAME);
6280 statement.clearParameters();
6281 statement.setString(1, ext);
6282 statement.setString(2, fileName.toLowerCase());
6283 statement.setString(3,
"%" + dirSubString.toLowerCase() +
"%");
6284 statement.setLong(4, dataSource.getId());
6287 resultSet = connection.executeQuery(statement);
6288 files.addAll(resultSetToAbstractFiles(resultSet, connection));
6289 }
catch (SQLException e) {
6290 throw new TskCoreException(bundle.getString(
"SleuthkitCase.findFiles3.exception.msg3.text"), e);
6292 closeResultSet(resultSet);
6293 closeConnection(connection);
6318 if (null != localTrans) {
6321 }
catch (TskCoreException ex2) {
6322 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
6340 long addObject(
long parentId,
int objectType, CaseDbConnection connection)
throws SQLException {
6341 ResultSet resultSet = null;
6345 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_OBJECT, Statement.RETURN_GENERATED_KEYS);
6346 statement.clearParameters();
6347 if (parentId != 0) {
6348 statement.setLong(1, parentId);
6350 statement.setNull(1, java.sql.Types.BIGINT);
6352 statement.setInt(2, objectType);
6353 connection.executeUpdate(statement);
6354 resultSet = statement.getGeneratedKeys();
6356 if (resultSet.next()) {
6357 if (parentId != 0) {
6358 setHasChildren(parentId);
6360 return resultSet.getLong(1);
6362 throw new SQLException(
"Error inserting object with parent " + parentId +
" into tsk_objects");
6365 closeResultSet(resultSet);
6388 if (transaction == null) {
6389 throw new TskCoreException(
"Passed null CaseDbTransaction");
6392 ResultSet resultSet = null;
6395 CaseDbConnection connection = transaction.getConnection();
6400 if (isRootDirectory((AbstractFile) parent, transaction)) {
6401 if (parent.
getName().isEmpty()) {
6404 parentPath =
"/" + parent.
getName() +
"/";
6407 parentPath = ((AbstractFile) parent).getParentPath() + parent.
getName() +
"/";
6421 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6422 statement.clearParameters();
6423 statement.setLong(1, newObjId);
6426 Long fileSystemObjectId = null;
6427 if (0 != parentId) {
6428 fileSystemObjectId = this.getFileSystemId(parentId, connection);
6429 if (fileSystemObjectId != -1) {
6430 statement.setLong(2, fileSystemObjectId);
6432 statement.setNull(2, java.sql.Types.BIGINT);
6433 fileSystemObjectId = null;
6436 statement.setNull(2, java.sql.Types.BIGINT);
6440 statement.setString(3, directoryName);
6444 statement.setShort(5, (
short) 1);
6448 statement.setShort(6, dirType.
getValue());
6450 statement.setShort(7, metaType.
getValue());
6454 statement.setShort(8, dirFlag.
getValue());
6457 statement.setShort(9, metaFlags);
6460 statement.setLong(10, 0);
6463 statement.setNull(11, java.sql.Types.BIGINT);
6464 statement.setNull(12, java.sql.Types.BIGINT);
6465 statement.setNull(13, java.sql.Types.BIGINT);
6466 statement.setNull(14, java.sql.Types.BIGINT);
6468 statement.setNull(15, java.sql.Types.VARCHAR);
6469 statement.setNull(16, java.sql.Types.VARCHAR);
6470 statement.setNull(17, java.sql.Types.VARCHAR);
6473 statement.setNull(19, java.sql.Types.VARCHAR);
6476 statement.setString(20, parentPath);
6479 long dataSourceObjectId;
6480 if (0 == parentId) {
6481 dataSourceObjectId = newObjId;
6483 dataSourceObjectId = getDataSourceObjectId(connection, parentId);
6485 statement.setLong(21, dataSourceObjectId);
6488 statement.setString(22, null);
6490 statement.setString(23,
OsAccount.NO_OWNER_ID);
6491 statement.setNull(24, java.sql.Types.BIGINT);
6494 connection.executeUpdate(statement);
6496 return new VirtualDirectory(
this, newObjId, dataSourceObjectId, fileSystemObjectId, directoryName, dirType,
6499 }
catch (SQLException e) {
6500 throw new TskCoreException(
"Error creating virtual directory '" + directoryName +
"'", e);
6502 closeResultSet(resultSet);
6524 }
catch (TskCoreException ex) {
6527 }
catch (TskCoreException ex2) {
6528 logger.log(Level.SEVERE, String.format(
"Failed to rollback transaction after exception: %s", ex.getMessage()), ex2);
6552 if (transaction == null) {
6553 throw new TskCoreException(
"Passed null CaseDbTransaction");
6556 ResultSet resultSet = null;
6559 CaseDbConnection connection = transaction.getConnection();
6562 if ((parent == null) || isRootDirectory(parent, transaction)) {
6575 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6576 statement.clearParameters();
6577 statement.setLong(1, newObjId);
6580 statement.setNull(2, java.sql.Types.BIGINT);
6583 statement.setString(3, directoryName);
6587 statement.setShort(5, (
short) 1);
6591 statement.setShort(6, dirType.
getValue());
6593 statement.setShort(7, metaType.
getValue());
6597 statement.setShort(8, dirFlag.
getValue());
6600 statement.setShort(9, metaFlags);
6603 statement.setLong(10, 0);
6606 statement.setNull(11, java.sql.Types.BIGINT);
6607 statement.setNull(12, java.sql.Types.BIGINT);
6608 statement.setNull(13, java.sql.Types.BIGINT);
6609 statement.setNull(14, java.sql.Types.BIGINT);
6611 statement.setNull(15, java.sql.Types.VARCHAR);
6612 statement.setNull(16, java.sql.Types.VARCHAR);
6613 statement.setNull(17, java.sql.Types.VARCHAR);
6616 statement.setNull(19, java.sql.Types.VARCHAR);
6619 statement.setString(20, parentPath);
6622 long dataSourceObjectId = getDataSourceObjectId(connection, parentId);
6623 statement.setLong(21, dataSourceObjectId);
6626 statement.setString(22, null);
6628 statement.setString(23,
OsAccount.NO_OWNER_ID);
6629 statement.setNull(24, java.sql.Types.BIGINT);
6632 connection.executeUpdate(statement);
6634 return new LocalDirectory(
this, newObjId, dataSourceObjectId, directoryName, dirType,
6637 }
catch (SQLException e) {
6638 throw new TskCoreException(
"Error creating local directory '" + directoryName +
"'", e);
6640 closeResultSet(resultSet);
6689 Statement statement = null;
6691 CaseDbConnection connection = transaction.getConnection();
6704 statement = connection.createStatement();
6705 statement.executeUpdate(
"INSERT INTO data_source_info (obj_id, device_id, time_zone, host_id) "
6706 +
"VALUES(" + newObjId +
", '" + deviceId +
"', '" + timeZone +
"', " + host.getHostId() +
");");
6715 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
6716 preparedStatement.clearParameters();
6717 preparedStatement.setLong(1, newObjId);
6718 preparedStatement.setNull(2, java.sql.Types.BIGINT);
6719 preparedStatement.setString(3, rootDirectoryName);
6721 preparedStatement.setShort(5, (
short) 1);
6725 preparedStatement.setShort(7, metaType.
getValue());
6727 preparedStatement.setShort(8, dirFlag.
getValue());
6730 preparedStatement.setShort(9, metaFlags);
6731 preparedStatement.setLong(10, 0);
6732 preparedStatement.setNull(11, java.sql.Types.BIGINT);
6733 preparedStatement.setNull(12, java.sql.Types.BIGINT);
6734 preparedStatement.setNull(13, java.sql.Types.BIGINT);
6735 preparedStatement.setNull(14, java.sql.Types.BIGINT);
6736 preparedStatement.setNull(15, java.sql.Types.VARCHAR);
6737 preparedStatement.setNull(16, java.sql.Types.VARCHAR);
6738 preparedStatement.setNull(17, java.sql.Types.VARCHAR);
6740 preparedStatement.setNull(19, java.sql.Types.VARCHAR);
6741 String parentPath =
"/";
6742 preparedStatement.setString(20, parentPath);
6743 preparedStatement.setLong(21, newObjId);
6744 preparedStatement.setString(22, null);
6745 preparedStatement.setString(23,
OsAccount.NO_OWNER_ID);
6746 preparedStatement.setNull(24, java.sql.Types.BIGINT);
6750 connection.executeUpdate(preparedStatement);
6752 return new LocalFilesDataSource(
this, newObjId, newObjId, deviceId, rootDirectoryName, dirType, metaType, dirFlag, metaFlags, timeZone, null, null, null,
FileKnown.
UNKNOWN, parentPath);
6754 }
catch (SQLException ex) {
6755 throw new TskCoreException(String.format(
"Error creating local files data source with device id %s and directory name %s", deviceId, rootDirectoryName), ex);
6757 closeStatement(statement);
6781 String timezone, String md5, String sha1, String sha256,
6784 return addImage(type, sectorSize, size, displayName, imagePaths, timezone, md5, sha1, sha256, deviceId, null, transaction);
6808 String timezone, String md5, String sha1, String sha256,
6809 String deviceId,
Host host,
6811 Statement statement = null;
6814 CaseDbConnection connection = transaction.getConnection();
6819 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_INFO);
6820 preparedStatement.clearParameters();
6821 preparedStatement.setLong(1, newObjId);
6822 preparedStatement.setShort(2, (
short) type.getValue());
6823 preparedStatement.setLong(3, sectorSize);
6824 preparedStatement.setString(4, timezone);
6826 long savedSize = size < 0 ? 0 : size;
6827 preparedStatement.setLong(5, savedSize);
6828 preparedStatement.setString(6, md5);
6829 preparedStatement.setString(7, sha1);
6830 preparedStatement.setString(8, sha256);
6831 preparedStatement.setString(9, displayName);
6832 connection.executeUpdate(preparedStatement);
6835 for (
int i = 0; i < imagePaths.size(); i++) {
6836 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
6837 preparedStatement.clearParameters();
6838 preparedStatement.setLong(1, newObjId);
6839 preparedStatement.setString(2, imagePaths.get(i));
6840 preparedStatement.setLong(3, i);
6841 connection.executeUpdate(preparedStatement);
6845 String name = displayName;
6846 if (name == null || name.isEmpty()) {
6847 if (imagePaths.size() > 0) {
6848 String path = imagePaths.get(0);
6849 name = (
new java.io.File(path)).getName();
6857 if (name.isEmpty()) {
6865 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_DATA_SOURCE_INFO);
6866 statement = connection.createStatement();
6867 preparedStatement.setLong(1, newObjId);
6868 preparedStatement.setString(2, deviceId);
6869 preparedStatement.setString(3, timezone);
6870 preparedStatement.setLong(4,
new Date().getTime());
6871 preparedStatement.setLong(5, host.getHostId());
6872 connection.executeUpdate(preparedStatement);
6875 return new Image(
this, newObjId, type.getValue(), deviceId, sectorSize, name,
6876 imagePaths.toArray(
new String[imagePaths.size()]), timezone, md5, sha1, sha256, savedSize);
6877 }
catch (SQLException ex) {
6878 if (!imagePaths.isEmpty()) {
6879 throw new TskCoreException(String.format(
"Error adding image with path %s to database", imagePaths.get(0)), ex);
6881 throw new TskCoreException(String.format(
"Error adding image with display name %s to database", displayName), ex);
6884 closeStatement(statement);
6905 CaseDbConnection connection = transaction.getConnection();
6906 long newObjId = addObject(parentObjId,
TskData.
ObjectType.
VS.getObjectType(), connection);
6910 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_INFO);
6911 preparedStatement.clearParameters();
6912 preparedStatement.setLong(1, newObjId);
6913 preparedStatement.setShort(2, (
short) type.getVsType());
6914 preparedStatement.setLong(3, imgOffset);
6915 preparedStatement.setLong(4, blockSize);
6916 connection.executeUpdate(preparedStatement);
6919 return new VolumeSystem(
this, newObjId,
"", type.getVsType(), imgOffset, blockSize);
6920 }
catch (SQLException ex) {
6921 throw new TskCoreException(String.format(
"Error creating volume system with parent ID %d and image offset %d",
6922 parentObjId, imgOffset), ex);
6941 public Volume addVolume(
long parentObjId,
long addr,
long start,
long length, String desc,
6945 CaseDbConnection connection = transaction.getConnection();
6950 PreparedStatement preparedStatement;
6952 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_PART_POSTGRESQL);
6954 preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_VS_PART_SQLITE);
6956 preparedStatement.clearParameters();
6957 preparedStatement.setLong(1, newObjId);
6958 preparedStatement.setLong(2, addr);
6959 preparedStatement.setLong(3, start);
6960 preparedStatement.setLong(4, length);
6961 preparedStatement.setString(5, desc);
6962 preparedStatement.setShort(6, (
short) flags);
6963 connection.executeUpdate(preparedStatement);
6966 return new Volume(
this, newObjId, addr, start, length, flags, desc);
6967 }
catch (SQLException ex) {
6968 throw new TskCoreException(String.format(
"Error creating volume with address %d and parent ID %d", addr, parentObjId), ex);
6986 CaseDbConnection connection = transaction.getConnection();
6991 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_POOL_INFO);
6992 preparedStatement.clearParameters();
6993 preparedStatement.setLong(1, newObjId);
6994 preparedStatement.setShort(2, type.getValue());
6995 connection.executeUpdate(preparedStatement);
6998 return new Pool(
this, newObjId, type.getName(), type.getValue());
6999 }
catch (SQLException ex) {
7000 throw new TskCoreException(String.format(
"Error creating pool with type %d and parent ID %d", type.getValue(), parentObjId), ex);
7023 long rootInum,
long firstInum,
long lastInum, String displayName,
7027 CaseDbConnection connection = transaction.getConnection();
7028 long newObjId = addObject(parentObjId,
TskData.
ObjectType.
FS.getObjectType(), connection);
7031 long dataSourceId = getDataSourceObjectId(connection, newObjId);
7035 PreparedStatement preparedStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FS_INFO);
7036 preparedStatement.clearParameters();
7037 preparedStatement.setLong(1, newObjId);
7038 preparedStatement.setLong(2, dataSourceId);
7039 preparedStatement.setLong(3, imgOffset);
7040 preparedStatement.setInt(4, type.getValue());
7041 preparedStatement.setLong(5, blockSize);
7042 preparedStatement.setLong(6, blockCount);
7043 preparedStatement.setLong(7, rootInum);
7044 preparedStatement.setLong(8, firstInum);
7045 preparedStatement.setLong(9, lastInum);
7046 preparedStatement.setString(10, displayName);
7047 connection.executeUpdate(preparedStatement);
7050 return new FileSystem(
this, newObjId, displayName, imgOffset, type, blockSize, blockCount, rootInum,
7051 firstInum, lastInum);
7052 }
catch (SQLException ex) {
7053 throw new TskCoreException(String.format(
"Error creating file system with image offset %d and parent ID %d",
7054 imgOffset, parentObjId), ex);
7085 long metaAddr,
int metaSeq,
7088 long ctime,
long crtime,
long atime,
long mtime,
7089 boolean isFile,
Content parent)
throws TskCoreException {
7095 metaAddr, metaSeq, attrType, attrId, dirFlag, metaFlags, size,
7096 ctime, crtime, atime, mtime, null, null, null, isFile, parent,
7098 Collections.emptyList(), transaction);
7102 return fileSystemFile;
7104 if (null != transaction) {
7107 }
catch (TskCoreException ex2) {
7108 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
7153 long metaAddr,
int metaSeq,
7156 long ctime,
long crtime,
long atime,
long mtime,
7157 String md5Hash, String sha256Hash, String mimeType,
7158 boolean isFile,
Content parent, String ownerUid,
7159 OsAccount osAccount, List<Attribute> fileAttributes,
7166 dirFlag, metaFlags, size,
7167 ctime, crtime, atime, mtime,
7168 md5Hash, sha256Hash, null,
7170 isFile, parent, ownerUid,
7171 osAccount, fileAttributes,
7216 long metaAddr,
int metaSeq,
7219 long ctime,
long crtime,
long atime,
long mtime,
7220 String md5Hash, String sha256Hash, String sha1Hash,
7221 String mimeType,
boolean isFile,
7222 Content parent, String ownerUid,
7223 OsAccount osAccount, List<Attribute> fileAttributes,
7229 dirFlag, metaFlags, size,
7230 ctime, crtime, atime, mtime,
7231 md5Hash, sha256Hash, sha1Hash,
7233 isFile, parent, ownerUid,
7280 long metaAddr,
int metaSeq,
7283 long ctime,
long crtime,
long atime,
long mtime,
7284 String md5Hash, String sha256Hash, String sha1Hash,
7285 String mimeType,
boolean isFile,
7286 Content parent, String ownerUid,
7288 List<Attribute> fileAttributes,
7292 Statement queryStatement = null;
7293 String parentPath =
"/";
7295 CaseDbConnection connection = transaction.getConnection();
7302 AbstractFile parentFile = (AbstractFile) parent;
7303 if (isRootDirectory(parentFile, transaction)) {
7306 parentPath = parentFile.
getParentPath() + parent.getName() +
"/";
7312 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE_SYSTEM_FILE);
7313 statement.clearParameters();
7314 statement.setLong(1, objectId);
7315 statement.setLong(2, fsObjId);
7316 statement.setLong(3, dataSourceObjId);
7317 statement.setShort(4, (
short) attrType.getValue());
7318 statement.setInt(5, attrId);
7319 statement.setString(6, fileName);
7320 statement.setLong(7, metaAddr);
7321 statement.setInt(8, metaSeq);
7323 statement.setShort(10, (
short) 1);
7325 statement.setShort(11, dirType.
getValue());
7327 statement.setShort(12, metaType.
getValue());
7328 statement.setShort(13, dirFlag.getValue());
7329 statement.setShort(14, metaFlags);
7330 statement.setLong(15, size < 0 ? 0 : size);
7331 statement.setLong(16, ctime);
7332 statement.setLong(17, crtime);
7333 statement.setLong(18, atime);
7334 statement.setLong(19, mtime);
7335 statement.setString(20, md5Hash);
7336 statement.setString(21, sha256Hash);
7337 statement.setString(22, sha1Hash);
7338 statement.setString(23, mimeType);
7339 statement.setString(24, parentPath);
7340 final String extension = extractExtension(fileName);
7341 statement.setString(25, extension);
7342 statement.setString(26, ownerUid);
7343 if (null != osAccount) {
7344 statement.setLong(27, osAccount.getId());
7346 statement.setNull(27, java.sql.Types.BIGINT);
7348 statement.setLong(28, collected.getType());
7350 connection.executeUpdate(statement);
7352 Long osAccountId = (osAccount != null) ? osAccount.getId() : null;
7353 DerivedFile derivedFile =
new DerivedFile(
this, objectId, dataSourceObjId, fsObjId, fileName, dirType, metaType, dirFlag, metaFlags,
7354 size, ctime, crtime, atime, mtime, md5Hash, sha256Hash, sha1Hash, null, parentPath, null, parent.getId(), mimeType, null, extension, ownerUid, osAccountId);
7356 if (!timelineEventsDisabled.get()) {
7357 timelineManager.addEventsForNewFile(derivedFile, connection);
7360 for (
Attribute fileAttribute : fileAttributes) {
7361 fileAttribute.setAttributeParentId(objectId);
7362 fileAttribute.setCaseDatabase(
this);
7363 addFileAttribute(fileAttribute, connection);
7366 if (osAccount != null) {
7371 attrType, attrId, fileName, metaAddr, metaSeq,
7372 dirType, metaType, dirFlag, metaFlags,
7373 size, ctime, crtime, atime, mtime,
7374 (
short) 0, 0, 0, md5Hash, sha256Hash, sha1Hash, null, parentPath, mimeType,
7375 extension, ownerUid, osAccountId, collected, fileAttributes);
7377 }
catch (SQLException ex) {
7378 throw new TskCoreException(String.format(
"Failed to INSERT file system file %s (%s) with parent id %d in tsk_files table", fileName, parentPath, parent.getId()), ex);
7380 closeStatement(queryStatement);
7393 CaseDbConnection connection = null;
7395 ResultSet rs = null;
7398 connection = connections.getConnection();
7399 s = connection.createStatement();
7400 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE"
7402 +
" AND obj_id = data_source_obj_id"
7403 +
" ORDER BY dir_type, LOWER(name)");
7404 List<VirtualDirectory> virtDirRootIds =
new ArrayList<VirtualDirectory>();
7406 virtDirRootIds.add(virtualDirectory(rs, connection));
7408 return virtDirRootIds;
7409 }
catch (SQLException ex) {
7410 throw new TskCoreException(
"Error getting local files virtual folder id", ex);
7414 closeConnection(connection);
7432 assert (null != fileRanges);
7433 if (null == fileRanges) {
7434 throw new TskCoreException(
"TskFileRange object is null");
7437 assert (null != parent);
7438 if (null == parent) {
7439 throw new TskCoreException(
"Conent is null");
7444 parentPath = ((AbstractFile) parent).getParentPath() + parent.getName() +
'/';
7450 Statement statement = null;
7451 ResultSet resultSet = null;
7455 CaseDbConnection connection = transaction.getConnection();
7458 Long fileSystemObjectId;
7459 if (0 != parent.getId()) {
7460 fileSystemObjectId = this.getFileSystemId(parent.getId(), connection);
7461 if (fileSystemObjectId == -1) {
7462 fileSystemObjectId = null;
7465 fileSystemObjectId = null;
7468 List<LayoutFile> fileRangeLayoutFiles =
new ArrayList<>();
7476 long end_byte_in_parent = fileRange.getByteStart() + fileRange.getByteLen() - 1;
7486 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
7487 prepStmt.clearParameters();
7488 prepStmt.setLong(1, fileRangeId);
7489 if (fileSystemObjectId != null) {
7490 prepStmt.setLong(2, fileSystemObjectId);
7492 prepStmt.setNull(2, java.sql.Types.BIGINT);
7494 prepStmt.setString(3,
"Unalloc_" + parent.getId() +
"_" + fileRange.getByteStart() +
"_" + end_byte_in_parent);
7496 prepStmt.setNull(5, java.sql.Types.BIGINT);
7501 prepStmt.setLong(10, fileRange.getByteLen());
7502 prepStmt.setNull(11, java.sql.Types.BIGINT);
7503 prepStmt.setNull(12, java.sql.Types.BIGINT);
7504 prepStmt.setNull(13, java.sql.Types.BIGINT);
7505 prepStmt.setNull(14, java.sql.Types.BIGINT);
7506 prepStmt.setNull(15, java.sql.Types.VARCHAR);
7507 prepStmt.setNull(16, java.sql.Types.VARCHAR);
7508 prepStmt.setNull(17, java.sql.Types.VARCHAR);
7511 prepStmt.setNull(19, java.sql.Types.VARCHAR);
7512 prepStmt.setString(20, parentPath);
7513 prepStmt.setLong(21, parent.getId());
7516 prepStmt.setString(22, null);
7518 prepStmt.setString(23,
OsAccount.NO_OWNER_ID);
7519 prepStmt.setNull(24, java.sql.Types.BIGINT);
7522 connection.executeUpdate(prepStmt);
7529 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
7530 prepStmt.clearParameters();
7531 prepStmt.setLong(1, fileRangeId);
7532 prepStmt.setLong(2, fileRange.getByteStart());
7533 prepStmt.setLong(3, fileRange.getByteLen());
7534 prepStmt.setLong(4, fileRange.getSequence());
7535 connection.executeUpdate(prepStmt);
7540 fileRangeLayoutFiles.add(
new LayoutFile(
this,
7544 Long.toString(fileRange.getSequence()),
7550 fileRange.getByteLen(),
7554 parent.getUniquePath(),
7562 return fileRangeLayoutFiles;
7564 }
catch (SQLException ex) {
7565 throw new TskCoreException(
"Failed to add layout files to case database", ex);
7567 closeResultSet(resultSet);
7568 closeStatement(statement);
7570 if (null != transaction) {
7573 }
catch (TskCoreException ex2) {
7574 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
7586 private class CarvedFileDirInfo {
7589 AtomicInteger count;
7592 this.currentFolder = currentFolder;
7593 count =
new AtomicInteger(0);
7596 CarvedFileDirInfo(VirtualDirectory currentFolder,
int count) {
7597 this.currentFolder = currentFolder;
7598 this.count =
new AtomicInteger(count);
7608 return count.get() >= MAX_CARVED_FILES_PER_FOLDER;
7614 void incrementFileCounter() {
7615 count.incrementAndGet();
7628 private CarvedFileDirInfo getMostRecentCarvedDirInfo(VirtualDirectory carvedFilesBaseDir)
throws TskCoreException {
7629 VirtualDirectory mostRecentDir = null;
7630 for (Content child : carvedFilesBaseDir.getChildren()) {
7631 if (isValidCarvedFileSubfolder(child)) {
7632 if (mostRecentDir == null
7633 || (mostRecentDir.getId() < child.getId())) {
7634 mostRecentDir = (VirtualDirectory) child;
7639 if (mostRecentDir != null) {
7640 return new CarvedFileDirInfo(mostRecentDir, mostRecentDir.getChildrenCount());
7653 private boolean isValidCarvedFileSubfolder(Content subfolder) {
7654 if (!(subfolder instanceof VirtualDirectory)) {
7657 return subfolder.getName().matches(
"^[0-9]+$");
7673 private CarvedFileDirInfo createCarvedFilesSubfolder(Content carvedFilesBaseDir, CarvedFileDirInfo currentSubfolderInfo)
throws TskCoreException {
7675 if (currentSubfolderInfo != null) {
7677 int currentIndex = Integer.parseInt(currentSubfolderInfo.currentFolder.getName());
7678 nextIndex = currentIndex + 1;
7679 }
catch (NumberFormatException ex) {
7680 throw new TskCoreException(
"Unexpected name format for carved files subdirectory with ID: " + currentSubfolderInfo.currentFolder.getId() +
" (" + currentSubfolderInfo.currentFolder.getName() +
")", ex);
7684 VirtualDirectory carvedFilesSubdir =
addVirtualDirectory(carvedFilesBaseDir.getId(), Integer.toString(nextIndex));
7685 return new CarvedFileDirInfo(carvedFilesSubdir);
7700 assert (null != carvingResult);
7701 if (null == carvingResult) {
7702 throw new TskCoreException(
"Carving is null");
7704 assert (null != carvingResult.getParent());
7705 if (null == carvingResult.getParent()) {
7706 throw new TskCoreException(
"Carving result has null parent");
7708 assert (null != carvingResult.getCarvedFiles());
7709 if (null == carvingResult.getCarvedFiles()) {
7710 throw new TskCoreException(
"Carving result has null carved files");
7713 Statement statement = null;
7714 ResultSet resultSet = null;
7724 while (null != root) {
7738 CarvedFileDirInfo carvedFilesDirInfo = null;
7739 synchronized (carvedFileDirsLock) {
7741 carvedFilesDirInfo = rootIdsToCarvedFileDirs.get(root.
getId());
7742 if (carvedFilesDirInfo != null) {
7743 carvedFilesDirInfo.incrementFileCounter();
7746 if (carvedFilesDirInfo.isFull()) {
7747 carvedFilesDirInfo = createCarvedFilesSubfolder(carvedFilesDirInfo.currentFolder.getParent(), carvedFilesDirInfo);
7751 if (null == carvedFilesDirInfo) {
7752 List<Content> rootChildren;
7754 rootChildren = ((FileSystem) root).getRootDirectory().getChildren();
7758 for (
Content child : rootChildren) {
7759 if (child instanceof VirtualDirectory && child.getName().equals(VirtualDirectory.NAME_CARVED)) {
7761 VirtualDirectory baseDir = (VirtualDirectory) child;
7764 carvedFilesDirInfo = getMostRecentCarvedDirInfo(baseDir);
7767 if (carvedFilesDirInfo == null) {
7768 carvedFilesDirInfo = createCarvedFilesSubfolder(baseDir, null);
7772 if (carvedFilesDirInfo.isFull()) {
7773 carvedFilesDirInfo = createCarvedFilesSubfolder(baseDir, carvedFilesDirInfo);
7776 rootIdsToCarvedFileDirs.put(root.
getId(), carvedFilesDirInfo);
7780 if (carvedFilesDirInfo == null) {
7784 long parId = root.
getId();
7786 if (root instanceof FileSystem) {
7787 Content rootDir = ((FileSystem) root).getRootDirectory();
7788 parId = rootDir.
getId();
7790 VirtualDirectory carvedFilesBaseDir =
addVirtualDirectory(parId, VirtualDirectory.NAME_CARVED);
7791 carvedFilesDirInfo = createCarvedFilesSubfolder(carvedFilesBaseDir, null);
7792 rootIdsToCarvedFileDirs.put(root.
getId(), carvedFilesDirInfo);
7801 VirtualDirectory carvedFilesBaseDir = (VirtualDirectory) carvedFilesDirInfo.currentFolder.getParent();
7803 CaseDbConnection connection = transaction.getConnection();
7804 String parentPath = getFileParentPath(carvedFilesDirInfo.currentFolder.getId(), connection) + carvedFilesDirInfo.currentFolder.getName() +
"/";
7805 List<LayoutFile> carvedFiles =
new ArrayList<>();
7811 VirtualDirectory carvedFilesDir = carvedFilesDirInfo.currentFolder;
7812 if (carvedFilesDirInfo.isFull()) {
7818 synchronized (carvedFileDirsLock) {
7820 carvedFilesDirInfo = rootIdsToCarvedFileDirs.get(root.
getId());
7821 if (carvedFilesDirInfo.isFull()) {
7822 carvedFilesDirInfo = createCarvedFilesSubfolder(carvedFilesBaseDir, carvedFilesDirInfo);
7823 rootIdsToCarvedFileDirs.put(root.
getId(), carvedFilesDirInfo);
7824 carvedFilesDir = carvedFilesDirInfo.currentFolder;
7830 connection = transaction.getConnection();
7831 parentPath = getFileParentPath(carvedFilesDir.
getId(), connection) + carvedFilesDir.
getName() +
"/";
7834 carvedFilesDirInfo.incrementFileCounter();
7852 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
7853 prepStmt.clearParameters();
7854 prepStmt.setLong(1, carvedFileId);
7855 Long fileSystemObjectId;
7857 prepStmt.setLong(2, root.
getId());
7858 fileSystemObjectId = root.
getId();
7860 prepStmt.setNull(2, java.sql.Types.BIGINT);
7861 fileSystemObjectId = null;
7863 prepStmt.setString(3, carvedFile.getName());
7865 prepStmt.setShort(5, (
short) 1);
7870 prepStmt.setLong(10, carvedFile.getSizeInBytes());
7871 prepStmt.setNull(11, java.sql.Types.BIGINT);
7872 prepStmt.setNull(12, java.sql.Types.BIGINT);
7873 prepStmt.setNull(13, java.sql.Types.BIGINT);
7874 prepStmt.setNull(14, java.sql.Types.BIGINT);
7875 prepStmt.setNull(15, java.sql.Types.VARCHAR);
7876 prepStmt.setNull(16, java.sql.Types.VARCHAR);
7877 prepStmt.setNull(17, java.sql.Types.VARCHAR);
7880 prepStmt.setNull(19, java.sql.Types.VARCHAR);
7881 prepStmt.setString(20, parentPath);
7883 prepStmt.setString(22, extractExtension(carvedFile.getName()));
7885 prepStmt.setString(23,
OsAccount.NO_OWNER_ID);
7886 prepStmt.setNull(24, java.sql.Types.BIGINT);
7889 connection.executeUpdate(prepStmt);
7896 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
7897 for (
TskFileRange tskFileRange : carvedFile.getLayoutInParent()) {
7898 prepStmt.clearParameters();
7899 prepStmt.setLong(1, carvedFileId);
7900 prepStmt.setLong(2, tskFileRange.getByteStart());
7901 prepStmt.setLong(3, tskFileRange.getByteLen());
7902 prepStmt.setLong(4, tskFileRange.getSequence());
7903 connection.executeUpdate(prepStmt);
7913 carvedFile.getName(),
7919 carvedFile.getSizeInBytes(),
7933 }
catch (SQLException ex) {
7934 throw new TskCoreException(
"Failed to add carved files to case database", ex);
7936 closeResultSet(resultSet);
7937 closeStatement(statement);
7939 if (null != transaction) {
7942 }
catch (TskCoreException ex2) {
7943 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
7980 long size,
long ctime,
long crtime,
long atime,
long mtime,
7981 boolean isFile,
Content parentObj,
7982 String rederiveDetails, String toolName, String toolVersion,
7987 size, ctime, crtime, atime, mtime,
7989 rederiveDetails, toolName, toolVersion,
7990 otherDetails, encodingType, transaction);
7993 }
catch (TskCoreException ex) {
8000 long size,
long ctime,
long crtime,
long atime,
long mtime,
8001 boolean isFile,
Content parentObj,
8002 String rederiveDetails, String toolName, String toolVersion,
8005 localPath = localPath.replaceAll(
"^[/\\\\]+",
"");
8009 CaseDbConnection connection = transaction.getConnection();
8011 final long parentId = parentObj.getId();
8012 String parentPath =
"";
8014 parentPath = parentObj.getUniquePath() +
'/' + parentObj.getName() +
'/';
8016 parentPath = ((AbstractFile) parentObj).getParentPath() + parentObj.getName() +
'/';
8028 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
8029 statement.clearParameters();
8030 statement.setLong(1, newObjId);
8033 Long fsObjId = this.getFileSystemId(parentId, connection);
8034 if (fsObjId != -1) {
8035 statement.setLong(2, fsObjId);
8038 statement.setNull(2, java.sql.Types.BIGINT);
8040 statement.setString(3, fileName);
8044 statement.setShort(5, (
short) 1);
8048 statement.setShort(6, dirType.
getValue());
8050 statement.setShort(7, metaType.
getValue());
8054 statement.setShort(8, dirFlag.
getValue());
8057 statement.setShort(9, metaFlags);
8061 long savedSize = size < 0 ? 0 : size;
8062 statement.setLong(10, savedSize);
8066 statement.setLong(11, ctime);
8067 statement.setLong(12, crtime);
8068 statement.setLong(13, atime);
8069 statement.setLong(14, mtime);
8071 statement.setNull(15, java.sql.Types.VARCHAR);
8072 statement.setNull(16, java.sql.Types.VARCHAR);
8073 statement.setNull(17, java.sql.Types.VARCHAR);
8076 statement.setNull(19, java.sql.Types.VARCHAR);
8079 statement.setString(20, parentPath);
8082 long dataSourceObjId = getDataSourceObjectId(connection, parentObj);
8083 statement.setLong(21, dataSourceObjId);
8084 final String extension = extractExtension(fileName);
8086 statement.setString(22, extension);
8088 statement.setString(23,
OsAccount.NO_OWNER_ID);
8089 statement.setNull(24, java.sql.Types.BIGINT);
8092 connection.executeUpdate(statement);
8095 addFilePath(connection, newObjId, localPath, encodingType);
8097 DerivedFile derivedFile =
new DerivedFile(
this, newObjId, dataSourceObjId, fsObjId, fileName, dirType, metaType, dirFlag, metaFlags,
8098 savedSize, ctime, crtime, atime, mtime, null, null, null, null, parentPath, localPath, parentId, null, encodingType, extension,
OsAccount.NO_OWNER_ID,
OsAccount.NO_ACCOUNT);
8100 if (!timelineEventsDisabled.get()) {
8101 timelineManager.addEventsForNewFile(derivedFile, connection);
8106 }
catch (SQLException ex) {
8107 throw new TskCoreException(
"Failed to add derived file to case database", ex);
8142 long size,
long ctime,
long crtime,
long atime,
long mtime,
8143 boolean isFile, String mimeType,
8144 String rederiveDetails, String toolName, String toolVersion,
8153 size, ctime, crtime, atime, mtime,
8155 rederiveDetails, toolName, toolVersion,
8156 otherDetails, encodingType, parentObj, trans);
8159 }
catch (TskCoreException ex) {
8160 if (trans != null) {
8168 long size,
long ctime,
long crtime,
long atime,
long mtime,
8169 boolean isFile, String mimeType,
8170 String rederiveDetails, String toolName, String toolVersion,
8175 localPath = localPath.replaceAll(
"^[/\\\\]+",
"");
8177 ResultSet rs = null;
8179 final long parentId = parentObj.
getId();
8180 String parentPath =
"";
8182 parentPath = parentObj.getUniquePath() +
'/' + parentObj.getName() +
'/';
8184 parentPath = ((AbstractFile) parentObj).getParentPath() + parentObj.getName() +
'/';
8188 PreparedStatement statement = trans.getConnection().getPreparedStatement(PREPARED_STATEMENT.UPDATE_DERIVED_FILE);
8189 statement.clearParameters();
8196 statement.setShort(2, dirType.
getValue());
8198 statement.setShort(3, metaType.
getValue());
8202 statement.setShort(4, dirFlag.
getValue());
8205 statement.setShort(5, metaFlags);
8209 long savedSize = size < 0 ? 0 : size;
8210 statement.setLong(6, savedSize);
8214 statement.setLong(7, ctime);
8215 statement.setLong(8, crtime);
8216 statement.setLong(9, atime);
8217 statement.setLong(10, mtime);
8218 statement.setString(11, mimeType);
8219 statement.setString(12, String.valueOf(derivedFile.
getId()));
8220 trans.getConnection().executeUpdate(statement);
8223 updateFilePath(trans.getConnection(), derivedFile.
getId(), localPath, encodingType);
8225 long dataSourceObjId = getDataSourceObjectId(trans.getConnection(), parentObj);
8227 final String extension = extractExtension(derivedFile.
getName());
8228 return new DerivedFile(
this, derivedFile.
getId(), dataSourceObjId, fileSystemObjId, derivedFile.
getName(), dirType, metaType, dirFlag, metaFlags,
8229 savedSize, ctime, crtime, atime, mtime, null, null, null, null, parentPath, localPath, parentId, null, encodingType, extension,
8231 }
catch (SQLException ex) {
8232 throw new TskCoreException(
"Failed to add derived file to case database", ex);
8258 long size,
long ctime,
long crtime,
long atime,
long mtime,
8264 LocalFile created =
addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile, encodingType, parent, localTrans);
8269 if (null != localTrans) {
8272 }
catch (TskCoreException ex2) {
8273 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
8304 long size,
long ctime,
long crtime,
long atime,
long mtime,
8309 size, ctime, crtime, atime, mtime,
8311 isFile, encodingType,
8312 parent, transaction);
8344 long size,
long ctime,
long crtime,
long atime,
long mtime,
8345 String md5, String sha256,
FileKnown known, String mimeType,
8349 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime,
8350 md5, sha256, known, mimeType, isFile, encodingType,
8386 long size,
long ctime,
long crtime,
long atime,
long mtime,
8387 String md5, String sha256,
FileKnown known, String mimeType,
8392 size, ctime, crtime, atime, mtime,
8393 md5, sha256, null, known, mimeType,
8394 isFile, encodingType, osAccountId, ownerAccount,
8395 parent, transaction);
8432 long size,
long ctime,
long crtime,
long atime,
long mtime,
8433 String md5, String sha256, String sha1Hash,
FileKnown known, String mimeType,
8436 CaseDbConnection connection = transaction.getConnection();
8437 Statement queryStatement = null;
8449 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
8450 statement.clearParameters();
8451 statement.setLong(1, objectId);
8452 statement.setNull(2, java.sql.Types.BIGINT);
8453 statement.setString(3, fileName);
8455 statement.setShort(5, (
short) 1);
8457 statement.setShort(6, dirType.
getValue());
8459 statement.setShort(7, metaType.
getValue());
8461 statement.setShort(8, dirFlag.
getValue());
8463 statement.setShort(9, metaFlags);
8465 long savedSize = size < 0 ? 0 : size;
8466 statement.setLong(10, savedSize);
8467 statement.setLong(11, ctime);
8468 statement.setLong(12, crtime);
8469 statement.setLong(13, atime);
8470 statement.setLong(14, mtime);
8471 statement.setString(15, md5);
8472 statement.setString(16, sha256);
8473 statement.setString(17, sha1Hash);
8475 if (known != null) {
8476 statement.setByte(18, known.getFileKnownValue());
8480 statement.setString(19, mimeType);
8482 long dataSourceObjId;
8485 AbstractFile parentFile = (AbstractFile) parent;
8486 if (isRootDirectory(parentFile, transaction)) {
8489 parentPath = parentFile.
getParentPath() + parent.getName() +
"/";
8494 dataSourceObjId = getDataSourceObjectId(connection, parent);
8496 statement.setString(20, parentPath);
8497 statement.setLong(21, dataSourceObjId);
8498 final String extension = extractExtension(fileName);
8499 statement.setString(22, extension);
8501 if (ownerAccount != null) {
8502 statement.setString(23, ownerAccount);
8504 statement.setNull(23, java.sql.Types.VARCHAR);
8507 if (osAccountId != null) {
8508 statement.setLong(24, osAccountId);
8510 statement.setNull(24, java.sql.Types.BIGINT);
8515 connection.executeUpdate(statement);
8516 addFilePath(connection, objectId, localPath, encodingType);
8526 ctime, crtime, atime, mtime,
8527 mimeType, md5, sha256, sha1Hash, known,
8528 parent.getId(), parentPath,
8531 encodingType, extension,
8532 ownerAccount, osAccountId);
8533 if (!timelineEventsDisabled.get()) {
8538 }
catch (SQLException ex) {
8539 throw new TskCoreException(String.format(
"Failed to INSERT local file %s (%s) with parent id %d in tsk_files table", fileName, localPath, parent.getId()), ex);
8541 closeStatement(queryStatement);
8550 private class RootDirectoryKey {
8552 private long dataSourceId;
8553 private Long fileSystemId;
8555 RootDirectoryKey(
long dataSourceId, Long fileSystemId) {
8556 this.dataSourceId = dataSourceId;
8557 this.fileSystemId = fileSystemId;
8561 public int hashCode() {
8563 hash = 41 * hash + Objects.hashCode(dataSourceId);
8564 hash = 41 * hash + Objects.hashCode(fileSystemId);
8569 public boolean equals(Object obj) {
8576 if (getClass() != obj.getClass()) {
8580 RootDirectoryKey otherKey = (RootDirectoryKey) obj;
8581 if (dataSourceId != otherKey.dataSourceId) {
8585 if (fileSystemId != null) {
8586 return fileSystemId.equals(otherKey.fileSystemId);
8588 return (otherKey.fileSystemId == null);
8604 private boolean isRootDirectory(AbstractFile file, CaseDbTransaction transaction)
throws TskCoreException {
8609 Long fsObjId = null;
8610 if (file instanceof FsContent) {
8611 fsObjId = ((FsContent) file).getFileSystemId();
8614 synchronized (rootDirectoryMapLock) {
8615 if (rootDirectoryMap.containsKey(key)) {
8616 return rootDirectoryMap.get(key).equals(file.
getId());
8623 Boolean isRoot = isRootDirectoryCache.getIfPresent(file.
getId());
8624 if (isRoot != null) {
8628 CaseDbConnection connection = transaction.getConnection();
8629 Statement statement = null;
8630 ResultSet resultSet = null;
8633 String query = String.format(
"SELECT ParentRow.type AS parent_type, ParentRow.obj_id AS parent_object_id "
8634 +
"FROM tsk_objects ParentRow JOIN tsk_objects ChildRow ON ChildRow.par_obj_id = ParentRow.obj_id "
8635 +
"WHERE ChildRow.obj_id = %s;", file.
getId());
8637 statement = connection.createStatement();
8638 resultSet = statement.executeQuery(query);
8639 if (resultSet.next()) {
8640 long parentId = resultSet.getLong(
"parent_object_id");
8641 if (parentId == 0) {
8644 int type = resultSet.getInt(
"parent_type");
8645 boolean result = type == TskData.ObjectType.IMG.getObjectType()
8646 || type == TskData.ObjectType.VS.getObjectType()
8647 || type == TskData.ObjectType.VOL.getObjectType()
8648 || type == TskData.ObjectType.FS.getObjectType();
8649 if (result ==
true) {
8650 synchronized (rootDirectoryMapLock) {
8652 rootDirectoryMap.put(key, file.
getId());
8655 isRootDirectoryCache.put(file.
getId(), result);
8660 synchronized (rootDirectoryMapLock) {
8661 rootDirectoryMap.put(key, file.
getId());
8663 isRootDirectoryCache.put(file.
getId(),
true);
8668 }
catch (SQLException ex) {
8669 throw new TskCoreException(String.format(
"Failed to lookup parent of file (%s) with id %d", file.
getName(), file.
getId()), ex);
8671 closeResultSet(resultSet);
8672 closeStatement(statement);
8698 long ctime,
long crtime,
long atime,
long mtime,
8699 List<TskFileRange> fileRanges,
8700 Content parent)
throws TskCoreException {
8702 if (null == parent) {
8703 throw new TskCoreException(
"Parent can not be null");
8708 parentPath = ((AbstractFile) parent).getParentPath() + parent.getName() +
'/';
8714 Statement statement = null;
8715 ResultSet resultSet = null;
8718 CaseDbConnection connection = transaction.getConnection();
8734 PreparedStatement prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_FILE);
8735 prepStmt.clearParameters();
8736 prepStmt.setLong(1, newFileId);
8739 Long fileSystemObjectId;
8740 if (0 != parent.getId()) {
8741 fileSystemObjectId = this.getFileSystemId(parent.getId(), connection);
8742 if (fileSystemObjectId != -1) {
8743 prepStmt.setLong(2, fileSystemObjectId);
8745 prepStmt.setNull(2, java.sql.Types.BIGINT);
8746 fileSystemObjectId = null;
8749 prepStmt.setNull(2, java.sql.Types.BIGINT);
8750 fileSystemObjectId = null;
8752 prepStmt.setString(3, fileName);
8754 prepStmt.setShort(5, (
short) 0);
8757 prepStmt.setShort(8, dirFlag.getValue());
8758 prepStmt.setShort(9, metaFlag.getValue());
8760 long savedSize = size < 0 ? 0 : size;
8761 prepStmt.setLong(10, savedSize);
8762 prepStmt.setLong(11, ctime);
8763 prepStmt.setLong(12, crtime);
8764 prepStmt.setLong(13, atime);
8765 prepStmt.setLong(14, mtime);
8766 prepStmt.setNull(15, java.sql.Types.VARCHAR);
8767 prepStmt.setNull(16, java.sql.Types.VARCHAR);
8768 prepStmt.setNull(17, java.sql.Types.VARCHAR);
8771 prepStmt.setNull(19, java.sql.Types.VARCHAR);
8772 prepStmt.setString(20, parentPath);
8773 prepStmt.setLong(21, parent.getDataSource().getId());
8775 prepStmt.setString(22, extractExtension(fileName));
8777 prepStmt.setString(23,
OsAccount.NO_OWNER_ID);
8778 prepStmt.setNull(24, java.sql.Types.BIGINT);
8781 connection.executeUpdate(prepStmt);
8788 prepStmt = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LAYOUT_FILE);
8790 prepStmt.clearParameters();
8791 prepStmt.setLong(1, newFileId);
8792 prepStmt.setLong(2, tskFileRange.getByteStart());
8793 prepStmt.setLong(3, tskFileRange.getByteLen());
8794 prepStmt.setLong(4, tskFileRange.getSequence());
8795 connection.executeUpdate(prepStmt);
8803 parent.getDataSource().getId(),
8810 metaFlag.getValue(),
8812 ctime, crtime, atime, mtime,
8824 }
catch (SQLException ex) {
8825 throw new TskCoreException(
"Failed to add layout file " + fileName +
" to case database", ex);
8827 closeResultSet(resultSet);
8828 closeStatement(statement);
8830 if (null != transaction) {
8833 }
catch (TskCoreException ex2) {
8834 logger.log(Level.SEVERE,
"Failed to rollback transaction after exception", ex2);
8849 private long getDataSourceObjectId(CaseDbConnection connection,
Content content)
throws TskCoreException {
8850 if (content == null) {
8851 throw new TskCoreException(
"Null Content parameter given");
8853 if (content instanceof AbstractFile) {
8854 return ((AbstractFile) content).getDataSourceObjectId();
8856 return getDataSourceObjectId(connection, content.getId());
8872 private long getDataSourceObjectId(CaseDbConnection connection,
long objectId)
throws TskCoreException {
8874 Statement statement = null;
8875 ResultSet resultSet = null;
8877 statement = connection.createStatement();
8878 long dataSourceObjId;
8879 long ancestorId = objectId;
8881 dataSourceObjId = ancestorId;
8882 String query = String.format(
"SELECT par_obj_id FROM tsk_objects WHERE obj_id = %s;", ancestorId);
8883 resultSet = statement.executeQuery(query);
8884 if (resultSet.next()) {
8885 ancestorId = resultSet.getLong(
"par_obj_id");
8887 throw new TskCoreException(String.format(
"tsk_objects table is corrupt, SQL query returned no result: %s", query));
8891 }
while (0 != ancestorId);
8892 return dataSourceObjId;
8893 }
catch (SQLException ex) {
8894 throw new TskCoreException(String.format(
"Error finding root data source for object (obj_id = %d)", objectId), ex);
8896 closeResultSet(resultSet);
8897 closeStatement(statement);
8913 private void addFilePath(CaseDbConnection connection,
long objId, String path, TskData.EncodingType type) throws SQLException {
8914 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_LOCAL_PATH);
8915 statement.clearParameters();
8916 statement.setLong(1, objId);
8917 statement.setString(2, path);
8918 statement.setInt(3, type.getType());
8919 connection.executeUpdate(statement);
8933 private void updateFilePath(CaseDbConnection connection,
long objId, String path, TskData.EncodingType type) throws SQLException {
8934 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_LOCAL_PATH);
8935 statement.clearParameters();
8936 statement.setString(1, path);
8937 statement.setInt(2, type.getType());
8938 statement.setLong(3, objId);
8939 connection.executeUpdate(statement);
8955 public List<AbstractFile>
findFilesInFolder(String fileName, AbstractFile parentFile)
throws TskCoreException {
8957 if (!containsLikeWildcard(fileName)) {
8961 CaseDbConnection connection = null;
8962 ResultSet rs = null;
8963 long parentId = parentFile.getId();
8967 connection = connections.getConnection();
8969 PreparedStatement statement;
8970 if (ext.isEmpty()) {
8971 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_PARENT_AND_NAME);
8972 statement.clearParameters();
8973 statement.setLong(1, parentId);
8974 statement.setString(2, fileName);
8976 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_FILES_BY_EXTENSION_AND_PARENT_AND_NAME);
8977 statement.clearParameters();
8978 statement.setString(1, ext);
8979 statement.setLong(2, parentId);
8980 statement.setString(3, fileName);
8983 rs = connection.executeQuery(statement);
8984 return resultSetToAbstractFiles(rs, connection);
8985 }
catch (SQLException ex) {
8986 throw new TskCoreException(
"Error getting AbstractFile children with name=" + fileName +
" for Content parent with ID=" + parentFile.getId(), ex);
8989 closeConnection(connection);
9006 CaseDbConnection connection = null;
9008 ResultSet rs = null;
9011 connection = connections.getConnection();
9012 s = connection.createStatement();
9013 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE " + sqlWhereClause);
9015 return rs.getLong(
"count");
9016 }
catch (SQLException e) {
9017 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.countFilesWhere().", e);
9021 closeConnection(connection);
9044 CaseDbConnection connection = null;
9046 ResultSet rs = null;
9049 connection = connections.getConnection();
9050 s = connection.createStatement();
9051 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
9052 return resultSetToAbstractFiles(rs, connection);
9053 }
catch (SQLException e) {
9054 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFilesWhere(): " + sqlWhereClause, e);
9058 closeConnection(connection);
9082 String queryTemplate =
"SELECT tsk_files.* FROM tsk_files JOIN tsk_objects ON tsk_objects.obj_id = tsk_files.obj_id WHERE par_obj_id = %d AND %s";
9084 try (CaseDbConnection connection = connections.getConnection()) {
9085 String query = String.format(queryTemplate, parentId, sqlWhereClause);
9086 try (Statement s = connection.createStatement(); ResultSet rs = connection.executeQuery(s, query)) {
9087 return resultSetToAbstractFiles(rs, connection);
9088 }
catch (SQLException ex) {
9089 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFilesInFolderWhere(): " + query, ex);
9109 CaseDbConnection connection = null;
9111 ResultSet rs = null;
9114 connection = connections.getConnection();
9115 s = connection.createStatement();
9116 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_files WHERE " + sqlWhereClause);
9117 List<Long> ret =
new ArrayList<>();
9119 ret.add(rs.getLong(
"obj_id"));
9122 }
catch (SQLException e) {
9123 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findAllFileIdsWhere(): " + sqlWhereClause, e);
9127 closeConnection(connection);
9143 public List<AbstractFile>
openFiles(
Content dataSource, String filePath)
throws TskCoreException {
9147 String path = AbstractFile.createNonUniquePath(filePath).toLowerCase();
9150 int lastSlash = path.lastIndexOf(
'/');
9153 if (lastSlash == path.length()) {
9154 path = path.substring(0, lastSlash - 1);
9155 lastSlash = path.lastIndexOf(
'/');
9158 String parentPath = path.substring(0, lastSlash);
9159 String fileName = path.substring(lastSlash);
9161 return findFiles(dataSource, fileName, parentPath);
9175 CaseDbConnection connection = null;
9177 ResultSet rs = null;
9180 connection = connections.getConnection();
9181 s = connection.createStatement();
9182 rs = connection.executeQuery(s,
"SELECT * FROM tsk_file_layout WHERE obj_id = " +
id +
" ORDER BY sequence");
9183 List<TskFileRange> ranges =
new ArrayList<TskFileRange>();
9186 rs.getLong(
"byte_len"), rs.getLong(
"sequence"));
9190 }
catch (SQLException ex) {
9191 throw new TskCoreException(
"Error getting TskFileLayoutRanges by id, id = " +
id, ex);
9195 closeConnection(connection);
9211 CaseDbConnection connection = null;
9213 ResultSet rs = null;
9216 connection = connections.getConnection();
9217 s = connection.createStatement();
9218 rs = connection.executeQuery(s,
"SELECT tsk_image_info.type, tsk_image_info.ssize, tsk_image_info.tzone, tsk_image_info.size, tsk_image_info.md5, tsk_image_info.sha1, tsk_image_info.sha256, tsk_image_info.display_name, data_source_info.device_id, tsk_image_names.name "
9219 +
"FROM tsk_image_info "
9220 +
"INNER JOIN data_source_info ON tsk_image_info.obj_id = data_source_info.obj_id "
9221 +
"LEFT JOIN tsk_image_names ON tsk_image_names.obj_id = data_source_info.obj_id "
9222 +
"WHERE tsk_image_info.obj_id = " +
id);
9224 List<String> imagePaths =
new ArrayList<>();
9225 long type, ssize, size;
9226 String tzone, md5, sha1, sha256, name, device_id, imagePath;
9229 imagePath = rs.getString(
"name");
9230 if (imagePath != null) {
9231 imagePaths.add(imagePath);
9233 type = rs.getLong(
"type");
9234 ssize = rs.getLong(
"ssize");
9235 tzone = rs.getString(
"tzone");
9236 size = rs.getLong(
"size");
9237 md5 = rs.getString(
"md5");
9238 sha1 = rs.getString(
"sha1");
9239 sha256 = rs.getString(
"sha256");
9240 name = rs.getString(
"display_name");
9242 if (imagePaths.size() > 0) {
9243 String path = imagePaths.get(0);
9244 name = (
new java.io.File(path)).getName();
9249 device_id = rs.getString(
"device_id");
9251 throw new TskCoreException(
"No image found for id: " +
id);
9256 imagePath = rs.getString(
"name");
9257 if (imagePath != null) {
9258 imagePaths.add(imagePath);
9262 return new Image(
this,
id, type, device_id, ssize, name,
9263 imagePaths.toArray(
new String[imagePaths.size()]), tzone, md5, sha1, sha256, size);
9264 }
catch (SQLException ex) {
9265 throw new TskCoreException(
"Error getting Image by id, id = " +
id, ex);
9269 closeConnection(connection);
9286 CaseDbConnection connection = null;
9288 ResultSet rs = null;
9291 connection = connections.getConnection();
9292 s = connection.createStatement();
9293 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_info "
9294 +
"where obj_id = " +
id);
9296 long type = rs.getLong(
"vs_type");
9297 long imgOffset = rs.getLong(
"img_offset");
9298 long blockSize = rs.getLong(
"block_size");
9300 vs.setParent(parent);
9303 throw new TskCoreException(
"No volume system found for id:" +
id);
9305 }
catch (SQLException ex) {
9306 throw new TskCoreException(
"Error getting Volume System by ID.", ex);
9310 closeConnection(connection);
9323 VolumeSystem getVolumeSystemById(
long id,
long parentId)
throws TskCoreException {
9324 VolumeSystem vs = getVolumeSystemById(
id, null);
9325 vs.setParentId(parentId);
9340 FileSystem getFileSystemById(
long id, Image parent)
throws TskCoreException {
9341 return getFileSystemByIdHelper(
id, parent);
9352 FileSystem getFileSystemById(
long id,
long parentId)
throws TskCoreException {
9354 FileSystem fs = getFileSystemById(
id, vol);
9355 fs.setParentId(parentId);
9370 FileSystem getFileSystemById(
long id, Volume parent)
throws TskCoreException {
9371 return getFileSystemByIdHelper(
id, parent);
9385 Pool getPoolById(
long id, Content parent)
throws TskCoreException {
9386 return getPoolByIdHelper(
id, parent);
9397 Pool getPoolById(
long id,
long parentId)
throws TskCoreException {
9398 Pool pool = getPoolById(
id, null);
9399 pool.setParentId(parentId);
9414 private Pool getPoolByIdHelper(
long id, Content parent)
throws TskCoreException {
9417 try (CaseDbConnection connection = connections.getConnection();
9418 Statement s = connection.createStatement();
9419 ResultSet rs = connection.executeQuery(s,
"SELECT * FROM tsk_pool_info "
9420 +
"where obj_id = " +
id);) {
9422 Pool pool =
new Pool(
this, rs.getLong(
"obj_id"), TskData.TSK_POOL_TYPE_ENUM.valueOf(rs.getLong(
"pool_type")).getName(), rs.getLong(
"pool_type"));
9423 pool.setParent(parent);
9427 throw new TskCoreException(
"No pool found for ID:" +
id);
9429 }
catch (SQLException ex) {
9430 throw new TskCoreException(
"Error getting Pool by ID", ex);
9447 private FileSystem getFileSystemByIdHelper(
long id, Content parent)
throws TskCoreException {
9451 synchronized (fileSystemIdMap) {
9452 if (fileSystemIdMap.containsKey(
id)) {
9453 return fileSystemIdMap.get(
id);
9456 CaseDbConnection connection = null;
9458 ResultSet rs = null;
9461 connection = connections.getConnection();
9462 s = connection.createStatement();
9463 rs = connection.executeQuery(s,
"SELECT * FROM tsk_fs_info "
9464 +
"where obj_id = " +
id);
9466 TskData.TSK_FS_TYPE_ENUM fsType = TskData.TSK_FS_TYPE_ENUM.valueOf(rs.getInt(
"fs_type"));
9467 FileSystem fs =
new FileSystem(
this, rs.getLong(
"obj_id"),
"", rs.getLong(
"img_offset"),
9468 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
9469 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
9470 fs.setParent(parent);
9472 synchronized (fileSystemIdMap) {
9473 fileSystemIdMap.put(
id, fs);
9477 throw new TskCoreException(
"No file system found for id:" +
id);
9479 }
catch (SQLException ex) {
9480 throw new TskCoreException(
"Error getting File System by ID", ex);
9484 closeConnection(connection);
9500 Volume getVolumeById(
long id, VolumeSystem parent)
throws TskCoreException {
9501 CaseDbConnection connection = null;
9503 ResultSet rs = null;
9506 connection = connections.getConnection();
9507 s = connection.createStatement();
9508 rs = connection.executeQuery(s,
"SELECT * FROM tsk_vs_parts "
9509 +
"where obj_id = " +
id);
9520 description = rs.getString(
"desc");
9521 }
catch (Exception ex) {
9522 description = rs.getString(
"descr");
9524 Volume vol =
new Volume(
this, rs.getLong(
"obj_id"), rs.getLong(
"addr"),
9525 rs.getLong(
"start"), rs.getLong(
"length"), rs.getLong(
"flags"),
9527 vol.setParent(parent);
9530 throw new TskCoreException(
"No volume found for id:" +
id);
9532 }
catch (SQLException ex) {
9533 throw new TskCoreException(
"Error getting Volume by ID", ex);
9537 closeConnection(connection);
9550 Volume getVolumeById(
long id,
long parentId)
throws TskCoreException {
9551 Volume vol = getVolumeById(
id, null);
9552 vol.setParentId(parentId);
9567 Directory getDirectoryById(
long id, FileSystem parentFs)
throws TskCoreException {
9568 CaseDbConnection connection = null;
9570 ResultSet rs = null;
9573 connection = connections.getConnection();
9574 s = connection.createStatement();
9575 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files "
9576 +
"WHERE obj_id = " +
id);
9577 Directory temp = null;
9579 final short type = rs.getShort(
"type");
9580 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()) {
9581 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()
9582 || rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) {
9583 temp = directory(rs, parentFs);
9585 }
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()) {
9586 throw new TskCoreException(
"Expecting an FS-type directory, got virtual, id: " +
id);
9589 throw new TskCoreException(
"No Directory found for id:" +
id);
9592 }
catch (SQLException ex) {
9593 throw new TskCoreException(
"Error getting Directory by ID", ex);
9597 closeConnection(connection);
9612 List<FileSystem> fileSystems =
new ArrayList<>();
9613 String queryStr =
"SELECT * FROM tsk_fs_info WHERE data_source_obj_id = " + image.getId();
9615 CaseDbConnection connection = null;
9617 ResultSet rs = null;
9620 connection = connections.getConnection();
9621 s = connection.createStatement();
9622 rs = connection.executeQuery(s, queryStr);
9626 fsType, rs.getLong(
"block_size"), rs.getLong(
"block_count"),
9627 rs.getLong(
"root_inum"), rs.getLong(
"first_inum"), rs.getLong(
"last_inum"));
9629 fileSystems.add(fs);
9631 }
catch (SQLException ex) {
9632 throw new TskCoreException(
"Error looking up files systems. Query: " + queryStr, ex);
9636 closeConnection(connection);
9652 List<Content> getImageChildren(
Image img)
throws TskCoreException {
9653 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
9654 List<Content> children =
new ArrayList<Content>();
9655 for (ObjectInfo info : childInfos) {
9656 if (null != info.type) {
9657 switch (info.type) {
9659 children.add(getVolumeSystemById(info.id, img));
9662 children.add(getPoolById(info.id, img));
9665 children.add(getFileSystemById(info.id, img));
9683 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
9700 List<Long> getImageChildrenIds(Image img)
throws TskCoreException {
9701 Collection<ObjectInfo> childInfos = getChildrenInfo(img);
9702 List<Long> children =
new ArrayList<Long>();
9703 for (ObjectInfo info : childInfos) {
9704 if (info.type == ObjectType.VS
9705 || info.type == ObjectType.POOL
9706 || info.type == ObjectType.FS
9707 || info.type == ObjectType.ABSTRACTFILE
9708 || info.type == ObjectType.ARTIFACT) {
9709 children.add(info.id);
9710 }
else if (info.type == ObjectType.REPORT) {
9713 throw new TskCoreException(
"Image has child of invalid type: " + info.type);
9729 List<Content> getPoolChildren(Pool pool)
throws TskCoreException {
9730 Collection<ObjectInfo> childInfos = getChildrenInfo(pool);
9731 List<Content> children =
new ArrayList<Content>();
9732 for (ObjectInfo info : childInfos) {
9733 if (null != info.type) {
9734 switch (info.type) {
9736 children.add(getVolumeSystemById(info.id, pool));
9751 throw new TskCoreException(
"Pool has child of invalid type: " + info.type);
9768 List<Long> getPoolChildrenIds(Pool pool)
throws TskCoreException {
9769 Collection<ObjectInfo> childInfos = getChildrenInfo(pool);
9770 List<Long> children =
new ArrayList<Long>();
9771 for (ObjectInfo info : childInfos) {
9772 if (info.type == ObjectType.VS || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
9773 children.add(info.id);
9775 throw new TskCoreException(
"Pool has child of invalid type: " + info.type);
9791 List<Content> getVolumeSystemChildren(VolumeSystem vs)
throws TskCoreException {
9792 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
9793 List<Content> children =
new ArrayList<Content>();
9794 for (ObjectInfo info : childInfos) {
9795 if (null != info.type) {
9796 switch (info.type) {
9798 children.add(getVolumeById(info.id, vs));
9813 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
9830 List<Long> getVolumeSystemChildrenIds(VolumeSystem vs)
throws TskCoreException {
9831 Collection<ObjectInfo> childInfos = getChildrenInfo(vs);
9832 List<Long> children =
new ArrayList<Long>();
9833 for (ObjectInfo info : childInfos) {
9834 if (info.type == ObjectType.VOL || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
9835 children.add(info.id);
9837 throw new TskCoreException(
"VolumeSystem has child of invalid type: " + info.type);
9853 List<Content> getVolumeChildren(Volume vol)
throws TskCoreException {
9854 Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
9855 List<Content> children =
new ArrayList<Content>();
9856 for (ObjectInfo info : childInfos) {
9857 if (null != info.type) {
9858 switch (info.type) {
9860 children.add(getPoolById(info.id, vol));
9863 children.add(getFileSystemById(info.id, vol));
9878 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
9895 List<Long> getVolumeChildrenIds(Volume vol)
throws TskCoreException {
9896 final Collection<ObjectInfo> childInfos = getChildrenInfo(vol);
9897 final List<Long> children =
new ArrayList<Long>();
9898 for (ObjectInfo info : childInfos) {
9899 if (info.type == ObjectType.FS || info.type == ObjectType.ABSTRACTFILE || info.type == ObjectType.ARTIFACT) {
9900 children.add(info.id);
9902 throw new TskCoreException(
"Volume has child of invalid type: " + info.type);
9921 public Image addImageInfo(
long deviceObjId, List<String> imageFilePaths, String timeZone)
throws TskCoreException {
9922 return addImageInfo(deviceObjId, imageFilePaths, timeZone, null);
9939 public Image addImageInfo(
long deviceObjId, List<String> imageFilePaths, String timeZone,
Host host)
throws TskCoreException {
9940 long imageId = this.caseHandle.addImageInfo(deviceObjId, imageFilePaths, timeZone, host,
this);
9954 CaseDbConnection connection = null;
9955 Statement s1 = null;
9956 ResultSet rs1 = null;
9959 connection = connections.getConnection();
9960 s1 = connection.createStatement();
9961 rs1 = connection.executeQuery(s1,
"SELECT tsk_image_info.obj_id, tsk_image_names.name FROM tsk_image_info "
9962 +
"LEFT JOIN tsk_image_names ON tsk_image_info.obj_id = tsk_image_names.obj_id");
9963 Map<Long, List<String>> imgPaths =
new LinkedHashMap<Long, List<String>>();
9964 while (rs1.next()) {
9965 long obj_id = rs1.getLong(
"obj_id");
9966 String name = rs1.getString(
"name");
9967 List<String> imagePaths = imgPaths.get(obj_id);
9968 if (imagePaths == null) {
9969 List<String> paths =
new ArrayList<String>();
9973 imgPaths.put(obj_id, paths);
9976 imagePaths.add(name);
9981 }
catch (SQLException ex) {
9982 throw new TskCoreException(
"Error getting image paths.", ex);
9984 closeResultSet(rs1);
9986 closeConnection(connection);
10002 private List<String> getImagePathsById(
long objectId, CaseDbConnection connection)
throws TskCoreException {
10003 List<String> imagePaths =
new ArrayList<>();
10005 Statement statement = null;
10006 ResultSet resultSet = null;
10008 statement = connection.createStatement();
10009 resultSet = connection.executeQuery(statement,
"SELECT name FROM tsk_image_names WHERE tsk_image_names.obj_id = " + objectId);
10010 while (resultSet.next()) {
10011 imagePaths.add(resultSet.getString(
"name"));
10013 }
catch (SQLException ex) {
10014 throw new TskCoreException(String.format(
"Error getting image names with obj_id = %d", objectId), ex);
10016 closeResultSet(resultSet);
10017 closeStatement(statement);
10031 CaseDbConnection connection = null;
10032 Statement s = null;
10033 ResultSet rs = null;
10036 connection = connections.getConnection();
10037 s = connection.createStatement();
10038 rs = connection.executeQuery(s,
"SELECT obj_id FROM tsk_image_info");
10039 Collection<Long> imageIDs =
new ArrayList<Long>();
10040 while (rs.next()) {
10041 imageIDs.add(rs.getLong(
"obj_id"));
10043 List<Image> images =
new ArrayList<Image>();
10044 for (
long id : imageIDs) {
10048 }
catch (SQLException ex) {
10049 throw new TskCoreException(
"Error retrieving images.", ex);
10051 closeResultSet(rs);
10053 closeConnection(connection);
10068 public void setImagePaths(
long obj_id, List<String> paths)
throws TskCoreException {
10073 transaction = null;
10075 if (transaction != null) {
10095 PreparedStatement statement = trans.getConnection().getPreparedStatement(PREPARED_STATEMENT.DELETE_IMAGE_NAME);
10096 statement.clearParameters();
10097 statement.setLong(1, objId);
10098 trans.getConnection().executeUpdate(statement);
10099 for (
int i = 0; i < paths.size(); i++) {
10100 statement = trans.getConnection().getPreparedStatement(PREPARED_STATEMENT.INSERT_IMAGE_NAME);
10101 statement.clearParameters();
10102 statement.setLong(1, objId);
10103 statement.setString(2, paths.get(i));
10104 statement.setLong(3, i);
10105 trans.getConnection().executeUpdate(statement);
10107 }
catch (SQLException ex) {
10108 throw new TskCoreException(
"Error updating image paths.", ex);
10124 void deleteDataSource(
long dataSourceObjectId)
throws TskCoreException {
10130 Host hostToDelete = null;
10134 if (major > 9 || (major == 9 && minor >= 1)) {
10136 if (
getHostManager().getDataSourcesForHost(hostToDelete).size() != 1) {
10137 hostToDelete = null;
10141 CaseDbConnection connection = null;
10142 Statement statement;
10145 connection = connections.getConnection();
10146 statement = connection.createStatement();
10147 connection.beginTransaction();
10150 statement.execute(
"DELETE FROM tsk_objects WHERE obj_id = " + dataSourceObjectId);
10153 String accountSql =
"DELETE FROM accounts WHERE account_id in (SELECT account_id FROM accounts "
10154 +
"WHERE account_id NOT IN (SELECT account1_id FROM account_relationships) "
10155 +
"AND account_id NOT IN (SELECT account2_id FROM account_relationships))";
10156 statement.execute(accountSql);
10160 if (hostToDelete != null) {
10161 statement.execute(
"DELETE FROM tsk_hosts WHERE id = " + hostToDelete.
getHostId());
10164 String deleteOsAcctObjectsQuery =
"DELETE FROM tsk_objects "
10165 +
"WHERE type=" + TskData.ObjectType.OS_ACCOUNT.getObjectType() +
" "
10166 +
"AND obj_id NOT IN (SELECT os_account_obj_id FROM tsk_os_accounts WHERE os_account_obj_id IS NOT NULL)";
10167 statement.execute(deleteOsAcctObjectsQuery);
10170 connection.commitTransaction();
10171 }
catch (SQLException ex) {
10172 rollbackTransaction(connection);
10173 throw new TskCoreException(
"Error deleting data source.", ex);
10175 closeConnection(connection);
10205 List<AbstractFile> resultSetToAbstractFiles(ResultSet rs, CaseDbConnection connection)
throws SQLException {
10206 ArrayList<AbstractFile> results =
new ArrayList<AbstractFile>();
10208 while (rs.next()) {
10209 final short type = rs.getShort(
"type");
10210 if (type == TSK_DB_FILES_TYPE_ENUM.FS.getFileType()
10211 && (rs.getShort(
"meta_type") != TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue())) {
10213 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
10214 result = directory(rs, null);
10216 result = file(rs, null);
10218 results.add(result);
10219 }
else if (type == TSK_DB_FILES_TYPE_ENUM.VIRTUAL_DIR.getFileType()
10220 || (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue())) {
10221 final VirtualDirectory virtDir = virtualDirectory(rs, connection);
10222 results.add(virtDir);
10223 }
else if (type == TSK_DB_FILES_TYPE_ENUM.LOCAL_DIR.getFileType()) {
10224 final LocalDirectory localDir = localDirectory(rs);
10225 results.add(localDir);
10226 }
else if (type == TSK_DB_FILES_TYPE_ENUM.UNALLOC_BLOCKS.getFileType()
10227 || type == TSK_DB_FILES_TYPE_ENUM.UNUSED_BLOCKS.getFileType()
10228 || type == TSK_DB_FILES_TYPE_ENUM.CARVED.getFileType()
10229 || type == TSK_DB_FILES_TYPE_ENUM.LAYOUT_FILE.getFileType()) {
10230 TSK_DB_FILES_TYPE_ENUM atype = TSK_DB_FILES_TYPE_ENUM.valueOf(type);
10231 String parentPath = rs.getString(
"parent_path");
10232 if (parentPath == null) {
10236 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10237 if (rs.wasNull()) {
10238 osAccountObjId = null;
10241 LayoutFile lf =
new LayoutFile(
this,
10242 rs.getLong(
"obj_id"),
10243 rs.getLong(
"data_source_obj_id"),
10244 rs.getLong(
"fs_obj_id"),
10245 rs.getString(
"name"),
10247 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")), TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10248 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
10249 rs.getLong(
"size"),
10250 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10251 rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10252 FileKnown.valueOf(rs.getByte(
"known")), parentPath,
10253 rs.getString(
"mime_type"),
10254 rs.getString(
"owner_uid"), osAccountObjId);
10256 }
else if (type == TSK_DB_FILES_TYPE_ENUM.DERIVED.getFileType()) {
10257 final DerivedFile df;
10258 df = derivedFile(rs, connection, AbstractContent.UNKNOWN_ID);
10260 }
else if (type == TSK_DB_FILES_TYPE_ENUM.LOCAL.getFileType()) {
10261 final LocalFile lf;
10262 lf = localFile(rs, connection, AbstractContent.UNKNOWN_ID);
10264 }
else if (type == TSK_DB_FILES_TYPE_ENUM.SLACK.getFileType()) {
10265 final SlackFile sf = slackFile(rs, null);
10269 }
catch (SQLException e) {
10270 logger.log(Level.SEVERE,
"Error getting abstract files from result set", e);
10289 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10290 if (rs.wasNull()) {
10291 osAccountObjId = null;
10295 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
10296 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
10297 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
10298 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10299 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10300 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
10301 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
10302 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10303 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
10304 rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10305 FileKnown.valueOf(rs.getByte(
"known")),
10306 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension"), rs.getString(
"owner_uid"),
10307 osAccountObjId, TskData.CollectedStatus.valueOf(rs.getInt(
"collected")), Collections.emptyList());
10308 f.setFileSystem(fs);
10323 Directory directory(ResultSet rs, FileSystem fs)
throws SQLException {
10324 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10325 if (rs.wasNull()) {
10326 osAccountObjId = null;
10329 Directory dir =
new Directory(
this, rs.getLong(
"obj_id"), rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
10330 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
10331 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
10332 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10333 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10334 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
10335 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
10336 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10337 rs.getShort(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
10338 rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10339 FileKnown.valueOf(rs.getByte(
"known")),
10340 rs.getString(
"parent_path"), rs.getString(
"owner_uid"), osAccountObjId);
10341 dir.setFileSystem(fs);
10355 VirtualDirectory virtualDirectory(ResultSet rs, CaseDbConnection connection)
throws SQLException {
10356 String parentPath = rs.getString(
"parent_path");
10357 if (parentPath == null) {
10361 long objId = rs.getLong(
"obj_id");
10362 long dsObjId = rs.getLong(
"data_source_obj_id");
10363 if (objId == dsObjId) {
10365 String deviceId =
"";
10366 String timeZone =
"";
10367 Statement s = null;
10368 ResultSet rsDataSourceInfo = null;
10372 s = connection.createStatement();
10373 rsDataSourceInfo = connection.executeQuery(s,
"SELECT device_id, time_zone FROM data_source_info WHERE obj_id = " + objId);
10374 if (rsDataSourceInfo.next()) {
10375 deviceId = rsDataSourceInfo.getString(
"device_id");
10376 timeZone = rsDataSourceInfo.getString(
"time_zone");
10378 }
catch (SQLException ex) {
10379 logger.log(Level.SEVERE,
"Error data source info for datasource id " + objId, ex);
10381 closeResultSet(rsDataSourceInfo);
10386 return new LocalFilesDataSource(
this,
10389 rs.getString(
"name"),
10390 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10391 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10392 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
10393 rs.getShort(
"meta_flags"),
10395 rs.getString(
"md5"),
10396 rs.getString(
"sha256"),
10397 rs.getString(
"sha1"),
10398 FileKnown.valueOf(rs.getByte(
"known")),
10401 final VirtualDirectory vd =
new VirtualDirectory(
this,
10403 rs.getLong(
"fs_obj_id"),
10404 rs.getString(
"name"),
10405 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10406 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10407 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
10408 rs.getShort(
"meta_flags"), rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10409 FileKnown.valueOf(rs.getByte(
"known")), parentPath);
10423 LocalDirectory localDirectory(ResultSet rs)
throws SQLException {
10424 String parentPath = rs.getString(
"parent_path");
10425 if (parentPath == null) {
10428 final LocalDirectory ld =
new LocalDirectory(
this, rs.getLong(
"obj_id"),
10429 rs.getLong(
"data_source_obj_id"), rs.getString(
"name"),
10430 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10431 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10432 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
10433 rs.getShort(
"meta_flags"), rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10434 FileKnown.valueOf(rs.getByte(
"known")), parentPath);
10451 private DerivedFile derivedFile(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
10452 boolean hasLocalPath = rs.getBoolean(
"has_path");
10453 long objId = rs.getLong(
"obj_id");
10454 String localPath = null;
10455 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
10456 if (hasLocalPath) {
10457 ResultSet rsFilePath = null;
10460 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
10461 statement.clearParameters();
10462 statement.setLong(1, objId);
10463 rsFilePath = connection.executeQuery(statement);
10464 if (rsFilePath.next()) {
10465 localPath = rsFilePath.getString(
"path");
10466 encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
10468 }
catch (SQLException ex) {
10469 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
10471 closeResultSet(rsFilePath);
10475 String parentPath = rs.getString(
"parent_path");
10476 if (parentPath == null) {
10480 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10481 if (rs.wasNull()) {
10482 osAccountObjId = null;
10485 final DerivedFile df =
new DerivedFile(
this, objId, rs.getLong(
"data_source_obj_id"),
10486 rs.getLong(
"fs_obj_id"),
10487 rs.getString(
"name"),
10488 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10489 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10490 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
10491 rs.getLong(
"size"),
10492 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10493 rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10494 FileKnown.valueOf(rs.getByte(
"known")),
10495 parentPath, localPath, parentId, rs.getString(
"mime_type"),
10496 encodingType, rs.getString(
"extension"),
10497 rs.getString(
"owner_uid"), osAccountObjId);
10514 private LocalFile localFile(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
10515 long objId = rs.getLong(
"obj_id");
10516 String localPath = null;
10517 TskData.EncodingType encodingType = TskData.EncodingType.NONE;
10518 if (rs.getBoolean(
"has_path")) {
10519 ResultSet rsFilePath = null;
10522 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE);
10523 statement.clearParameters();
10524 statement.setLong(1, objId);
10525 rsFilePath = connection.executeQuery(statement);
10526 if (rsFilePath.next()) {
10527 localPath = rsFilePath.getString(
"path");
10528 encodingType = TskData.EncodingType.valueOf(rsFilePath.getInt(
"encoding_type"));
10530 }
catch (SQLException ex) {
10531 logger.log(Level.SEVERE,
"Error getting encoding type for file " + objId, ex);
10533 closeResultSet(rsFilePath);
10537 String parentPath = rs.getString(
"parent_path");
10538 if (null == parentPath) {
10541 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10542 if (rs.wasNull()) {
10543 osAccountObjId = null;
10546 LocalFile file =
new LocalFile(
this, objId, rs.getString(
"name"),
10547 TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type")),
10548 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10549 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10550 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
10551 rs.getLong(
"size"),
10552 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10553 rs.getString(
"mime_type"), rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10554 FileKnown.valueOf(rs.getByte(
"known")),
10555 parentId, parentPath, rs.getLong(
"data_source_obj_id"),
10556 localPath, encodingType, rs.getString(
"extension"),
10557 rs.getString(
"owner_uid"), osAccountObjId);
10573 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10574 if (rs.wasNull()) {
10575 osAccountObjId = null;
10578 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
10579 TskData.TSK_FS_ATTR_TYPE_ENUM.valueOf(rs.getShort(
"attr_type")),
10580 rs.getInt(
"attr_id"), rs.getString(
"name"), rs.getLong(
"meta_addr"), rs.getInt(
"meta_seq"),
10581 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10582 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10583 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")),
10584 rs.getShort(
"meta_flags"), rs.getLong(
"size"),
10585 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10586 (short) rs.getInt(
"mode"), rs.getInt(
"uid"), rs.getInt(
"gid"),
10587 rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10588 FileKnown.valueOf(rs.getByte(
"known")),
10589 rs.getString(
"parent_path"), rs.getString(
"mime_type"), rs.getString(
"extension"),
10590 rs.getString(
"owner_uid"), osAccountObjId);
10591 f.setFileSystem(fs);
10606 List<Content> fileChildren(ResultSet rs, CaseDbConnection connection,
long parentId)
throws SQLException {
10607 List<Content> children =
new ArrayList<Content>();
10609 while (rs.next()) {
10610 TskData.TSK_DB_FILES_TYPE_ENUM type = TskData.TSK_DB_FILES_TYPE_ENUM.valueOf(rs.getShort(
"type"));
10612 if (null != type) {
10615 if (rs.getShort(
"meta_type") != TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_VIRT_DIR.getValue()) {
10617 if (rs.getShort(
"meta_type") == TSK_FS_META_TYPE_ENUM.TSK_FS_META_TYPE_DIR.getValue()) {
10618 result = directory(rs, null);
10620 result = file(rs, null);
10622 children.add(result);
10624 VirtualDirectory virtDir = virtualDirectory(rs, connection);
10625 children.add(virtDir);
10629 VirtualDirectory virtDir = virtualDirectory(rs, connection);
10630 children.add(virtDir);
10633 LocalDirectory localDir = localDirectory(rs);
10634 children.add(localDir);
10636 case UNALLOC_BLOCKS:
10637 case UNUSED_BLOCKS:
10639 case LAYOUT_FILE: {
10640 String parentPath = rs.getString(
"parent_path");
10641 if (parentPath == null) {
10644 Long osAccountObjId = rs.getLong(
"os_account_obj_id");
10645 if (rs.wasNull()) {
10646 osAccountObjId = null;
10648 final LayoutFile lf =
new LayoutFile(
this, rs.getLong(
"obj_id"),
10649 rs.getLong(
"data_source_obj_id"), rs.getLong(
"fs_obj_id"),
10650 rs.getString(
"name"), type,
10651 TSK_FS_NAME_TYPE_ENUM.valueOf(rs.getShort(
"dir_type")),
10652 TSK_FS_META_TYPE_ENUM.valueOf(rs.getShort(
"meta_type")),
10653 TSK_FS_NAME_FLAG_ENUM.valueOf(rs.getShort(
"dir_flags")), rs.getShort(
"meta_flags"),
10654 rs.getLong(
"size"),
10655 rs.getLong(
"ctime"), rs.getLong(
"crtime"), rs.getLong(
"atime"), rs.getLong(
"mtime"),
10656 rs.getString(
"md5"), rs.getString(
"sha256"), rs.getString(
"sha1"),
10657 FileKnown.valueOf(rs.getByte(
"known")), parentPath, rs.getString(
"mime_type"),
10658 rs.getString(
"owner_uid"), osAccountObjId);
10663 final DerivedFile df = derivedFile(rs, connection, parentId);
10667 final LocalFile lf = localFile(rs, connection, parentId);
10672 final SlackFile sf = slackFile(rs, null);
10741 CaseDbConnection getConnection() throws TskCoreException {
10742 return connections.getConnection();
10752 String getCaseHandleIdentifier() {
10753 return caseHandleIdentifier;
10756 @SuppressWarnings(
"deprecation")
10773 connections.close();
10774 }
catch (TskCoreException ex) {
10775 logger.log(Level.SEVERE,
"Error closing database connection pool.", ex);
10778 fileSystemIdMap.clear();
10781 if (this.caseHandle != null) {
10782 this.caseHandle.free();
10783 this.caseHandle = null;
10785 }
catch (TskCoreException ex) {
10786 logger.log(Level.SEVERE,
"Error freeing case handle.", ex);
10805 long id = file.getId();
10806 FileKnown currentKnown = file.getKnown();
10807 if (currentKnown.compareTo(fileKnown) > 0) {
10811 try (CaseDbConnection connection = connections.getConnection();
10812 Statement statement = connection.createStatement();) {
10813 connection.executeUpdate(statement,
"UPDATE tsk_files "
10814 +
"SET known='" + fileKnown.getFileKnownValue() +
"' "
10815 +
"WHERE obj_id=" + id);
10817 file.setKnown(fileKnown);
10818 }
catch (SQLException ex) {
10819 throw new TskCoreException(
"Error setting Known status.", ex);
10834 void setFileName(String name,
long objId)
throws TskCoreException {
10836 try (CaseDbConnection connection = connections.getConnection();) {
10838 preparedStatement.clearParameters();
10839 preparedStatement.setString(1, name);
10840 preparedStatement.setLong(2, objId);
10841 connection.executeUpdate(preparedStatement);
10842 }
catch (SQLException ex) {
10843 throw new TskCoreException(String.format(
"Error updating while the name for object ID %d to %s", objId, name), ex);
10857 void setImageName(String name,
long objId)
throws TskCoreException {
10859 try (CaseDbConnection connection = connections.getConnection();) {
10860 PreparedStatement preparedStatement = connection.getPreparedStatement(SleuthkitCase.PREPARED_STATEMENT.UPDATE_IMAGE_NAME);
10861 preparedStatement.clearParameters();
10862 preparedStatement.setString(1, name);
10863 preparedStatement.setLong(2, objId);
10864 connection.executeUpdate(preparedStatement);
10865 }
catch (SQLException ex) {
10866 throw new TskCoreException(String.format(
"Error updating while the name for object ID %d to %s", objId, name), ex);
10886 void setImageSizes(Image image,
long totalSize,
long sectorSize)
throws TskCoreException {
10889 try (CaseDbConnection connection = connections.getConnection();) {
10890 PreparedStatement preparedStatement = connection.getPreparedStatement(SleuthkitCase.PREPARED_STATEMENT.UPDATE_IMAGE_SIZES);
10891 preparedStatement.clearParameters();
10892 preparedStatement.setLong(1, totalSize);
10893 preparedStatement.setLong(2, sectorSize);
10894 preparedStatement.setLong(3, image.getId());
10895 connection.executeUpdate(preparedStatement);
10896 }
catch (SQLException ex) {
10897 throw new TskCoreException(String.format(
"Error updating image sizes to %d and sector size to %d for object ID %d ", totalSize, sectorSize, image.getId()), ex);
10914 try (CaseDbConnection connection = connections.getConnection();
10915 Statement statement = connection.createStatement()) {
10916 connection.executeUpdate(statement, String.format(
"UPDATE tsk_files SET mime_type = '%s' WHERE obj_id = %d", mimeType, file.getId()));
10917 file.setMIMEType(mimeType);
10918 }
catch (SQLException ex) {
10919 throw new TskCoreException(String.format(
"Error setting MIME type for file (obj_id = %s)", file.getId()), ex);
10938 short metaFlag = file.getMetaFlagsAsInt();
10947 try (CaseDbConnection connection = connections.getConnection();
10948 Statement statement = connection.createStatement();) {
10949 connection.executeUpdate(statement, String.format(
"UPDATE tsk_files SET meta_flags = '%d', dir_flags = '%d' WHERE obj_id = %d", newMetaFlgs, newDirFlags, file.getId()));
10956 }
catch (SQLException ex) {
10957 throw new TskCoreException(String.format(
"Error setting unalloc meta flag for file (obj_id = %s)", file.getId()), ex);
10972 void setMd5Hash(AbstractFile file, String md5Hash)
throws TskCoreException {
10973 if (md5Hash == null) {
10976 long id = file.getId();
10978 try (CaseDbConnection connection = connections.getConnection();) {
10979 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_FILE_MD5);
10980 statement.clearParameters();
10981 statement.setString(1, md5Hash.toLowerCase());
10982 statement.setLong(2,
id);
10983 connection.executeUpdate(statement);
10984 file.setMd5Hash(md5Hash.toLowerCase());
10985 }
catch (SQLException ex) {
10986 throw new TskCoreException(
"Error setting MD5 hash", ex);
11001 void setMd5ImageHash(Image img, String md5Hash)
throws TskCoreException {
11002 if (md5Hash == null) {
11005 long id = img.getId();
11007 try (CaseDbConnection connection = connections.getConnection();) {
11008 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_MD5);
11009 statement.clearParameters();
11010 statement.setString(1, md5Hash.toLowerCase());
11011 statement.setLong(2,
id);
11012 connection.executeUpdate(statement);
11013 }
catch (SQLException ex) {
11014 throw new TskCoreException(
"Error setting MD5 hash", ex);
11030 String getMd5ImageHash(Image img)
throws TskCoreException {
11031 long id = img.getId();
11032 CaseDbConnection connection = null;
11033 ResultSet rs = null;
11037 connection = connections.getConnection();
11039 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_MD5);
11040 statement.clearParameters();
11041 statement.setLong(1,
id);
11042 rs = connection.executeQuery(statement);
11044 hash = rs.getString(
"md5");
11047 }
catch (SQLException ex) {
11048 throw new TskCoreException(
"Error getting MD5 hash", ex);
11050 closeResultSet(rs);
11051 closeConnection(connection);
11065 void setSha1ImageHash(Image img, String sha1Hash)
throws TskCoreException {
11066 if (sha1Hash == null) {
11069 long id = img.getId();
11071 try (CaseDbConnection connection = connections.getConnection();) {
11072 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_SHA1);
11073 statement.clearParameters();
11074 statement.setString(1, sha1Hash.toLowerCase());
11075 statement.setLong(2,
id);
11076 connection.executeUpdate(statement);
11077 }
catch (SQLException ex) {
11078 throw new TskCoreException(
"Error setting SHA1 hash", ex);
11094 String getSha1ImageHash(Image img)
throws TskCoreException {
11095 long id = img.getId();
11096 CaseDbConnection connection = null;
11097 ResultSet rs = null;
11101 connection = connections.getConnection();
11103 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_SHA1);
11104 statement.clearParameters();
11105 statement.setLong(1,
id);
11106 rs = connection.executeQuery(statement);
11108 hash = rs.getString(
"sha1");
11111 }
catch (SQLException ex) {
11112 throw new TskCoreException(
"Error getting SHA1 hash", ex);
11114 closeResultSet(rs);
11115 closeConnection(connection);
11129 void setSha256ImageHash(Image img, String sha256Hash)
throws TskCoreException {
11130 if (sha256Hash == null) {
11133 long id = img.getId();
11135 try (CaseDbConnection connection = connections.getConnection();) {
11136 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_SHA256);
11137 statement.clearParameters();
11138 statement.setString(1, sha256Hash.toLowerCase());
11139 statement.setLong(2,
id);
11140 connection.executeUpdate(statement);
11141 }
catch (SQLException ex) {
11142 throw new TskCoreException(
"Error setting SHA256 hash", ex);
11158 String getSha256ImageHash(Image img)
throws TskCoreException {
11159 long id = img.getId();
11160 CaseDbConnection connection = null;
11161 ResultSet rs = null;
11165 connection = connections.getConnection();
11167 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_IMAGE_SHA256);
11168 statement.clearParameters();
11169 statement.setLong(1,
id);
11170 rs = connection.executeQuery(statement);
11172 hash = rs.getString(
"sha256");
11175 }
catch (SQLException ex) {
11176 throw new TskCoreException(
"Error setting SHA256 hash", ex);
11178 closeResultSet(rs);
11179 closeConnection(connection);
11192 void setAcquisitionDetails(DataSource datasource, String details)
throws TskCoreException {
11194 long id = datasource.getId();
11196 try (CaseDbConnection connection = connections.getConnection();) {
11197 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ACQUISITION_DETAILS);
11198 statement.clearParameters();
11199 statement.setString(1, details);
11200 statement.setLong(2,
id);
11201 connection.executeUpdate(statement);
11202 }
catch (SQLException ex) {
11203 throw new TskCoreException(
"Error setting acquisition details", ex);
11220 void setAcquisitionToolDetails(DataSource datasource, String name, String version, String settings)
throws TskCoreException {
11222 long id = datasource.getId();
11224 try (CaseDbConnection connection = connections.getConnection();) {
11225 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ACQUISITION_TOOL_SETTINGS);
11226 statement.clearParameters();
11227 statement.setString(1, settings);
11228 statement.setString(2, name);
11229 statement.setString(3, version);
11230 statement.setLong(4,
id);
11231 connection.executeUpdate(statement);
11232 }
catch (SQLException ex) {
11233 throw new TskCoreException(
"Error setting acquisition details", ex);
11248 void setAcquisitionDetails(
long dataSourceId, String details, CaseDbTransaction trans)
throws TskCoreException {
11250 CaseDbConnection connection = trans.getConnection();
11251 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_ACQUISITION_DETAILS);
11252 statement.clearParameters();
11253 statement.setString(1, details);
11254 statement.setLong(2, dataSourceId);
11255 connection.executeUpdate(statement);
11256 }
catch (SQLException ex) {
11257 throw new TskCoreException(
"Error setting acquisition details", ex);
11270 String getAcquisitionDetails(DataSource datasource)
throws TskCoreException {
11271 long id = datasource.getId();
11272 CaseDbConnection connection = null;
11273 ResultSet rs = null;
11277 connection = connections.getConnection();
11279 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ACQUISITION_DETAILS);
11280 statement.clearParameters();
11281 statement.setLong(1,
id);
11282 rs = connection.executeQuery(statement);
11284 hash = rs.getString(
"acquisition_details");
11287 }
catch (SQLException ex) {
11288 throw new TskCoreException(
"Error setting acquisition details", ex);
11290 closeResultSet(rs);
11291 closeConnection(connection);
11306 String getDataSourceInfoString(DataSource datasource, String columnName)
throws TskCoreException {
11307 long id = datasource.getId();
11308 CaseDbConnection connection = null;
11309 ResultSet rs = null;
11310 String returnValue =
"";
11313 connection = connections.getConnection();
11315 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ACQUISITION_TOOL_SETTINGS);
11316 statement.clearParameters();
11317 statement.setLong(1,
id);
11318 rs = connection.executeQuery(statement);
11320 returnValue = rs.getString(columnName);
11322 return returnValue;
11323 }
catch (SQLException ex) {
11324 throw new TskCoreException(
"Error setting acquisition details", ex);
11326 closeResultSet(rs);
11327 closeConnection(connection);
11342 Long getDataSourceInfoLong(DataSource datasource, String columnName)
throws TskCoreException {
11343 long id = datasource.getId();
11344 CaseDbConnection connection = null;
11345 ResultSet rs = null;
11346 Long returnValue = null;
11349 connection = connections.getConnection();
11351 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ACQUISITION_TOOL_SETTINGS);
11352 statement.clearParameters();
11353 statement.setLong(1,
id);
11354 rs = connection.executeQuery(statement);
11356 returnValue = rs.getLong(columnName);
11358 return returnValue;
11359 }
catch (SQLException ex) {
11360 throw new TskCoreException(
"Error setting acquisition details", ex);
11362 closeResultSet(rs);
11363 closeConnection(connection);
11379 if (newStatus == null) {
11383 try (CaseDbConnection connection = connections.getConnection();
11384 Statement statement = connection.createStatement();) {
11385 connection.executeUpdate(statement,
"UPDATE blackboard_artifacts "
11386 +
" SET review_status_id=" + newStatus.getID()
11387 +
" WHERE blackboard_artifacts.artifact_id = " + artifact.
getArtifactID());
11388 }
catch (SQLException ex) {
11389 throw new TskCoreException(
"Error setting review status", ex);
11406 CaseDbConnection connection = null;
11407 Statement s = null;
11408 ResultSet rs = null;
11411 connection = connections.getConnection();
11412 s = connection.createStatement();
11413 Short contentShort = contentType.getValue();
11414 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files WHERE meta_type = '" + contentShort.toString() +
"'");
11417 count = rs.getInt(
"count");
11420 }
catch (SQLException ex) {
11421 throw new TskCoreException(
"Error getting number of objects.", ex);
11423 closeResultSet(rs);
11425 closeConnection(connection);
11439 String escapedText = null;
11440 if (text != null) {
11441 escapedText = text.replaceAll(
"'",
"''");
11443 return escapedText;
11454 if (md5Hash == null) {
11455 return Collections.<AbstractFile>emptyList();
11458 CaseDbConnection connection = null;
11459 Statement s = null;
11460 ResultSet rs = null;
11463 connection = connections.getConnection();
11464 s = connection.createStatement();
11465 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE "
11466 +
" md5 = '" + md5Hash.toLowerCase() +
"' "
11468 return resultSetToAbstractFiles(rs, connection);
11469 }
catch (SQLException | TskCoreException ex) {
11470 logger.log(Level.WARNING,
"Error querying database.", ex);
11472 closeResultSet(rs);
11474 closeConnection(connection);
11477 return Collections.<AbstractFile>emptyList();
11487 boolean allFilesAreHashed =
false;
11489 CaseDbConnection connection = null;
11490 Statement s = null;
11491 ResultSet rs = null;
11494 connection = connections.getConnection();
11495 s = connection.createStatement();
11496 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
11498 +
"AND md5 IS NULL "
11499 +
"AND size > '0'");
11500 if (rs.next() && rs.getInt(
"count") == 0) {
11501 allFilesAreHashed =
true;
11503 }
catch (SQLException | TskCoreException ex) {
11504 logger.log(Level.WARNING,
"Failed to query whether all files have MD5 hashes", ex);
11506 closeResultSet(rs);
11508 closeConnection(connection);
11511 return allFilesAreHashed;
11523 CaseDbConnection connection = null;
11524 Statement s = null;
11525 ResultSet rs = null;
11527 connection = connections.getConnection();
11528 s = connection.createStatement();
11529 rs = connection.executeQuery(s,
"SELECT COUNT(*) AS count FROM tsk_files "
11530 +
"WHERE md5 IS NOT NULL "
11531 +
"AND size > '0'");
11533 count = rs.getInt(
"count");
11535 }
catch (SQLException | TskCoreException ex) {
11536 logger.log(Level.WARNING,
"Failed to query for all the files.", ex);
11538 closeResultSet(rs);
11540 closeConnection(connection);
11556 CaseDbConnection connection = null;
11557 ResultSet resultSet = null;
11560 connection = connections.getConnection();
11563 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES);
11564 resultSet = connection.executeQuery(statement);
11565 ArrayList<TagName> tagNames =
new ArrayList<>();
11566 while (resultSet.next()) {
11567 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11569 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank")));
11572 }
catch (SQLException ex) {
11573 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
11575 closeResultSet(resultSet);
11576 closeConnection(connection);
11592 CaseDbConnection connection = null;
11593 ResultSet resultSet = null;
11596 connection = connections.getConnection();
11599 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE);
11600 resultSet = connection.executeQuery(statement);
11601 ArrayList<TagName> tagNames =
new ArrayList<>();
11602 while (resultSet.next()) {
11603 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11605 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank")));
11608 }
catch (SQLException ex) {
11609 throw new TskCoreException(
"Error selecting rows from tag_names table", ex);
11611 closeResultSet(resultSet);
11612 closeConnection(connection);
11631 ArrayList<TagName> tagNames =
new ArrayList<>();
11637 CaseDbConnection connection = null;
11638 ResultSet resultSet = null;
11641 connection = connections.getConnection();
11643 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_TAG_NAMES_IN_USE_BY_DATASOURCE);
11644 statement.setLong(1, dsObjId);
11645 statement.setLong(2, dsObjId);
11646 resultSet = connection.executeQuery(statement);
11647 while (resultSet.next()) {
11648 tagNames.add(
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11650 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank")));
11653 }
catch (SQLException ex) {
11654 throw new TskCoreException(
"Failed to get tag names in use for data source objID : " + dsObjId, ex);
11656 closeResultSet(resultSet);
11657 closeConnection(connection);
11676 @SuppressWarnings(
"deprecation")
11730 PreparedStatement statement = trans.getConnection().getPreparedStatement(PREPARED_STATEMENT.DELETE_CONTENT_TAG);
11731 statement.clearParameters();
11732 statement.setLong(1, tag.getId());
11733 trans.getConnection().executeUpdate(statement);
11736 Long contentId = tag.getContent() != null ? tag.getContent().getId() : null;
11737 Long dataSourceId = tag.getContent() != null && tag.getContent().getDataSource() != null
11738 ? tag.getContent().getDataSource().getId()
11741 this.
getScoringManager().updateAggregateScoreAfterDeletion(contentId, dataSourceId, trans);
11745 }
catch (SQLException ex) {
11746 throw new TskCoreException(
"Error deleting row from content_tags table (id = " + tag.getId() +
")", ex);
11748 if (trans != null) {
11763 CaseDbConnection connection = null;
11764 ResultSet resultSet = null;
11767 connection = connections.getConnection();
11773 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS);
11774 resultSet = connection.executeQuery(statement);
11775 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
11776 while (resultSet.next()) {
11777 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11779 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
11781 tags.add(
new ContentTag(resultSet.getLong(
"tag_id"), content, tagName, resultSet.getString(
"comment"),
11782 resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name")));
11785 }
catch (SQLException ex) {
11786 throw new TskCoreException(
"Error selecting rows from content_tags table", ex);
11788 closeResultSet(resultSet);
11789 closeConnection(connection);
11805 if (tagName.getId() ==
Tag.ID_NOT_SET) {
11806 throw new TskCoreException(
"TagName object is invalid, id not set");
11808 CaseDbConnection connection = null;
11809 ResultSet resultSet = null;
11812 connection = connections.getConnection();
11815 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME);
11816 statement.clearParameters();
11817 statement.setLong(1, tagName.getId());
11818 resultSet = connection.executeQuery(statement);
11819 if (resultSet.next()) {
11820 return resultSet.getLong(
"count");
11822 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
11824 }
catch (SQLException ex) {
11825 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
11827 closeResultSet(resultSet);
11828 closeConnection(connection);
11850 if (tagName.getId() ==
Tag.ID_NOT_SET) {
11851 throw new TskCoreException(
"TagName object is invalid, id not set");
11854 CaseDbConnection connection = null;
11855 ResultSet resultSet = null;
11858 connection = connections.getConnection();
11863 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
11864 statement.clearParameters();
11865 statement.setLong(1, tagName.getId());
11866 statement.setLong(2, dsObjId);
11868 resultSet = connection.executeQuery(statement);
11869 if (resultSet.next()) {
11870 return resultSet.getLong(
"count");
11872 throw new TskCoreException(
"Error getting content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")" +
" for dsObjId = " + dsObjId);
11874 }
catch (SQLException ex) {
11875 throw new TskCoreException(
"Failed to get content_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
11877 closeResultSet(resultSet);
11878 closeConnection(connection);
11895 CaseDbConnection connection = null;
11896 ResultSet resultSet = null;
11900 connection = connections.getConnection();
11907 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAG_BY_ID);
11908 statement.clearParameters();
11909 statement.setLong(1, contentTagID);
11910 resultSet = connection.executeQuery(statement);
11912 while (resultSet.next()) {
11913 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
11915 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
11917 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
11921 }
catch (SQLException ex) {
11922 throw new TskCoreException(
"Error getting content tag with id = " + contentTagID, ex);
11924 closeResultSet(resultSet);
11925 closeConnection(connection);
11943 if (tagName.getId() ==
Tag.ID_NOT_SET) {
11944 throw new TskCoreException(
"TagName object is invalid, id not set");
11946 CaseDbConnection connection = null;
11947 ResultSet resultSet = null;
11950 connection = connections.getConnection();
11956 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME);
11957 statement.clearParameters();
11958 statement.setLong(1, tagName.getId());
11959 resultSet = connection.executeQuery(statement);
11960 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
11961 while (resultSet.next()) {
11963 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
11968 }
catch (SQLException ex) {
11969 throw new TskCoreException(
"Error getting content_tags rows (tag_name_id = " + tagName.getId() +
")", ex);
11971 closeResultSet(resultSet);
11972 closeConnection(connection);
11991 CaseDbConnection connection = null;
11992 ResultSet resultSet = null;
11995 connection = connections.getConnection();
12003 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
12004 statement.clearParameters();
12005 statement.setLong(1, tagName.getId());
12006 statement.setLong(2, dsObjId);
12007 resultSet = connection.executeQuery(statement);
12008 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
12009 while (resultSet.next()) {
12011 tagName, resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
12016 }
catch (SQLException ex) {
12017 throw new TskCoreException(
"Failed to get content_tags row count for tag_name_id = " + tagName.getId() +
" data source objID : " + dsObjId, ex);
12019 closeResultSet(resultSet);
12020 closeConnection(connection);
12037 CaseDbConnection connection = null;
12038 ResultSet resultSet = null;
12041 connection = connections.getConnection();
12048 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_CONTENT_TAGS_BY_CONTENT);
12049 statement.clearParameters();
12050 statement.setLong(1, content.getId());
12051 resultSet = connection.executeQuery(statement);
12052 ArrayList<ContentTag> tags =
new ArrayList<ContentTag>();
12053 while (resultSet.next()) {
12054 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
12056 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
12058 resultSet.getString(
"comment"), resultSet.getLong(
"begin_byte_offset"), resultSet.getLong(
"end_byte_offset"), resultSet.getString(
"login_name"));
12062 }
catch (SQLException ex) {
12063 throw new TskCoreException(
"Error getting content tags data for content (obj_id = " + content.getId() +
")", ex);
12065 closeResultSet(resultSet);
12066 closeConnection(connection);
12099 PreparedStatement statement = trans.getConnection().getPreparedStatement(PREPARED_STATEMENT.DELETE_ARTIFACT_TAG);
12100 statement.clearParameters();
12101 statement.setLong(1, tag.getId());
12102 trans.getConnection().executeUpdate(statement);
12105 Long artifactObjId = tag.getArtifact().getId();
12106 Long dataSourceId = tag.getContent() != null && tag.getContent().getDataSource() != null
12107 ? tag.getContent().getDataSource().getId()
12110 this.
getScoringManager().updateAggregateScoreAfterDeletion(artifactObjId, dataSourceId, trans);
12114 }
catch (SQLException ex) {
12115 throw new TskCoreException(
"Error deleting row from blackboard_artifact_tags table (id = " + tag.getId() +
")", ex);
12117 if (trans != null) {
12133 CaseDbConnection connection = null;
12134 ResultSet resultSet = null;
12137 connection = connections.getConnection();
12143 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS);
12144 resultSet = connection.executeQuery(statement);
12145 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<>();
12146 while (resultSet.next()) {
12147 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
12149 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
12153 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
12157 }
catch (SQLException ex) {
12158 throw new TskCoreException(
"Error selecting rows from blackboard_artifact_tags table", ex);
12160 closeResultSet(resultSet);
12161 closeConnection(connection);
12177 if (tagName.getId() ==
Tag.ID_NOT_SET) {
12178 throw new TskCoreException(
"TagName object is invalid, id not set");
12180 CaseDbConnection connection = null;
12181 ResultSet resultSet = null;
12184 connection = connections.getConnection();
12187 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME);
12188 statement.clearParameters();
12189 statement.setLong(1, tagName.getId());
12190 resultSet = connection.executeQuery(statement);
12191 if (resultSet.next()) {
12192 return resultSet.getLong(
"count");
12194 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() +
")");
12196 }
catch (SQLException ex) {
12197 throw new TskCoreException(
"Error getting blackboard artifact_content_tags row count for tag name (tag_name_id = " + tagName.getId() +
")", ex);
12199 closeResultSet(resultSet);
12200 closeConnection(connection);
12221 if (tagName.getId() ==
Tag.ID_NOT_SET) {
12222 throw new TskCoreException(
"TagName object is invalid, id not set");
12225 CaseDbConnection connection = null;
12226 ResultSet resultSet = null;
12229 connection = connections.getConnection();
12234 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.COUNT_ARTIFACTS_BY_TAG_NAME_BY_DATASOURCE);
12235 statement.clearParameters();
12236 statement.setLong(1, tagName.getId());
12237 statement.setLong(2, dsObjId);
12238 resultSet = connection.executeQuery(statement);
12239 if (resultSet.next()) {
12240 return resultSet.getLong(
"count");
12242 throw new TskCoreException(
"Error getting blackboard_artifact_tags row count for tag name (tag_name_id = " + tagName.getId() +
")" +
" for dsObjId = " + dsObjId);
12244 }
catch (SQLException ex) {
12245 throw new TskCoreException(
"Failed to get blackboard_artifact_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
12247 closeResultSet(resultSet);
12248 closeConnection(connection);
12265 if (tagName.getId() ==
Tag.ID_NOT_SET) {
12266 throw new TskCoreException(
"TagName object is invalid, id not set");
12268 CaseDbConnection connection = null;
12269 ResultSet resultSet = null;
12272 connection = connections.getConnection();
12278 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME);
12279 statement.clearParameters();
12280 statement.setLong(1, tagName.getId());
12281 resultSet = connection.executeQuery(statement);
12282 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
12283 while (resultSet.next()) {
12287 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
12291 }
catch (SQLException ex) {
12292 throw new TskCoreException(
"Error getting blackboard artifact tags data (tag_name_id = " + tagName.getId() +
")", ex);
12294 closeResultSet(resultSet);
12295 closeConnection(connection);
12316 if (tagName.getId() ==
Tag.ID_NOT_SET) {
12317 throw new TskCoreException(
"TagName object is invalid, id not set");
12320 CaseDbConnection connection = null;
12321 ResultSet resultSet = null;
12324 connection = connections.getConnection();
12332 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_TAG_NAME_BY_DATASOURCE);
12333 statement.clearParameters();
12334 statement.setLong(1, tagName.getId());
12335 statement.setLong(2, dsObjId);
12336 resultSet = connection.executeQuery(statement);
12337 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<BlackboardArtifactTag>();
12338 while (resultSet.next()) {
12342 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
12346 }
catch (SQLException ex) {
12347 throw new TskCoreException(
"Failed to get blackboard_artifact_tags row count for tag_name_id = " + tagName.getId() +
"data source objID : " + dsObjId, ex);
12349 closeResultSet(resultSet);
12350 closeConnection(connection);
12369 CaseDbConnection connection = null;
12370 ResultSet resultSet = null;
12374 connection = connections.getConnection();
12381 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAG_BY_ID);
12382 statement.clearParameters();
12383 statement.setLong(1, artifactTagID);
12384 resultSet = connection.executeQuery(statement);
12386 while (resultSet.next()) {
12387 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
12389 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
12393 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
12397 }
catch (SQLException ex) {
12398 throw new TskCoreException(
"Error getting blackboard artifact tag with id = " + artifactTagID, ex);
12400 closeResultSet(resultSet);
12401 closeConnection(connection);
12420 CaseDbConnection connection = null;
12421 ResultSet resultSet = null;
12424 connection = connections.getConnection();
12431 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_ARTIFACT_TAGS_BY_ARTIFACT);
12432 statement.clearParameters();
12433 statement.setLong(1, artifact.getArtifactID());
12434 resultSet = connection.executeQuery(statement);
12435 ArrayList<BlackboardArtifactTag> tags =
new ArrayList<>();
12436 while (resultSet.next()) {
12437 TagName tagName =
new TagName(resultSet.getLong(
"tag_name_id"), resultSet.getString(
"display_name"),
12439 TskData.
FileKnown.
valueOf(resultSet.getByte(
"knownStatus")), resultSet.getLong(
"tag_set_id"), resultSet.getInt(
"rank"));
12442 artifact, content, tagName, resultSet.getString(
"comment"), resultSet.getString(
"login_name"));
12446 }
catch (SQLException ex) {
12447 throw new TskCoreException(
"Error getting blackboard artifact tags data (artifact_id = " + artifact.getArtifactID() +
")", ex);
12449 closeResultSet(resultSet);
12450 closeConnection(connection);
12465 try (CaseDbConnection connection = connections.getConnection();) {
12467 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.UPDATE_IMAGE_PATH);
12468 statement.clearParameters();
12469 statement.setString(1, newPath);
12470 statement.setLong(2, objectId);
12471 connection.executeUpdate(statement);
12472 }
catch (SQLException ex) {
12473 throw new TskCoreException(
"Error updating image path in database for object " + objectId, ex);
12492 public Report addReport(String localPath, String sourceModuleName, String reportName)
throws TskCoreException {
12493 return addReport(localPath, sourceModuleName, reportName, null);
12514 String relativePath =
"";
12515 long createTime = 0;
12516 String localPathLower = localPath.toLowerCase();
12518 if (localPathLower.startsWith(
"http")) {
12519 relativePath = localPathLower;
12520 createTime = System.currentTimeMillis() / 1000;
12531 int length =
new File(casePathLower).toURI().relativize(
new File(localPathLower).toURI()).getPath().length();
12532 relativePath =
new File(localPath.substring(localPathLower.length() - length)).getPath();
12533 }
catch (IllegalArgumentException ex) {
12534 String errorMessage = String.format(
"Local path %s not in the database directory or one of its subdirectories", localPath);
12535 throw new TskCoreException(errorMessage, ex);
12539 java.io.File tempFile =
new java.io.File(localPath);
12541 createTime = tempFile.lastModified() / 1000;
12542 }
catch (Exception ex) {
12543 throw new TskCoreException(
"Could not get create time for report at " + localPath, ex);
12549 try (CaseDbConnection connection = connections.getConnection();) {
12552 long parentObjId = 0;
12553 if (parent != null) {
12554 parentObjId = parent.getId();
12559 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_REPORT);
12560 statement.clearParameters();
12561 statement.setLong(1, objectId);
12562 statement.setString(2, relativePath);
12563 statement.setLong(3, createTime);
12564 statement.setString(4, sourceModuleName);
12565 statement.setString(5, reportName);
12566 connection.executeUpdate(statement);
12567 return new Report(
this, objectId, localPath, createTime, sourceModuleName, reportName, parent);
12568 }
catch (SQLException ex) {
12569 throw new TskCoreException(
"Error adding report " + localPath +
" to reports table", ex);
12584 CaseDbConnection connection = null;
12585 ResultSet resultSet = null;
12586 ResultSet parentResultSet = null;
12587 PreparedStatement statement = null;
12588 Statement parentStatement = null;
12591 connection = connections.getConnection();
12594 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_REPORTS);
12595 parentStatement = connection.createStatement();
12596 resultSet = connection.executeQuery(statement);
12597 ArrayList<Report> reports =
new ArrayList<Report>();
12598 while (resultSet.next()) {
12599 String localpath = resultSet.getString(
"path");
12600 if (localpath.toLowerCase().startsWith(
"http") ==
false) {
12602 localpath = Paths.get(
getDbDirPath(), localpath).normalize().toString();
12607 long reportId = resultSet.getLong(
"obj_id");
12608 String parentQuery = String.format(
"SELECT * FROM tsk_objects WHERE obj_id = %s;", reportId);
12609 parentResultSet = parentStatement.executeQuery(parentQuery);
12610 if (parentResultSet.next()) {
12611 long parentId = parentResultSet.getLong(
"par_obj_id");
12614 parentResultSet.close();
12616 reports.add(
new Report(
this,
12619 resultSet.getLong(
"crtime"),
12620 resultSet.getString(
"src_module_name"),
12621 resultSet.getString(
"report_name"),
12625 }
catch (SQLException ex) {
12626 throw new TskCoreException(
"Error querying reports table", ex);
12628 closeResultSet(resultSet);
12629 closeResultSet(parentResultSet);
12630 closeStatement(statement);
12631 closeStatement(parentStatement);
12633 closeConnection(connection);
12648 CaseDbConnection connection = null;
12649 PreparedStatement statement = null;
12650 Statement parentStatement = null;
12651 ResultSet resultSet = null;
12652 ResultSet parentResultSet = null;
12656 connection = connections.getConnection();
12659 statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_REPORT_BY_ID);
12660 parentStatement = connection.createStatement();
12661 statement.clearParameters();
12662 statement.setLong(1,
id);
12663 resultSet = connection.executeQuery(statement);
12665 if (resultSet.next()) {
12668 String parentQuery = String.format(
"SELECT * FROM tsk_objects WHERE obj_id = %s;",
id);
12669 parentResultSet = parentStatement.executeQuery(parentQuery);
12670 if (parentResultSet.next()) {
12671 long parentId = parentResultSet.getLong(
"par_obj_id");
12675 report =
new Report(
this, resultSet.getLong(
"obj_id"),
12676 Paths.get(
getDbDirPath(), resultSet.getString(
"path")).normalize().toString(),
12677 resultSet.getLong(
"crtime"),
12678 resultSet.getString(
"src_module_name"),
12679 resultSet.getString(
"report_name"),
12682 throw new TskCoreException(
"No report found for id: " +
id);
12684 }
catch (SQLException ex) {
12685 throw new TskCoreException(
"Error querying reports table for id: " +
id, ex);
12687 closeResultSet(resultSet);
12688 closeResultSet(parentResultSet);
12689 closeStatement(statement);
12690 closeStatement(parentStatement);
12691 closeConnection(connection);
12707 try (CaseDbConnection connection = connections.getConnection();) {
12709 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_REPORT);
12710 statement.setLong(1, report.getId());
12711 connection.executeUpdate(statement);
12713 statement = connection.getPreparedStatement(PREPARED_STATEMENT.DELETE_REPORT_TSK_OBJECT);
12714 statement.setLong(1, report.getId());
12716 connection.executeUpdate(statement);
12717 }
catch (SQLException ex) {
12718 throw new TskCoreException(
"Error querying reports table", ex);
12724 static void closeResultSet(ResultSet resultSet) {
12725 if (resultSet != null) {
12728 }
catch (SQLException ex) {
12729 logger.log(Level.SEVERE,
"Error closing ResultSet", ex);
12734 static void closeStatement(Statement statement) {
12735 if (statement != null) {
12738 }
catch (SQLException ex) {
12739 logger.log(Level.SEVERE,
"Error closing Statement", ex);
12745 static void closeConnection(CaseDbConnection connection) {
12746 if (connection != null) {
12747 connection.close();
12751 private static void rollbackTransaction(CaseDbConnection connection) {
12752 if (connection != null) {
12753 connection.rollbackTransaction();
12765 void setIngestJobEndDateTime(
long ingestJobId,
long endDateTime)
throws TskCoreException {
12767 try (CaseDbConnection connection = connections.getConnection();) {
12768 Statement statement = connection.createStatement();
12769 statement.executeUpdate(
"UPDATE ingest_jobs SET end_date_time=" + endDateTime +
" WHERE ingest_job_id=" + ingestJobId +
";");
12770 }
catch (SQLException ex) {
12771 throw new TskCoreException(
"Error updating the end date (ingest_job_id = " + ingestJobId +
".", ex);
12777 void setIngestJobStatus(
long ingestJobId, IngestJobStatusType status)
throws TskCoreException {
12779 try (CaseDbConnection connection = connections.getConnection();
12780 Statement statement = connection.createStatement();) {
12781 statement.executeUpdate(
"UPDATE ingest_jobs SET status_id=" + status.ordinal() +
" WHERE ingest_job_id=" + ingestJobId +
";");
12782 }
catch (SQLException ex) {
12783 throw new TskCoreException(
"Error ingest job status (ingest_job_id = " + ingestJobId +
".", ex);
12806 CaseDbConnection connection = null;
12808 ResultSet resultSet = null;
12809 Statement statement;
12811 connection = connections.getConnection();
12812 connection.beginTransaction();
12813 statement = connection.createStatement();
12814 PreparedStatement insertStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INGEST_JOB, Statement.RETURN_GENERATED_KEYS);
12815 insertStatement.setLong(1, dataSource.getId());
12816 insertStatement.setString(2, hostName);
12817 insertStatement.setLong(3, jobStart.getTime());
12818 insertStatement.setLong(4, jobEnd.getTime());
12819 insertStatement.setInt(5, status.ordinal());
12820 insertStatement.setString(6, settingsDir);
12821 connection.executeUpdate(insertStatement);
12822 resultSet = insertStatement.getGeneratedKeys();
12824 long id = resultSet.getLong(1);
12825 for (
int i = 0; i < ingestModules.size(); i++) {
12827 statement.executeUpdate(
"INSERT INTO ingest_job_modules (ingest_job_id, ingest_module_id, pipeline_position) "
12828 +
"VALUES (" +
id +
", " + ingestModule.
getIngestModuleId() +
", " + i +
");");
12832 connection.commitTransaction();
12833 return new IngestJobInfo(
id, dataSource.getId(), hostName, jobStart,
"", ingestModules,
this);
12834 }
catch (SQLException ex) {
12835 rollbackTransaction(connection);
12836 throw new TskCoreException(
"Error adding the ingest job.", ex);
12838 closeResultSet(resultSet);
12839 closeConnection(connection);
12858 CaseDbConnection connection = null;
12859 ResultSet resultSet = null;
12860 Statement statement = null;
12861 String uniqueName = factoryClassName +
"-" + displayName +
"-" + version;
12864 connection = connections.getConnection();
12865 statement = connection.createStatement();
12866 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
12867 if (!resultSet.next()) {
12870 PreparedStatement insertStatement = connection.getPreparedStatement(PREPARED_STATEMENT.INSERT_INGEST_MODULE, Statement.RETURN_GENERATED_KEYS);
12871 insertStatement.setString(1, displayName);
12872 insertStatement.setString(2, uniqueName);
12873 insertStatement.setInt(3, type.ordinal());
12874 insertStatement.setString(4, version);
12875 connection.executeUpdate(insertStatement);
12876 resultSet = statement.getGeneratedKeys();
12878 long id = resultSet.getLong(1);
12883 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
12884 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version"));
12886 }
catch (SQLException ex) {
12888 closeStatement(statement);
12889 if (connection != null) {
12890 statement = connection.createStatement();
12891 resultSet = statement.executeQuery(
"SELECT * FROM ingest_modules WHERE unique_name = '" + uniqueName +
"'");
12892 if (resultSet.next()) {
12893 return new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
12897 throw new TskCoreException(
"Couldn't add new module to database.", ex);
12898 }
catch (SQLException ex1) {
12899 throw new TskCoreException(
"Couldn't add new module to database.", ex1);
12902 closeResultSet(resultSet);
12903 closeStatement(statement);
12904 closeConnection(connection);
12917 CaseDbConnection connection = null;
12918 ResultSet resultSet = null;
12919 Statement statement = null;
12920 List<IngestJobInfo> ingestJobs =
new ArrayList<>();
12923 connection = connections.getConnection();
12924 statement = connection.createStatement();
12925 resultSet = statement.executeQuery(
"SELECT * FROM ingest_jobs");
12926 while (resultSet.next()) {
12927 ingestJobs.add(
new IngestJobInfo(resultSet.getInt(
"ingest_job_id"), resultSet.getLong(
"obj_id"),
12928 resultSet.getString(
"host_name"),
new Date(resultSet.getLong(
"start_date_time")),
12930 resultSet.getString(
"settings_dir"), this.getIngestModules(resultSet.getInt(
"ingest_job_id"), connection),
this));
12933 }
catch (SQLException ex) {
12934 throw new TskCoreException(
"Couldn't get the ingest jobs.", ex);
12936 closeResultSet(resultSet);
12937 closeStatement(statement);
12938 closeConnection(connection);
12953 private List<IngestModuleInfo> getIngestModules(
int ingestJobId, CaseDbConnection connection)
throws SQLException {
12954 ResultSet resultSet = null;
12955 Statement statement = null;
12956 List<IngestModuleInfo> ingestModules =
new ArrayList<>();
12959 statement = connection.createStatement();
12960 resultSet = statement.executeQuery(
"SELECT ingest_job_modules.ingest_module_id AS ingest_module_id, "
12961 +
"ingest_job_modules.pipeline_position AS pipeline_position, "
12962 +
"ingest_modules.display_name AS display_name, ingest_modules.unique_name AS unique_name, "
12963 +
"ingest_modules.type_id AS type_id, ingest_modules.version AS version "
12964 +
"FROM ingest_job_modules, ingest_modules "
12965 +
"WHERE ingest_job_modules.ingest_job_id = " + ingestJobId +
" "
12966 +
"AND ingest_modules.ingest_module_id = ingest_job_modules.ingest_module_id "
12967 +
"ORDER BY (ingest_job_modules.pipeline_position);");
12968 while (resultSet.next()) {
12969 ingestModules.add(
new IngestModuleInfo(resultSet.getInt(
"ingest_module_id"), resultSet.getString(
"display_name"),
12970 resultSet.getString(
"unique_name"),
IngestModuleType.
fromID(resultSet.getInt(
"type_id")), resultSet.getString(
"version")));
12972 return ingestModules;
12974 closeResultSet(resultSet);
12975 closeStatement(statement);
12990 String getInsertOrIgnoreSQL(String sql) {
12993 return " INSERT " + sql +
" ON CONFLICT DO NOTHING ";
12995 return " INSERT OR IGNORE " + sql;
12997 throw new UnsupportedOperationException(
"Unsupported DB type: " +
getDatabaseType().name());
13021 private List<? extends BlackboardArtifact> getArtifactsForValues(BlackboardArtifact.Category category, String dbColumn, List<? extends Number> values, CaseDbConnection connection)
throws TskCoreException {
13025 for (Number value : values) {
13026 if (!where.isEmpty()) {
13029 where += dbColumn +
" = " + value;
13034 if (category == BlackboardArtifact.Category.DATA_ARTIFACT) {
13044 static class ObjectInfo {
13047 private TskData.ObjectType type;
13049 ObjectInfo(
long id, ObjectType type) {
13058 TskData.ObjectType getType() {
13063 private interface DbCommand {
13065 void execute() throws SQLException;
13068 private enum PREPARED_STATEMENT {
13070 SELECT_ARTIFACTS_BY_TYPE(
"SELECT artifact_id, obj_id FROM blackboard_artifacts "
13071 +
"WHERE artifact_type_id = ?"),
13072 COUNT_ARTIFACTS_OF_TYPE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
13073 COUNT_ARTIFACTS_OF_TYPE_BY_DATA_SOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE data_source_obj_id = ? AND artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
13074 COUNT_ARTIFACTS_FROM_SOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE obj_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
13075 COUNT_ARTIFACTS_BY_SOURCE_AND_TYPE(
"SELECT COUNT(*) AS count FROM blackboard_artifacts WHERE obj_id = ? AND artifact_type_id = ? AND review_status_id != " + BlackboardArtifact.ReviewStatus.REJECTED.getID()),
13076 SELECT_FILES_BY_PARENT(
"SELECT tsk_files.* "
13077 +
"FROM tsk_objects INNER JOIN tsk_files "
13078 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
13079 +
"WHERE (tsk_objects.par_obj_id = ? ) "
13080 +
"ORDER BY tsk_files.meta_type DESC, LOWER(tsk_files.name)"),
13081 SELECT_FILES_BY_PARENT_AND_TYPE(
"SELECT tsk_files.* "
13082 +
"FROM tsk_objects INNER JOIN tsk_files "
13083 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
13084 +
"WHERE (tsk_objects.par_obj_id = ? AND tsk_files.type = ? ) "
13085 +
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"),
13086 SELECT_FILES_BY_PARENT_AND_NAME(
"SELECT tsk_files.* "
13087 +
"FROM tsk_objects INNER JOIN tsk_files "
13088 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
13089 +
"WHERE (tsk_objects.par_obj_id = ? AND "
13090 +
"LOWER(tsk_files.name) LIKE LOWER(?) AND LOWER(tsk_files.name) NOT LIKE LOWER('%journal%')) "
13091 +
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"),
13092 SELECT_FILES_BY_EXTENSION_AND_PARENT_AND_NAME(
"SELECT tsk_files.* "
13093 +
"FROM tsk_objects INNER JOIN tsk_files "
13094 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
13095 +
"WHERE tsk_files.extension = ? AND "
13096 +
"(tsk_objects.par_obj_id = ? AND "
13097 +
"LOWER(tsk_files.name) LIKE LOWER(?) AND LOWER(tsk_files.name) NOT LIKE LOWER('%journal%')) "
13098 +
"ORDER BY tsk_files.dir_type, LOWER(tsk_files.name)"),
13099 SELECT_FILE_IDS_BY_PARENT(
"SELECT tsk_files.obj_id AS obj_id "
13100 +
"FROM tsk_objects INNER JOIN tsk_files "
13101 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
13102 +
"WHERE (tsk_objects.par_obj_id = ?)"),
13103 SELECT_FILE_IDS_BY_PARENT_AND_TYPE(
"SELECT tsk_files.obj_id AS obj_id "
13104 +
"FROM tsk_objects INNER JOIN tsk_files "
13105 +
"ON tsk_objects.obj_id=tsk_files.obj_id "
13106 +
"WHERE (tsk_objects.par_obj_id = ? "
13107 +
"AND tsk_files.type = ? )"),
13108 SELECT_FILE_BY_ID(
"SELECT * FROM tsk_files WHERE obj_id = ? LIMIT 1"),
13109 SELECT_ARTIFACT_BY_ARTIFACT_OBJ_ID(
"SELECT * FROM blackboard_artifacts WHERE artifact_obj_id = ? LIMIT 1"),
13110 SELECT_ARTIFACT_TYPE_BY_ARTIFACT_OBJ_ID(
"SELECT artifact_type_id FROM blackboard_artifacts WHERE artifact_obj_id = ? LIMIT 1"),
13111 SELECT_ARTIFACT_BY_ARTIFACT_ID(
"SELECT * FROM blackboard_artifacts WHERE artifact_id = ? LIMIT 1"),
13112 INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, review_status_id) "
13113 +
"VALUES (?, ?, ?, ?, ?," + BlackboardArtifact.ReviewStatus.UNDECIDED.getID() +
")"),
13114 POSTGRESQL_INSERT_ARTIFACT(
"INSERT INTO blackboard_artifacts (artifact_id, obj_id, artifact_obj_id, data_source_obj_id, artifact_type_id, review_status_id) "
13115 +
"VALUES (DEFAULT, ?, ?, ?, ?," + BlackboardArtifact.ReviewStatus.UNDECIDED.getID() +
")"),
13116 INSERT_ANALYSIS_RESULT(
"INSERT INTO tsk_analysis_results (artifact_obj_id, conclusion, significance, priority, configuration, justification) "
13117 +
"VALUES (?, ?, ?, ?, ?, ?)"),
13118 INSERT_STRING_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_text) "
13119 +
"VALUES (?,?,?,?,?,?,?)"),
13120 INSERT_BYTE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_byte) "
13121 +
"VALUES (?,?,?,?,?,?,?)"),
13122 INSERT_INT_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int32) "
13123 +
"VALUES (?,?,?,?,?,?,?)"),
13124 INSERT_LONG_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_int64) "
13125 +
"VALUES (?,?,?,?,?,?,?)"),
13126 INSERT_DOUBLE_ATTRIBUTE(
"INSERT INTO blackboard_attributes (artifact_id, artifact_type_id, source, context, attribute_type_id, value_type, value_double) "
13127 +
"VALUES (?,?,?,?,?,?,?)"),
13128 INSERT_FILE_ATTRIBUTE(
"INSERT INTO tsk_file_attributes (obj_id, attribute_type_id, value_type, value_byte, value_text, value_int32, value_int64, value_double) "
13129 +
"VALUES (?,?,?,?,?,?,?,?)"),
13130 SELECT_FILES_BY_DATA_SOURCE_AND_NAME(
"SELECT * FROM tsk_files WHERE LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND data_source_obj_id = ?"),
13131 SELECT_FILES_BY_EXTENSION_AND_DATA_SOURCE_AND_NAME(
"SELECT * FROM tsk_files WHERE extension = ? AND LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND data_source_obj_id = ?"),
13132 SELECT_FILES_BY_DATA_SOURCE_AND_PARENT_PATH_AND_NAME(
"SELECT * FROM tsk_files WHERE LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND LOWER(parent_path) LIKE LOWER(?) AND data_source_obj_id = ?"),
13133 SELECT_FILES_BY_EXTENSION_AND_DATA_SOURCE_AND_PARENT_PATH_AND_NAME(
"SELECT * FROM tsk_files WHERE extension = ? AND LOWER(name) LIKE LOWER(?) AND LOWER(name) NOT LIKE LOWER('%journal%') AND LOWER(parent_path) LIKE LOWER(?) AND data_source_obj_id = ?"),
13134 UPDATE_FILE_MD5(
"UPDATE tsk_files SET md5 = ? WHERE obj_id = ?"),
13135 UPDATE_IMAGE_MD5(
"UPDATE tsk_image_info SET md5 = ? WHERE obj_id = ?"),
13136 UPDATE_IMAGE_SHA1(
"UPDATE tsk_image_info SET sha1 = ? WHERE obj_id = ?"),
13137 UPDATE_IMAGE_SHA256(
"UPDATE tsk_image_info SET sha256 = ? WHERE obj_id = ?"),
13138 SELECT_IMAGE_MD5(
"SELECT md5 FROM tsk_image_info WHERE obj_id = ?"),
13139 SELECT_IMAGE_SHA1(
"SELECT sha1 FROM tsk_image_info WHERE obj_id = ?"),
13140 SELECT_IMAGE_SHA256(
"SELECT sha256 FROM tsk_image_info WHERE obj_id = ?"),
13141 UPDATE_ACQUISITION_DETAILS(
"UPDATE data_source_info SET acquisition_details = ? WHERE obj_id = ?"),
13142 UPDATE_ACQUISITION_TOOL_SETTINGS(
"UPDATE data_source_info SET acquisition_tool_settings = ?, acquisition_tool_name = ?, acquisition_tool_version = ? WHERE obj_id = ?"),
13143 SELECT_ACQUISITION_DETAILS(
"SELECT acquisition_details FROM data_source_info WHERE obj_id = ?"),
13144 SELECT_ACQUISITION_TOOL_SETTINGS(
"SELECT acquisition_tool_settings, acquisition_tool_name, acquisition_tool_version, added_date_time FROM data_source_info WHERE obj_id = ?"),
13145 SELECT_LOCAL_PATH_FOR_FILE(
"SELECT path FROM tsk_files_path WHERE obj_id = ?"),
13146 SELECT_ENCODING_FOR_FILE(
"SELECT encoding_type FROM tsk_files_path WHERE obj_id = ?"),
13147 SELECT_LOCAL_PATH_AND_ENCODING_FOR_FILE(
"SELECT path, encoding_type FROM tsk_files_path WHERE obj_id = ?"),
13148 SELECT_PATH_FOR_FILE(
"SELECT parent_path FROM tsk_files WHERE obj_id = ?"),
13149 SELECT_FILE_NAME(
"SELECT name FROM tsk_files WHERE obj_id = ?"),
13150 SELECT_DERIVED_FILE(
"SELECT derived_id, rederive FROM tsk_files_derived WHERE obj_id = ?"),
13151 SELECT_FILE_DERIVATION_METHOD(
"SELECT tool_name, tool_version, other FROM tsk_files_derived_method WHERE derived_id = ?"),
13152 SELECT_MAX_OBJECT_ID(
"SELECT MAX(obj_id) AS max_obj_id FROM tsk_objects"),
13153 INSERT_OBJECT(
"INSERT INTO tsk_objects (par_obj_id, type) VALUES (?, ?)"),
13154 INSERT_FILE(
"INSERT INTO tsk_files (obj_id, fs_obj_id, name, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, md5, sha256, sha1, known, mime_type, parent_path, data_source_obj_id, extension, owner_uid, os_account_obj_id, collected) "
13155 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
13156 INSERT_FILE_SYSTEM_FILE(
"INSERT INTO tsk_files(obj_id, fs_obj_id, data_source_obj_id, attr_type, attr_id, name, meta_addr, meta_seq, type, has_path, dir_type, meta_type, dir_flags, meta_flags, size, ctime, crtime, atime, mtime, md5, sha256, sha1, mime_type, parent_path, extension, owner_uid, os_account_obj_id, collected)"
13157 +
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
13158 UPDATE_DERIVED_FILE(
"UPDATE tsk_files SET type = ?, dir_type = ?, meta_type = ?, dir_flags = ?, meta_flags = ?, size= ?, ctime= ?, crtime= ?, atime= ?, mtime= ?, mime_type = ? "
13159 +
"WHERE obj_id = ?"),
13160 INSERT_LAYOUT_FILE(
"INSERT INTO tsk_file_layout (obj_id, byte_start, byte_len, sequence) "
13161 +
"VALUES (?, ?, ?, ?)"),
13162 INSERT_LOCAL_PATH(
"INSERT INTO tsk_files_path (obj_id, path, encoding_type) VALUES (?, ?, ?)"),
13163 UPDATE_LOCAL_PATH(
"UPDATE tsk_files_path SET path = ?, encoding_type = ? WHERE obj_id = ?"),
13164 COUNT_CHILD_OBJECTS_BY_PARENT(
"SELECT COUNT(obj_id) AS count FROM tsk_objects WHERE par_obj_id = ?"),
13165 SELECT_FILE_SYSTEM_BY_OBJECT(
"SELECT fs_obj_id from tsk_files WHERE obj_id=?"),
13166 SELECT_TAG_NAMES(
"SELECT * FROM tag_names"),
13167 SELECT_TAG_NAMES_IN_USE(
"SELECT * FROM tag_names "
13168 +
"WHERE tag_name_id IN "
13169 +
"(SELECT tag_name_id from content_tags UNION SELECT tag_name_id FROM blackboard_artifact_tags)"),
13170 SELECT_TAG_NAMES_IN_USE_BY_DATASOURCE(
"SELECT * FROM tag_names "
13171 +
"WHERE tag_name_id IN "
13172 +
"( SELECT content_tags.tag_name_id as tag_name_id "
13173 +
"FROM content_tags as content_tags, tsk_files as tsk_files"
13174 +
" WHERE content_tags.obj_id = tsk_files.obj_id"
13175 +
" AND tsk_files.data_source_obj_id = ?"
13177 +
"SELECT artifact_tags.tag_name_id as tag_name_id "
13178 +
" FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts "
13179 +
" WHERE artifact_tags.artifact_id = arts.artifact_id"
13180 +
" AND arts.data_source_obj_id = ?"
13182 INSERT_TAG_NAME(
"INSERT INTO tag_names (display_name, description, color, knownStatus) VALUES (?, ?, ?, ?)"),
13183 INSERT_CONTENT_TAG(
"INSERT INTO content_tags (obj_id, tag_name_id, comment, begin_byte_offset, end_byte_offset, examiner_id) VALUES (?, ?, ?, ?, ?, ?)"),
13184 DELETE_CONTENT_TAG(
"DELETE FROM content_tags WHERE tag_id = ?"),
13185 COUNT_CONTENT_TAGS_BY_TAG_NAME(
"SELECT COUNT(*) AS count FROM content_tags WHERE tag_name_id = ?"),
13186 COUNT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
13187 "SELECT COUNT(*) AS count FROM content_tags as content_tags, tsk_files as tsk_files WHERE content_tags.obj_id = tsk_files.obj_id"
13188 +
" AND content_tags.tag_name_id = ? "
13189 +
" AND tsk_files.data_source_obj_id = ? "
13191 SELECT_CONTENT_TAGS(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
13192 +
"FROM content_tags "
13193 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
13194 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id"),
13195 SELECT_CONTENT_TAGS_BY_TAG_NAME(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tsk_examiners.login_name "
13196 +
"FROM content_tags "
13197 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
13198 +
"WHERE tag_name_id = ?"),
13199 SELECT_CONTENT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id "
13200 +
"FROM content_tags as content_tags, tsk_files as tsk_files, tag_names as tag_names, tsk_examiners as tsk_examiners "
13201 +
"WHERE content_tags.examiner_id = tsk_examiners.examiner_id"
13202 +
" AND content_tags.obj_id = tsk_files.obj_id"
13203 +
" AND content_tags.tag_name_id = tag_names.tag_name_id"
13204 +
" AND content_tags.tag_name_id = ?"
13205 +
" AND tsk_files.data_source_obj_id = ? "),
13206 SELECT_CONTENT_TAG_BY_ID(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
13207 +
"FROM content_tags "
13208 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
13209 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
13210 +
"WHERE tag_id = ?"),
13211 SELECT_CONTENT_TAGS_BY_CONTENT(
"SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
13212 +
"FROM content_tags "
13213 +
"INNER JOIN tag_names ON content_tags.tag_name_id = tag_names.tag_name_id "
13214 +
"LEFT OUTER JOIN tsk_examiners ON content_tags.examiner_id = tsk_examiners.examiner_id "
13215 +
"WHERE content_tags.obj_id = ?"),
13216 INSERT_ARTIFACT_TAG(
"INSERT INTO blackboard_artifact_tags (artifact_id, tag_name_id, comment, examiner_id) "
13217 +
"VALUES (?, ?, ?, ?)"),
13218 DELETE_ARTIFACT_TAG(
"DELETE FROM blackboard_artifact_tags WHERE tag_id = ?"),
13219 SELECT_ARTIFACT_TAGS(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tag_names.tag_set_id, tsk_examiners.login_name, tag_names.rank "
13220 +
"FROM blackboard_artifact_tags "
13221 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
13222 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id"),
13223 COUNT_ARTIFACTS_BY_TAG_NAME(
"SELECT COUNT(*) AS count FROM blackboard_artifact_tags WHERE tag_name_id = ?"),
13224 COUNT_ARTIFACTS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT COUNT(*) AS count FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts WHERE artifact_tags.artifact_id = arts.artifact_id"
13225 +
" AND artifact_tags.tag_name_id = ?"
13226 +
" AND arts.data_source_obj_id = ? "),
13227 SELECT_ARTIFACT_TAGS_BY_TAG_NAME(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tsk_examiners.login_name "
13228 +
"FROM blackboard_artifact_tags "
13229 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
13230 +
"WHERE tag_name_id = ?"),
13231 SELECT_ARTIFACT_TAGS_BY_TAG_NAME_BY_DATASOURCE(
"SELECT artifact_tags.tag_id, artifact_tags.artifact_id, artifact_tags.tag_name_id, artifact_tags.comment, arts.obj_id, arts.artifact_obj_id, arts.data_source_obj_id, arts.artifact_type_id, arts.review_status_id, tsk_examiners.login_name "
13232 +
"FROM blackboard_artifact_tags as artifact_tags, blackboard_artifacts AS arts, tsk_examiners AS tsk_examiners "
13233 +
"WHERE artifact_tags.examiner_id = tsk_examiners.examiner_id"
13234 +
" AND artifact_tags.artifact_id = arts.artifact_id"
13235 +
" AND artifact_tags.tag_name_id = ? "
13236 +
" AND arts.data_source_obj_id = ? "),
13237 SELECT_ARTIFACT_TAG_BY_ID(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
13238 +
"FROM blackboard_artifact_tags "
13239 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
13240 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
13241 +
"WHERE blackboard_artifact_tags.tag_id = ?"),
13242 SELECT_ARTIFACT_TAGS_BY_ARTIFACT(
"SELECT blackboard_artifact_tags.tag_id, blackboard_artifact_tags.artifact_id, blackboard_artifact_tags.tag_name_id, blackboard_artifact_tags.comment, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tsk_examiners.login_name, tag_names.tag_set_id, tag_names.rank "
13243 +
"FROM blackboard_artifact_tags "
13244 +
"INNER JOIN tag_names ON blackboard_artifact_tags.tag_name_id = tag_names.tag_name_id "
13245 +
"LEFT OUTER JOIN tsk_examiners ON blackboard_artifact_tags.examiner_id = tsk_examiners.examiner_id "
13246 +
"WHERE blackboard_artifact_tags.artifact_id = ?"),
13247 SELECT_REPORTS(
"SELECT * FROM reports"),
13248 SELECT_REPORT_BY_ID(
"SELECT * FROM reports WHERE obj_id = ?"),
13249 INSERT_REPORT(
"INSERT INTO reports (obj_id, path, crtime, src_module_name, report_name) VALUES (?, ?, ?, ?, ?)"),
13250 DELETE_REPORT(
"DELETE FROM reports WHERE reports.obj_id = ?"),
13251 DELETE_REPORT_TSK_OBJECT(
"DELETE FROM tsk_objects where tsk_objects.obj_id = ? and tsk_objects.type = ?"),
13252 INSERT_INGEST_JOB(
"INSERT INTO ingest_jobs (obj_id, host_name, start_date_time, end_date_time, status_id, settings_dir) VALUES (?, ?, ?, ?, ?, ?)"),
13253 INSERT_INGEST_MODULE(
"INSERT INTO ingest_modules (display_name, unique_name, type_id, version) VALUES(?, ?, ?, ?)"),
13254 SELECT_ATTR_BY_VALUE_BYTE(
"SELECT source FROM blackboard_attributes WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
13255 UPDATE_ATTR_BY_VALUE_BYTE(
"UPDATE blackboard_attributes SET source = ? WHERE artifact_id = ? AND attribute_type_id = ? AND value_type = 4 AND value_byte = ?"),
13256 UPDATE_IMAGE_PATH(
"UPDATE tsk_image_names SET name = ? WHERE obj_id = ?"),
13257 SELECT_ARTIFACT_OBJECTIDS_BY_PARENT(
"SELECT blackboard_artifacts.artifact_obj_id AS artifact_obj_id "
13258 +
"FROM tsk_objects INNER JOIN blackboard_artifacts "
13259 +
"ON tsk_objects.obj_id=blackboard_artifacts.obj_id "
13260 +
"WHERE (tsk_objects.par_obj_id = ?)"),
13261 SELECT_EXAMINER_BY_ID(
"SELECT * FROM tsk_examiners WHERE examiner_id = ?"),
13262 SELECT_EXAMINER_BY_LOGIN_NAME(
"SELECT * FROM tsk_examiners WHERE login_name = ?"),
13263 INSERT_EXAMINER_POSTGRESQL(
"INSERT INTO tsk_examiners (login_name) VALUES (?) ON CONFLICT DO NOTHING"),
13264 INSERT_EXAMINER_SQLITE(
"INSERT OR IGNORE INTO tsk_examiners (login_name) VALUES (?)"),
13265 UPDATE_FILE_NAME(
"UPDATE tsk_files SET name = ? WHERE obj_id = ?"),
13266 UPDATE_IMAGE_NAME(
"UPDATE tsk_image_info SET display_name = ? WHERE obj_id = ?"),
13267 UPDATE_IMAGE_SIZES(
"UPDATE tsk_image_info SET size = ?, ssize = ? WHERE obj_id = ?"),
13268 DELETE_IMAGE_NAME(
"DELETE FROM tsk_image_names WHERE obj_id = ?"),
13269 INSERT_IMAGE_NAME(
"INSERT INTO tsk_image_names (obj_id, name, sequence) VALUES (?, ?, ?)"),
13270 INSERT_IMAGE_INFO(
"INSERT INTO tsk_image_info (obj_id, type, ssize, tzone, size, md5, sha1, sha256, display_name)"
13271 +
" VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"),
13272 INSERT_DATA_SOURCE_INFO(
"INSERT INTO data_source_info (obj_id, device_id, time_zone, added_date_time, host_id) VALUES (?, ?, ?, ?, ?)"),
13273 INSERT_VS_INFO(
"INSERT INTO tsk_vs_info (obj_id, vs_type, img_offset, block_size) VALUES (?, ?, ?, ?)"),
13274 INSERT_VS_PART_SQLITE(
"INSERT INTO tsk_vs_parts (obj_id, addr, start, length, desc, flags) VALUES (?, ?, ?, ?, ?, ?)"),
13275 INSERT_VS_PART_POSTGRESQL(
"INSERT INTO tsk_vs_parts (obj_id, addr, start, length, descr, flags) VALUES (?, ?, ?, ?, ?, ?)"),
13276 INSERT_POOL_INFO(
"INSERT INTO tsk_pool_info (obj_id, pool_type) VALUES (?, ?)"),
13277 INSERT_FS_INFO(
"INSERT INTO tsk_fs_info (obj_id, data_source_obj_id, img_offset, fs_type, block_size, block_count, root_inum, first_inum, last_inum, display_name)"
13278 +
"VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"),
13279 SELECT_TAG_NAME_BY_ID(
"SELECT * FROM tag_names where tag_name_id = ?");
13281 private final String sql;
13283 private PREPARED_STATEMENT(String sql) {
13297 abstract private class ConnectionPool {
13299 private PooledDataSource pooledDataSource;
13301 public ConnectionPool() {
13302 pooledDataSource = null;
13305 CaseDbConnection getConnection() throws TskCoreException {
13306 if (pooledDataSource == null) {
13307 throw new TskCoreException(
"Error getting case database connection - case is closed");
13310 return getPooledConnection();
13311 }
catch (SQLException exp) {
13312 throw new TskCoreException(exp.getMessage());
13316 void close() throws TskCoreException {
13317 if (pooledDataSource != null) {
13319 pooledDataSource.close();
13320 }
catch (SQLException exp) {
13321 throw new TskCoreException(exp.getMessage());
13323 pooledDataSource = null;
13328 abstract CaseDbConnection getPooledConnection() throws SQLException;
13330 public PooledDataSource getPooledDataSource() {
13331 return pooledDataSource;
13334 public void setPooledDataSource(PooledDataSource pooledDataSource) {
13335 this.pooledDataSource = pooledDataSource;
13343 private final class SQLiteConnections
extends ConnectionPool {
13345 private final Map<String, String> configurationOverrides =
new HashMap<String, String>();
13347 SQLiteConnections(String dbPath)
throws SQLException {
13348 configurationOverrides.put(
"acquireIncrement",
"2");
13349 configurationOverrides.put(
"initialPoolSize",
"5");
13350 configurationOverrides.put(
"minPoolSize",
"5");
13355 configurationOverrides.put(
"maxPoolSize",
"20");
13356 configurationOverrides.put(
"maxStatements",
"200");
13357 configurationOverrides.put(
"maxStatementsPerConnection",
"20");
13359 SQLiteConfig config =
new SQLiteConfig();
13360 config.setSynchronous(SQLiteConfig.SynchronousMode.OFF);
13361 config.setReadUncommited(
true);
13362 config.enforceForeignKeys(
true);
13363 SQLiteDataSource unpooled =
new SQLiteDataSource(config);
13364 unpooled.setUrl(
"jdbc:sqlite:" + dbPath);
13365 setPooledDataSource((PooledDataSource) DataSources.pooledDataSource(unpooled, configurationOverrides));
13369 public CaseDbConnection getPooledConnection() throws SQLException {
13371 if (CaseDbTransaction.hasOpenTransaction(Thread.currentThread().getId())) {
13373 if (!Thread.currentThread().getName().contains(
"ImageGallery")) {
13374 logger.log(Level.WARNING, String.format(
"Thread %s (ID = %d) already has an open transaction. New connection may encounter SQLITE_BUSY error. ", Thread.currentThread().getName(), Thread.currentThread().getId()),
new Throwable());
13377 return new SQLiteConnection(getPooledDataSource().getConnection());
13385 private final class PostgreSQLConnections
extends ConnectionPool {
13387 PostgreSQLConnections(String host,
int port, String dbName, String userName, String password)
throws PropertyVetoException, UnsupportedEncodingException {
13388 ComboPooledDataSource comboPooledDataSource =
new ComboPooledDataSource();
13389 comboPooledDataSource.setDriverClass(
"org.postgresql.Driver");
13390 comboPooledDataSource.setJdbcUrl(
"jdbc:postgresql://" + host +
":" + port +
"/"
13391 + URLEncoder.encode(dbName, StandardCharsets.UTF_8.toString()));
13392 comboPooledDataSource.setUser(userName);
13393 comboPooledDataSource.setPassword(password);
13394 comboPooledDataSource.setAcquireIncrement(2);
13395 comboPooledDataSource.setInitialPoolSize(5);
13396 comboPooledDataSource.setMinPoolSize(5);
13401 comboPooledDataSource.setMaxPoolSize(20);
13402 comboPooledDataSource.setMaxStatements(200);
13403 comboPooledDataSource.setMaxStatementsPerConnection(20);
13404 setPooledDataSource(comboPooledDataSource);
13408 public CaseDbConnection getPooledConnection() throws SQLException {
13409 return new PostgreSQLConnection(getPooledDataSource().getConnection());
13416 abstract class CaseDbConnection
implements AutoCloseable {
13418 static final int SLEEP_LENGTH_IN_MILLISECONDS = 5000;
13419 static final int MAX_RETRIES = 20;
13421 private class CreateStatement
implements DbCommand {
13423 private final Connection connection;
13424 private Statement statement = null;
13426 CreateStatement(Connection connection) {
13427 this.connection = connection;
13430 Statement getStatement() {
13435 public void execute() throws SQLException {
13436 statement = connection.createStatement();
13440 private class SetAutoCommit
implements DbCommand {
13442 private final Connection connection;
13443 private final boolean mode;
13445 SetAutoCommit(Connection connection,
boolean mode) {
13446 this.connection = connection;
13451 public void execute() throws SQLException {
13452 connection.setAutoCommit(mode);
13456 private class Commit
implements DbCommand {
13458 private final Connection connection;
13460 Commit(Connection connection) {
13461 this.connection = connection;
13465 public void execute() throws SQLException {
13466 connection.commit();
13478 private class AggregateScoreTablePostgreSQLWriteLock
implements DbCommand {
13480 private final Connection connection;
13482 AggregateScoreTablePostgreSQLWriteLock(Connection connection) {
13483 this.connection = connection;
13487 public void execute() throws SQLException {
13488 PreparedStatement preparedStatement = connection.prepareStatement(
"LOCK TABLE ONLY tsk_aggregate_score in SHARE ROW EXCLUSIVE MODE");
13489 preparedStatement.execute();
13494 private class ExecuteQuery
implements DbCommand {
13496 private final Statement statement;
13497 private final String query;
13498 private ResultSet resultSet;
13500 ExecuteQuery(Statement statement, String query) {
13501 this.statement = statement;
13502 this.query = query;
13505 ResultSet getResultSet() {
13510 public void execute() throws SQLException {
13511 resultSet = statement.executeQuery(query);
13515 private class ExecutePreparedStatementQuery
implements DbCommand {
13517 private final PreparedStatement preparedStatement;
13518 private ResultSet resultSet;
13520 ExecutePreparedStatementQuery(PreparedStatement preparedStatement) {
13521 this.preparedStatement = preparedStatement;
13524 ResultSet getResultSet() {
13529 public void execute() throws SQLException {
13530 resultSet = preparedStatement.executeQuery();
13534 private class ExecutePreparedStatementUpdate
implements DbCommand {
13536 private final PreparedStatement preparedStatement;
13538 ExecutePreparedStatementUpdate(PreparedStatement preparedStatement) {
13539 this.preparedStatement = preparedStatement;
13543 public void execute() throws SQLException {
13544 preparedStatement.executeUpdate();
13548 private class ExecuteStatementUpdate
implements DbCommand {
13550 private final Statement statement;
13551 private final String updateCommand;
13553 ExecuteStatementUpdate(Statement statement, String updateCommand) {
13554 this.statement = statement;
13555 this.updateCommand = updateCommand;
13559 public void execute() throws SQLException {
13560 statement.executeUpdate(updateCommand);
13564 private class ExecuteStatementUpdateGenerateKeys
implements DbCommand {
13566 private final Statement statement;
13567 private final int generateKeys;
13568 private final String updateCommand;
13570 ExecuteStatementUpdateGenerateKeys(Statement statement, String updateCommand,
int generateKeys) {
13571 this.statement = statement;
13572 this.generateKeys = generateKeys;
13573 this.updateCommand = updateCommand;
13577 public void execute() throws SQLException {
13578 statement.executeUpdate(updateCommand, generateKeys);
13582 private class PrepareStatement
implements DbCommand {
13584 private final Connection connection;
13585 private final String input;
13586 private PreparedStatement preparedStatement = null;
13588 PrepareStatement(Connection connection, String input) {
13589 this.connection = connection;
13590 this.input = input;
13593 PreparedStatement getPreparedStatement() {
13594 return preparedStatement;
13598 public void execute() throws SQLException {
13599 preparedStatement = connection.prepareStatement(input);
13603 private class PrepareStatementGenerateKeys
implements DbCommand {
13605 private final Connection connection;
13606 private final String input;
13607 private final int generateKeys;
13608 private PreparedStatement preparedStatement = null;
13610 PrepareStatementGenerateKeys(Connection connection, String input,
int generateKeysInput) {
13611 this.connection = connection;
13612 this.input = input;
13613 this.generateKeys = generateKeysInput;
13616 PreparedStatement getPreparedStatement() {
13617 return preparedStatement;
13621 public void execute() throws SQLException {
13622 preparedStatement = connection.prepareStatement(input, generateKeys);
13626 abstract void executeCommand(DbCommand command)
throws SQLException;
13628 private final Connection connection;
13629 private final Map<PREPARED_STATEMENT, PreparedStatement> preparedStatements;
13630 private final Map<String, PreparedStatement> adHocPreparedStatements;
13632 CaseDbConnection(Connection connection) {
13633 this.connection = connection;
13634 preparedStatements =
new EnumMap<PREPARED_STATEMENT, PreparedStatement>(PREPARED_STATEMENT.class);
13635 adHocPreparedStatements =
new HashMap<>();
13639 return this.connection != null;
13642 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey)
throws SQLException {
13643 return getPreparedStatement(statementKey, Statement.NO_GENERATED_KEYS);
13646 PreparedStatement getPreparedStatement(PREPARED_STATEMENT statementKey,
int generateKeys)
throws SQLException {
13648 PreparedStatement statement;
13649 if (this.preparedStatements.containsKey(statementKey)) {
13650 statement = this.preparedStatements.get(statementKey);
13652 statement = prepareStatement(statementKey.getSQL(), generateKeys);
13653 this.preparedStatements.put(statementKey, statement);
13669 PreparedStatement getPreparedStatement(String sqlStatement,
int generateKeys)
throws SQLException {
13670 PreparedStatement statement;
13671 String statementKey =
"SQL:" + sqlStatement +
" Key:" + generateKeys;
13672 if (adHocPreparedStatements.containsKey(statementKey) && !adHocPreparedStatements.get(statementKey).isClosed()) {
13673 statement = this.adHocPreparedStatements.get(statementKey);
13675 statement = prepareStatement(sqlStatement, generateKeys);
13676 this.adHocPreparedStatements.put(statementKey, statement);
13681 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
13682 PrepareStatement prepareStatement =
new PrepareStatement(this.getConnection(), sqlStatement);
13683 executeCommand(prepareStatement);
13684 return prepareStatement.getPreparedStatement();
13687 Statement createStatement() throws SQLException {
13688 CreateStatement createStatement =
new CreateStatement(this.connection);
13689 executeCommand(createStatement);
13690 return createStatement.getStatement();
13694 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
false);
13695 executeCommand(setAutoCommit);
13698 void commitTransaction() throws SQLException {
13699 Commit commit =
new Commit(connection);
13700 executeCommand(commit);
13702 SetAutoCommit setAutoCommit =
new SetAutoCommit(connection,
true);
13703 executeCommand(setAutoCommit);
13711 void rollbackTransaction() {
13713 connection.rollback();
13714 }
catch (SQLException e) {
13715 logger.log(Level.SEVERE,
"Error rolling back transaction", e);
13718 connection.setAutoCommit(
true);
13719 }
catch (SQLException e) {
13720 logger.log(Level.SEVERE,
"Error restoring auto-commit", e);
13731 void rollbackTransactionWithThrow() throws SQLException {
13733 connection.rollback();
13735 connection.setAutoCommit(
true);
13747 void getAggregateScoreTableWriteLock() throws SQLException, TskCoreException {
13750 AggregateScoreTablePostgreSQLWriteLock tableWriteLock =
new AggregateScoreTablePostgreSQLWriteLock(connection);
13751 executeCommand(tableWriteLock);
13758 throw new TskCoreException(
"Unknown DB Type: " +
getDatabaseType().name());
13762 ResultSet
executeQuery(Statement statement, String query)
throws SQLException {
13763 ExecuteQuery queryCommand =
new ExecuteQuery(statement, query);
13764 executeCommand(queryCommand);
13765 return queryCommand.getResultSet();
13777 ResultSet
executeQuery(PreparedStatement statement)
throws SQLException {
13778 ExecutePreparedStatementQuery executePreparedStatementQuery =
new ExecutePreparedStatementQuery(statement);
13779 executeCommand(executePreparedStatementQuery);
13780 return executePreparedStatementQuery.getResultSet();
13783 void executeUpdate(Statement statement, String update)
throws SQLException {
13784 executeUpdate(statement, update, Statement.NO_GENERATED_KEYS);
13787 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
13788 ExecuteStatementUpdate executeStatementUpdate =
new ExecuteStatementUpdate(statement, update);
13789 executeCommand(executeStatementUpdate);
13792 void executeUpdate(PreparedStatement statement)
throws SQLException {
13793 ExecutePreparedStatementUpdate executePreparedStatementUpdate =
new ExecutePreparedStatementUpdate(statement);
13794 executeCommand(executePreparedStatementUpdate);
13801 public void close() {
13803 for (PreparedStatement stmt : preparedStatements.values()) {
13804 closeStatement(stmt);
13806 for (PreparedStatement stmt : adHocPreparedStatements.values()) {
13807 closeStatement(stmt);
13809 connection.close();
13810 }
catch (SQLException ex) {
13811 logger.log(Level.SEVERE,
"Unable to close connection to case database", ex);
13815 Connection getConnection() {
13816 return this.connection;
13823 private final class SQLiteConnection
extends CaseDbConnection {
13825 private static final int DATABASE_LOCKED_ERROR = 0;
13826 private static final int SQLITE_BUSY_ERROR = 5;
13828 SQLiteConnection(Connection conn) {
13833 void executeCommand(DbCommand command)
throws SQLException {
13834 int retryCounter = 0;
13839 }
catch (SQLException ex) {
13840 if ((ex.getErrorCode() == SQLITE_BUSY_ERROR || ex.getErrorCode() == DATABASE_LOCKED_ERROR) && retryCounter < MAX_RETRIES) {
13847 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
13848 }
catch (InterruptedException exp) {
13849 Logger.getLogger(SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
13862 private final class PostgreSQLConnection
extends CaseDbConnection {
13864 private final String COMMUNICATION_ERROR = PSQLState.COMMUNICATION_ERROR.getState();
13865 private final String SYSTEM_ERROR = PSQLState.SYSTEM_ERROR.getState();
13866 private final String UNKNOWN_STATE = PSQLState.UNKNOWN_STATE.getState();
13867 private static final int MAX_RETRIES = 3;
13869 PostgreSQLConnection(Connection conn) {
13874 void executeUpdate(Statement statement, String update,
int generateKeys)
throws SQLException {
13875 CaseDbConnection.ExecuteStatementUpdateGenerateKeys executeStatementUpdateGenerateKeys =
new CaseDbConnection.ExecuteStatementUpdateGenerateKeys(statement, update, generateKeys);
13876 executeCommand(executeStatementUpdateGenerateKeys);
13880 PreparedStatement prepareStatement(String sqlStatement,
int generateKeys)
throws SQLException {
13881 CaseDbConnection.PrepareStatementGenerateKeys prepareStatementGenerateKeys =
new CaseDbConnection.PrepareStatementGenerateKeys(this.getConnection(), sqlStatement, generateKeys);
13882 executeCommand(prepareStatementGenerateKeys);
13883 return prepareStatementGenerateKeys.getPreparedStatement();
13887 void executeCommand(DbCommand command)
throws SQLException {
13888 SQLException lastException = null;
13889 for (
int retries = 0; retries < MAX_RETRIES; retries++) {
13892 lastException = null;
13894 }
catch (SQLException ex) {
13895 lastException = ex;
13896 String sqlState = ex.getSQLState();
13897 if (sqlState == null || sqlState.equals(COMMUNICATION_ERROR) || sqlState.equals(SYSTEM_ERROR) || sqlState.equals(UNKNOWN_STATE)) {
13899 Thread.sleep(SLEEP_LENGTH_IN_MILLISECONDS);
13900 }
catch (InterruptedException exp) {
13901 Logger.getLogger(SleuthkitCase.class.getName()).log(Level.WARNING,
"Unexpectedly unable to wait for database.", exp);
13910 if (lastException != null) {
13911 throw lastException;
13949 private final CaseDbConnection connection;
13957 private Map<Long, ScoreChange> scoreChangeMap =
new HashMap<>();
13958 private List<Host> hostsAdded =
new ArrayList<>();
13959 private List<TimelineEventAddedEvent> timelineEvents =
new ArrayList<>();
13960 private List<OsAccount> accountsChanged =
new ArrayList<>();
13961 private List<OsAccount> accountsAdded =
new ArrayList<>();
13964 private List<Long> deletedOsAccountObjectIds =
new ArrayList<>();
13965 private List<Long> deletedResultObjectIds =
new ArrayList<>();
13968 private static Set<Long> threadsWithOpenTransaction =
new HashSet<>();
13969 private static final Object threadsWithOpenTransactionLock =
new Object();
13972 this.sleuthkitCase = sleuthkitCase;
13975 this.connection = sleuthkitCase.getConnection();
13977 synchronized (threadsWithOpenTransactionLock) {
13978 this.connection.beginTransaction();
13979 threadsWithOpenTransaction.add(Thread.currentThread().getId());
13981 }
catch (SQLException ex) {
13983 throw new TskCoreException(
"Failed to create transaction on case database", ex);
13995 CaseDbConnection getConnection() {
13996 return this.connection;
14004 void registerScoreChange(
ScoreChange scoreChange) {
14005 scoreChangeMap.put(scoreChange.
getObjectId(), scoreChange);
14013 if (timelineEvent != null) {
14014 timelineEvents.add(timelineEvent);
14023 void registerAddedHost(
Host host) {
14024 if (host != null) {
14025 this.hostsAdded.add(host);
14034 void registerChangedOsAccount(
OsAccount account) {
14035 if (account != null) {
14036 accountsChanged.add(account);
14045 void registerDeletedOsAccount(
long osAccountObjId) {
14046 deletedOsAccountObjectIds.add(osAccountObjId);
14054 void registerAddedOsAccount(
OsAccount account) {
14055 if (account != null) {
14056 accountsAdded.add(account);
14066 void registerMergedOsAccount(
long sourceOsAccountObjId,
long destinationOsAccountObjId) {
14076 void registerDeletedAnalysisResult(
long analysisResultObjId) {
14077 this.deletedResultObjectIds.add(analysisResultObjId);
14088 private static boolean hasOpenTransaction(
long threadId) {
14089 synchronized (threadsWithOpenTransactionLock) {
14090 return threadsWithOpenTransaction.contains(threadId);
14102 this.connection.commitTransaction();
14103 }
catch (SQLException ex) {
14104 throw new TskCoreException(
"Failed to commit transaction on case database", ex);
14108 if (!scoreChangeMap.isEmpty()) {
14109 Map<Long, List<ScoreChange>> changesByDataSource = scoreChangeMap.values().stream()
14111 for (Map.Entry<Long, List<ScoreChange>> entry : changesByDataSource.entrySet()) {
14115 if (!timelineEvents.isEmpty()) {
14117 sleuthkitCase.fireTSKEvent(evt);
14120 if (!hostsAdded.isEmpty()) {
14123 if (!accountsAdded.isEmpty()) {
14126 if (!accountsChanged.isEmpty()) {
14129 if (!accountsMerged.isEmpty()) {
14132 if (!deletedOsAccountObjectIds.isEmpty()) {
14135 if (!deletedResultObjectIds.isEmpty()) {
14149 this.connection.rollbackTransactionWithThrow();
14150 }
catch (SQLException ex) {
14151 throw new TskCoreException(
"Case database transaction rollback failed", ex);
14162 this.connection.close();
14164 synchronized (threadsWithOpenTransactionLock) {
14165 threadsWithOpenTransaction.remove(Thread.currentThread().getId());
14181 private ResultSet resultSet;
14182 private CaseDbConnection connection;
14184 private CaseDbQuery(String query)
throws TskCoreException {
14185 this(query,
false);
14188 private CaseDbQuery(String query,
boolean allowWriteQuery)
throws TskCoreException {
14189 if (!allowWriteQuery) {
14190 if (!query.regionMatches(
true, 0,
"SELECT", 0,
"SELECT".length())) {
14191 throw new TskCoreException(
"Unsupported query: Only SELECT queries are supported.");
14197 connection = connections.getConnection();
14198 resultSet = connection.executeQuery(connection.createStatement(), query);
14199 }
catch (SQLException ex) {
14201 throw new TskCoreException(
"Error executing query: ", ex);
14202 }
catch (TskCoreException ex) {
14218 public void close() throws TskCoreException {
14220 if (resultSet != null) {
14221 final Statement statement = resultSet.getStatement();
14222 if (statement != null) {
14227 closeConnection(connection);
14228 }
catch (SQLException ex) {
14229 throw new TskCoreException(
"Error closing query: ", ex);
14245 sleuthkitCaseErrorObservers.add(observer);
14257 int i = sleuthkitCaseErrorObservers.indexOf(observer);
14259 sleuthkitCaseErrorObservers.remove(i);
14273 for (
ErrorObserver observer : sleuthkitCaseErrorObservers) {
14274 if (observer != null) {
14276 observer.receiveError(context, errorMessage);
14277 }
catch (Exception ex) {
14278 logger.log(Level.SEVERE,
"Observer client unable to receive message: {0}, {1}",
new Object[]{context, errorMessage, ex});
14310 private final String contextString;
14312 private Context(String context) {
14313 this.contextString = context;
14317 return contextString;
14321 void receiveError(String context, String errorMessage);
14335 long getDataSourceObjectId(
long objectId) {
14337 CaseDbConnection connection = connections.getConnection();
14339 return getDataSourceObjectId(connection, objectId);
14341 closeConnection(connection);
14343 }
catch (TskCoreException ex) {
14344 logger.log(Level.SEVERE,
"Error getting data source object id for a file", ex);
14360 CaseDbConnection connection = null;
14361 ResultSet rs = null;
14364 connection = connections.getConnection();
14367 PreparedStatement statement = connection.getPreparedStatement(PREPARED_STATEMENT.SELECT_MAX_OBJECT_ID);
14368 rs = connection.executeQuery(statement);
14371 id = rs.getLong(
"max_obj_id");
14374 }
catch (SQLException e) {
14375 throw new TskCoreException(
"Error getting last object id", e);
14377 closeResultSet(rs);
14378 closeConnection(connection);
14398 CaseDbConnection connection = null;
14399 Statement s = null;
14400 ResultSet rs = null;
14403 connection = connections.getConnection();
14404 s = connection.createStatement();
14405 rs = connection.executeQuery(s,
"SELECT * FROM tsk_files WHERE " + sqlWhereClause);
14406 List<FsContent> results =
new ArrayList<FsContent>();
14407 List<AbstractFile> temp = resultSetToAbstractFiles(rs, connection);
14408 for (AbstractFile f : temp) {
14411 results.add((FsContent) f);
14415 }
catch (SQLException e) {
14416 throw new TskCoreException(
"SQLException thrown when calling 'SleuthkitCase.findFilesWhere().", e);
14418 closeResultSet(rs);
14420 closeConnection(connection);
14438 CaseDbConnection connection = null;
14439 Statement s = null;
14440 ResultSet rs = null;
14443 connection = connections.getConnection();
14444 s = connection.createStatement();
14445 rs = connection.executeQuery(s,
"SELECT artifact_type_id FROM blackboard_artifact_types WHERE type_name = '" + artifactTypeName +
"'");
14448 typeId = rs.getInt(
"artifact_type_id");
14451 }
catch (SQLException ex) {
14452 throw new TskCoreException(
"Error getting artifact type id", ex);
14454 closeResultSet(rs);
14456 closeConnection(connection);
14489 public int addArtifactType(String artifactTypeName, String displayName)
throws TskCoreException {
14492 }
catch (TskDataException ex) {
14493 throw new TskCoreException(
"Failed to add artifact type.", ex);
14511 public int addAttrType(String attrTypeString, String displayName)
throws TskCoreException {
14514 }
catch (TskDataException ex) {
14515 throw new TskCoreException(
"Couldn't add new attribute type");
14531 CaseDbConnection connection = null;
14532 Statement s = null;
14533 ResultSet rs = null;
14536 connection = connections.getConnection();
14537 s = connection.createStatement();
14538 rs = connection.executeQuery(s,
"SELECT attribute_type_id FROM blackboard_attribute_types WHERE type_name = '" + attrTypeName +
"'");
14541 typeId = rs.getInt(
"attribute_type_id");
14544 }
catch (SQLException ex) {
14545 throw new TskCoreException(
"Error getting attribute type id", ex);
14547 closeResultSet(rs);
14549 closeConnection(connection);
14568 CaseDbConnection connection = null;
14569 Statement s = null;
14570 ResultSet rs = null;
14573 connection = connections.getConnection();
14574 s = connection.createStatement();
14575 rs = connection.executeQuery(s,
"SELECT type_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
14577 return rs.getString(
"type_name");
14579 throw new TskCoreException(
"No type with that id");
14581 }
catch (SQLException ex) {
14582 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
14584 closeResultSet(rs);
14586 closeConnection(connection);
14605 CaseDbConnection connection = null;
14606 Statement s = null;
14607 ResultSet rs = null;
14610 connection = connections.getConnection();
14611 s = connection.createStatement();
14612 rs = connection.executeQuery(s,
"SELECT display_name FROM blackboard_attribute_types WHERE attribute_type_id = " + attrTypeID);
14614 return rs.getString(
"display_name");
14616 throw new TskCoreException(
"No type with that id");
14618 }
catch (SQLException ex) {
14619 throw new TskCoreException(
"Error getting or creating a attribute type name", ex);
14621 closeResultSet(rs);
14623 closeConnection(connection);
14658 public ResultSet
runQuery(String query)
throws SQLException {
14659 CaseDbConnection connection = null;
14662 connection = connections.getConnection();
14663 return connection.executeQuery(connection.createStatement(), query);
14664 }
catch (TskCoreException ex) {
14665 throw new SQLException(
"Error getting connection for ad hoc query", ex);
14669 closeConnection(connection);
14685 final Statement statement = resultSet.getStatement();
14687 if (statement != null) {
14709 public LayoutFile addCarvedFile(String carvedFileName,
long carvedFileSize,
long containerId, List<TskFileRange> data)
throws TskCoreException {
14712 files.add(carvedFile);
14716 || parent instanceof
Volume
14717 || parent instanceof
Image) {
14720 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", containerId));
14739 public List<LayoutFile>
addCarvedFiles(List<CarvedFileContainer> filesToAdd)
throws TskCoreException {
14743 carvedFiles.add(carvedFile);
14748 || parent instanceof
Volume
14749 || parent instanceof
Image) {
14752 throw new TskCoreException(String.format(
"Parent (id =%d) is not an file system, volume or image", parent.
getId()));
14788 long size,
long ctime,
long crtime,
long atime,
long mtime,
14789 boolean isFile, AbstractFile parentFile,
14790 String rederiveDetails, String toolName, String toolVersion, String otherDetails)
throws TskCoreException {
14791 return addDerivedFile(fileName, localPath, size, ctime, crtime, atime, mtime,
14792 isFile, parentFile, rederiveDetails, toolName, toolVersion,
14827 long size,
long ctime,
long crtime,
long atime,
long mtime,
14828 String md5,
FileKnown known, String mimeType,
14832 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime,
14833 md5, null, known, mimeType, isFile, encodingType,
14834 parent, transaction);
14863 long size,
long ctime,
long crtime,
long atime,
long mtime,
14866 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime, isFile,
14891 long size,
long ctime,
long crtime,
long atime,
long mtime,
14893 AbstractFile parent)
throws TskCoreException {
14894 return addLocalFile(fileName, localPath, size, ctime, crtime, atime, mtime,
14916 return this.caseHandle.initAddImageProcess(timezone, addUnallocSpace, noFatFsOrphans,
"",
this);
14933 }
catch (TskCoreException ex) {
14934 logger.log(Level.SEVERE,
"Error loading all file systems for image with ID {0}", image.
getId());
14935 return new ArrayList<>();
14957 public List<AbstractFile>
findFiles(
Content dataSource, String fileName, AbstractFile parentFile)
throws TskCoreException {
Image addImageInfo(long deviceObjId, List< String > imageFilePaths, String timeZone, Host host)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, long value)
final IngestJobInfo addIngestJob(Content dataSource, String hostName, List< IngestModuleInfo > ingestModules, Date jobStart, Date jobEnd, IngestJobStatusType status, String settingsDir)
static SleuthkitCase newCase(String dbPath, ContentStreamProvider contentProvider)
static Priority fromID(int id)
static ARTIFACT_TYPE fromID(int id)
FS
File that can be found in file system tree.
static FileKnown valueOf(byte known)
TagName addOrUpdateTagName(String displayName, String description, TagName.HTML_COLOR color, TskData.FileKnown knownStatus)
static Significance fromID(int id)
BlackboardArtifact getArtifactByArtifactId(long id)
AddImageProcess makeAddImageProcess(String timezone, boolean addUnallocSpace, boolean noFatFsOrphans)
BlackboardArtifact getArtifactById(long id)
List< Report > getAllReports()
ArrayList< BlackboardAttribute > getBlackboardAttributes(final BlackboardArtifact artifact)
long getBlackboardArtifactsCount(long objId)
int getArtifactTypeID(String artifactTypeName)
Host getHostByDataSource(DataSource dataSource)
long getBlackboardArtifactTagsCountByTagName(TagName tagName)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType)
LocalDirectory addLocalDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, int value)
void addBlackboardAttributes(Collection< BlackboardAttribute > attributes, int artifactTypeId)
Optional< HostAddress > getHostAddress(HostAddress.HostAddressType type, String address)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID, long obj_id)
static final Score SCORE_UNKNOWN
CommunicationsManager getCommunicationsManager()
AnalysisResult getAnalysisResultById(long artifactObjId)
static Set< TSK_FS_META_FLAG_ENUM > valuesOf(short metaFlags)
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parentFile, String rederiveDetails, String toolName, String toolVersion, String otherDetails)
CaseDbTransaction beginTransaction()
OsAccount getOsAccountByObjectId(long osAccountObjId)
boolean isCompatible(CaseDbSchemaVersionNumber dbSchemaVersion)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent)
ALLOC
Metadata structure is currently in an allocated state.
int countFilesMd5Hashed()
static TSK_FS_TYPE_ENUM valueOf(int fsTypeValue)
CaseDbSchemaVersionNumber getDBSchemaCreationVersion()
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID)
void addErrorObserver(ErrorObserver observer)
DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, String mimeType, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType, Content parentObj, CaseDbTransaction trans)
DerivedFile updateDerivedFile(DerivedFile derivedFile, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, String mimeType, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
Blackboard getBlackboard()
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
TSK_FS_META_TYPE_DIR
Directory file NON-NLS.
List< AbstractFile > findFiles(Content dataSource, String fileName, AbstractFile parentFile)
synchronized void close()
static Category fromID(int id)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, String sha256, String sha1Hash, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Long osAccountId, String ownerAccount, Content parent, CaseDbTransaction transaction)
TagName addOrUpdateTagName(String displayName, String description, TagName.HTML_COLOR color, TskData.FileKnown knownStatus)
void setFileMIMEType(AbstractFile file, String mimeType)
UNALLOC
Metadata structure is currently in an unallocated state.
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, long sourceObjId, Long dataSourceObjId, Collection< BlackboardAttribute > attributes, Long osAccountId)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, String sha256, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Long osAccountId, String ownerAccount, Content parent, CaseDbTransaction transaction)
void addBlackboardAttribute(BlackboardAttribute attr, int artifactTypeId)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, AbstractFile parent, CaseDbTransaction transaction)
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList)
final List< LayoutFile > addLayoutFiles(Content parent, List< TskFileRange > fileRanges)
ArrayList< BlackboardAttribute > getBlackboardAttributes(final BlackboardArtifact artifact)
int addArtifactType(String artifactTypeName, String displayName)
List< DataSource > getDataSources()
BlackboardArtifactTagChange addArtifactTag(BlackboardArtifact artifact, TagName tagName, String comment)
synchronized CaseDbAccessManager getCaseDbAccessManager()
DataArtifact getDataArtifactById(long artifactObjId)
BlackboardArtifactTag getBlackboardArtifactTagByID(long artifactTagID)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, double value)
List< AbstractFile > openFiles(Content dataSource, String filePath)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByArtifact(BlackboardArtifact artifact)
final IngestModuleInfo addIngestModule(String displayName, String factoryClassName, IngestModuleType type, String version)
long getBlackboardArtifactsCount(String artifactTypeName, long obj_id)
Content getContentById(long id)
BlackboardArtifactTag getAddedTag()
VersionNumber getDBSchemaVersion()
static IngestJobStatusType fromID(int typeId)
List< TagName > getTagNamesInUse()
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, byte value)
LAYOUT_FILE
Set of blocks from an image that have been designated as a file.
List< AbstractFile > findAllFilesInFolderWhere(long parentId, String sqlWhereClause)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, String md5, String sha256, FileKnown known, String mimeType, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
static SleuthkitCase openCase(String databaseName, CaseDbConnectionInfo info, String caseDir)
static IngestModuleType fromID(int typeId)
List< ContentTag > getAllContentTags()
long getDataSourceObjectId()
List< VirtualDirectory > getVirtualDirectoryRoots()
LayoutFile addLayoutFile(String fileName, long size, TSK_FS_NAME_FLAG_ENUM dirFlag, TSK_FS_META_FLAG_ENUM metaFlag, long ctime, long crtime, long atime, long mtime, List< TskFileRange > fileRanges, Content parent)
FsContent addFileSystemFile(long dataSourceObjId, long fsObjId, String fileName, long metaAddr, int metaSeq, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, String md5Hash, String sha256Hash, String sha1Hash, String mimeType, boolean isFile, Content parent, String ownerUid, OsAccount osAccount, TskData.CollectedStatus collected, List< Attribute > fileAttributes, CaseDbTransaction transaction)
long getBlackboardArtifactTagsCountByTagName(TagName tagName, long dsObjId)
static SleuthkitCase openCase(String databaseName, CaseDbConnectionInfo info, String caseDir, ContentStreamProvider contentProvider)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypes()
ContentTag getContentTagByID(long contentTagID)
LOCAL
Local file that was added (not from a disk image)
HostAddressManager getHostAddressManager()
Map< Long, List< String > > getImagePaths()
List< Long > findAllFileIdsWhere(String sqlWhereClause)
synchronized TaggingManager getTaggingManager()
BlackboardArtifact getBlackboardArtifact(long artifactID)
List< BlackboardArtifact.Type > getArtifactTypesInUse()
OsAccountRealmManager getOsAccountRealmManager()
BlackboardAttribute.Type addArtifactAttributeType(String attrTypeString, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName)
AbstractFile getAbstractFileById(long id)
CARVED
Set of blocks for a file found from carving. Could be on top of a TSK_DB_FILES_TYPE_UNALLOC_BLOCKS ra...
BlackboardArtifactTag addBlackboardArtifactTag(BlackboardArtifact artifact, TagName tagName, String comment)
List< AnalysisResult > getAnalysisResults(long dataSourceObjId, Integer artifactTypeID)
long countFilesWhere(String sqlWhereClause)
List< AnalysisResult > getAnalysisResultsWhere(String whereClause)
long getBlackboardArtifactsCount(ARTIFACT_TYPE artifactType, long obj_id)
FS
File System - see tsk_fs_info for more details.
Pool addPool(long parentObjId, TskData.TSK_POOL_TYPE_ENUM type, CaseDbTransaction transaction)
boolean isFileFromSource(Content dataSource, long fileId)
ArrayList< BlackboardArtifact > getMatchingArtifacts(String whereClause)
VirtualDirectory addVirtualDirectory(long parentId, String directoryName, CaseDbTransaction transaction)
ArrayList< BlackboardArtifact.ARTIFACT_TYPE > getBlackboardArtifactTypesInUse()
void deleteReport(Report report)
List< Image > getImages()
int getAttrTypeID(String attrTypeName)
synchronized BlackboardAttribute.Type getOrAddAttributeType(String typeName, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName)
Image getImageById(long id)
Report addReport(String localPath, String sourceModuleName, String reportName, Content parent)
List< Content > getChildren()
USED
Metadata structure has been allocated at least once.
void unregisterForEvents(Object listener)
LOCAL_DIR
Local directory that was added (not from a disk image)
TimelineManager getTimelineManager()
final List< LayoutFile > addCarvedFiles(CarvingResult carvingResult)
void releaseSingleUserCaseReadLock()
PersonManager getPersonManager()
FsContent addFileSystemFile(long dataSourceObjId, long fsObjId, String fileName, long metaAddr, int metaSeq, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, String md5Hash, String sha256Hash, String sha1Hash, String mimeType, boolean isFile, Content parent, String ownerUid, OsAccount osAccount, List< Attribute > fileAttributes, CaseDbTransaction transaction)
VOL
Volume - see tsk_vs_parts for more details.
void closeRunQuery(ResultSet resultSet)
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType)
void disableTimelineEventCreation()
static SleuthkitCase newCase(String caseName, CaseDbConnectionInfo info, String caseDirPath, ContentStreamProvider contentProvider)
int addAttrType(String attrTypeString, String displayName)
void deleteBlackboardArtifactTag(BlackboardArtifactTag tag)
long getContentTagsCountByTagName(TagName tagName, long dsObjId)
List< ContentTag > getContentTagsByTagName(TagName tagName)
BlackboardArtifact newBlackboardArtifact(int artifactTypeID, long obj_id)
static String escapeSingleQuotes(String text)
String getAttrTypeDisplayName(int attrTypeID)
List< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
void setFileUnalloc(AbstractFile file)
List< AbstractFile > findFiles(Content dataSource, String fileName)
List< AbstractFile > findFilesInFolder(String fileName, AbstractFile parentFile)
List< TagName > getAllTagNames()
HostManager getHostManager()
Report getReportById(long id)
BlackboardAttribute.Type getAttributeType(String attrTypeName)
Image addImageInfo(long deviceObjId, List< String > imageFilePaths, String timeZone)
BlackboardArtifact.Type getArtifactType(String artTypeName)
static HTML_COLOR getColorByName(String colorName)
void acquireSingleUserCaseWriteLock()
REPORT
Artifact - see blackboard_artifacts for more details.
List< AbstractFile > findFilesByMd5(String md5Hash)
OsAccountInstance newOsAccountInstance(OsAccount osAccount, DataSource dataSource, OsAccountInstance.OsAccountInstanceType instanceType)
long getBlackboardArtifactsTypeCount(int artifactTypeID, long dataSourceID)
BlackboardArtifact.Type getArtifactType(String artTypeName)
void releaseSingleUserCaseWriteLock()
DERIVED
File derived from a parent file (i.e. from ZIP)
Host newHost(String name)
List< LayoutFile > addCarvedFiles(List< CarvedFileContainer > filesToAdd)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName)
static TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE fromType(long typeId)
static SleuthkitCase newCase(String caseName, CaseDbConnectionInfo info, String caseDirPath)
Report addReport(String localPath, String sourceModuleName, String reportName)
void releaseExclusiveLock()
List< BlackboardArtifactTag > getAllBlackboardArtifactTags()
ArrayList< BlackboardArtifact > getBlackboardArtifacts(String artifactTypeName, long obj_id)
Image addImage(TskData.TSK_IMG_TYPE_ENUM type, long sectorSize, long size, String displayName, List< String > imagePaths, String timezone, String md5, String sha1, String sha256, String deviceId, CaseDbTransaction transaction)
void removeErrorObserver(ErrorObserver observer)
String getContextString()
List< Content > getRootObjects()
List< AbstractFile > findFiles(Content dataSource, String fileName, String dirSubString)
static short toInt(Set< TSK_FS_META_FLAG_ENUM > metaFlags)
ContentTagChange addContentTag(Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset)
FileSystem addFileSystem(long parentObjId, long imgOffset, TskData.TSK_FS_TYPE_ENUM type, long blockSize, long blockCount, long rootInum, long firstInum, long lastInum, String displayName, CaseDbTransaction transaction)
void acquireExclusiveLock()
boolean allFilesMd5Hashed()
String getAttrTypeString(int attrTypeID)
int getBlackboardAttributeTypesCount()
LayoutFile addCarvedFile(String carvedFileName, long carvedFileSize, long containerId, List< TskFileRange > data)
ArrayList< BlackboardAttribute.ATTRIBUTE_TYPE > getBlackboardAttributeTypes()
List< DataArtifact > getDataArtifactsWhere(String whereClause)
UNALLOC_BLOCKS
Set of blocks not allocated by file system. Parent should be image, volume, or file system...
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, AbstractFile parent)
AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, long objId, Long dataSourceObjId, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList)
ArrayList< BlackboardAttribute > getMatchingAttributes(String whereClause)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String value)
long getBlackboardArtifactsTypeCount(int artifactTypeID)
List< ContentTag > getContentTagsByTagName(TagName tagName, long dsObjId)
void deleteContentTag(ContentTag tag)
AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList)
BlackboardArtifact.Type getOrAddArtifactType(String typeName, String displayName)
static ObjectType valueOf(short objectType)
Optional< String > getOwnerUid()
long getContentTagsCountByTagName(TagName tagName)
FsContent addFileSystemFile(long dataSourceObjId, long fsObjId, String fileName, long metaAddr, int metaSeq, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parent)
Optional< Long > getFileSystemObjectId()
Collection< FileSystem > getImageFileSystems(Image image)
void updateImagePath(String newPath, long objectId)
static SleuthkitCase openCase(String dbPath, ContentStreamProvider provider)
VolumeSystem addVolumeSystem(long parentObjId, TskData.TSK_VS_TYPE_ENUM type, long imgOffset, long blockSize, CaseDbTransaction transaction)
Examiner getCurrentExaminer()
LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootDirectoryName, String timeZone, Host host, CaseDbTransaction transaction)
UNKNOWN
File marked as unknown by hash db.
List< TagName > getTagNamesInUse(long dsObjId)
List< AbstractFile > findAllFilesWhere(String sqlWhereClause)
boolean setKnown(AbstractFile file, FileKnown fileKnown)
OsAccountManager getOsAccountManager()
static void tryConnect(CaseDbConnectionInfo info)
static SleuthkitCase openCase(String dbPath)
CaseDbQuery executeInsertOrUpdate(String query)
List< BlackboardArtifactTag > getBlackboardArtifactTagsByTagName(TagName tagName, long dsObjId)
Volume addVolume(long parentObjId, long addr, long start, long length, String desc, long flags, CaseDbTransaction transaction)
long getBlackboardArtifactsCount(int artifactTypeID, long obj_id)
DerivedFile addDerivedFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, Content parentObj, String rederiveDetails, String toolName, String toolVersion, String otherDetails, TskData.EncodingType encodingType, CaseDbTransaction transaction)
void submitError(String context, String errorMessage)
final List< IngestJobInfo > getIngestJobs()
ALLOC
Name is in an allocated state.
VIRTUAL_DIR
Virtual directory (not on fs) with no meta-data entry that can be used to group files of types other ...
static SleuthkitCase newCase(String dbPath)
String getBackupDatabasePath()
void acquireSingleUserCaseReadLock()
VirtualDirectory addVirtualDirectory(long parentId, String directoryName)
LocalFile addLocalFile(String fileName, String localPath, long size, long ctime, long crtime, long atime, long mtime, boolean isFile, TskData.EncodingType encodingType, Content parent, CaseDbTransaction transaction)
List< ContentTag > getContentTagsByContent(Content content)
ArrayList< BlackboardArtifact > getBlackboardArtifacts(ARTIFACT_TYPE artifactType, long obj_id)
TagName addTagName(String displayName, String description, TagName.HTML_COLOR color)
int countFsContentType(TskData.TSK_FS_META_TYPE_ENUM contentType)
ABSTRACTFILE
File - see tsk_files for more details.
ContentTag addContentTag(Content content, TagName tagName, String comment, long beginByteOffset, long endByteOffset)
DataSource getDataSource(long objectId)
BlackboardAttribute.Type getAttributeType(String attrTypeName)
List< BlackboardArtifact > getBlackboardArtifacts(BlackboardAttribute.ATTRIBUTE_TYPE attrType, String subString, boolean startsWith)
TSK_FS_META_TYPE_REG
Regular file NON-NLS.
Iterable< BlackboardArtifact.Type > getArtifactTypes()
List< BlackboardAttribute.Type > getAttributeTypes()
LocalFilesDataSource addLocalFilesDataSource(String deviceId, String rootDirectoryName, String timeZone, CaseDbTransaction transaction)
FsContent addFileSystemFile(long dataSourceObjId, long fsObjId, String fileName, long metaAddr, int metaSeq, TSK_FS_ATTR_TYPE_ENUM attrType, int attrId, TSK_FS_NAME_FLAG_ENUM dirFlag, short metaFlags, long size, long ctime, long crtime, long atime, long mtime, String md5Hash, String sha256Hash, String mimeType, boolean isFile, Content parent, String ownerUid, OsAccount osAccount, List< Attribute > fileAttributes, CaseDbTransaction transaction)
AddImageProcess makeAddImageProcess(String timeZone, boolean addUnallocSpace, boolean noFatFsOrphans, String imageCopyPath)
List< FsContent > findFilesWhere(String sqlWhereClause)
Long getDataSourceObjectId()
static ReviewStatus withID(int id)
void copyCaseDB(String newDBPath)
FileManager getFileManager()
Image addImage(TskData.TSK_IMG_TYPE_ENUM type, long sectorSize, long size, String displayName, List< String > imagePaths, String timezone, String md5, String sha1, String sha256, String deviceId, Host host, CaseDbTransaction transaction)
void setImagePaths(long objId, List< String > paths, CaseDbTransaction trans)
ResultSet runQuery(String query)
List< TskFileRange > getFileRanges(long id)
BlackboardArtifact.Type addBlackboardArtifactType(String artifactTypeName, String displayName)
void registerForEvents(Object listener)
CaseDbQuery executeQuery(String query)
ScoringManager getScoringManager()
void setReviewStatus(BlackboardArtifact artifact, BlackboardArtifact.ReviewStatus newStatus)
void setImagePaths(long obj_id, List< String > paths)
VS
Volume System - see tsk_vs_info for more details.
IMG
Disk Image - see tsk_image_info for more details.
UNALLOC
Name is in an unallocated state.
Collection< FileSystem > getFileSystems(Image image)
LocalDirectory addLocalDirectory(long parentId, String directoryName)
Optional< Long > getOsAccountObjectId()