Sleuth Kit Java Bindings (JNI)  4.12.1
Java bindings for using The Sleuth Kit
AbstractContent.java
Go to the documentation of this file.
1 /*
2  * Sleuth Kit Data Model
3  *
4  * Copyright 2011-2016 Basis Technology Corp.
5  * Contact: carrier <at> sleuthkit <dot> org
6  *
7  * Licensed under the Apache License, Version 2.0 (the "License");
8  * you may not use this file except in compliance with the License.
9  * You may obtain a copy of the License at
10  *
11  * http://www.apache.org/licenses/LICENSE-2.0
12  *
13  * Unless required by applicable law or agreed to in writing, software
14  * distributed under the License is distributed on an "AS IS" BASIS,
15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * See the License for the specific language governing permissions and
17  * limitations under the License.
18  */
19 package org.sleuthkit.datamodel;
20 
21 import com.google.common.annotations.Beta;
22 import java.util.ArrayList;
23 import java.util.Collection;
24 import java.util.Collections;
25 import java.util.HashSet;
26 import java.util.List;
27 import java.util.Optional;
28 import java.util.Set;
29 import java.util.logging.Level;
30 import java.util.logging.Logger;
37 
42 public abstract class AbstractContent implements Content {
43 
44  private final static BlackboardArtifact.Type GEN_INFO_TYPE = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_GEN_INFO);
45  public final static long UNKNOWN_ID = -1;
46  private final SleuthkitCase db;
47  private final long objId;
48  private final String name;
49  private volatile Content parent;
50  private volatile String uniquePath;
51  protected long parentId;
52  private volatile boolean hasChildren;
53  private volatile boolean checkedHasChildren;
54  private volatile int childrenCount;
55  private BlackboardArtifact genInfoArtifact = null;
56 
57  protected AbstractContent(SleuthkitCase db, long obj_id, String name) {
58  this.db = db;
59  this.objId = obj_id;
60  this.name = name;
61  this.parentId = UNKNOWN_ID;
62 
63  checkedHasChildren = false;
64  hasChildren = false;
65  childrenCount = -1;
66  }
67 
68  @Override
69  public String getName() {
70  return this.name;
71  }
72 
73  /*
74  * This base implementation simply walks the hierarchy appending its own
75  * name to the result of calling its parent's getUniquePath() method (with
76  * interleaving forward slashes).
77  */
78  @Override
79  public String getUniquePath() throws TskCoreException {
80  // It is possible that multiple threads could be doing this calculation
81  // simultaneously, but it's worth the potential extra processing to prevent deadlocks.
82  if (uniquePath == null) {
83  String tempUniquePath = "";
84  if (!name.isEmpty()) {
85  tempUniquePath = "/" + getName();
86  }
87 
88  Content myParent = getParent();
89  if (myParent != null) {
90  tempUniquePath = myParent.getUniquePath() + tempUniquePath;
91  }
92 
93  // Don't update uniquePath until it is complete.
94  uniquePath = tempUniquePath;
95  }
96  return uniquePath;
97  }
98 
99  @Override
100  public boolean hasChildren() throws TskCoreException {
101  if (checkedHasChildren == true) {
102  return hasChildren;
103  }
104 
105  hasChildren = this.getSleuthkitCase().getHasChildren(this);
106  checkedHasChildren = true;
107 
108  return hasChildren;
109  }
110 
111  @Override
112  public int getChildrenCount() throws TskCoreException {
113  if (childrenCount != -1) {
114  return childrenCount;
115  }
116 
117  childrenCount = this.getSleuthkitCase().getContentChildrenCount(this);
118 
119  hasChildren = childrenCount > 0;
120  checkedHasChildren = true;
121 
122  return childrenCount;
123  }
124 
125  @Override
127  // It is possible that multiple threads could be doing this calculation
128  // simultaneously, but it's worth the potential extra processing to prevent deadlocks.
129  if (parent == null) {
130  Optional<Long> parentIdOpt = getParentId();
131  if (!parentIdOpt.isPresent()) {
132  parent = null;
133  } else {
134  parent = db.getContentById(parentIdOpt.get());
135  }
136  }
137  return parent;
138  }
139 
140  void setParent(Content parent) {
141  this.parent = parent;
142  }
143 
152  @Beta
153  public Optional<Long> getParentId() throws TskCoreException {
154  if (parentId == UNKNOWN_ID) {
155  ObjectInfo parentInfo = db.getParentInfo(this);
156  if (parentInfo != null) {
157  parentId = parentInfo.getId();
158  }
159  }
160 
161  return parentId == UNKNOWN_ID
162  ? Optional.empty()
163  : Optional.of(parentId);
164  }
165 
173  void setParentId(long parentId) {
174  this.parentId = parentId;
175  }
176 
177  @Override
178  public long getId() {
179  return this.objId;
180  }
181 
190  @Override
191  public List<Content> getChildren() throws TskCoreException {
192  List<Content> children = new ArrayList<Content>();
193 
194  children.addAll(getSleuthkitCase().getAbstractFileChildren(this));
195  children.addAll(getSleuthkitCase().getBlackboardArtifactChildren(this));
196 
197  return children;
198 
199  }
200 
210  @Override
211  public List<Long> getChildrenIds() throws TskCoreException {
212 
213  List<Long> childrenIDs = new ArrayList<Long>();
214 
215  childrenIDs.addAll(getSleuthkitCase().getAbstractFileChildrenIds(this));
216  childrenIDs.addAll(getSleuthkitCase().getBlackboardArtifactChildrenIds(this));
217 
218  return childrenIDs;
219  }
220 
221  // classes should override this if they can be a data source
222  @Override
224  Content myParent = getParent();
225  if (myParent == null) {
226  return null;
227  }
228 
229  return myParent.getDataSource();
230  }
231 
239  boolean isPoolContent() throws TskCoreException {
240  return getPool() != null;
241  }
242 
251  Volume getPoolVolume() throws TskCoreException {
252  Content myParent = getParent();
253  if (myParent == null) {
254  return null;
255  }
256 
257  if (!(myParent instanceof AbstractContent)) {
258  return null;
259  }
260 
261  if (myParent instanceof Volume) {
262  // This is potentially it, but need to check that this is a volume under a pool
263  if (((Volume) myParent).isPoolContent()) {
264  return (Volume) myParent;
265  } else {
266  // There are no pools in the hierarchy, so we're done
267  return null;
268  }
269  }
270 
271  // Try one level higher
272  return ((AbstractContent) myParent).getPoolVolume();
273  }
274 
282  Pool getPool() throws TskCoreException {
283  Content myParent = getParent();
284  if (myParent == null) {
285  return null;
286  }
287 
288  if (!(myParent instanceof AbstractContent)) {
289  return null;
290  }
291 
292  if (myParent instanceof Pool) {
293  return (Pool) myParent;
294  }
295 
296  // Try one level higher
297  return ((AbstractContent) myParent).getPool();
298  }
299 
306  return db;
307  }
308 
309  @Override
310  public boolean equals(Object obj) {
311  if (obj == null) {
312  return false;
313  }
314  if (getClass() != obj.getClass()) {
315  return false;
316  }
317  final AbstractContent other = (AbstractContent) obj;
318  if (this.objId != other.objId) {
319  return false;
320  }
321 
322  try {
323  // New children may have been added to an existing content
324  // object in which case they are not equal.
325  if (this.getChildrenCount() != other.getChildrenCount()) {
326  return false;
327  }
328  } catch (TskCoreException ex) {
329  Logger.getLogger(AbstractContent.class.getName()).log(Level.SEVERE, null, ex);
330  }
331 
332  return true;
333  }
334 
335  @Override
336  public int hashCode() {
337  int hash = 7 + (int) (this.objId ^ (this.objId >>> 32));
338  try {
339  hash = 41 * hash + this.getChildrenCount();
340  } catch (TskCoreException ex) {
341  Logger.getLogger(AbstractContent.class.getName()).log(Level.SEVERE, null, ex);
342  }
343  return hash;
344  }
345 
346  @Deprecated
347  @Override
348  public BlackboardArtifact newArtifact(int artifactTypeID) throws TskCoreException {
349  // don't let them make more than 1 GEN_INFO
350  if (artifactTypeID == ARTIFACT_TYPE.TSK_GEN_INFO.getTypeID()) {
351  return getGenInfoArtifact(true);
352  }
353  BlackboardArtifact.Type artifactType = db.getBlackboard().getArtifactType(artifactTypeID);
354  switch (artifactType.getCategory()) {
355  case DATA_ARTIFACT:
356  return this.newDataArtifact(artifactType, Collections.emptyList());
357  case ANALYSIS_RESULT: {
358  AnalysisResultAdded addedResult = this.newAnalysisResult(artifactType, Score.SCORE_UNKNOWN, null, null, null, Collections.emptyList());
359  return addedResult.getAnalysisResult();
360  }
361  default:
362  throw new TskCoreException(String.format("Unknown category: %s for artifact type id: %d",
363  artifactType.getCategory().getName(), artifactTypeID));
364  }
365  }
366 
367  @Override
368  public AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection<BlackboardAttribute> attributesList) throws TskCoreException {
369 
370  long dataSourceObjectId = this.getDataSource().getId();
371  CaseDbTransaction trans = db.beginTransaction();
372  try {
373  AnalysisResultAdded resultAdded = db.getBlackboard().newAnalysisResult(artifactType, objId, dataSourceObjectId, score, conclusion, configuration, justification, attributesList, trans);
374 
375  trans.commit();
376  return resultAdded;
377  } catch (BlackboardException ex) {
378  trans.rollback();
379  throw new TskCoreException(String.format("Error adding analysis result to content with objId = %d.", objId), ex);
380  }
381  }
382 
383  @Override
384  public AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection<BlackboardAttribute> attributesList, long dataSourceId) throws TskCoreException {
385 
386  long dataSourceObjectId = dataSourceId;
387  CaseDbTransaction trans = db.beginTransaction();
388  try {
389  AnalysisResultAdded resultAdded = db.getBlackboard().newAnalysisResult(artifactType, objId, dataSourceObjectId, score, conclusion, configuration, justification, attributesList, trans);
390 
391  trans.commit();
392  return resultAdded;
393  } catch (BlackboardException ex) {
394  trans.rollback();
395  throw new TskCoreException(String.format("Error adding analysis result to content with objId = %d.", objId), ex);
396  }
397  }
398 
399  @Override
400  public DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection<BlackboardAttribute> attributesList, Long osAccountId) throws TskCoreException {
401  return db.getBlackboard().newDataArtifact(artifactType, objId, this.getDataSource().getId(), attributesList, osAccountId);
402  }
403 
404  @Override
405  public DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection<BlackboardAttribute> attributesList, Long osAccountId, long dataSourceId) throws TskCoreException {
406  return db.getBlackboard().newDataArtifact(artifactType, objId, dataSourceId, attributesList, osAccountId);
407  }
408 
409  @Override
410  public DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection<BlackboardAttribute> attributesList) throws TskCoreException {
411  return newDataArtifact(artifactType, attributesList, null);
412  }
413 
414  @Deprecated
415  @SuppressWarnings("deprecation")
416  @Override
417  public BlackboardArtifact newArtifact(BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException {
418  return newArtifact(type.getTypeID());
419  }
420 
421  @Override
422  public ArrayList<BlackboardArtifact> getArtifacts(String artifactTypeName) throws TskCoreException {
423  return getArtifacts(db.getBlackboard().getArtifactType(artifactTypeName).getTypeID());
424  }
425 
426  @Override
427  public ArrayList<BlackboardArtifact> getArtifacts(int artifactTypeID) throws TskCoreException {
428  if (artifactTypeID == ARTIFACT_TYPE.TSK_GEN_INFO.getTypeID()) {
429  if (genInfoArtifact == null) // don't make one if it doesn't already exist
430  {
431  getGenInfoArtifact(false);
432  }
433 
434  ArrayList<BlackboardArtifact> list = new ArrayList<BlackboardArtifact>();
435  // genInfoArtifact coudl still be null if there isn't an artifact
436  if (genInfoArtifact != null) {
437  list.add(genInfoArtifact);
438  }
439  return list;
440  }
441  return db.getBlackboardArtifacts(artifactTypeID, objId);
442  }
443 
444  @Override
445  public ArrayList<BlackboardArtifact> getArtifacts(BlackboardArtifact.ARTIFACT_TYPE type) throws TskCoreException {
446  return getArtifacts(type.getTypeID());
447  }
448 
449  @Override
450  public BlackboardArtifact getGenInfoArtifact() throws TskCoreException {
451  return getGenInfoArtifact(true);
452  }
453 
454  @Override
455  public BlackboardArtifact getGenInfoArtifact(boolean create) throws TskCoreException {
456  if (genInfoArtifact != null) {
457  return genInfoArtifact;
458  }
459 
460  // go to db directly to avoid infinite loop
461  ArrayList<BlackboardArtifact> arts = db.getBlackboardArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_GEN_INFO, objId);
462  BlackboardArtifact retArt;
463  if (arts.isEmpty()) {
464  if (create) {
465  retArt = this.newDataArtifact(GEN_INFO_TYPE, Collections.emptyList());
466  } else {
467  return null;
468  }
469  } else {
470  retArt = arts.get(0);
471  }
472  genInfoArtifact = retArt;
473  return retArt;
474  }
475 
476  @Override
477  public ArrayList<BlackboardAttribute> getGenInfoAttributes(ATTRIBUTE_TYPE attr_type) throws TskCoreException {
478  ArrayList<BlackboardAttribute> returnList = new ArrayList<BlackboardAttribute>();
479 
480  if (genInfoArtifact == null) {
481  getGenInfoArtifact(false);
482  if (genInfoArtifact == null) {
483  return returnList;
484  }
485  }
486 
487  for (BlackboardAttribute attribute : genInfoArtifact.getAttributes()) {
488  if (attribute.getAttributeType().getTypeID() == attr_type.getTypeID()) {
489  returnList.add(attribute);
490  }
491  }
492 
493  return returnList;
494  }
495 
496  @Override
497  public ArrayList<BlackboardArtifact> getAllArtifacts() throws TskCoreException {
498  return db.getMatchingArtifacts("WHERE obj_id = " + objId); //NON-NLS
499  }
500 
501  @Override
502  public List<AnalysisResult> getAllAnalysisResults() throws TskCoreException {
503  return db.getBlackboard().getAnalysisResults(objId);
504  }
505 
506  @Override
507  public List<DataArtifact> getAllDataArtifacts() throws TskCoreException {
508  return db.getBlackboard().getDataArtifactsBySource(objId);
509  }
510 
511  @Override
512  public Score getAggregateScore() throws TskCoreException {
513  return db.getScoringManager().getAggregateScore(objId);
514  }
515 
516  @Override
517  public List<AnalysisResult> getAnalysisResults(BlackboardArtifact.Type artifactType) throws TskCoreException {
518  return db.getBlackboard().getAnalysisResults(objId, artifactType.getTypeID()); //NON-NLS
519  }
520 
521  @Override
522  public long getArtifactsCount(String artifactTypeName) throws TskCoreException {
523  return db.getBlackboardArtifactsCount(artifactTypeName, objId);
524  }
525 
526  @Override
527  public long getArtifactsCount(int artifactTypeID) throws TskCoreException {
528  return db.getBlackboardArtifactsCount(artifactTypeID, objId);
529  }
530 
531  @Override
532  public long getArtifactsCount(ARTIFACT_TYPE type) throws TskCoreException {
533  return db.getBlackboardArtifactsCount(type, objId);
534  }
535 
536  @Override
537  public long getAllArtifactsCount() throws TskCoreException {
538  return db.getBlackboardArtifactsCount(objId);
539  }
540 
541  @Override
542  public Set<String> getHashSetNames() throws TskCoreException {
543  Set<String> hashNames = new HashSet<String>();
544  ArrayList<BlackboardArtifact> artifacts = getArtifacts(BlackboardArtifact.ARTIFACT_TYPE.TSK_HASHSET_HIT);
545 
546  for (BlackboardArtifact a : artifacts) {
548  if (attribute != null) {
549  hashNames.add(attribute.getValueString());
550  }
551  }
552  return Collections.unmodifiableSet(hashNames);
553  }
554 
555  @Override
556  public String toString() {
557  return toString(true);
558  }
559 
560  public String toString(boolean preserveState) {
561  if (preserveState) {
562  return "AbstractContent [\t" + "objId " + String.format("%010d", objId) + "\t" //NON-NLS
563  + "name " + name + "\t" + "parentId " + parentId + "\t" //NON-NLS
564  + "\t" + "checkedHasChildren " + checkedHasChildren //NON-NLS
565  + "\t" + "hasChildren " + hasChildren //NON-NLS
566  + "\t" + "childrenCount " + childrenCount //NON-NLS
567  + "uniquePath " + uniquePath + "]\t"; //NON-NLS
568  } else {
569  try {
570  if (getParent() != null) {
571  return "AbstractContent [\t" + "objId " + String.format("%010d", objId) //NON-NLS
572  + "\t" + "name " + name //NON-NLS
573  + "\t" + "checkedHasChildren " + checkedHasChildren //NON-NLS
574  + "\t" + "hasChildren " + hasChildren //NON-NLS
575  + "\t" + "childrenCount " + childrenCount //NON-NLS
576  + "\t" + "getUniquePath " + getUniquePath() //NON-NLS
577  + "\t" + "getParent " + getParent().getId() + "]\t"; //NON-NLS
578  } else {
579  return "AbstractContent [\t" + "objId " //NON-NLS
580  + String.format("%010d", objId) + "\t" + "name " + name //NON-NLS
581  + "\t" + "checkedHasChildren " + checkedHasChildren //NON-NLS
582  + "\t" + "hasChildren " + hasChildren //NON-NLS
583  + "\t" + "childrenCount " + childrenCount //NON-NLS
584  + "\t" + "uniquePath " + getUniquePath() //NON-NLS
585  + "\t" + "parentId " + parentId + "]\t"; //NON-NLS
586  }
587  } catch (TskCoreException ex) {
588  Logger.getLogger(AbstractContent.class.getName()).log(Level.SEVERE, "Could not find Parent", ex); //NON-NLS
589  return "AbstractContent [\t" + "objId " + String.format("%010d", objId) + "\t" //NON-NLS
590  + "name " + name + "\t" + "parentId " + parentId + "\t" //NON-NLS
591  + "\t" + "checkedHasChildren " + checkedHasChildren //NON-NLS
592  + "\t" + "hasChildren " + hasChildren //NON-NLS
593  + "\t" + "childrenCount " + childrenCount //NON-NLS
594  + "uniquePath " + uniquePath + "]\t"; //NON-NLS
595  }
596  }
597  }
598 }
static final Score SCORE_UNKNOWN
Definition: Score.java:213
ArrayList< BlackboardArtifact > getBlackboardArtifacts(int artifactTypeID)
ArrayList< BlackboardArtifact > getArtifacts(int artifactTypeID)
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, long sourceObjId, Long dataSourceObjId, Collection< BlackboardAttribute > attributes, Long osAccountId)
AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList)
List< AnalysisResult > getAnalysisResults(BlackboardArtifact.Type artifactType)
ArrayList< BlackboardArtifact > getAllArtifacts()
List< AnalysisResult > getAnalysisResults(long dataSourceObjId, Integer artifactTypeID)
String toString(boolean preserveState)
ArrayList< BlackboardArtifact > getMatchingArtifacts(String whereClause)
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId, long dataSourceId)
List< AnalysisResult > getAllAnalysisResults()
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList)
AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList, long dataSourceId)
BlackboardArtifact newArtifact(BlackboardArtifact.ARTIFACT_TYPE type)
ArrayList< BlackboardArtifact > getArtifacts(BlackboardArtifact.ARTIFACT_TYPE type)
AbstractContent(SleuthkitCase db, long obj_id, String name)
BlackboardArtifact.Type getArtifactType(String artTypeName)
long getArtifactsCount(ARTIFACT_TYPE type)
AnalysisResultAdded newAnalysisResult(BlackboardArtifact.Type artifactType, long objId, Long dataSourceObjId, Score score, String conclusion, String configuration, String justification, Collection< BlackboardAttribute > attributesList)
BlackboardArtifact newArtifact(int artifactTypeID)
long getArtifactsCount(int artifactTypeID)
DataArtifact newDataArtifact(BlackboardArtifact.Type artifactType, Collection< BlackboardAttribute > attributesList, Long osAccountId)
ArrayList< BlackboardArtifact > getArtifacts(String artifactTypeName)
BlackboardArtifact getGenInfoArtifact(boolean create)
ArrayList< BlackboardAttribute > getGenInfoAttributes(ATTRIBUTE_TYPE attr_type)
long getArtifactsCount(String artifactTypeName)

Copyright © 2011-2021 Brian Carrier. (carrier -at- sleuthkit -dot- org)
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.